net-imap: Net::IMAP: Command injection via non-synchronizing literals

A flaw was found in Net::IMAP, a Ruby library that provides Internet Message Access Protocol IMAP client functionality. This vulnerability allows a remote attacker to inject arbitrary IMAP commands. This is possible when an IMAP server does not support non-synchronizing literals, leading to the...

net-imap: rubygem-net-imap: Net::IMAP: Denial of Service via malformed command input

A flaw was found in Net::IMAP, a Ruby client library for the Internet Message Access Protocol IMAP. This vulnerability allows a remote attacker to cause a denial of service by sending specially crafted input to certain Net::IMAP commands. When a raw string argument, derived from user-controlled...

Important: Red Hat Security Advisory: ruby:3.3 security, bug fix, and enhancement update

An update for the ruby:3.3 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication

A flaw was found in Net::IMAP, a Ruby library for Internet Message Access Protocol IMAP client functionality. A hostile server can exploit this vulnerability during SCRAM-SHA1 or SCRAM-SHA256 Salted Challenge Response Authentication Mechanism - Secure Hash Algorithm 1 or 256 authentication by...

net-imap: Net::IMAP: Arbitrary IMAP command injection due to improper input validation

A flaw was found in Net::IMAP, a Ruby library that implements Internet Message Access Protocol IMAP client functionality. This vulnerability arises from improper input validation when handling ID field values and arguments to the enable command. A remote attacker could exploit this by injecting...

CVE-2026-64580

In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdevput in xfrm6filldst On the error path where in6devgetdev returns NULL, xfrm6filldst releases the device reference with netdevput but leaves xdst-u.dst.dev set. dstdestroy later...

CVE-2026-64580 xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()

In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdevput in xfrm6filldst On the error path where in6devgetdev returns NULL, xfrm6filldst releases the device reference with netdevput but leaves xdst-u.dst.dev set. dstdestroy later...

Important: ruby:4.0 security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fixes: zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command...

Oracle Linux 9 : kernel (ELSA-2026-49212)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-49212 advisory. - net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle CKI Backport Bot RHEL-213299 CVE-2026-64530 - ipc: limit nextid allocation to the valid I...

Oracle Linux 10 : kernel (ELSA-2026-49211)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-49211 advisory. - net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle CKI Backport Bot RHEL-214082 CVE-2026-64530 - ksm: use range-walk function to jump over...

ALSA-2026:50828 Important: ruby:3.3 security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fixes: zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command...

SUSE SLES15 Security Update : aws-iam-authenticator (SUSE-SU-2026:3473-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3473-1 advisory. This update for aws-iam-authenticator fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only...

SUSE SLES12 Security Update : google-cloud-sap-agent (SUSE-SU-2026:3471-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3471-1 advisory. This update for google-cloud-sap-agent fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only...

Linux Distros Unpatched Vulnerability : CVE-2026-64580

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfrm6: clear dst.dev on error to avoid double netdevput in xfrm6filldst On the error path where in6devgetdev returns NULL, xfrm6filldst releases the device...

Important: ruby:3.3 security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fixes: zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...