Oracle Linux 9 : libsoup (ELSA-2026-68234)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-68234 advisory. - Fix CVE-2026-15711: Reject oversized WebSocket control frames Tenable has extracted the preceding description block directly from the Oracle Linux...

CVE-2026-20295

A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software and Cisco Secure FTD Software could allow an unauthenticated, remote attacker to exhaust the available memory of an affected device. This vulnerability is due to improper management of memory resource...

CVE-2026-75516

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start applies Math.minmaxInboundMessageBodySize, frameMax after Connection.Tune negotiation even though AMQP defines frameMax value zero as...

CVE-2026-75516

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start applies Math.minmaxInboundMessageBodySize, frameMax after Connection.Tune negotiation even though AMQP defines frameMax value zero as...

CVE-2026-89780

In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: restore skb-dev on deaggregated frames rmnetmapdeaggregate allocates each sub-frame with allocskb and leaves skb-dev NULL. rmnetmapingresshandler assigns skb-dev = ep-egressdev only on the data path, but a M...

libsoup security update

2.72.0-16.3 - Fix CVE-2026-15711: Reject oversized WebSocket control frames 2.72.0-16.2 - Backport patch for CVE-2026-15709...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS in the readLoop process. An attacker can exhaust system memory by sending HTTP/2 frames with a declared payload size significantly larger than the configured maximum, causing the server or client to buffer excessiv...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to the unbounded queue used for outbound HTTP/2 frames. An attacker can exhaust server memory by continuously sending frames that trigger the server to enqueue responses faster than they are processed. Workarou...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the H2Connection process. An attacker can exhaust heap memory and cause service disruption by sending HTTP/2 HEADERS or PUSHPROMISE frames without ENDHEADERS, followed by unbounded...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the H2Connection process. An attacker can exhaust heap memory and cause service disruption by sending HTTP/2 HEADERS or PUSHPROMISE frames without ENDHEADERS, followed by unbounded...

Http4s Ember HTTP/2: unbounded continuation frame accumulation

When Ember receives an HTTP/2 HEADERS or PUSHPROMISE frame without the ENDHEADERS flag, it buffers the header block fragment and waits for subsequent CONTINUATION frames. These accumulate unbounded until the connection closes. Impact A remote, unauthenticated peer can exhaust the heap on any Embe...

GHSA-CP4Q-FQW9-4HF6 Http4s Ember HTTP/2: unbounded continuation frame accumulation

When Ember receives an HTTP/2 HEADERS or PUSHPROMISE frame without the ENDHEADERS flag, it buffers the header block fragment and waits for subsequent CONTINUATION frames. These accumulate unbounded until the connection closes. Impact A remote, unauthenticated peer can exhaust the heap on any Embe...

CVE-2026-69218 Http4s Ember HTTP/2: unbounded continuation frame accumulation

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, When Ember receives an HTTP/2 HEADERS or PUSHPROMISE frame without ENDHEADERS, H2Connection buffers the header block and subsequent CONTINUATION fragments without a size bound. A remote peer can keep an incomplete bloc...

CVE-2026-69218

Http4s Ember HTTP/2 is vulnerable to unbounded continuation frame accumulation in its H2Connection component. When Ember receives an HTTP/2 HEADERS or PUSH_PROMISE frame without END_HEADERS, it buffers the header block and subsequent CONTINUATION fragments without a size bound . A remote peer can...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

Chromium CVE-2026-87437: Information leak in Frames

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

ROS-20260915-73-0057

The vulnerability of the confidentiality function of Fenced Frames in Microsoft Edge and Google Chrome is related to a lack of verification mechanism for the source of the data. Exploiting this vulnerability can allow attackers to bypass existing security measures remotely...

PT-2026-92428

When Ember receives an HTTP/2 HEADERS or PUSH PROMISE frame without the END HEADERS flag, it buffers the header block fragment and waits for subsequent CONTINUATION frames. These accumulate unbounded until the connection closes. Impact A remote, unauthenticated peer can exhaust the heap on any...

OESA-2026-3779 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: A vulnerability was found in libsoup's WebSocket frame parsing implementation...

Astra Linux – Vulnerability in dav1d

An integer overflow occurs in the dav1d AV1 decoder, which can happen when decoding videos with a large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading to a version later than 1.4.0 of dav1d...