Fixed in Apache Tomcat 9.0.123

Important: HTTP/2 request/response mix-up after error during async processing CVE-2026-101356 Incorrect object recycling and re-use affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This was fixed with commit 4b1eb9a1. This issue was...

Fixed in Apache Tomcat 11.0.27

Important: AJP response mix-up CVE-2026-103119 A buffer under-read meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly...

Important: php

Issue Overview: The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined...

Amazon Linux 2023 : perl-HTTP-Tiny, perl-HTTP-Tiny-tests (ALAS2023-2026-3194)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3194 advisory. HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, mayberedirect follows the Location: header and...

TencentOS Server 3: nodejs:24 (TSSA-2026:1137)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1137 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

EulerOS 2.0 SP13 : mod_http2 (EulerOS-SA-2026-4072)

According to the versions of the modhttp2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP requests...

Amazon Linux 2 : php (ALASPHP8.2-2026-014)

The version of php installed on the remote host is prior to 8.2.34-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.2-2026-014 advisory. The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough...

AlmaLinux 9.6 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791471297)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791471297 advisory. - NULL Pointer Dereference vulnerability in Apache HTTP Servers modheartmonitor over unicast listener. This issue affects Apache HTT...

Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2026-3161)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3161 advisory. The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a...

EulerOS 2.0 SP11 : httpd (EulerOS-SA-2026-4236)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server:...

TencentOS Server 3: nodejs:22 (TSSA-2026:1141)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1141 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

EulerOS 2.0 SP11 : perl-HTTP-Tiny (EulerOS-SA-2026-4360)

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx...

CVE-2026-85976: Improper Neutralization of CRLF Sequences in HTTP Headers

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently sanitize input used by the Query Console file-exploration endpoint, which could allow HTTP response splitting and unintended client-side response handling...

PT-2026-110586

LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetches xml-stylesheet href URLs without scheme or host allowlisting. Authenticated users can upload XML documents whose stylesheet href points to internal http,...

PT-2026-111122

Name of the Vulnerable Software and Affected Versions IBM i version 7.3 IBM i version 7.4 IBM i version 7.5 IBM i version 7.6 Description Improper data sanitization within the HTTP Server Administration web application allows a remote authenticated attacker to execute arbitrary code or obtain...

PT-2026-110885

A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header...

PT-2026-110954

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.4.1 Description The GenerateShortToken function creates standalone short-token records that lack a long Token value. However, the DeleteUserTokens function only invalidates cached entries when the long Token field ...

PT-2026-110862

Name of the Vulnerable Software and Affected Versions obsidian-tc versions prior to 1.3.1 Description The Streamable HTTP transport fails to validate the Host or Origin header and lacks DNS-rebinding protection. DNS-rebinding is a technique used to bypass the Same-Origin Policy, allowing a websit...

Important: php8.4

Issue Overview: The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined...

Medium: perl-HTTP-Tiny

Issue Overview: HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, mayberedirect follows the Location: header and prepareheadersandcb re-merges the caller's headers argument into the new request, without...