CVE-2026-111816 Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out

Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and...

CVE-2026-111816

Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and...

CVE-2026-111816

Apache Traffic Server versions 8.0.0 through 8.1.11 , 9.0.0 through 9.2.15 , 10.0.0 through 10.1.4 , and 10.2.0 are vulnerable to a flaw where a malformed 302 response bypasses parse-error rejection. This occurs because the Transfer-Encoding: chunked carve-out allows the server to forward respons...

CVE-2026-86146

Inconsistent interpretation of HTTP requests HTTP request/response smuggling in the bundled HTTP/1.1 parser of Apache bRPC version 1.18.0 on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same byte...

CVE-2026-86146 Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing

Inconsistent interpretation of HTTP requests HTTP request/response smuggling in the bundled HTTP/1.1 parser of Apache bRPC version 1.18.0 on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same byte...

EUVD-2026-107226

Inconsistent interpretation of HTTP requests HTTP request/response smuggling in the bundled HTTP/1.1 parser of Apache bRPC version 1.18.0 on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same byte...

CVE-2026-86146

Apache bRPC (version

PT-2026-120566

Inconsistent interpretation of HTTP requests HTTP request/response smuggling in the bundled HTTP/1.1 parser of Apache bRPC version 1.18.0 on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same byte...

PT-2026-120780

Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and...

Linux Distros Unpatched Vulnerability : CVE-2026-98581

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfc: llcp: Fix list corruption / refcount desync in nfcllcprecvdm nfcllcprecvdm handles DMNOBOUND/DMREJ for a socket that is still linked on...

UBUNTU-CVE-2026-98581

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfcllcprecvdm nfcllcprecvdm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connectingsockets: it looks the socket up with nfcllcpconnectingsockget, sets...

CVE-2026-98581

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfcllcprecvdm nfcllcprecvdm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connectingsockets: it looks the socket up with nfcllcpconnectingsockget, sets...

DEBIAN-CVE-2026-98581

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfcllcprecvdm nfcllcprecvdm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connectingsockets: it looks the socket up with nfcllcpconnectingsockget, sets...

AZL-108833 CVE-2026-98581 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfcllcprecvdm nfcllcprecvdm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connectingsockets: it looks the socket up with nfcllcpconnectingsockget, sets...

CVE-2026-98581

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfcllcprecvdm nfcllcprecvdm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connectingsockets: it looks the socket up with nfcllcpconnectingsockget, sets...

CVE-2026-98581 nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfcllcprecvdm nfcllcprecvdm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connectingsockets: it looks the socket up with nfcllcpconnectingsockget, sets...

CVE-2026-98581

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfcllcprecvdm nfcllcprecvdm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connectingsockets: it looks the socket up with nfcllcpconnectingsockget, sets...

EUVD-2026-103626

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfcllcprecvdm nfcllcprecvdm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connectingsockets: it looks the socket up with nfcllcpconnectingsockget, sets...

CVE-2026-98581

The Linux kernel contains a vulnerability in the nfc: llcp component specifically within the nfc_llcp_recv_dm() function. The root cause is a list corruption and refcount desync occurring when handling DM(NOBOUND)/DM(REJ) for sockets still linked on local->connecting_sockets. Because the funct...

CVE-2026-98581 nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfcllcprecvdm nfcllcprecvdm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connectingsockets: it looks the socket up with nfcllcpconnectingsockget, sets...