SUSE-SU-2026:3930-1 Security update for nodejs20

This update for nodejs20 fixes the following issues: - CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request bsc1236258. - CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response...

SUSE-SU-2026:3929-1 Security update for nodejs20

This update for nodejs20 fixes the following issues: - CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request bsc1236258. - CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response...

Security update for nodejs20

This update for nodejs20 fixes the following issues: CVE-2025-22150: undici: predictable random values used when defining the boundary for a multipart/form-data request bsc1236258. CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery...

CVE-2026-2811

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

CVE-2026-2811

The Ajaxify Comments WordPress plugin before version 3.2 is affected by an HTTP Header Injection vulnerability caused by insufficient input sanitization and output escaping on user-supplied data. Unauthenticated attackers can inject arbitrary HTTP headers, resulting in low confidentiality and int...

CVE-2026-2811 Ajaxify Comments < 3.2 - Unauthenticated HTTP Header Injection

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

EUVD-2026-70050

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

CVE-2026-2811 Ajaxify Comments < 3.2 - Unauthenticated HTTP Header Injection

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

HTTP Header Injection

Blaze is vulnerable to HTTP header injection. The vulnerability is due to blaze-server merging attacker-controlled HTTP trailer fields into Request.headers, which allows an unauthenticated remote attacker to inject or spoof trusted headers such as X-Forwarded-For, X-Real-IP, X-Forwarded-Host, or...

PT-2026-84723

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

CVE-2026-2811: Improper Neutralization of CRLF Sequences in HTTP Headers

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

PT-2026-84257

Name of the Vulnerable Software and Affected Versions OTP versions 17.0 through 27.3.4.16 OTP versions 28.0 through 28.5.0.5 OTP versions 29.0 through 29.0.5 inets versions 5.10 through 9.3.2.6 inets versions 9.4 through 9.6.2.2 inets versions 9.7 through 9.7.1 Description httpd does not implemen...

Erlang/OTP -- multiple vulnerabilities in inets, stdlib, snmp and eldap

The Erlang/OTP project reports: OTP 29.0.6, 28.5.0.6 and 27.3.4.17 fix the following issues, most of them in the inets httpd and httpc implementations: CVE-2026-55951: httpc Memory Exhaustion via Unbounded Header Accumulation. CVE-2026-59696: stdlib: Denial-of-Service enabled by Unbounded Integer...

CVE-2026-19880

A flaw was found in Logback-classic. This path-traversal vulnerability allows a remote attacker to create and append log files outside the intended directory. This occurs because an unsanitized discriminator value, influenced by the attacker for example, via an HTTP header, is used in a file path...

CVE-2026-59314

Spring Framework spring-web is vulnerable to HTTP response splitting when untrusted input is used to build a Content-Disposition header value. An attacker can inject malicious characters via specially crafted file names to break HTTP headers or corrupt the framing of an outbound multipart body. T...

CVE-2026-59314 Spring Framework response splitting in ContentDisposition

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spri...

CVE-2026-59314 Spring Framework response splitting in ContentDisposition

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spri...

EUVD-2026-67184

Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by an uncontrolled resource consumption vulnerability due to Apache HttpComponents Core

Summary Apache HttpComponents Core is used by IBM Integrated Analytics System as a Java library providing low-level HTTP transport components. CVE-2026-54399 affects the HTTP/1.1 message parser in Apache HttpComponents Core versions 5.4.2 and earlier, where insufficient limits on the number and...

CVE-2026-77680 Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix

An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in...