CVE-2026-12538 IBM MQ Appliance is affected by an improper validation vulnerability

IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header structure length fields...

CVE-2026-113374

Sonatype Nexus Repository 3 is vulnerable to a privilege escalation flaw because it fails to require realm administration permission when creating a Rut Auth capability . An attacker with only the nexus:capabilities:create permission can create this capability to enable header-based authenticatio...

CVE-2026-113374 Nexus Repository 3 - Privilege Escalation via Rut Auth Capability Creation

Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability. A user who holds only the capability creation permission nexus:capabilities:create can create this capability, which turns on header-based authentication for the instance. A...

DEBIAN-CVE-2026-63183

OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed fullhost nor framework-level incoming host validation is configured. A remote unauthenticated client can...

CVE-2026-63183

OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed fullhost nor framework-level incoming host validation is configured. A remote unauthenticated client can...

CVE-2026-63183 OmniAuth: Host Header Injection Vulnerability

OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed fullhost nor framework-level incoming host validation is configured. A remote unauthenticated client can...

CVE-2026-63183

OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed fullhost nor framework-level incoming host validation is configured. A remote unauthenticated client can...

CVE-2026-63183 OmniAuth: Host Header Injection Vulnerability

OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed fullhost nor framework-level incoming host validation is configured. A remote unauthenticated client can...

CVE-2026-63183 OmniAuth: Host Header Injection Vulnerability

OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed fullhost nor framework-level incoming host validation is configured. A remote unauthenticated client can...

CVE-2026-63183

The OmniAuth authentication system (prior to version 2.2.0 ) is vulnerable to a host header injection risk. The root cause is that the system derives provider callback URLs from request-controlled host information when neither a fixed full_host nor framework-level incoming host validation is conf...

SUSE CVE-2026-120644

CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request...

SUSE CVE-2026-120647

CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename. header-attachment = $name writes $name into the quoted filename parameter of Content-Disposition without escaping double quotes. An application that passe...

net/http: golang: golang: Denial of Service via crafted HTTP Range headers

A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service DoS by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

SUSE CVE-2026-120435

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caused by an unvalidated characters-per-pixel value in the XPM header. Attackers can supply a crafted XPM file with characters-per-pixel greater than 3 to overrun fixed 3-byte...

SUSE CVE-2026-120639

CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipartstart and dopush. With autoEscape off, header decodes HTML entities in extra header values after its newline check, so an encoded CR or LF reaches t...

io.netty/netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough)

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary,...

io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite

A flaw was found in Netty, an asynchronous, event-driven network application framework. The CorsHandler component incorrectly replaces application Vary headers, such as Authorization or Cookie, with Origin. This allows a caching proxy or Content Delivery Network CDN to reuse authenticated respons...

io.netty/netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority

A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leadi...

io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...