SUSE-SU-2026:4180-1 Security update for clamav

This update for clamav fixes the following issues: - CVE-2026-20337: Improper boundary checks for content in zip archive parser bsc1274597. - CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records bsc1274598. - CVE-2026-20339: integer overflow in the PESpin...

Astra Linux – Vulnerability in http-parser

Node.js versions before 10.23.1, 12.20.1, 14.15.4, and 15.5.1 allow for two copies of a header field in an HTTP request for example, two Transfer-Encoding header fields. In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling...

CVE-2026-68006

An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/pumahttp11/http11parser.rl file...

CVE-2026-68006

An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/pumahttp11/http11parser.rl file...

CVE-2026-56657 Gitea SSH Key Parser Denial of Service

Gitea SSH Key Parser Denial of Service...

CVE-2026-10534

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer overflow in the IXF IMPORT parser...

EUVD-2026-54557

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling for headers such as Accept uses a regular expression vulnerable to quadratic backtracking, so a maliciously...

Important: Red Hat Security Advisory: python3.12 security update

An update for python3.12 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

SUSE CVE-2026-69243

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability...

RHEL 9 : python3.12 (RHSA-2026:50771)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:50771 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

RHEL 9 : python3.12 (RHSA-2026:50770)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:50770 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

Important: python

Issue Overview: CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. CVE-2026-15308 When...

Important: python3.13

Issue Overview: The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. CVE-2026-15308 In the Tarfile.extract function, the filter parameter is not passed properly when extracting...

Amazon Linux 2 : python3, --advisory ALAS2-2026-3852 (ALAS-2026-3852)

The version of python3 installed on the remote host is prior to 3.7.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3852 advisory. CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 The incremental HTML parser...

DEBIAN-CVE-2026-69243

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability...

CVE-2026-52857

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is...

CVE-2026-52857 Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is...

PT-2026-65824

veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/verapdf/pd/font/type1/Type1FontProgram.java and veraPDF-parser/src/main/java/org/verapdf/parser/postscript/PSOperator.java,...

Amazon Linux 2 : clamav1.4, --advisory ALAS2-2026-3820 (ALAS-2026-3820)

The version of clamav1.4 installed on the remote host is prior to 1.4.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3820 advisory. A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS...

CVE-2026-46671

Rust OneNote File Parser is a parser for Microsoft OneNote files implemented in Rust. Prior to version 1.1.1, a maliciously crafted .onetoc2 table-of-contents file can cause Parser::parsenotebook to open arbitrary files on the host filesystem outside the notebook's directory. The parser reads ent...