CVE-2026-62995

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...

CVE-2026-62995

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...

EUVD-2026-50450

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...

CVE-2026-62995 joserfc accepts JWT with padding, leading to JWT malleability

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...

CVE-2026-62995 joserfc accepts JWT with padding, leading to JWT malleability

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...

CVE-2026-62995

CVE-2026-62995 affects the Python library joserfc (versions ≤ 1.7.1). The issue: joserfc accepts JWTs with trailing padding (==), which is non-conforming to JOSE specs and enables JWT malleability when parsed by the library. Practical impact varies by deployment and could allow bypass of token re...

CVE-2026-18174

@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both...

CVE-2026-18174

@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both...

CVE-2026-64553

A flaw was found in the Linux kernel's packet sampling psample network module. This vulnerability, specifically within the PSAMPLEATTRDATA attribute handling, occurs because the nlaput function does not properly clear padding bytes. When the data length is not a multiple of four bytes,...

PT-2026-65869

Name of the Vulnerable Software and Affected Versions joserfc versions prior to 1.7.2 Description The library accepts JSON Web Tokens JWTs containing trailing padding ==, which does not conform to JSON Object Signing and Encryption JOSE specifications. This results in token malleability, where a...

Linux Distros Unpatched Vulnerability : CVE-2026-62995

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc...

Security Bulletin: Cargo in IBM Open SDK for Rust on AIX uses a vulnerable version of the openssl crate

Summary The cargo package manager in IBM Open SDK for Rust on AIX 1.92.0.2 and 1.94.0.0 ships a version of the openssl crate that contains multiple vulnerabilities. Vulnerability Details CVEID:CVE-2026-42327 DESCRIPTION: rust-openssl provides OpenSSL bindings for the Rust programming language. Fr...

SUSE CVE-2026-64553

In the Linux kernel, the following vulnerability has been resolved: net: psample: fix info leak in PSAMPLEATTRDATA psample open codes nlaput presumably to avoid wiping the data with 0s just to override it with packet data. This open coding is missing clearing the pad, however, each netlink attr i...

Linux Distros Unpatched Vulnerability : CVE-2026-64553

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: psample: fix info leak in PSAMPLEATTRDATA psample open codes nlaput presumably to avoid wiping the data with 0s just to override it with packet data. This...

AZL-94038 CVE-2026-64553 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: net: psample: fix info leak in PSAMPLEATTRDATA psample open codes nlaput presumably to avoid wiping the data with 0s just to override it with packet data. This open coding is missing clearing the pad, however, each netlink attr i...

CVE-2026-64553

In the Linux kernel, the following vulnerability has been resolved: net: psample: fix info leak in PSAMPLEATTRDATA psample open codes nlaput presumably to avoid wiping the data with 0s just to override it with packet data. This open coding is missing clearing the pad, however, each netlink attr i...

CVE-2026-64553 net: psample: fix info leak in PSAMPLE_ATTR_DATA

In the Linux kernel, the following vulnerability has been resolved: net: psample: fix info leak in PSAMPLEATTRDATA psample open codes nlaput presumably to avoid wiping the data with 0s just to override it with packet data. This open coding is missing clearing the pad, however, each netlink attr i...

CVE-2026-64553 net: psample: fix info leak in PSAMPLE_ATTR_DATA

In the Linux kernel, the following vulnerability has been resolved: net: psample: fix info leak in PSAMPLEATTRDATA psample open codes nlaput presumably to avoid wiping the data with 0s just to override it with packet data. This open coding is missing clearing the pad, however, each netlink attr i...

CVE-2026-64553

The CVE-2026-64553 entry concerns the Linux kernel net/psample, specifically PSAMPLE_ATTR_DATA. The vulnerability was an information leak caused by open coding in nla_put() that failed to clear padding for netlink attributes, with data_len not necessarily multiple of 4B. The issue affects the psa...

PT-2026-65228

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An information leak exists in the psample module. The implementation uses open coding instead of the nla put function to avoid zeroing data before overriding it with packet data. However...