PT-2026-120785

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version...

PT-2026-134493

TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in v7.4.8-p1+tuxcare...

Linux Distros Unpatched Vulnerability : CVE-2026-78660

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. Howeve...

Linux Distros Unpatched Vulnerability : CVE-2026-78659

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler...

Rocky Linux 8 [CIQ] Security Update: pcs / pcs-snmp Multiple Vulnerabilities (crlsa-2026_84798)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202684798 advisory. python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields CVE-2026-82397 python-tornado: Tornado before 6.4.1 HTTP Request Smugglin...

libsoup HTTP Range Header CPU Exhaustion

libsoup contains an algorithmic-complexity flaw in HTTP Range header coalescing that may allow remote unauthenticated attackers to consume excessive CPU and reduce service availability...

PT-2026-120535

Apache bRPC versions before 1.18.0 do not consistently enforce the configured max body size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing. A remote unauthenticated peer can cause an affected process to buffer message data beyond the configured...

PT-2026-120182

ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UPDATE SCHEMA permission. Attackers can send a bare ALTER TYPE edgeType WITH lightweight = true command over the HTTP, gRP...

PT-2026-120542

Uncontrolled resource consumption in the HTTP/2 h2 receive path of Apache bRPC version 1.18.0 on all platforms allows a remote unauthenticated attacker to crash the server or grow its memory without bound by sending crafted HTTP/2 frames. Root Cause: The h2 parser, enabled by default on every bRP...

Apache bRPC input validation error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain an input validation error vulnerability. This vulnerability arises because the bound HTTP/1.1 parser interprets HTTP requests differently than the frontend does, resulting in HTTP request and response smuggling. This could allow remote attackers to...

PT-2026-134494

TuxCare rebuilt symfony/http-foundation to address 1 CVE. Fixed in v6.4.35-p1+tuxcare...

PT-2026-120527

Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection. When ServerOptions.auth is enabled and builtin HTTP...

PT-2026-120648

Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-changing request. The REST API accepts HTTP Basic authentication and answers a browser with a Basic sign-in box; a brows...

Linux Distros Unpatched Vulnerability : CVE-2026-78663

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread...

Atlassian Confluence 7.11.x < 9.2.26 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104518)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104518 advisory. - Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset Thi...

Linux Distros Unpatched Vulnerability : CVE-2026-91453

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Lightweight HTTP Server...

RHEL 8 : go-toolset:rhel8 (RHSA-2026:86203)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:86203 advisory. Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: net/http: golang:...

RockyLinux 8 : go-toolset:rhel8 (RLSA-2026:86203)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:86203 advisory. net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial of Service via multiple...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libwebsockets (UTSA-2026-142308)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142308 advisory. libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra...

RockyLinux 9 : golang (RLSA-2026:86196)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:86196 advisory. net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial of Service via multiple...