RLSA-2026:55439 Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication CVE-2026-1965 curl: curl:...

curl: curl: Man-in-the-middle attack via SSH host key bypass

A flaw was found in curl. When a libcurl-based application uses SCP:// or SFTP:// for transfers and employs the CURLOPTSSHKEYFUNCTION callback, it may silently accept an untrusted server. This occurs if the server's host key type differs from the one stored in the knownhosts file. The callback...

curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP

A flaw was found in curl. When a user invokes curl with a schemeless URL and specifies SFTP SSH File Transfer Protocol or SCP Secure Copy Protocol as the default protocol, the tool layer fails to initialize critical SSH security options. This bypasses host verification, allowing curl to connect t...

curl: curl: Man-in-the-middle attack via SSH host key bypass

A flaw was found in curl. When a libcurl-based application uses SCP:// or SFTP:// for transfers and employs the CURLOPTSSHKEYFUNCTION callback, it may silently accept an untrusted server. This occurs if the server's host key type differs from the one stored in the knownhosts file. The callback...

UBUNTU-CVE-2026-72014

In the Linux kernel, the following vulnerability has been resolved: drbd: reject data replies with an out-of-range payload size recvdlessread receives a PDATAREPLY from a peer into the bio of an outstanding read request. The peer-supplied payload length reaches it as the signed int datasize, and...

CVE-2026-72014 drbd: reject data replies with an out-of-range payload size

In the Linux kernel, the following vulnerability has been resolved: drbd: reject data replies with an out-of-range payload size recvdlessread receives a PDATAREPLY from a peer into the bio of an outstanding read request. The peer-supplied payload length reaches it as the signed int datasize, and...

GHSA-25MV-J2QR-V5JQ vulnerabilities

Vulnerabilities for packages: kitty, docker-cli-fips, redis-operator-fips, crossplane-provider-aws-kafkaconnect-fips, gitlab-pages-fips, crossplane-aws-provider, nuclei, fscrypt, dynamic-localpv-provisioner-fips, ocm-kubernetes-controller-fips, net-kourier, crossplane-provider-aws-swf-fips,...

PT-2026-72203

In the Linux kernel, the following vulnerability has been resolved: drbd: reject data replies with an out-of-range payload size recv dless read receives a P DATA REPLY from a peer into the bio of an outstanding read request. The peer-supplied payload length reaches it as the signed int data size,...

CVE-2026-49457

erlangquic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was not validated, and the hostname was not compared against the certificat...

CVE-2026-49457

CVE-2026-49457 affects erlang_quic prior to 1.4.4, where the QUIC client did not authenticate the server during TLS 1.3 handshakes. Specifically, CertificateVerify signature checks were missing, the certificate chain was not validated, and hostname verification was skipped, effectively making ver...

CVE-2026-49457

erlangquic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was not validated, and the hostname was not compared against the certificat...

SUSE CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

Improper Certificate Validation

Spring Boot is vulnerable to Improper Certificate Validation. The vulnerability is due to hostname verification being disabled in Mail auto-configuration, which allows an attacker capable of intercepting the SMTP connection to impersonate the intended mail server and potentially access or...

oslo.messaging: openstack: OpenStack oslo.messaging: Man-in-the-middle attack via improper TLS hostname verification

A flaw was found in OpenStack oslo.messaging. The RabbitMQ driver does not properly verify the hostname of the message broker when establishing a TLS Transport Layer Security connection. An attacker capable of intercepting control-plane network traffic can exploit this vulnerability to impersonat...

erlang: Erlang OTP public_key: Certificate validation bypass allows hostname spoofing

A flaw was found in Erlang OTP publickey. This improper certificate validation vulnerability allows a subordinate Certificate Authority CA with restricted DNS nameConstraints to bypass these restrictions. By issuing a leaf certificate that lacks a Subject Alternative Name SAN but contains a craft...

CVE-2026-55402

CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an ‘in the middle’ position can send specially crafted data to a server causing a persistent denial of service...

CVE-2026-55402

An out-of-bounds read vulnerability in Secure Access servers prior to version 14.57 could allow a man-in-the-middle attacker to send specially crafted data to trigger a persistent denial of service. The connected documents do not specify the exact vulnerable component, underlying root cause detai...

CVE-2026-70454

rsync 3.2.0 through 3.2.3 openssl mode and rsync-ssl through 3.4.4 stunnel mode contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to valida...

com.ongres.scram/scram-client: com.ongres.scram/scram-common: SCRAM Libraries: Authentication downgrade via TLS man-in-the-middle attack

A flaw was found in the SCRAM Salted Challenge Response Authentication Mechanism client and common libraries. An attacker performing a man-in-the-middle MITM attack on a Transport Layer Security TLS connection can silently downgrade the authentication process. This vulnerability allows the attack...

org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade

A flaw was found in pgjdbc, an open-source PostgreSQL JDBC Driver. A remote attacker who can intercept a TLS Transport Layer Security connection can silently downgrade connections configured to require channel binding from SCRAM-SHA-256-PLUS to plain SCRAM-SHA-256. This downgrade bypasses the...