AlmaLinux 9.2 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791538487)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791538487 advisory. - Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to...

Golang net/http DoS

The vulnerability of the net/http component in the Golang programming language is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service failures...

AlmaLinux 9.2 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc (ALMALINUX9.2:CLSA-2026:1791536084)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791536084 advisory. - Out-of-bounds Write vulnerability in Apache HTTP Server's modcharsetlite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

Linux Distros Unpatched Vulnerability : CVE-2026-94439

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to...

CVE-2026-56866

A flaw was found in Go's net/http package. When an HTTP CONNECT request with a request body is rejected by a server, the client transport can desynchronize the connection before returning it to the shared idle pool. In shared reverse proxy environments, a remote attacker can exploit this issue to...

CVE-2026-78663

A flaw was found in Go's HTTP/2 server implementation. A remote attacker can bypass connection-level flow control limits—mechanisms that regulate incoming network data—potentially causing excessive memory consumption and a Denial of Service DoS. This issue occurs because the server improperly...

CVE-2026-97032

A flaw was found in Go's net/http package. A remote attacker can cause a Denial of Service DoS by crashing the HTTP/2 server. Due to missing synchronization, the server concurrently modifies its HPACK HTTP/2 header compression encoder when encoding response headers while processing incoming table...

CVE-2026-94439

A flaw was found in Go's net/http package. When an HTTP server sends a successful response to an HTTP/1 CONNECT request without taking raw control of the connection, it improperly continues to process incoming data as standard HTTP requests instead of establishing a tunnel. A remote attacker can...

CVE-2026-107715

A flaw was found in mechanize. The library fails to strip caller-supplied credential headers when following cross-origin Hypertext Transfer Protocol HTTP redirects. A remote attacker who controls the target server of a redirect can exploit this vulnerability to capture sensitive authentication...

CVE-2026-107714

A flaw was found in mechanize. The library treats redirects to the same host as same-origin requests without verifying whether the communication protocol scheme or port has changed. A malicious server can exploit this flaw to cause information disclosure by redirecting connections from secure HTT...

CVE-2026-78669

A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service DoS by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration SETTINGS frames that...

Security Bulletin: IBM i is Affected By An Improper Neutralization of Input Vulnerability in HTTP Server Administration GUI [CVE-2026-93886]

Summary IBM i is vulnerable to allowing a remote user to execute script code due to improper validation CVE-2026-93886 in HTTP Server Administration Graphical User Interface GUI as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-93886 DESCRIPTION: IBM i could...

Open Redirect

Overview @adonisjs/http-server is an AdonisJS HTTP server with support packed with Routing and Cookies Affected versions of this package are vulnerable to Open Redirect via the createURL function in src/client/helpers.ts, which fails to encode route parameters when generating URLs. An attacker ca...

AZL-107081 CVE-2026-97032 affecting package kata-containers-preview 3.27.0~preview2-2

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107237 CVE-2026-97032 affecting package containerd2 2.3.4-1

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107285 CVE-2026-97032 affecting package cri-tools 1.32.0-8

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107378 CVE-2026-97032 affecting package etcd 3.5.33-1

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107433 CVE-2026-97032 affecting package git-lfs 3.6.1-6

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107850 CVE-2026-97032 affecting package prometheus-process-exporter 0.8.2-5

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-108252 CVE-2026-97032 affecting package golang 1.26.7-1

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...