Sliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard Transports

Summary A Remote OOM Out-of-Memory vulnerability exists in the Sliver C2 server's mTLS and WireGuard C2 transport layer. The socketReadEnvelope and socketWGReadEnvelope functions trust an attacker-controlled 4-byte length prefix to allocate memory, with ServerMaxMessageSize allowing single...

The vulnerability of the phy_config_inband() function in the drivers/net/phy/phy.c file of the Linux physical layer network driver kernel module allows a hacker to cause a service failure.

The vulnerability of the phyconfiginband function in the drivers/net/phy/phy.c file of the Linux physical layer network driver is related to mutual locking. Exploiting this vulnerability could allow a attacker to cause a service failure...

PT-2026-26148

Name of the Vulnerable Software and Affected Versions Sliver versions 1.7.3 and below Description Sliver is a command and control framework that utilizes a custom Wireguard network stack. Versions 1.7.3 and below contain a Remote Out-of-Memory OOM issue in the mTLS and WireGuard C2 transport laye...

The vulnerability in the __driver_attach() function of the drivers/base/dd.c module of the Linux kernel’s device drivers allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the driverattach function in the drivers/base/dd.c file of the Linux kernel’s device driver framework is related to the occurrence of mutual locking. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

OpenSSL 安全漏洞

OpenSSL is an open-source encryption library developed by the OpenSSL team that enables secure implementation of Secure Sockets Layer SSLv2/v3 and Secure Transport Layer TLSv1 protocols. This product supports various encryption algorithms, including symmetric ciphers, hash algorithms, and secure...

The vulnerability of the pci_dev_lock() function in the drivers/pci/pci.c module of the Linux operating system’s device support driver allows a hacker to cause a service failure.

The vulnerability of the pcidevlock function in the drivers/pci/pci.c module of the Linux operating system’s device support driver for PCI devices is related to the occurrence of mutual locking. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the mem_dump_obj() function in the mm/util.c module of the Linux kernel’s memory management subsystem allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the memdumpobj function in the mm/util.c module of the Linux kernel’s memory management subsystem is related to the occurrence of mutual locking. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

The vulnerability of the opt3001_irq() function in the drivers/iio/light/opt3001.c file of the Linux kernel’s photodetection sensor driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the opt3001irq function in the drivers/iio/light/opt3001.c file of the Linux kernel’s photodetection sensor driver is related to the occurrence of mutual locking. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the usb_reset_device() function in the drivers/usb/core/hub.c file of the Linux kernel’s USB device driver allows a hacker to cause a service failure.

The vulnerability of the usbresetdevice function in the drivers/usb/core/hub.c file of the Linux kernel’s USB device driver module is related to the occurrence of mutual locking. Exploiting this vulnerability could allow a attacker to cause a service failure...

GO-2026-4539 Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2

Caddy mTLS authentication fails open in github.com/caddyserver/caddy/v2...

Linux Distros Unpatched Vulnerability : CVE-2026-27586

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in ClientAuthentication.provision cause mTLS clie...

The vulnerability of the raid_message() function in the drivers/md/dm-raid.c module of the Linux kernel support for multiple device types (RAID and LVM) allows a hacker to cause a service failure.

The vulnerability of the raidmessage function in the drivers/md/dm-raid.c module of the Linux support for multiple device types RAID and LVM is related to the occurrence of mutual locking. Exploiting this vulnerability can allow an attacker to cause a service failure...

GHSA-HFFM-G8V7-WRV7 Caddy: mTLS client authentication silently fails open when CA certificate file is missing or malformed

Summary Two swallowed errors in ClientAuthentication.provision cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts without error but accepts any client certificate signed by any system-trusted CA,...

Caddy: mTLS client authentication silently fails open when CA certificate file is missing or malformed

Summary Two swallowed errors in ClientAuthentication.provision cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts without error but accepts any client certificate signed by any system-trusted CA,...

Security Bulletin: Vulnerabilities in jersey-client-3.1.0.jar affecting MongoDB Enterprised Advanced (CVE-2025-12383)

Summary There is a vulnerability in jersey-client-3.1.0.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2025-12383. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2025-12383 DESCRIPTION: In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cau...

UBUNTU-CVE-2026-27586

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in ClientAuthentication.provision cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts...

CVE-2026-27586 Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in ClientAuthentication.provision cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts...

CVE-2026-27586

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in ClientAuthentication.provision cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts...

CVE-2026-27586

Summary (CVE-2026-27586): Caddy prior to 2.11.1 has two swallowed errors in ClientAuthentication.provision() that cause mTLS client authentication to silently fail open when the CA certificate file is missing, unreadable, or malformed. The server starts and accepts client certs signed by any syst...

Caddy 安全漏洞

Caddy is an open-source, cross-platform HTTP/Web server developed by the Caddy company. Versions of Caddy prior to 2.11.1 contained security vulnerabilities. These vulnerabilities were caused by two ignored errors in the ClientAuthentication.provision function, which led to a silent failure in mT...