SUSE-SU-2026:4217-1 Security update for openvpn

This update for openvpn fixes the following issues: - CVE-2026-63650: OpenVPN 2.7alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field bsc1275310. - CVE-2026-84732: Remote Denial of Service via...

CVE-2026-47845 Reactor Netty HTTP Server may incorrectly evaluate proxy addresses

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52...

CVE-2026-47845

Reactor Netty HTTP Server may incorrectly evaluate the remote IP address in specific scenarios when the HAProxy Protocol is enabled, allowing a client to spoof the reported source address. Affected versions are 1.3.0–1.3.6 , 1.1.0–1.2.18 , and 1.0.52 and earlier . The vulnerability is rated CVSS ...

UBUNTU-CVE-2026-74632

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: fix hugezeropfn race Patch series "mm/hugememory: fix hugezeropfn race", v2. There is a subtle race in the reference-counted hugezerofolio implementation. The fast path atomic logic fails to account for the fact th...

CVE-2026-74632

CVE-2026-74632 is a race condition in the Linux kernel's mm/huge_memory subsystem affecting the reference-counted huge_zero_folio implementation. When a memory shrinker (shrink_huge_zero_folio_scan()) is preempted between zeroing huge_zero_refcount and writing the ~0UL sentinel to huge_zero_pfn, ...

PT-2026-79637

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the reference-counted huge zero folio implementation. A race can occur between a shrinker decrementing the reference count to zero in the shrink huge zero foli...

CVE-2026-63650

A flaw was found in OpenVPN when using mbedTLS. A remote authenticated user could be misidentified due to the software ignoring the configured X.509 username identity lookup field. This could lead to incorrect user authentication and potential security bypasses...

SUSE CVE-2026-63650

OpenVPN 2.7alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field...

UBUNTU-CVE-2026-63650

OpenVPN 2.7alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field...

DEBIAN-CVE-2026-63650

OpenVPN 2.7alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field...

CVE-2026-63650

OpenVPN 2.7alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field...

CVE-2026-63650

OpenVPN 2.7_alpha1 through 2.7.5 with mbedTLS is affected by a misidentification issue where remote authenticated users can be misidentified due to ignoring the configured X.509 username identity lookup field. The vulnerability affects OpenVPN components from the specified 2.7 alpha to 2.7.5 rang...

CVE-2026-63650

OpenVPN 2.7alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field...

CVE-2026-63650

OpenVPN 2.7alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field...

CVE-2026-16221

A flaw was found in fast-uri. This vulnerability arises because fast-uri does not correctly interpret backslash characters as authority delimiters in Uniform Resource Locators URLs, unlike Node.js's native WHATWG URL parser. This discrepancy can cause applications that use fast-uri for security...

On Flock License Plate Tracking Cameras

A recent story of a writer who was mistakenly identified, tracked, and arrested using data from Flock cameras has gone viral. The New Jersey plates that were allegedly stolen from the LA dealer were 34 03 DTM , not 34 10 DTM. But when the police report was created and the plate was entered into...

CVE-2026-52842

Lightpanda (headless browser) prior to version 0.3.1 incorrectly searched for the character @ across the entire URL when computing origin, rather than only the authority component. This caused a URL like http://attacker.com/@victim.com/ to be fetched from attacker.com but treated as http://victim...

Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access

Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access cancraft a specially designed SQL DML statementthat is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgr...

CVE-2026-5941

Parsing logic flaws cause non-signature data to be misidentified as valid signatures when processing malformed form field hierarchies, leading to invalid memory writes and program crashes during internal data structure construction...

Amazon Linux 2023 : python3.14-pip, python3.14-pip-wheel (ALAS2023-2026-1718)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1718 advisory. pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as...