Amazon Linux 2023 : amazon-efs-utils (ALAS2023-2026-3378)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3378 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates...

Important: amazon-efs-utils

Issue Overview: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse ...

Important: amazon-efs-utils

Issue Overview: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse ...

io.netty/netty-codec-http: Netty: HTTP response desynchronization via HttpServerCodec

A flaw was found in Netty's HttpServerCodec. A remote attacker can exploit this vulnerability to cause HTTP response desynchronization, leading to response splitting and potential information disclosure. By sending pipelined requests with informational headers followed by another request, the...

nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse

A flaw was found in Node.js. The HTTP Agent keep-alive connection reuse logic can cause a client to treat data that arrived on an idle socket before a new request was sent as the response to that request. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when...

nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse

A flaw was found in Node.js. The HTTP Agent keep-alive connection reuse logic can cause a client to treat data that arrived on an idle socket before a new request was sent as the response to that request. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when...

CVE-2026-115823

A flaw was found in Starman. The web server improperly sends message bodies for HTTP responses that should contain headers only, such as HEAD requests and certain status codes. A remote attacker can exploit this behavior over persistent connections to cause HTTP response desynchronization between...

Linux Distros Unpatched Vulnerability : CVE-2026-115823

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman...

CVE-2026-115823

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses wi...

CVE-2026-115823 Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses wi...

CVE-2026-115823 Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses wi...

CVE-2026-115823

The Starman web server (versions before 0.4019 for Perl) is vulnerable to HTTP response desynchronization because it improperly sends message bodies for HEAD requests and certain status codes (1xx, 204, 304). While Starman omits chunked framing for these requests, it still writes the application-...

CVE-2026-115823

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses wi...

EUVD-2026-109560

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses wi...

PT-2026-123059

Name of the Vulnerable Software and Affected Versions Starman versions prior to 0.4019 Description Starman for Perl sends response bodies for HEAD requests, which leads to response desynchronization on keep-alive or pipelined connections. For HEAD requests, the software omits chunked framing but...

CVE-2026-105481

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event...

Red Hat: CVE-2026-105481: nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event...

Red Hat: CVE-2026-105481: nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event...

Node.js < 22.23.4, < 24.22.1, < 26.12.1 - HTTP Response Desynchronization on Pooled Keep-Alive Sockets

HTTP Response Desynchronization on Pooled Keep-Alive Sockets vulnerability discovered by hasanfleyah in WordPress npm Node.js versions 22.23.4...

io.netty/netty-codec-http: Netty: HTTP response desynchronization via HttpServerCodec

A flaw was found in Netty's HttpServerCodec. A remote attacker can exploit this vulnerability to cause HTTP response desynchronization, leading to response splitting and potential information disclosure. By sending pipelined requests with informational headers followed by another request, the...