CVE-2026-65100 Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from...

CVE-2026-65100

Apache Traffic Server HPACK issue: the encoder updates its dynamic table before the header block is confirmed, causing desynchronization with the decoder after a failed encode. This can corrupt subsequent header blocks on a connection. Affected versions: 8.0.0–8.1.9, 9.0.0–9.2.14, 10.0.0–10.1.3. ...

PT-2026-65768

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 Description Apache Traffic Server updates the HTTP/2 HPACK dynamic table before...

GHSA-5XVQ-CP9X-6P6R Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)

A pre-authentication denial-of-service panic in russh 0.62.2 commit c4be19f1915c8682f4615c3fd50008512b474491, current default branch main as of 2026-07-22. An unauthenticated client sends a single SSHMSGKEXECDHINIT whose QC is 32 zero bytes. russh's Curve25519 KEX does not reject the all-zero pee...

Updated apache packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Apache HTTP Server: modldap per-dir use-after-free. CVE-2026-29167 Apache HTTP Server: modproxyftp XSS. CVE-2026-29170 Apache HTTP Server: modproxyhtml buffer overflow. CVE-2026-34355 Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow...

PT-2026-63551

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final Description Netty's STOMP encoder StompSubframeEncoder fails to escape or validate header values in CONNECT and CONNECTED frames. This occurs because the encoder...

GHSA-5GJJ-6R7V-PH3X pillow-heif: Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read

Summary An integer overflow in the encode path buffer validation of pillowheif.c allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure server heap memory leaking into encoded images or denial...

EUVD-2026-9061

pillow-heif: Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read...

pillow-heif: Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read

Summary An integer overflow in the encode path buffer validation of pillowheif.c allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure server heap memory leaking into encoded images or denial...

CVE-2026-63887

The CVE-2026-63887 issue affects Linux kernel SCSI/ISCSI login handling. iscsi_encode_text_output() concatenates key=value records into login->rsp_buf using an 8192-byte buffer without checking remaining capacity, while a single PDU can carry up to 2048 pairs, potentially expanding to ~32 KiB....

CVE-2026-63853 drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set nouserfence for VCN v4.0 enc ring VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit fd852c048b46f9825e904a4f3f4538fe9d8827...

CVE-2026-63850

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set nouserfence for VCN v5.0.0 enc ring VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit...

PT-2026-61204

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A heap overrun occurs in the iscsi encode text output function when concatenating records into the rsp buf buffer. The function uses sprintf to append key-value pairs without verifying t...

SUSE SLES12 Security Update : python-idna (SUSE-SU-2026:3101-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3101-1 advisory. This update for python-idna fixes the following issue - CVE-2026-45409: specially crafted inputs to idna.encode can bypass earlier security...

SUSE-SU-2026:3101-1 Security update for python-idna

This update for python-idna fixes the following issue - CVE-2026-45409: specially crafted inputs to idna.encode can bypass earlier security fix bsc1265413...

Security update for python-idna

This update for python-idna fixes the following issue CVE-2026-45409: specially crafted inputs to idna.encode can bypass earlier security fix bsc1265413. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

The vulnerability of the ImagingTgaRleEncode() function in the TgaRleEncode.c component of the Pillow image processing library allows a hacker to disclose protected information.

The vulnerability of the ImagingTgaRleEncode function in the TgaRleEncode.c component of the Pillow image processing library is related to the output of the operation outside the buffer. Exploiting this vulnerability could allow an attacker to disclose protected information through the generated...

MAL-2026-10549 Malicious code in abi-encode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afc61427f74a028242a032b9436c09c43b1df60fef5688aa5389ef107e899259 The package advertises ABI encoding but on require schedules a 37-second timer that decodes test/fixtures/keypairs.dat base64-encoded stealer, staged...

Malicious code in abi-encode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afc61427f74a028242a032b9436c09c43b1df60fef5688aa5389ef107e899259 The package advertises ABI encoding but on require schedules a 37-second timer that decodes test/fixtures/keypairs.dat base64-encoded stealer, staged...

SUSE SLED15 / SLES15 Security Update : python-idna (SUSE-SU-2026:2828-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:2828-1 advisory. This update for python-idna fixes the following issue - CVE-2026-45409: specially crafted inputs to idna.encode can...