CentOS Linux 8.4 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc (CENTOS8.4:CLSA-2026:1791552138)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1791552138 advisory. - A NULL pointer dereference in modxml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untruste...

Progress Telerik Fiddler Classic < 6.0.20262.10021 Multiple Vulnerabilities

The version of Progress Telerik Fiddler Classic installed on the remote Windows host is prior to 6.0.20262.10021. It is, therefore, affected by multiple vulnerabilities: - An insufficient integrity check on external helper tools allows a local low-privileged attacker to replace a helper executabl...

CVE-2026-56866

A flaw was found in Go's net/http package. When an HTTP CONNECT request with a request body is rejected by a server, the client transport can desynchronize the connection before returning it to the shared idle pool. In shared reverse proxy environments, a remote attacker can exploit this issue to...

CVE-2026-78663

A flaw was found in Go's HTTP/2 server implementation. A remote attacker can bypass connection-level flow control limits—mechanisms that regulate incoming network data—potentially causing excessive memory consumption and a Denial of Service DoS. This issue occurs because the server improperly...

CVE-2026-97032

A flaw was found in Go's net/http package. A remote attacker can cause a Denial of Service DoS by crashing the HTTP/2 server. Due to missing synchronization, the server concurrently modifies its HPACK HTTP/2 header compression encoder when encoding response headers while processing incoming table...

CVE-2026-94439

A flaw was found in Go's net/http package. When an HTTP server sends a successful response to an HTTP/1 CONNECT request without taking raw control of the connection, it improperly continues to process incoming data as standard HTTP requests instead of establishing a tunnel. A remote attacker can...

CVE-2026-107715

A flaw was found in mechanize. The library fails to strip caller-supplied credential headers when following cross-origin Hypertext Transfer Protocol HTTP redirects. A remote attacker who controls the target server of a redirect can exploit this vulnerability to capture sensitive authentication...

CVE-2026-107714

A flaw was found in mechanize. The library treats redirects to the same host as same-origin requests without verifying whether the communication protocol scheme or port has changed. A malicious server can exploit this flaw to cause information disclosure by redirecting connections from secure HTT...

CVE-2026-78669

A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service DoS by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration SETTINGS frames that...

Security Bulletin: IBM i is Affected By An Improper Neutralization of Input Vulnerability in HTTP Server Administration GUI [CVE-2026-93886]

Summary IBM i is vulnerable to allowing a remote user to execute script code due to improper validation CVE-2026-93886 in HTTP Server Administration Graphical User Interface GUI as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-93886 DESCRIPTION: IBM i could...

Open Redirect

Overview @adonisjs/http-server is an AdonisJS HTTP server with support packed with Routing and Cookies Affected versions of this package are vulnerable to Open Redirect via the createURL function in src/client/helpers.ts, which fails to encode route parameters when generating URLs. An attacker ca...

CVE-2026-97032

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

DEBIAN-CVE-2026-97032

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107658 CVE-2026-97032 affecting package kubevirt 1.8.4-2

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107787 CVE-2026-97032 affecting package packer 1.9.5-21

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107751 CVE-2026-97032 affecting package moby-engine 25.0.3-20

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-108252 CVE-2026-97032 affecting package golang 1.26.7-1

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107081 CVE-2026-97032 affecting package kata-containers-preview 3.27.0~preview2-2

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107183 CVE-2026-97032 affecting package cert-manager 1.12.15-14

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107279 CVE-2026-97032 affecting package coredns 1.11.4-21

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...