Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak System

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-44486 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to ...

BIT-PHP-2026-91766 Cross-origin credential leak in HTTP stream wrapper redirects

When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore...

CentOS Linux 7 [TuxCare] Security Update: python-urllib3 (CENTOS7:CLSA-2024:1730142536)

The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1730142536 advisory. - urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with ProxyManager, the Proxy-Authorization header...

AlmaLinux 9.2 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.2:CLSA-2025:1755115606)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1755115606 advisory. - Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information...

Rocky Linux 8 [CIQ] Security Update: python3.12-urllib3 (crlsa-2024_8842)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20248842 advisory. urllib3: proxy-authorization request header is not stripped during cross-origin redirects CVE-2024-37891 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: python3-requests (crlsa-2023_4520)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20234520 advisory. python-requests: Unintended leak of Proxy-Authorization header CVE-2023-32681 Tenable has extracted the preceding description block directly from the CIQ security...

CentOS Linux 7 [TuxCare] Security Update: python3-pip (CENTOS7:CLSA-2024:1729512774)

The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1729512774 advisory. - urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with ProxyManager, the Proxy-Authorization header...

Rocky Linux 8 [CIQ] Security Update: Cython-debugsource / PyYAML-debugsource / babel / numpy-debugsource / etc (crlsa-2023_7042)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20237042 advisory. python-requests: Unintended leak of Proxy-Authorization header CVE-2023-32681 Tenable has extracted the preceding description block directly from the CIQ security...

AlmaLinux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785925031)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785925031 advisory. - When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear...

Rocky Linux 8 [CIQ] Security Update: python3-urllib3 (crlsa-2024_5309)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20245309 advisory. urllib3: proxy-authorization request header is not stripped during cross-origin redirects CVE-2024-37891 Tenable has extracted the preceding description block...

AlmaLinux 9.2 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1785925784)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1785925784 advisory. - When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear...

Rocky Linux 9 [CIQ] Security Update: python3.12-urllib3 (crlsa-2024_9457)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20249457 advisory. urllib3: proxy-authorization request header is not stripped during cross-origin redirects CVE-2024-37891 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: Cython-debugsource / PyYAML-debugsource / numpy-debugsource / etc Multiple Vulnerabilities (crlsa-2023_7034)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20237034 advisory. python: tarfile module directory traversal CVE-2007-4559 python-requests: Unintended leak of Proxy-Authorization header CVE-2023-32681 Tenable has extracte...

Rocky Linux 8 [CIQ] Security Update: python3.11-urllib3 (crlsa-2024_8843)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20248843 advisory. urllib3: proxy-authorization request header is not stripped during cross-origin redirects CVE-2024-37891 Tenable has extracted the preceding description block...

CentOS Linux 8 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1784123512)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1784123512 advisory. - Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the...

CLEANSTART-2026-QD51578 Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information

Security vulnerability affects the buildkitd package. Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information...

AlmaLinux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779357790)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779357790 advisory. - libcurl might in some circumstances reuse the wrong connection for SMBS transfers. libcurl features a pool of recent connections s...

AlmaLinux 9.2 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1776763201)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1776763201 advisory. - A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF Carriage Return Line Feed Injection, occurs...

Rocky Linux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779357790)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779357790 advisory. - libcurl might in some circumstances reuse the wrong connection for SMBS transfers. libcurl features a pool of recent connections...

CVE-2026-85719

A flaw was found in AsyncHttpClient. This vulnerability allows an attacker to expose SOCKS proxy credentials to the origin server when using an authenticated SOCKS proxy. This occurs because the library attaches Proxy-Authorization headers without verifying if the request is being sent to an HTTP...