CVE-2026-11873

Red Hat IdM (Identity Management) exposes an Apache-proxied Dogtag CA REST endpoint (POST /ca/rest/certrequests ) that, upon receiving an unauthenticated malformed or empty request, returns an HTTP 500 response containing internal Java stack traces . The same unauthenticated error path writes lar...

CVE-2026-11873 Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosure

An Apache-proxied Dogtag CA REST endpoint exposed by IdM POST /ca/rest/certrequests returns HTTP 500 with internal Java stack traces for unauthenticated malformed requests. The same unauthenticated error path emits large multi-line stack traces into the CA debug log, creating a log-amplification...

CVE-2026-84200

Kyverno versions v1.9.0 through v1.12.7 are affected by a policy exception handling flaw . When a policy in enforce mode is combined with two PolicyExceptions , the less restrictive exception takes precedence. An attacker can exploit this by crafting a resource name that matches the second except...

Security Bulletin: IBM ApplinX is vulnerable to allocation of resources without limits or throttling vulnerability caused due to parsing oversized baggage.

Summary IBM ApplinX is vulnerable to allocation of resources without limits or throttling vulnerability caused due to parsing oversized baggage. IBM ApplinX has been updated in order to address the vulnerability CVE-2026-45292. Vulnerability Details CVEID:CVE-2026-45292 DESCRIPTION:...

CVE-2026-82267

A flaw was found in Komodo. Authenticated users can exploit this vulnerability by guessing resource names, which allows them to obtain internal resource identifiers. This issue also enables them to insert fraudulent audit log entries, misrepresenting privileged operations, due to insufficient...

CVE-2026-42391

A flaw was found in Dovecot. An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in. This action causes the server to consume excessive memory and CPU resources, leading to the termination of login processes and other active connections...

BIT-GITLAB-2026-77801 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting background job processing, due to missing objec...

kernel: NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg

A flaw was found in the Linux kernel's Network File System Daemon NFSD. An issue with file access counting in the nfsd4addrdaccesstowrdeleg function can lead to an extra access count for nfs4file objects. This prevents the proper freeing of associated resources when the NFS server service is...

Updated perl-HTML-FormHandler packages fix a security vulnerability

HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because applyactions and adderror use error message text built from request data as a Locale::Maketext bracket notation template...

MGASA-2026-0360 Updated perl-HTML-FormHandler packages fix a security vulnerability

HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because applyactions and adderror use error message text built from request data as a Locale::Maketext bracket notation template...

RLSA-2026:61389 Important: iperf3 security update

Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss. Security Fixes: iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via...

iperf3 security update

An update is available for iperf3. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Iperf is a tool which can measure maximum TCP bandwidth and tune various...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

Improper Authorization in Confluence Data Center

This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an...

CVE-2026-82743

Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it. Ash.Actions.Read.AsyncLimiter.awaitatleastone/1 lib/ash/actions/read/asynclimiter.ex waited for concurrent async read tasks by...

CVE-2026-82742

Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory. Ash.Filter.Runtime matches a filter against an in-memory record by first expanding the record into combinations of its...

CVE-2026-82735

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.applyconstraints/2 lib/ash/type/string.ex evaluated the :match regex regardless of...

CVE-2026-82746 Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records

Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.updatemany/4. Ash.updatemany/4 runs as a single atomic statement a data-layer updatemany, for example a SQL MERGE whenever an atomic strategy is...

CVE-2026-82746 Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records

Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.updatemany/4. Ash.updatemany/4 runs as a single atomic statement a data-layer updatemany, for example a SQL MERGE whenever an atomic strategy is...