1102 matches found
RHLW-2026-E6D7B954CD8149D6 Lightwell Security Advisory: httpclient 4.5.12.rhlw-00001
Red Hat Lightwell has released org.apache.httpcomponents:httpclient 4.5.12.rhlw-00001 with a backported security fix. CVE-2020-13956: Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI...
CLEANSTART-2026-XL17660 HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header va...
Security vulnerability affects the apache-nifi package. HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message...
PT-2026-117911
Security vulnerability affects the apache-nifi package. HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message...
RHLW-2026-7B188D550BF6BFC3 Lightwell Security Advisory: httpclient 4.5.6.rhlw-00001
Red Hat Lightwell has released org.apache.httpcomponents:httpclient 4.5.6.rhlw-00001 with a backported security fix. CVE-2020-13956: Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI...
CLEANSTART-2026-FO83563 HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header va...
Security vulnerability affects the wso2am package. HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message...
CLEANSTART-2026-LH05062 HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header va...
Security vulnerability affects the sonarqube package. HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message...
Security Bulletin: IBM Maximo Manage application in IBM Maximo Application Suite uses httpclient5-5.6.3.jar and is vulnerable to CVE-2026-71290
Summary IBM Maximo Manage application in IBM Maximo Application Suite uses httpclient5-5.6.3.jar and is vulnerable to CVE-2026-71290. This bulletin contains information regarding how to address these vulnerabilities. Vulnerability Details CVEID:CVE-2026-71290 DESCRIPTION: Improper TLS hostname...
CLEANSTART-2026-EK15836 HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header va...
Security vulnerability affects the apache-nifi package. HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message...
Rocky Linux 8 [CIQ] Security Update: aopalliance / apache-commons-cli / apache-commons-codec / etc (crlsa-2022_1861)
The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20221861 advisory. apache-httpclient: incorrect handling of malformed authority component in request URIs CVE-2020-13956 Tenable has extracted the preceding description block directly...
Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-5.0 / aspnetcore-targeting-pack-5.0 / etc Multiple Vulnerabilities (crlsa-2022_2200)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20222200 advisory. dotnet: excess memory allocation via HttpClient causes DoS CVE-2022-23267 dotnet: malicious content causes high CPU and memory usage CVE-2022-29117 dotnet:...
Rocky Linux 8 [CIQ] Security Update: aopalliance / apache-commons-cli / apache-commons-codec / etc (crlsa-2022_1860)
The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20221860 advisory. apache-httpclient: incorrect handling of malformed authority component in request URIs CVE-2020-13956 Tenable has extracted the preceding description block directly...
Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-3.1 / aspnetcore-targeting-pack-3.1 / etc Multiple Vulnerabilities (crlsa-2022_2202)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20222202 advisory. dotnet: excess memory allocation via HttpClient causes DoS CVE-2022-23267 dotnet: malicious content causes high CPU and memory usage CVE-2022-29117 dotnet:...
CLEANSTART-2026-SO94492 HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header va...
CVE-2026-64607 affects multiple packages. HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. See references for individual...
Security Bulletin: Multiple Security Vulnerabilities in Apache HttpComponents Client affect IBM Content Navigator
Summary Apache HttpComponents Client is affected by two vulnerabilities CVSS up to 9.1, Critical. CVE-2026-71290 CVSS 9.1 is an improper TLS hostname verification flaw in the async HttpClient versions 5.4 and later where HostnameVerificationPolicyBUILTIN has no effect, allowing a network attacker...
Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities
Summary Multiple vulnerabilities are found in dependent open source libraries used in IBM Quantum Safe Explorer code base. IBM Quantum Safe Explorer has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-64607 DESCRIPTION:...
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
Summary The Feed Reader front-end module passes RSS feed URLs from its configuration directly to $this-feedIo-read$url without any scheme validation or private-IP blocklist. A backend user with module-edit permissions can configure an arbitrary URL pointing to internal network services,...
How to Configure HTTP Proxy for Veeam Service Provider Console 9.3+
Purpose This article explains how to configure an HTTP proxy for Veeam Service Provider Console 9.3 and later, which introduced a dedicated proxy configuration mechanism that is disabled by default and does not use the WinHTTP, Internet Options, or environment variable proxy settings described in...
Vulnerabilities found in Oracle Communications
Oracle has identified 31 vulnerabilities in various Oracle Communications products, including Oracle Communications Unified Assurance, Oracle Communications Cloud Native Core Security Edge Protection Proxy, Oracle Communications MetaSolv Solution Module – ASR, Oracle Communications Service Catalo...
Improper Certificate Validation
Apache HttpComponents Client is vulnerable to Improper Certificate Validation. The vulnerability is due to the HostnameVerificationPolicyBUILTIN setting being ineffective in the asynchronous HttpClient, which allows an attacker capable of intercepting and modifying traffic to impersonate the...