SUSE CVE-2026-88011

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 until 3.7.12, a client-supplied dot-form header such as X.Authenticated.User survives ForwardAuth replacement and underscoreHeadersStrategy because Go treats it as distinct from X-Authenticated-User...

CVE-2026-91865

A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

CVE-2026-91865

A flaw in Apache Neethi allows a remote attacker to cause a denial of service (DoS) by providing a specially crafted WS-Policy document . The vulnerability is triggered when the document contains repeated policy references , forcing Neethi to re-expand these references exponentially during normal...

CVE-2026-91865 Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service

A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in fast-uri (CVE-2026-6322)

Summary An IPv6 parsing validation bypass vulnerability in the fast-uri library CVE-2026-6322 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 3.1.5. Vulnerability Details CVEID:CVE-2026-6322 DESCRIPTION: fast-uri normalize decoded percent-encod...

CVE-2026-73551: Use of Non-Canonical URL Paths for Authorization Decisions

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefor...

CVE-2026-91865: Allocation of Resources Without Limits or Throttling

A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory denial of service. Users are recommended to upgrade to version 3.2.4, which fixes this issue...

PT-2026-96082

Name of the Vulnerable Software and Affected Versions Neethi versions prior to 3.2.4 Description A small WS-Policy document using repeated policy references can force the software to re-expand the same references exponentially during normalization. This process consumes excessive CPU and memory,...

CVE-2026-87743

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

CVE-2026-87743

CVE-2026-87743 is an authorization bypass in Quarkus HTTP security (quarkus-vertx-http). The root cause is a path normalization discrepancy between the security matcher and HTTP request dispatchers: an unauthenticated attacker can craft a URL that the security matcher treats as public, but which ...

CVE-2026-87743 Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

EUVD-2026-82862

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

CVE-2026-87743 Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

CVE-2026-87743: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

CVE-2026-92598

A flaw was found in Nodemailer. This vulnerability arises from the failure to properly apply UTS-46 normalization when encoding international domain names. A remote attacker can exploit this by crafting recipient addresses with invisible characters or compatibility mappings. This allows them to...

CVE-2026-87743

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

EUVD-2026-81298

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

DEBIAN-CVE-2026-92598

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

CVE-2026-92598 Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

CVE-2026-92598

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...