EUVD-2026-93308

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

CVE-2026-98323 RDMA/siw: Bound fragmented header copies by the remaining length

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

CVE-2026-98323

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

CVE-2026-98323

The Linux kernel is vulnerable to an out-of-bounds (OOB) write due to how the RDMA/siw component handles fragmented header copies. Specifically, the siw_get_hdr() function can receive an extended DDP/RDMAP header across multiple TCP callbacks. If the first callback receives most of the header, th...

CVE-2026-98288 net: stmmac: fix TSO header length truncation

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO header length truncation stmmactsoxmit stores the protocol header length returned by stmmactsoheadersize in a u8. stmmactsovalidpacket admits headers up to 1023 bytes, so a header longer than 255 bytes wraps...

EUVD-2026-93216

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO header length truncation stmmactsoxmit stores the protocol header length returned by stmmactsoheadersize in a u8. stmmactsovalidpacket admits headers up to 1023 bytes, so a header longer than 255 bytes wraps...

CVE-2026-98288

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO header length truncation stmmactsoxmit stores the protocol header length returned by stmmactsoheadersize in a u8. stmmactsovalidpacket admits headers up to 1023 bytes, so a header longer than 255 bytes wraps...

CVE-2026-98288

The Linux kernel contains a vulnerability in the stmmac driver where stmmac_tso_xmit() incorrectly stores the protocol header length in a u8 variable. Because stmmac_tso_valid_packet() allows headers up to 1023 bytes, any header exceeding 255 bytes—such as a TCP over IPv6 socket with specific des...

CVE-2026-98287 pppoatm: ensure a writable skb header and linear data

In the Linux kernel, the following vulnerability has been resolved: pppoatm: ensure a writable skb header and linear data In pppoatmsend, LLC encapsulation checks whether there is sufficient headroom for the 4-byte LLC header, but does not ensure that the skb header is writable. Normal transmit...

CVE-2026-98287

In the Linux kernel, the following vulnerability has been resolved: pppoatm: ensure a writable skb header and linear data In pppoatmsend, LLC encapsulation checks whether there is sufficient headroom for the 4-byte LLC header, but does not ensure that the skb header is writable. Normal transmit...

CVE-2026-98271 net: skbuff: do not leave stale header offsets after pskb_carve()

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: do not leave stale header offsets after pskbcarve pskbcarveinsideheader and pskbcarveinsidenonlinear remove the first bytes of a packet and reallocate skb-head. All the headers that were present before the operation...

EUVD-2026-93166

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate the netif index in t7xxccmnirecvskb The netif index carried in the DPMAIF PIT header is five bits wide, but ccmniinst only has room for NICDEVMAX 21 entries. t7xxccmnirecvskb indexes the array without a...

CVE-2026-98238 net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate the netif index in t7xxccmnirecvskb The netif index carried in the DPMAIF PIT header is five bits wide, but ccmniinst only has room for NICDEVMAX 21 entries. t7xxccmnirecvskb indexes the array without a...

CVE-2026-98233

In the Linux kernel, the following vulnerability has been resolved: net/packet: clear RX owner on VNET header error Commit 61fad6816fc1 "net/packet: tpacketrcv: avoid a producer race condition" added rxownermap and made tpacketrcv claim a V1 or V2 ring slot before converting the virtio-net header...

CVE-2026-55584

CVE-2026-55584 - phpSysInfo IP Allowlist Bypass CWE-290, CVSS 7.5 High, phpSysInfo = 3.4.5 Refs: GHSA-786w-p5pm-cvgh, CVE.org PSIALLOWED resolves the client IP from the attacker-controlled X-Forwarded-For then Client-IP headers before falling back to REMOTEADDR. There is no trusted-proxy concept,...

netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification

A flaw was found in Netty, a network application framework. A remote attacker could exploit a vulnerability in the SPDY header decoding process. By sending a specially crafted, small compressed header block, the attacker can cause it to expand significantly during decompression, leading to...

io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header

A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...

CVE-2026-105782

A flaw was found in Scrapy. A remote attacker controlling a malicious website can cause a Denial of Service DoS by providing a specially crafted Referrer-Policy HTTP response header. When processing the response, the RefererMiddleware treats the header value as a Python import path and executes t...

CVE-2026-47323

camel-cxf-rest / camel-cxf / camel-knative-http 헤더 인젝션 재현기 CVE-2026-47323 이 프로젝트는 Apache Camel의 CXF 및 Knative HTTP 헤더 필터 전략에서 메시지-헤더 인젝션 을 시연하며, CVE-2026-47323 로 추적됩니다. CxfRsHeaderFilterStrategy camel-cxf-rest, CxfHeaderFilterStrategy camel-cxf-transport 및 KnativeHttpHeaderFilterStrategy...

[SECURITY] [DSA 6545-1] roundcube security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6545-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 06, 2026 https://www.debian.org/security/faq -...