PT-2026-64673

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the 6lowpan implementation. The function lowpan nhc do uncompression retrieves an NHC descriptor while holding the lowpan nhc lock. If the descriptor lac...

PT-2026-64544

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read can occur when mounting a crafted UDF image with a virtual VAT partition. The udf load vat function fails to validate the lengthHeader value from the on-disk VAT 2....

PT-2026-64514

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iommufd veventq fops read function where a bound-check for the normal vEVENT path incorrectly uses sizeofhdr instead of sizeofhdr. Because hdr is a pointer,...

PT-2026-64513

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the iommufd component, memory allocation for veventq occurs inside a spinlock. Because the queue depth is determined by user space, a user can allocate excessively large queues to...

CVE-2026-64323: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udfloadvat takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size:...

Linux Distros Unpatched Vulnerability : CVE-2026-55833

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding...

Linux Distros Unpatched Vulnerability : CVE-2026-64442

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: rtl8723bs: fix OOB reads in IE loops in issueassocreq and joincmdhdl Two IE parsing loops are missing the header bounds checks before they dereference...

Linux Distros Unpatched Vulnerability : CVE-2026-64264

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuseuringcommit copyfromuser returns the number of bytes...

Linux Distros Unpatched Vulnerability : CVE-2026-56746

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through...

Linux Distros Unpatched Vulnerability : CVE-2026-66139

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known. CVE-2026-66139 Note that Nessus relies on the presenc...

CVE-2026-66339

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials,...

CVE-2026-66339

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials,...

CVE-2026-66339 Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials,...

CVE-2026-66339

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials,...

GHSA-46Q4-43PH-C6FR blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)

Summary blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names/values e.g. X-Forwarded-For, internal-auth headers that a fronting proxy sanitized from the...

blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)

Summary blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names/values e.g. X-Forwarded-For, internal-auth headers that a fronting proxy sanitized from the...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the process that merges HTTP/1.1 chunked-body trailer fields into Request.headers. An attacker can inject arbitrary HTTP headers by sending specially crafted trailer fields, potentially bypassing header-based...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the process that merges HTTP/1.1 chunked-body trailer fields into Request.headers. An attacker can inject arbitrary HTTP headers by sending specially crafted trailer fields, potentially bypassing header-based...

swift-nio-http2: Missing CR/LF/NUL validation in header values

Summary SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. Impact Two related gaps in inbound header...

GHSA-Q3G2-M552-3R9C swift-nio-http2: Missing CR/LF/NUL validation in header values

Summary SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. Impact Two related gaps in inbound header...