Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Apache HttpComponents (CVE-2026-64607, CVE-2026-71290 )

Summary IBM Watson Speech Services Cartridge is vulnerable to Improper Certificate Validation and Missing Release of Resource in Apache HttpComponents, due to flaws in TLS hostname verification and HttpClient. Apache is used in our Speech microservices. These vulnerabilities have been addressed...

PT-2026-109215

improper handling of exceptional conditions, Missing release of resource after effective lifetime vulnerability in Apache Thrift java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

Missing Release of Resource after Effective Lifetime

Overview pydantic-ai-slim is an Agent Framework / shim to use Pydantic with LLMs, slim package Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via ConcurrencyLimitedModel when streaming model responses. A RuntimeError is raised and a...

CVE-2026-94651

improper handling of exceptional conditions, Missing release of resource after effective lifetime vulnerability in Apache Thrift java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94651

improper handling of exceptional conditions, Missing release of resource after effective lifetime vulnerability in Apache Thrift java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-91404

improper handling of exceptional conditions, Missing release of resource after effective lifetime vulnerability in Apache Thrift java bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-104208

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Apache Thrift java bindings contain an issue involving the improper handling of exceptional conditions and the missing release of resources after their effective lifetime. Recommendations...

UBUNTU-CVE-2026-79677

Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through...

CVE-2026-79677

Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime in the rpcapd process. An attacker can exhaust system memory by sending specially crafted RPCAPMSGUPDATEFILTERREQ or RPCAPMSGSTARTCAPREQ messages, causing the service to become...

CVE-2026-59654: Missing Release of Resource after Effective Lifetime

Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service DoS scenari...

CVE-2026-56444: Missing Release of Resource after Effective Lifetime

In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout discard-timeout 0' contrary to the suggested values, the discard-timeout branch during the serve expired logic drops an aged client reply without...

CVE-2026-23219: Missing Release of Resource after Effective Lifetime

In the Linux kernel, the following vulnerability has been resolved: mm/slab: Add alloctaggingslabfreehook for memcgallocabortsingle When CONFIGMEMALLOCPROFILINGDEBUG is enabled, the following warning may be noticed: 3959.023862 ------------ cut here ------------ 3959.023891 alloctag was not clear...

Missing Release of Resource after Effective Lifetime

Overview org.hibernate.reactive:hibernate-reactive-core is a The core module of Hibernate Reactive Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime by leaving transactions open in the connection pool. An attacker can cause resource exhaustio...

Missing Release of Resource after Effective Lifetime

Overview nicegui is a Create web-based user interfaces with Python. The nice way. Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime in the handledisconnect function, when using the Redis backend for tab storage. An attacker can cause service...

CVE-2025-64734: Missing Release of Resource after Effective Lifetime

Missing Release of Resource after Effective Lifetime CWE-772 in the T21 Reader allows an attacker with physical access to the Reader to perform a denial-of-service attack against that specific reader, preventing cardholders from badging for entry. This issue affects Command Centre Server: 9.30...

EUVD-2022-52806

Malicious code in bioql PyPI...

CVE-2024-45802 Squid Denial of Service

Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to Input Validation, Premature Release of Resource During Expected Lifetime, and Missing Release of Resource after Effective Lifetime bugs, Squid is vulnerable to Denial of Service attacks by a trusted...

CVE-2024-45802

CVE-2024-45802 affects Squid; Debian security update DLA-4083-1 notes the fix disables ESI to mitigate a Denial of Service due to Input Validation, Premature Release of Resource During Expected Lifetime, and Missing Release of Resource after Effective Lifetime bugs. Other advisories (CloudLinux, ...

Apache Answer: The link to reset the user's password will remain valid after sending a new link

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. User sends multiple password reset emails, each containing a valid link. Within the link's validity period, this could potentially lead to the link being misused o...