CVE-2026-55991 Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion if compiled with assertions on and terminate the entire Unbound process using a single DNS-over-QUIC DoQ connection and one normal DNS query. This is caused by an erroneous...

The vulnerabilities of the functions sti_dvo_connector_mode_valid() (drivers/gpu/drm/sti/sti_dvo.c), sti_hda_connector_mode_valid() (drivers/gpu/drm/sti/sti_hda.c), and sti_hdmi_connector_mode_valid() (drivers/gpu/drm/sti/sti_hdmi.c) in the Linux kernel’s Direct Rendering Infrastructure (DRI) driver libraries allow a hacker to cause a service failure.

The vulnerabilities of the functions stidvoconnectormodevalid drivers/gpu/drm/sti/stidvo.c, stihdaconnectormodevalid drivers/gpu/drm/sti/stihda.c, and stihdmiconnectormodevalid drivers/gpu/drm/sti/stihdmi.c in the Linux kernel’s Direct Rendering Infrastructure DRI driver libraries are related to...

undertow: potential security issue in flow control over HTTP/2 may lead to DOS

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability...