Astra Linux – vulnerability in Thunderbird

When an HTTPS page was embedded within an HTTP page, and a service worker was registered for the former, the service worker could have intercepted the request for the secure page despite the fact that the iframe did not constitute a secure context due to the insecure framing. This vulnerability...

Astra Linux – vulnerability in Apache2

The Loop with Unreachable Exit Condition ‘Infinite Loop’ vulnerability exists in the modproxyftp module of the Apache HTTP Server when an attacker controls a backend FTP server. This issue affects versions 2.4.0 through 2.4.67. Users are advised to upgrade to version 2.4.68, which resolves the...

Astra Linux – vulnerability in Perl

HTTP::Tiny versions prior to 0.083—a Perl core module since version 5.13.9 and available as a standalone package on CPAN—feature an insecure default TLS configuration requiring users to explicitly enable certificate verification...

CVE-2026-100347 kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation...

CVE-2026-100347 kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation...

CVE-2026-100347 kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation...

CVE-2026-100347

The kin-openapi Go project (versions prior to 0.145.0 ) contains a vulnerability in the openapi3filter.ValidationHandler . The routers/legacy router may pass unsupported or non-canonical HTTP methods (e.g., PROPFIND or lowercase get ) for existing static paths to openapi3.PathItem.GetOperation . ...

DEBIAN-CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

SUSE CVE-2026-61642

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing src/HttpHeader.cc accepted the bare Transfer-Encoding: identity...

CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082 Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082 Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082

The symfony/http-foundation component is vulnerable to a Regular Expression Denial of Service (ReDoS) in the HeaderUtils::split() function. The root cause is a regex pattern that matches whitespace followed by a lookbehind; an attacker can provide a long sequence of whitespace in the Cache-Contro...

CVE-2026-108082 Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

No title provided

A flaw was found in Netty. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending numerous pipelined HTTP/1.1 requests over a single connection while withholding reads. Netty's HTTP server codec stores unanswered requests in an internal queue...

io.netty/netty-codec-http: Netty: Denial of Service via unbounded SPDY concurrent streams

A flaw was found in Netty. This vulnerability allows a remote attacker to cause a Denial of Service DoS by exhausting server memory. Because the SPDY session handler does not restrict the number of concurrent streams initiated by a remote peer, an attacker can transmit an excessive volume of stre...

io.netty/netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams

A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAXVALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYNSTREAM...