PT-2026-103931

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.68 Description Internal state files in the mod dav fs module are accessible to external parties. This allows a remote client to read WebDAV dead properties of resources they are not authorized to...

CVE-2026-58415: Files or Directories Accessible to External Parties

Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects...

PT-2026-103910

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...

PT-2026-105906

Description Sanic's HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating 0r chunk. Because of that, attacker-controlled bytes left in the connection buffer after the first chunked request can be interpreted as the start of a new HTTP request on the same...

PT-2026-105617

fzf vulnerable to denial of service through quadratic HTTP request-body accumulation in github.com/junegunn/fzf...

Rocky Linux 9 [CIQ] Security Update: gvisor-tap-vsock / gvisor-tap-vsock-debuginfo / etc (crlsa-2025_9150)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259150 advisory. net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-22871 Tenable has extracted the preceding description block directly from...

Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2022_7830)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20227830 advisory. nodejs: Improper handling of URI Subject Alternative Names CVE-2021-44531 nodejs: Certificate Verification Bypass via String Injection CVE-2021-44532 nodej...

Rocky Linux 8 [CIQ] Security Update: 389-ds-base / 389-ds-base-debuginfo / 389-ds-base-debugsource / etc Multiple Vulnerabilities (crlsa-2024_4235)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20244235 advisory. 389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request CVE-2024-3657 389-ds-base: Malformed userPassword may cause crash at...

Rocky Linux 9 [CIQ] Security Update: 389-ds-base / 389-ds-base-debuginfo / 389-ds-base-debugsource / etc Multiple Vulnerabilities (crlsa-2024_5192)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20245192 advisory. 389-ds-base: Malformed userPassword hash may cause Denial of Service CVE-2024-5953 389-ds-base: unauthenticated user can trigger a DoS by sending a specifi...

Rocky Linux 8 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (crlsa-2024_0539)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20240539 advisory. tomcat: HTTP request smuggling via malformed trailer headers CVE-2023-46589 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785497476)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785497476 advisory. - Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat via invalid chunk...

AlmaLinux 9.6 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc (ALMALINUX9.6:CLSA-2026:1778836031)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778836031 advisory. - A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soupmessageheadersappendcommon function in...

Rocky Linux 9 [CIQ] Security Update: xorg-x11-server-Xdmx / xorg-x11-server-Xdmx-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_9303)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20259303 advisory. xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension Animated Cursors CVE-2025-49175 xorg-x11-server-Xwayland:...

Rocky Linux 10.2 [CIQ] Security Update: libevent / libevent-debuginfo / libevent-debugsource / etc Multiple Vulnerabilities (crlsa-2026_67909)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202667909 advisory. libevent: Libevent: Denial of Service via malformed RPC data CVE-2026-63383 libevent: Libevent: Off-by-one stack buffer overflow leading to denial of...

Rocky Linux 9 [CIQ] Security Update: git-lfs / git-lfs-debuginfo / git-lfs-debugsource (crlsa-2025_9106)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259106 advisory. net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-22871 Tenable has extracted the preceding description block directly from...

Rocky Linux 8 [CIQ] Security Update: httpd / httpd-debuginfo / httpd-debugsource / httpd-devel / etc Multiple Vulnerabilities (crlsa-2023_0852)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20230852 advisory. httpd: moddav: out-of-bounds read/write of zero byte CVE-2006-20001 httpd: modproxyajp: Possible request smuggling CVE-2022-36760 httpd: modproxy: HTTP...

Rocky Linux 8 [CIQ] Security Update: aardvark-dns / buildah / buildah-debuginfo / buildah-debugsource / etc (crlsa-2025_9142)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259142 advisory. net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-22871 Tenable has extracted the preceding description block directly from...

AlmaLinux 9.6 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc (ALMALINUX9.6:CLSA-2026:1784192091)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784192091 advisory. - The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed...

Rocky Linux 8 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource / go-toolset / golang / etc (crlsa-2025_8478)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20258478 advisory. net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-22871 Tenable has extracted the preceding description block directly from...

Rocky Linux 9 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc (crlsa-2025_9147)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259147 advisory. net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-22871 Tenable has extracted the preceding description block directly from...