CVE-2026-86248 Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to versi...

CVE-2026-86248

Apache Tomcat is vulnerable to a flaw where CLIENT_CERT authentication does not fail as expected in specific scenarios even when soft fail is disabled. This was caused by an incomplete fix for CVE-2026-34500 , where OCSP checks sometimes soft-fail with FFM. This issue affects versions 11.0.0-M14 ...

CVE-2026-86248 Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to versi...

CVE-2026-86248: Improper Authentication

CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to versi...

CVE-2026-88831: Not Failing Securely

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...

PT-2026-97426

Name of the Vulnerable Software and Affected Versions BusyBox versions prior to 1.38.0-3.1 Description The httpd component in BusyBox handles IP deny rules incorrectly when invalid CIDR prefix lengths are provided. This causes the system to fail open, resulting in a parsed IP with a zeroed mask,...

CVE-2026-90462

A flaw was found in SSSD. When configured with the LDAP access provider and ldapaccessorder including ppolicy or lockout, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision,...

CVE-2026-90462 Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization

A flaw was found in SSSD. When configured with the LDAP access provider and ldapaccessorder including ppolicy or lockout, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision,...

EUVD-2026-84537

A flaw was found in SSSD. When configured with the LDAP access provider and ldapaccessorder including ppolicy or lockout, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision,...

CVE-2026-90462 Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization

A flaw was found in SSSD. When configured with the LDAP access provider and ldapaccessorder including ppolicy or lockout, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision,...

CVE-2026-90462

A flaw in SSSD occurs when using the LDAP access provider with ldap_access_order containing ppolicy or lockout. A fail-open condition exists in the LDAP ppolicy access check if a user lookup returns zero results, which can incorrectly return success and cache an allow decision. This allows a remo...

CVE-2026-90462

A flaw was found in SSSD. When configured with the LDAP access provider and ldapaccessorder including ppolicy or lockout, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision,...

Linux Distros Unpatched Vulnerability : CVE-2026-90462

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in SSSD. When configured with the LDAP access provider and ldapaccessorder including ppolicy or lockout, a fail-open condition in the LDAP...

CVE-2026-90462: Improper Handling of Insufficient Permissions or Privileges

A flaw was found in SSSD. When configured with the LDAP access provider and ldapaccessorder including ppolicy or lockout, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision,...

PT-2026-96814

Name of the Vulnerable Software and Affected Versions SSSD affected versions not specified Description A flaw exists when the software is configured with the LDAP access provider and the ldap access order variable includes ppolicy or lockout. A fail-open condition occurs during the LDAP ppolicy...

CVE-2026-73552

Envoy HTTP RBAC safe_regex matching evaluates header values with RE2's UTF-8 subject semantics , but Envoy accepts RFC-valid obs-text (non-UTF-8) header bytes. In a negative RBAC policy (deny rule), a crafted header containing an obs-text octet causes RE2::FullMatch to return no-match, which the ...

CVE-2026-73552 Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates saferegex values with RE2's UTF-8 subject semantics. A downstream client can preserve a prohibit...

CVE-2026-73552 Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates saferegex values with RE2's UTF-8 subject semantics. A downstream client can preserve a prohibit...

CVE-2026-93593

ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries types do not own normal record buckets. An authenticated low-privilege user can read or insert TimeSeries samples despite...

CVE-2026-93593

ArcadeDB before 26.9.1 is affected by a TimeSeries ACL bypass (CVE-2026-93593). The root cause lies in the ACL resolver, which builds permissions from bucket IDs; however, TimeSeries types do not own normal record buckets, causing the missing type-name-based access check and resulting in permissi...