CLEANSTART-2026-UK08664 In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition

Security vulnerability affects the strimzi-kafka-operator package. In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition...

EUVD-2026-101748

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules.headers to inject cust...

EUVD-2026-101718

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

UBUNTU-CVE-2026-110835

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

PT-2026-122697

Security vulnerability affects the kafka package. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present...

PT-2026-122777

Security vulnerability affects the kafka package. In Eclipse Jetty, a first HTTP/1...

PT-2026-122872

Security vulnerability affects the kafka package. In Eclipse Jetty, an HTTP URI of this form: /public;/...

Linux Distros Unpatched Vulnerability : CVE-2026-109855

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is...

Fortinet FortiSandbox 4.4.x < 4.4.10 / 5.0.x < 5.0.7 Authentication Bypass (FG-IR-26-185)

The version of Fortinet FortiSandbox installed on the remote host is 4.4.x prior to 4.4.10 or 5.0.x prior to 5.0.7. It is, therefore, affected by a vulnerability: - An authentication bypass using an alternate path or channel vulnerability CWE-288 in the FortiSandbox GUI may allow a remote...

Unity Linux 20.1070e Security Update: libsoup (UTSA-2026-130405)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130405 advisory. A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soupmessageheadersappendcommon function in libsoup/soup-message-headers.c...

UBUNTU-CVE-2026-109855

undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the...

RHCOS 4 : Red Hat build of MicroShift 4.18.57 (RHSA-2026:80167)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:80167 advisory. - net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGSMAXFRAMESIZE frame...

RHCOS 4 : OpenShift Container Platform 4.17.59 (RHSA-2026:77547)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:77547 advisory. - net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGSMAXFRAMESIZE frame CVE-2026-33814 No...

HPE NonStop HTTP WEBSERVER input validation error vulnerability

The HPE NonStop HTTP WEBSERVER T1144L24 AAL and earlier versions contain an input validation error vulnerability caused by memory corruption, which may lead to a system crash...

PT-2026-114939

In the Eclipse Adoptium website adoptium.net, in every deployment built from commit 0b24ea1 2025-06-18 up to the fix in commit cbb53cf 2026-09-24, the post-download page /locale/download takes a download URL from the "link" query parameter and automatically navigates to it with a meta...

PT-2026-114825

In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerabilit...

PT-2026-114868

Name of the Vulnerable Software and Affected Versions jetty-security affected versions not specified jetty-eeN-security affected versions not specified jetty-eeN-servlet affected versions not specified Description Jakarta Spec constraints defined as http-method-omission can be bypassed by using...

UBUNTU-CVE-2026-103930

cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::openstream in httplib.h accepts a caller-controlled path that reaches detail::writerequestline without the detail::encodepath protection used by the ordinary buffered request path. Raw carriage-return and...

PT-2026-122771

Security vulnerability affects the kafka package. A client may issue specially crafted HTTP/1...

Unity Linux 20.1070e Security Update: tomcat (UTSA-2026-130386)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130386 advisory. Uncontrolled Resource Consumption vulnerability in Apache Tomcatvia an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apach...