Security Bulletin: IBM Fusion Data Foundation is vulnerable to Denial of Service.

Summary opentelemetry-go is used by IBM Fusion Data Foundation, which could cause a Denial of Service. CVE-2026-29181. Vulnerability Details CVEID:CVE-2026-29181 DESCRIPTION: OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction...

GHSA-2V4P-QF9Q-27WJ gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

A vulnerability exists in gRPC-Go servers configured with xds.NewGRPCServer where a crafted request missing both :authority and Host headers can cause a server panic, resulting in a Denial of Service DoS. Servers built with xds.NewGRPCServer install an xDS routing interceptor on every RPC. This...

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

A vulnerability exists in gRPC-Go servers configured with xds.NewGRPCServer where a crafted request missing both :authority and Host headers can cause a server panic, resulting in a Denial of Service DoS. Servers built with xds.NewGRPCServer install an xDS routing interceptor on every RPC. This...

CakePHP: SmtpTransport vulnerable to CRLF header injection

Impact Custom mail headers added with Message::setHeaders or addHeaders do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes. Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue. Workarounds You c...

EUVD-2026-65123

CakePHP: SmtpTransport vulnerable to CRLF header injection...

GHSA-2QH5-382H-3JPC CakePHP: SmtpTransport vulnerable to CRLF header injection

Impact Custom mail headers added with Message::setHeaders or addHeaders do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes. Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue. Workarounds You c...

EUVD-2026-69419

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion...

GHSA-QC2Q-P7WX-3PX3 gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Summary A vulnerability in the xDS RBAC HTTP filter implementation in grpc-go allows remote attackers to bypass authorization policies specifically DENY rules by using mixed-case or canonical-case header matchers e.g., X-Role instead of x-role. Additionally, the safety guards introduced by gRFC A...

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Summary A vulnerability in the xDS RBAC HTTP filter implementation in grpc-go allows remote attackers to bypass authorization policies specifically DENY rules by using mixed-case or canonical-case header matchers e.g., X-Role instead of x-role. Additionally, the safety guards introduced by gRFC A...

HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

Summary HTTPX2 can automatically add a Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. The resulting HTTP/1.1 request contains both framing headers, which can create an ambiguous message boundary and enable request smuggling or connection...

EUVD-2026-70248

HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated...

GHSA-PF96-P4FJ-6566 HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

Summary HTTPX2 can automatically add a Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. The resulting HTTP/1.1 request contains both framing headers, which can create an ambiguous message boundary and enable request smuggling or connection...

GHSA-H4X7-GW46-3WM6 HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

Summary HTTPX2 serializes the per-file Content-Type and custom headers supplied through the files= tuple API directly into the multipart/form-data body without validating custom header names or values. An attacker who can influence upload metadata passed to HTTPX2 can use CR or LF characters to...

HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

Summary HTTPX2 serializes the per-file Content-Type and custom headers supplied through the files= tuple API directly into the multipart/form-data body without validating custom header names or values. An attacker who can influence upload metadata passed to HTTPX2 can use CR or LF characters to...

EUVD-2026-70246

HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers...

CVE-2026-78560

The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In architectures where this optional source is enabled without an upstream reverse proxy or firewall configured to saniti...

CVE-2026-78560 Improper Authentication Validation in Okta Access Gateway Pass-Through Authentication Source

The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In architectures where this optional source is enabled without an upstream reverse proxy or firewall configured to saniti...

CVE-2026-78560

CVE-2026-78560 affects the Okta Access Gateway , specifically its optional pass-through authentication source , which accepts user identity from a client-supplied HTTP header without cryptographic validation. When this source is enabled without an upstream reverse proxy or firewall that sanitizes...

EUVD-2026-74171

The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In architectures where this optional source is enabled without an upstream reverse proxy or firewall configured to saniti...

CVE-2026-78560 Improper Authentication Validation in Okta Access Gateway Pass-Through Authentication Source

The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In architectures where this optional source is enabled without an upstream reverse proxy or firewall configured to saniti...