PT-2025-26161

Name of the Vulnerable Software and Affected Versions llama index versions prior to 0.12.42 llama index.core versions prior to 0.12.42 Description The SimpleDirectoryReader component in llama index.core is subject to uncontrolled memory consumption due to a flaw in resource management. The num...

CVE-2025-45526

A denial of service DoS vulnerability has been identified in the JavaScript library microlight version 0.0.7. This library, used for syntax highlighting, does not limit the size of textual content it processes in HTML elements with the microlight class. When excessively large content e.g., 100...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.0 security and extras update

Red Hat OpenShift Container Platform release 4.19.0 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a security impact of...

CVE-2025-48976

A denial-of-service DoS vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number...

CVE-2025-48988

A denial-of-service DoS vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger...

CVE-2025-3526

SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA through update 25, and older unsupported versions does not restrict the saving of request parameters in the HTTP session, which allows remote attackers to consume system memory leading to...

Astra Linux – Vulnerability in libsoup3, libsoup2.4

A flaw was discovered in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range multiple times in a single HTTP request, causing the server to use large amounts of memory. This does not resul...

TencentOS Server 4: osbuild-composer (TSSA-2025:0333)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0333 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

Summary Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images Vulnerability Details CVEID:CVE-2024-12133 DESCRIPTION: A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate,...

Fedora 42 : python3.12 (2025-41dc96c19a)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-41dc96c19a advisory. Update to 3.12.11. - gh-135034: CVE 2024-12718 CVE 2025-4138 CVE 2025-4330 CVE 2025-4435 CVE 2025-4517 Fixes multiple issues that allowed tarfile extraction...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.42 bug fix and security update

Red Hat OpenShift Container Platform release 4.16.42 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

Fedora 41 : python3.10 (2025-76b69d1931)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-76b69d1931 advisory. Update to 3.10.18. Security content in this release - gh-135034: CVE 2024-12718 CVE 2025-4138 CVE 2025-4330 CVE 2025-4435 CVE 2025-4517 Fixes multiple issues...

Fedora 42 : python3.10 (2025-f41fafb942)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-f41fafb942 advisory. Update to 3.10.18. Security content in this release - gh-135034: CVE 2024-12718 CVE 2025-4138 CVE 2025-4330 CVE 2025-4435 CVE 2025-4517 Fixes multiple issues...

Debian dsa-5940 : libapache2-mod-security2 - security update

The remote Debian 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5940 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5940-1 [email protected] https://www.debian.org/securit...

CVE-2025-47950

CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service DoS vulnerability exists in the CoreDNS DNS-over-QUIC DoQ server implementation. The server previously created a new goroutine for every incoming QUIC stream without imposing any limits on the number of...

CVE-2025-47950 CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification

CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service DoS vulnerability exists in the CoreDNS DNS-over-QUIC DoQ server implementation. The server previously created a new goroutine for every incoming QUIC stream without imposing any limits on the number of...

CVE-2025-47950

CVE-2025-47950 affects CoreDNS DoQ, where the DoS occurred because the DoQ server spawned a new goroutine per incoming QUIC stream with no concurrency cap. The fixed patch (v1.12.2) adds explicit limits: max_streams per connection defaults to 256 and a server-wide bounded worker pool (worker_pool...

PT-2025-24315

Name of the Vulnerable Software and Affected Versions CoreDNS versions prior to 1.12.2 CoreDNS versions prior to 1.21.2 Description A Denial of Service DoS issue exists in the CoreDNS DNS-over-QUIC DoQ server implementation. The server previously created a new goroutine for every incoming QUIC...

[slackware-security] python3

New python3 packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/python3-3.9.23-i586-1slack15.0.txz: Upgraded. This update fixes security issues: gh-135034: CVE-2024-12718 CVE-2025-4138 CVE-2025-433...

Security update for libsoup2

This update for libsoup2 fixes the following issues: CVE-2025-2784: Fixed heap buffer over-read in skipinsignificantspace when sniffing conten bsc1240750 CVE-2025-32050: Fixed integer overflow in appendparamquoted bsc1240752 CVE-2025-32052: Fixed heap buffer overflow in sniffunknown bsc1240756...