Consul vulnerable to a denial of service in the native RPC listener

Summary Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory before ACL authorization is evaluated. A client that can complete the internal RPC mTLS handshake may exploit this issue without...

CVE-2026-85597

A flaw was found in Traefik. This vulnerability allows unauthenticated attackers to bypass client-certificate authentication. By creating conflicting Transport Layer Security TLS options on multi-host routers, attackers can exploit shared TLS resolution across multiple hostnames in a single route...

CVE-2026-88883

Renovate is an automated dependency update tool. In versions before 44.14.4 and Mend Renovate CE/EE images before 15.4.0 and the mend-renovate-enterprise-edition Helm chart before 10.4.0, log sanitisation for TLS private keys used for Mutual TLS was incomplete. While the value of...

CVE-2026-88883

A flaw was found in Renovate, an automated dependency update tool. Due to incomplete log sanitization, Transport Layer Security TLS private keys used for Mutual TLS could be written to logs in cleartext. This occurs when these keys are configured in a specific way without utilizing the documented...

PT-2026-89567

Name of the Vulnerable Software and Affected Versions Consul versions prior to 2.0.4 Consul Enterprise versions prior to 1.21.18 Consul Enterprise versions prior to 1.22.12 Consul Enterprise versions prior to 2.0.4 Description A denial of service exists in the native RPC listener. An authenticate...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: curl (UTSA-2026-106769)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106769 advisory. libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps...

GHSA-C4C3-7FPV-J4Q5 Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext

Summary A fragmented TLS ClientHello whose handshake header spans multiple records makes Netty silently fall back to the default SslContext; where per-SNI selection is the sole mTLS gate, an unauthenticated attacker can bypass the route's mTLS requirement. Details In...

Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext

Summary A fragmented TLS ClientHello whose handshake header spans multiple records makes Netty silently fall back to the default SslContext; where per-SNI selection is the sole mTLS gate, an unauthenticated attacker can bypass the route's mTLS requirement. Details In...

nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw

A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity,...

rewerse-engineering v1.4.0

rewerse engineering An unofficial REWE API client in Go and Python. It implements the publicly accessible unauthenticated endpoints the REWE app uses for querying current discounts Angebote, products, markets and recalls. Current supported APK version: 5.18.1 as of 29.09.26 !CAUTION The...

SUSE CVE-2026-85597

Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiti...

CVE-2026-19283

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, caused by missing destination namespace validation when copying etcd mTLS client credentials from the openshift-etcd system...

CVE-2026-19283 IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, caused by missing destination namespace validation when copying etcd mTLS client credentials from the openshift-etcd system...

CVE-2026-19283

IBM Instana Agent Operator (part of IBM Observability with Instana, builds 1.0.303 through 1.0.323) is vulnerable to information disclosure caused by missing destination namespace validation when copying etcd mTLS client credentials from the openshift-etcd system namespace into an attacker-contro...

CVE-2026-19283 IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, caused by missing destination namespace validation when copying etcd mTLS client credentials from the openshift-etcd system...

EUVD-2026-71272

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, caused by missing destination namespace validation when copying etcd mTLS client credentials from the openshift-etcd system...

CVE-2026-85597

Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiti...

CVE-2026-85597 Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict

Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiti...

CVE-2026-85597 Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict

Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiti...

EUVD-2026-71020

Traefik before v2.11.55 contains a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiting shared TLS resolution...