PT-2026-120566

Inconsistent interpretation of HTTP requests HTTP request/response smuggling in the bundled HTTP/1.1 parser of Apache bRPC version 1.18.0 on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same byte...

Apache Camel 4.22.0 Platform HTTP Proxy Mode

Apache Camel version 4.22.0 camel-platform-http contains an unintended proxy-mode issue where endpoint paths beginning with proxy are treated as catch-all forwarding proxies. https://packetstorm.news/download/236741...

Apache bRPC buffer error vulnerability

A security vulnerability exists in Apache bRPC versions prior to 1.18.0. This vulnerability stems from integer underflow and out-of-bounds reads during the parsing of HTTP/2 DATA frames, potentially allowing unauthenticated remote attackers to send malformed DATA frames and induce a...

Apache AsterixDB 0.9.9 Missing Authentication

Apache AsterixDB version 0.9.9 contains a missing authentication vulnerability in its Cluster Controller HTTP API, allowing unauthenticated SQL++ queries and cluster shutdown requests. !/usr/bin/env perl Apache AsterixDB 0.9.9 Missing Authentication Vendor: The Apache Software Foundation Product...

PT-2026-120650

Insufficient resource pool in the ACME HTTP-01 challenge responder of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to cause a certificate issuance or renewal to fail. When the server obtains or renews a TLS certificate over ACME it runs an HTTP-01...

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a security vulnerability. This vulnerability arises because the HTTP/2 h2 receive path fails to enforce endpoint restrictions such as SETTINGSMAXCONCURRENTSTREAMS and SETTINGSMAXHEADERLISTSIZE. As a result, write limits on control frames are bypasse...

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a resource management error vulnerability. This vulnerability arises from the failure to consistently enforce the configured maxbodysize limit during non-persistent HTTP/1 and HTTP/2 parsing, as well as in parsing responses from memcache and...

Apache bRPC authorization issue vulnerability

Apache bRPC versions 1.17.0 and earlier contain an authorization issue vulnerability. This vulnerability stems from improper authentication; remote unauthenticated attackers can send built-in HTTP requests on the same HTTP/1.1 keep-alive connection, thereby bypassing authentication for protected...

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a resource management error vulnerability. This vulnerability arises because the HTTP/2 HPACK decoder fails to limit recursion depth. Remote attackers can exploit this by sending specially crafted HTTP/2 header blocks containing numerous consecutive...

PT-2026-120568

On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal port, the HTTP built-in service exemption on internal port can be abused to bypass authentication entirely. VerifyHttpRequest returns true without checking any credential when a built-in service is requested on interna...

PT-2026-120541

A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 h2/gRPC stack in Apache bRPC version = 1 byte + value = 1 byte + 32 bytes of overhead. However, RFC 7541 section 4.1 specifies that the minimum entry size is 33 bytes, because the value may be empty name = 1 byte +...

PT-2026-134492

TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in v5.4.50-p1+tuxcare...

PT-2026-120564

Interpretation conflict in the HTTP protocol implementation in Apache bRPC version 1.18.0 on all platforms allows remote attackers to bypass access control rules enforced by a front proxy. Root Cause: The method dispatch function FindMethodPropertyByURI in bRPC's HTTP protocol splits the request...

PT-2026-120784

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to versio...

Oracle Primavera P6 Enterprise Project Portfolio Management (October 2026 CPU)

The versions of Primavera P6 Enterprise Project Portfolio Management installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and...

Oracle HTTP Server 14c (October 2026 CPU)

The version of Oracle HTTP Server installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware component: OSSL Module. Supported versions that are affected are...

Oracle Access Manager 14.1.2.1 (October 2026 CPU)

The 14.1.2.1.0 version of Access Manager installed on the remote host is affected by a vulnerability as referenced in the October 2026 CPU advisory. - Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Third Party Apache HttpComponents. The supported version...

Debian dsa-6575 : libnginx-mod-http-geoip - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6575 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6575-1 [email protected] https://www.debian.org/securit...

RHEL 9 : golang (RHSA-2026:86196)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:86196 advisory. The golang packages provide the Go programming language compiler. Security Fixes: net/http: golang: golang: Denial of Service via crafted...

Apache AsterixDB 0.9.9 Missing Authentication

Summary Apache AsterixDB is a highly scalable data management system that can store, index, and manage semi-structured data, e.g., much like MongoDB, but it also supports a full-power query language with the expressiveness of SQL and more. Unlike analytics engines like Apache Hive or Apache Spark...