CLEANSTART-2026-HB54446 HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service

Security vulnerability affects the traefik-fips package. HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service...

Fedora 45 : python-django5 (2026-36373ca634)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-36373ca634 advisory. Update Django 5 to version 5.2.18 - Fixes CVE-2026-77050 low: Potential denial-of-service vulnerability in getsupportedlanguagevariant - Fixes...

Fedora 45 : python-django6 (2026-c221dbc190)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c221dbc190 advisory. Update Django 6 to version 6.1.2 - Fixes CVE-2026-77050 low: Potential denial-of-service vulnerability in getsupportedlanguagevariant - Fixes...

CLEANSTART-2026-KQ20007 HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service

Security vulnerability affects the traefik package. HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service...

MGASA-2026-0510 Updated python-django package fixes security vulnerabilities

Potential denial-of-service vulnerability in getsupportedlanguagevariant. CVE-2026-77050 Potential denial-of-service vulnerability in HTTP header parsing. CVE-2026-84429 Potential request forgery via spatial lookup byte values. CVE-2026-87890 Privilege abuse in model formsets with editable primar...

Updated python-django package fixes security vulnerabilities

Potential denial-of-service vulnerability in getsupportedlanguagevariant. CVE-2026-77050 Potential denial-of-service vulnerability in HTTP header parsing. CVE-2026-84429 Potential request forgery via spatial lookup byte values. CVE-2026-87890 Privilege abuse in model formsets with editable primar...

Fedora 43 : python-django5 (2026-a7b8ff851a)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a7b8ff851a advisory. Update Django 5 to version 5.2.18 - Fixes CVE-2026-77050 low: Potential denial-of-service vulnerability in getsupportedlanguagevariant - Fixes...

Fedora 44 : python-django6 (2026-dbd9eb6961)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dbd9eb6961 advisory. Update Django 6 to version 6.1.2 - Fixes CVE-2026-77050 low: Potential denial-of-service vulnerability in getsupportedlanguagevariant - Fixes...

Fedora 44 : python-django5 (2026-8a0e918188)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8a0e918188 advisory. Update Django 5 to version 5.2.18 - Fixes CVE-2026-77050 low: Potential denial-of-service vulnerability in getsupportedlanguagevariant - Fixes...

CVE-2026-84429

A flaw was found in Django. Inefficient processing occurs when the HTTP header parsing function handles quoted parameter values containing numerous separator characters. A remote, unauthenticated attacker could exploit this flaw by sending requests with crafted header parameters, causing excessiv...

CVE-2026-84429 Potential denial-of-service vulnerability in HTTP header parsing

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parseheaderparameters was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An...

Astra Linux – Vulnerability in Squid

Squid is a caching proxy for the Web. Due to an uncontrolled recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack involving HTTP request parsing. This issue allows a remote client to carr...

Erlang/OTP -- multiple vulnerabilities in inets, stdlib, snmp and eldap

The Erlang/OTP project reports: OTP 29.0.6, 28.5.0.6 and 27.3.4.17 fix the following issues, most of them in the inets httpd and httpc implementations: CVE-2026-55951: httpc Memory Exhaustion via Unbounded Header Accumulation. CVE-2026-59696: stdlib: Denial-of-Service enabled by Unbounded Integer...

JLSEC-2026-1381

Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The clcount and tecount checks in the mghttpparse and httpcb paths in src/http.c accept both...

[SECURITY] [DLA 4747-1] python-httplib2 security update

Debian LTS Advisory DLA-4747-1 [email protected] https://www.debian.org/lts/security/ Emmanuel Arias August 20, 2026 https://wiki.debian.org/LTS Package : python-httplib2 Version : 0.18.1-3+deb11u1 CVE ID : CVE-2021-21240 CVE-2026-59939 Debian Bug : 982738 Two vulnerabilities were...

CVE-2026-68005

An issue in ACME minihttpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the handlerequest function...

CVE-2026-68005

An issue in ACME minihttpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the handlerequest function...

CVE-2026-58154

Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which f...

OESA-2026-2718 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing...

PT-2026-45941

Name of the Vulnerable Software and Affected Versions daphne versions prior to 4.2.2 Description A parser differential exists when reconstructing raw HTTP requests from Twisted's parsed headers for WebSocket handshake processing in autobahn. While Twisted does not recognize the bytes x0b, x0c, x1...