DEBIAN-CVE-2026-114655

libmongocrypt builds requests to external key management services AWS, Azure and GCP by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with...

CVE-2026-114655

libmongocrypt builds requests to external key management services AWS, Azure and GCP by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with...

CVE-2026-114655 KMS request injection via unsanitized key vault and provider values in libmongocrypt

libmongocrypt builds requests to external key management services AWS, Azure and GCP by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with...

CVE-2026-114655

libmongocrypt is vulnerable to a request injection flaw when interacting with external key management services, including AWS , Azure , and GCP . The issue stems from the library inserting values from key vault documents, KMS provider configurations, and KMS responses into request lines, headers,...

CVE-2026-114655

libmongocrypt builds requests to external key management services AWS, Azure and GCP by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with...

EUVD-2026-108330

libmongocrypt builds requests to external key management services AWS, Azure and GCP by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with...

CVE-2026-114655 KMS request injection via unsanitized key vault and provider values in libmongocrypt

libmongocrypt builds requests to external key management services AWS, Azure and GCP by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with...

[SECURITY] [DSA 6575-1] nginx security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6575-1 [email protected] https://www.debian.org/security/ Jan Mojžíš October 21, 2026 https://www.debian.org/security/faq -...

Debian dsa-6575 : libnginx-mod-http-geoip - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6575 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6575-1 [email protected] https://www.debian.org/securit...

Rocky Linux 10.2 [CIQ] Security Update: freerdp / freerdp-debuginfo / freerdp-debugsource / freerdp-devel / etc Multiple Vulnerabilities (crlsa-2026_54486)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202654486 advisory. FreeRDP: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow CVE-2026-64620 FreeRDP: FreeRDP: Double-free vulnerability...

Rocky Linux 8 [CIQ] Security Update: freerdp / freerdp-debuginfo / freerdp-debugsource / freerdp-devel / etc Multiple Vulnerabilities (crlsa-2026_54485)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202654485 advisory. FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files CVE-2026-64624 FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message...

Rocky Linux 9 [CIQ] Security Update: freerdp / freerdp-debuginfo / freerdp-debugsource / freerdp-devel / etc Multiple Vulnerabilities (crlsa-2026_54487)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202654487 advisory. FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files CVE-2026-64624 FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message...

CVE-2026-77762

Apache Tomcat is vulnerable to a race condition caused by concurrent execution using a shared resource with improper synchronization. This flaw allows an attacker to inject trailer fields into another HTTP/2 request via a stale HPACK emitter injecting into a recycled pooled request. Affected vers...

EUVD-2026-83386

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls ...

CVE-2026-93562

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls ...

CVE-2026-11927

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

EUVD-2026-78892

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

CVE-2024-58384 Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests...

PT-2026-98967

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and lo...

Security Bulletin: MongoDB Enterprised Advanced affected by: CRLF Injection (CVE-2026-41417)

Summary There are vulnerabilities in netty-codec-http-4.1.132.Final.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-41417. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-41417 DESCRIPTION: Netty allows request-line validation to be bypassed when a...