CVE-2026-105452: Exposure of Sensitive Information to an Unauthorized Actor

Docker Sandboxes could forward a client-supplied credential alongside a credential injected by the host egress proxy. The proxy removed alternate credentials only when their values matched known sentinel values, so untrusted code in an authorized sandbox could supply an unrecognized credential in...

CVE-2026-101998: Not Failing Securely

Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-body read returned data together with an error, affected handlers could forward unmasked bytes. Code inside an authorized sandbox could use this to recover host-managed OAuth access and refres...

PT-2026-108132

Name of the Vulnerable Software and Affected Versions Docker Sandboxes affected versions not specified Description The egress proxy in Docker Sandboxes may forward client-supplied credentials along with credentials injected by the host. This occurs because the proxy only removes alternate...

PT-2026-108105

Name of the Vulnerable Software and Affected Versions Malcolm affected versions not specified Description The front nginx reverse proxy uses a case-insensitive regex matcher for the Dashboards to Arkime shortcut location, but employs a case-sensitive rewrite. If a request path is not in exact...

CVE-2026-78660: Inconsistent Interpretation of HTTP Requests

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

Linux Distros Unpatched Vulnerability : CVE-2026-107232

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and...

Zabbix Server 7.0.x < 7.0.29 / 7.4.x < 7.4.13 Authentication Bypass (ZBX-28196)

The version of Zabbix Server installed on the remote host is 7.0.x prior to 7.0.29, or 7.4.x prior to 7.4.13. It is, therefore, affected by an authentication bypass vulnerability: - Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate...

PT-2026-108216

Name of the Vulnerable Software and Affected Versions Mechanize versions prior to 2.14.1 Description Mechanize leaks caller-supplied credential headers to a different host during an HTTP redirect. This occurs because Mechanizerequest headers= is reapplied by Mechanize::HTTP::Agentrequest add...

PT-2026-108131

Name of the Vulnerable Software and Affected Versions Docker Sandboxes affected versions not specified Description Docker Sandboxes may fail open when masking credentials in protected proxy responses. This occurs when a response-body read returns data simultaneously with an error, causing affecte...

PT-2026-107784

Name of the Vulnerable Software and Affected Versions Brocade Fabric OS versions prior to 10.0.1 Description An information disclosure issue exists in the SupportLink diagnostic collection utilities. When SupportLink is configured to use an authenticated HTTP proxy, the system stores the full pro...

PT-2026-108102

Name of the Vulnerable Software and Affected Versions Malcolm affected versions not specified Description An inconsistency in URL path normalization exists between the Lua-based role-based access control RBAC authorization layer and the nginx request routing logic in the reverse proxy. An...

CVE-2026-107336: Authentication Bypass by Spoofing

Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase for example /IDDASH2ARK/... enters the location the matcher fires but evades the rewrite n...

PT-2026-109277

Name of the Vulnerable Software and Affected Versions OWASP Coraza WAF versions 3.0.0 through 3.7.0 Description An issue exists in the ProcessURI function within internal/corazawaf/transaction.go where the library fails to properly handle URIs containing raw control bytes such as x00, , r, or t...

CVE-2026-107285

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy...

DEBIAN-CVE-2026-107285

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy...

CVE-2026-107232

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a pro...

DEBIAN-CVE-2026-107232

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a pro...

UBUNTU-CVE-2026-107285

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy...

CVE-2026-107232

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a pro...

CVE-2026-107285

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy...