NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing

Background NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The nats-server offers a Nats-Request-Info: message header, providing information about a request. Problem Description The NATS message head...

CVE-2026-30851 Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation

Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forwardauth copyheaders does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2...

CVE-2026-30851

Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forwardauth copyheaders does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2...

Linux Distros Unpatched Vulnerability : CVE-2024-36933

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nsh: Restore skb-protocol,data,macheader for outer header in nshgsosegment. syzbot triggered various splats see 0 and links by a crafted GSO packet of...

openSUSE Security Advisory (SUSE-SU-2025:0285-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2025:0285-1 Security update for go1.24

This update for go1.24 fixes the following issues: This update ships go1.24rc2 bsc1236217. - CVE-2024-45341: Properly check for IPv6 hosts in URIs bsc1236045 - CVE-2024-45336: Persist header stripping across repeated redirects bsc1236046 - CVE-2025-22865: Avoid panic when parsing partial PKCS1...

SUSE-SU-2025:0281-1 Security update for go1.22

This update for go1.22 fixes the following issues: - Update to go1.22.11 bsc1218424 - CVE-2024-45341: Properly check for IPv6 hosts in URIs bsc1236045 - CVE-2024-45336: Persist header stripping across repeated redirects bsc1236046...

Security update for go1.23

This update for go1.23 fixes the following issues: Update to go1.23.5 bsc1229122 CVE-2024-45341: Properly check for IPv6 hosts in URIs bsc1236045 CVE-2024-45336: Persist header stripping across repeated redirects bsc1236046 Patch Instructions: To install this SUSE update use the SUSE recommended...

SUSE-SU-2025:0280-1 Security update for go1.23

This update for go1.23 fixes the following issues: - Update to go1.23.5 bsc1229122 - CVE-2024-45341: Properly check for IPv6 hosts in URIs bsc1236045 - CVE-2024-45336: Persist header stripping across repeated redirects bsc1236046...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.24 (SUSE-SU-2025:0285-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0285-1 advisory. This update ships go1.24rc2 bsc1236217. - CVE-2024-45341: Properly check for IPv6 hosts in URIs...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.23 (SUSE-SU-2025:0280-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0280-1 advisory. - Update to go1.23.5 bsc1229122 - CVE-2024-45341: Properly check for IPv6 hosts in URIs bsc12360...

urllib3: proxy-authorization request header is not stripped during cross-origin redirects

A flaw was found in urllib3, an HTTP client library for Python. In certain configurations, urllib3 does not treat the Proxy-Authorization HTTP header as one carrying authentication material. This issue results in not stripping the header on cross-origin redirects...

Open Redirect

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Open Redirect due to the cURL wrapper behavior, in Moodle stripped HTTPAUTH and USERPWD headers, during emulated redirects. Remediation Upgrade moodle/moodle to version 4.4.2, 4.3.6, 4.2.9, 4.1.12 o...

EulerOS Virtualization 2.12.0 : python-urllib3 (EulerOS-SA-2024-2779)

According to the versions of the python-urllib3 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with ProxyManager, the...

Medium: python-urllib3

Issue Overview: urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with ProxyManager, the Proxy-Authorization header is only sent to the configured proxy, as expected. However, when sending HTTP requests without using urllib3's proxy support, it's possib...

urllib3: proxy-authorization request header is not stripped during cross-origin redirects

A flaw was found in urllib3, an HTTP client library for Python. In certain configurations, urllib3 does not treat the Proxy-Authorization HTTP header as one carrying authentication material. This issue results in not stripping the header on cross-origin redirects...

urllib3: proxy-authorization request header is not stripped during cross-origin redirects

A flaw was found in urllib3, an HTTP client library for Python. In certain configurations, urllib3 does not treat the Proxy-Authorization HTTP header as one carrying authentication material. This issue results in not stripping the header on cross-origin redirects...

urllib3: proxy-authorization request header is not stripped during cross-origin redirects

A flaw was found in urllib3, an HTTP client library for Python. In certain configurations, urllib3 does not treat the Proxy-Authorization HTTP header as one carrying authentication material. This issue results in not stripping the header on cross-origin redirects...

urllib3: proxy-authorization request header is not stripped during cross-origin redirects

A flaw was found in urllib3, an HTTP client library for Python. In certain configurations, urllib3 does not treat the Proxy-Authorization HTTP header as one carrying authentication material. This issue results in not stripping the header on cross-origin redirects...

SUSE CVE-2024-37891

urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with ProxyManager, the Proxy-Authorization header is only sent to the configured proxy, as expected. However, when sending HTTP requests without using urllib3's proxy support, it's possible to accidental...