RockyLinux 9 : libsoup (RLSA-2026:68234)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:68234 advisory. SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service CVE-2026-15709 libsoup:...

GHSA-9PJ6-VHGR-3MWH RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service

Summary An unauthenticated remote attacker can leak one entry per HTTP request out of the in-memory session table of LocalSessionManager by sending a well-formed JSON-RPC POST that is not an InitializeRequest. The Streamable HTTP server's handlepost allocates the session before it validates the...

RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service

Summary An unauthenticated remote attacker can leak one entry per HTTP request out of the in-memory session table of LocalSessionManager by sending a well-formed JSON-RPC POST that is not an InitializeRequest. The Streamable HTTP server's handlepost allocates the session before it validates the...

CVE-2026-46352

A flaw was found in Suricata. Suricata's IP defragmentation code could deadlock when processing fragmented network traffic that contains an encapsulated tunnel protocol whose payload is also fragmented. This could allow a remote attacker to cause a Denial of Service DoS by making the system...

Moderate: Red Hat Security Advisory: libsoup security update

An update for libsoup is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Moderate: Red Hat Security Advisory: libsoup security update

An update for libsoup is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

PT-2026-93260

A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0. Affected is the function MoRIIOConnectorScheduler.request finished/MoRIIOConnectorWorker.get finished/MoRIIOWrapper. handle release message of the file vllm/distributed/kv transfer/kv connector/v1/moriio/moriio connector.py of the...

ALSA-2026:68266 Moderate: libsoup security update

The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control frame protocol violation CVE-2026-15711 For more details about the security issues, including the impact, a...

The vulnerability of the CMP module in the OpenSSL library, which allows a hacker to trigger a service failure

The vulnerability of the CMP module in the OpenSSL library is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

PT-2026-93837

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.24.0 Description An issue exists in the audio handling path for the /v1/chat/completions endpoint where the input audio content is processed without a duration limit. Specifically, the AudioMediaIO.load bytes and...

Moderate: libsoup security update

The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control frame protocol violation CVE-2026-15711 For more details about the security issues, including the impact, a...

PT-2026-93370

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.22.0 through 1.26.1 Description A use-after-free issue occurs when the software is compiled for DNS-over-QUIC DoQ support using the --with-libngtcp2 flag. In this configuration, each DoQ stream utilizes an output...

CVE-2026-20135: Double Free

A vulnerability in the TLS 1.3 implementation in Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. This vulnerability is due to improper buffer...

RHEL 10 : libsoup3 (RHSA-2026:68235)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68235 advisory. Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup,...

libp2p-quic: Remote panic via certificate expiry race during QUIC handshake

Summary libp2p-quic can panic on an inbound QUIC handshake if a malicious peer presents a valid, short lived libp2p TLS certificate and delays the final TLS 1.3 handshake fragment until the certificate expires. This is remotely reachable by a network peer and can crash applications exposing a...

EUVD-2026-78980

In Cellular Modem, there is a possible denial of service due to improper input validation. This could lead to remote proximal/adjacent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-78631

FreeRDP before 3.31.0 fails to validate client-supplied DesktopWidth and DesktopHeight values during GCC negotiation, allowing remote attackers to crash the server. Attackers can send crafted RDP packets with zero or oversized dimensions to trigger division-by-zero or assertion failures in...

CVE-2026-90439

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with OpenSSL versions = OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner th...

EUVD-2026-78268

A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/completions of the component Jinja Template Rendering. This manipulation of the argument chattemplate causes resource consumption. The attack can be initiated remotely. The exploit...

CVE-2026-12358: Uncontrolled Recursion

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...