SUSE-SU-2026:24219-1 Security update for python-PyJWT

This update for python-PyJWT fixes the following issues: - CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint bsc1283060. - CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response bsc1283061. -...

SUSE-SU-2026:24126-1 Security update for python-PyJWT

This update for python-PyJWT fixes the following issues: - CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint bsc1283060. - CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response bsc1283061. -...

httpd bug fix and enhancement update

An update is available for httpd. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The httpd packages provide the Apache HTTP Server, a powerful, efficient, and...

RLSA-2026:79177 Important: mod_auth_openidc security update

The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fixes: modauthopenidc: modauthopenidc: Denial of Service via malformed state cookie parsi...

mod_auth_openidc security update

An update is available for modauthopenidc. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The modauthopenidc is an OpenID Connect authentication module for Apac...

CVE-2026-107938

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

BIT-THRIFT-2026-86537 Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service

Uncaught exception, Loop with unreachable exit condition 'infinite loop', Integer underflow wrap or wraparound vulnerability in Apache Thrift D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-107938 Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

CVE-2026-107938

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

org.apache.cxf:apache-cxf (>=4.2.0, <=4.2.3), org.apache.cxf:cxf-distribution-manifest (>=4.2.0, <=4.2.3) potentially affected by CVE-2026-107938 via org.apache.cxf:cxf-rt-transports-http-netty-client (>=4.2.0, <=4.2.3)

org.apache.cxf:cxf-rt-transports-http-netty-client MAVEN version =4.2.0, =4.2.0, =4.2.0, =4.2.3 Source cves: CVE-2026-107938 Source advisory: MEND:CVE-2026-107938...

EUVD-2026-95703

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

CVE-2026-107938

The Apache CXF Netty-based HTTP client transport (cxf-rt-transports-http-netty-client ) fails to verify that the hostname in a server's TLS certificate matches the host being called. This flaw impacts both HTTP/1.1 and HTTP/2 protocols, even when the disableCNCheck parameter is set to its default...

kr.jclab.wsman:abstract-wsman (>=0.0.1-rc2, <=0.0.1-rc4), kr.jclab.wsman:abstract-wsman-netty (>=0.0.2-rc1, <=0.0.4) +3 more potentially affected by CVE-2026-107938 via org.apache.cxf:cxf-rt-transports-http-netty-client (>=4.0.0, <=4.1.8)

org.apache.cxf:cxf-rt-transports-http-netty-client MAVEN version =4.0.0, =0.0.1-rc2, =0.0.2-rc1, =4.0.2, =4.0.0, =4.0.0, =4.1.8 Source cves: CVE-2026-107938 Source advisory: MEND:CVE-2026-107938...

CVE-2026-107938 Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

CVE-2026-107938 Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

org.apache.cxf.systests:cxf-systests-transport-netty (>=3.5.7, <=3.6.3), org.apache.cxf:apache-cxf (>=3.0.0, <=3.6.12) +1 more potentially affected by CVE-2026-107938 via org.apache.cxf:cxf-rt-transports-http-netty-client (>=3.0.0, <=3.6.12)

org.apache.cxf:cxf-rt-transports-http-netty-client MAVEN version =3.0.0, =3.5.7, =3.0.0, =3.0.0, =3.6.12 Source cves: CVE-2026-107938 Source advisory: MEND:CVE-2026-107938...

SUSE-SU-2026:4602-1 Security update for php8

This update for php8 fixes the following issues: - CVE-2025-1218: php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser bsc1282981. - CVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsing bsc1283216. - CVE-2026-6103: Archive entry injection via...

CVE-2026-56154

A use-after-free flaw was found in the modrewrite module of Apache HTTP Server when evaluating URL lookahead expressions that reference HTTP request headers, such as %LA-U:HTTP:.... A remote attacker may be able to trigger invalid memory access in a server using an affected rewrite configuration,...

CLSA-2026-1791531340 Fix of 10 CVEs

SECURITY UPDATE: credentials leaked to another origin on HTTP redirects - debian/patches/CVE-2026-91766.patch: strip the Authorization, Cookie and Proxy-Authorization user headers when a redirect changes the scheme, host or port, and remove whole header lines in ext/standard/httpfopenwrapper.c -...

CVE-2026-57941

A flaw was found in the modhttp2 module of Apache HTTP Server. A remote, unauthenticated attacker could exploit a use-after-free condition—where memory is accessed after being released—through re-entrant processing of shared session buffers. This flaw can allow an attacker to potentially execute...