DEBIAN-CVE-2026-47737

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when setremoteaddress proxyprotocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive...

CVE-2026-44289 protobufjs: Denial of service through unbounded protobuf recursion

protobufjs compiles protobuf definitions into JavaScript JS functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf...

CVE-2025-64330

CVE-2025-64330 concerns Suricata, a network IDS/IPS engine. Prior to versions 7.0.13 and 8.0.2, a single-byte read heap overflow during verdict logging in eve.alert/eve.drop can cause crashes when the per-packet alert queue is saturated and a pass rule follows. The issue has been patched in 7.0.1...