Security update for perl-HTTP-Date (moderate)

openSUSE security update: security update for perl-http-date ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21427-1 Rating: moderate References: bsc1271705 Cross-References: CVE-2026-14741 CVSS scores: CVE-2026-14741 SUSE : 5.3...

CVE-2026-64785

SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2...

Security Bulletin: Multiple vulnerabilities have been identified in IBM HTTP Server used by IBM Rational ClearQuest

Summary IBM HTTP Server IHS is used by the IBM Rational ClearQuest server and web components. Information about security vulnerabilities affecting IHS have been published in a security bulletins. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affecte...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution in the lookup function when handling HTTP/2 requests. An attacker can cause the application to crash by sending specially crafted HTTP method values that exploit inherited object properties, leading to a denial of...

find-my-way: DDoS with HTTP2

Impact Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The short version is that lookup passes req.method into find, and find indexes this.treesmethod. Since this.trees is a normal object, HTTP/2 method values like constructor, toString, or proto can resolve...

CVE-2026-16756

CVE-2026-16756 affects the aws-smithy-http-server in its default serve() path. Missing connection and header-read timeouts and no concurrent-connection cap can allow unauthenticated remote attackers to exhaust server sockets and tasks by opening many connections and sending partial requests, cons...

Updated apache packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Apache HTTP Server: modldap per-dir use-after-free. CVE-2026-29167 Apache HTTP Server: modproxyftp XSS. CVE-2026-29170 Apache HTTP Server: modproxyhtml buffer overflow. CVE-2026-34355 Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow...

CVE-2026-44909

Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGSINITIALWINDOWSIZE to 0 or withholding WINDOWUPDATE frames, causing the server to buffer complete response bodies ...

CVE-2026-44909

Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGSINITIALWINDOWSIZE to 0 or withholding WINDOWUPDATE frames, causing the server to buffer complete response bodies ...

CVE-2026-44909

Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGSINITIALWINDOWSIZE to 0 or withholding WINDOWUPDATE frames, causing the server to buffer complete response bodies ...

EUVD-2026-48310

Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGSINITIALWINDOWSIZE to 0 or withholding WINDOWUPDATE frames, causing the server to buffer complete response bodies ...

EUVD-2026-48306

CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kill, delete, and corrupt other tenants' backups. Attackers can send crafted POST requests with arbitrary backupCancellationDoma...

GHSA-6HQ5-7373-42RG PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

Summary The domain whitelist introduced in PhpSpreadsheet 5.4.0 for the WEBSERVICE formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but filegetcontents follows 302/301 redirects by default without re-validating the redirect target agains...

Exploit for Path Traversal in Apache Http_Server

CVE-2021-41773 Apache HTTP Server Exploit This repository con...

RLSA-2026:41901 Important: .NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29...

Oracle WebLogic Server Administration Console - Remote Code Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Services versions 0.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0 contain an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. id:...

Oracle E-Business Suite - Server-Side Request Forgery

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite component: Runtime UI. Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. id:...

CVE-2026-16653

A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function httpsendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit...

CVE-2026-16653 boazsegev facil.io Public Folder http.c http_sendfile2 path traversal

A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function httpsendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit...

CVE-2026-16653 boazsegev facil.io Public Folder http.c http_sendfile2 path traversal

A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function httpsendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit...