RockyLinux 8 : libevent (RLSA-2026:67908)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67908 advisory. libevent: Libevent: Denial of Service via malformed RPC data CVE-2026-63383 libevent: Libevent: Off-by-one stack buffer overflow leading to denial of...

AlmaLinux 10 : libevent (ALSA-2026:67909)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67909 advisory. libevent: Libevent: Denial of Service via malformed RPC data CVE-2026-63383 libevent: Libevent: Off-by-one stack buffer overflow leading to denial of...

GO-2026-6468 Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization in github.com/traefik/traefik

Traefik: Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' and Incorrect Authorization in github.com/traefik/traefik...

Security Bulletin: Multiple Vulnerabilities in IBM DataStax Enterprise

Summary Multiple vulnerabilities were addressed in IBM DataStax Enterprise 6.9.24 Vulnerability Details CVEID:CVE-2016-4970 DESCRIPTION: handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service infinite loo...

MGASA-2026-0409 Updated python-h2 packages fix a security vulnerability

Duplicate Host header facilitate request smuggling. CVE-2026-71554...

Updated python-h2 packages fix a security vulnerability

Duplicate Host header facilitate request smuggling. CVE-2026-71554...

Security Bulletin: Vulnerabilities in Eclipse affect Tivoli Netcool/OMNIbus

Summary There are vulnerabilities in the Jetty libraries shipped in the MIB Manager application that is a component of Tivoli Netcool/OMNIbus. The Jetty libraries have been removed from the application. Vulnerability Details CVEID:CVE-2026-2332 DESCRIPTION: In Eclipse Jetty, the HTTP/1.1 parser i...

libevent: Libevent: HTTP header handling bugs create risk of access control bypass.

A flaw was found in libevent. The evhttpdecodeuriinternal function in http.c decodes percent-encoded %00 bytes into literal NUL characters without rejecting them, allowing an attacker to craft a URI such as /admin/secret%00.jpg where extension-based access checks see .jpg but the server processes...

libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling

A flaw was found in libevent. The evhttp parser in libevent's http.c component inconsistently handles HTTP Transfer-Encoding headers and chunked framing. This inconsistency allows an unauthenticated remote attacker to desynchronize request boundaries when libevent is used behind a proxy. Successf...

Important: Red Hat Security Advisory: libevent security update

An update for libevent is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling

A flaw was found in libevent. The evhttp parser in libevent's http.c component inconsistently handles HTTP Transfer-Encoding headers and chunked framing. This inconsistency allows an unauthenticated remote attacker to desynchronize request boundaries when libevent is used behind a proxy. Successf...

libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling

A flaw was found in libevent. The evhttp parser in libevent's http.c component inconsistently handles HTTP Transfer-Encoding headers and chunked framing. This inconsistency allows an unauthenticated remote attacker to desynchronize request boundaries when libevent is used behind a proxy. Successf...

libevent: Libevent: HTTP header handling bugs create risk of access control bypass.

A flaw was found in libevent. The evhttpdecodeuriinternal function in http.c decodes percent-encoded %00 bytes into literal NUL characters without rejecting them, allowing an attacker to craft a URI such as /admin/secret%00.jpg where extension-based access checks see .jpg but the server processes...

RHEL 8 : libevent (RHSA-2026:67908)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67908 advisory. The libevent packages provide an abstract asynchronous event notification library. Security Fixes: libevent: Libevent: Denial of Service vi...

RHEL 9 : libevent (RHSA-2026:67910)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67910 advisory. The libevent packages provide an abstract asynchronous event notification library. Security Fixes: libevent: Libevent: Denial of Service vi...

Linux Distros Unpatched Vulnerability : CVE-2023-54397

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content- Length headers accepting non-standard characters...

ALSA-2026:67908 Important: libevent security update

The libevent packages provide an abstract asynchronous event notification library. Security Fixes: libevent: Libevent: Denial of Service via malformed RPC data CVE-2026-63383 libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption CVE-2026-63387...

Linux Distros Unpatched Vulnerability : CVE-2024-14029

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a...

Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-11710)

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to lenient parsing in the chunk decoder process. An attacker can bypass intermediary controls, poison caches, or hijack the request queue by crafting specially formatted chunked requests that exploit differenc...