cve-2026-29145

CVE-2026-29145 — OCSP checks sometimes soft-fail even when soft-fail is disabled Discoverer: gregk4sec https://github.com/gregk4sec/cve Discovery Date: 2026-02-26 Affected Vendor: Apache Affected Product: Tomcat Severity: 9.1 CRITICAL CWE: CWE-287 Improper Authentication Status: Under Review /...

CVE-2026-118768

Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocspcheck command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return a...

CVE-2026-118768

Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocspcheck command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return a...

CVE-2026-117499 @fastify/session vulnerable to session revocation bypass via a logout race condition

@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call, recreating the destroyed session...

CVE-2026-117499

The @fastify/session plugin for Fastify is vulnerable to a session revocation bypass via a logout race condition in all releases before 11.1.6 . With default rolling session behavior, a request that restores a session before a logout can save a copy after a concurrent request completes the destro...

CVE-2026-117499 @fastify/session vulnerable to session revocation bypass via a logout race condition

@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call, recreating the destroyed session...

Security Bulletin:Multiple vulnerabilities in netty-handler-ssl-ocsp may affect IBM Infosphere Change Data Capture (CVE-2026-93493, CVE-2026-93578)

Summary Multiple security vulnerabilities have been identified in netty-handler-ssl-ocsp, Netty/Handler/Ssl/Ocsp. netty-handler-ssl-ocsp is used by IBM Infosphere Change Data Capture. IBM has addressed these vulnerabilities. Refer to the "Remediation/Fixes" section below for remediation details...

PT-2026-118045

Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed in code.vikunja.io/api...

curl: OpenSSL `--cert-status` accepts indefinitely stale GOOD OCSP staples

Summary When curl uses its OpenSSL backend with CURLOPTSSLVERIFYSTATUS the --cert-status tool option, a correctly signed OCSP response can be accepted forever if its optional nextUpdate field is absent. curl passes -1 as OpenSSL's maximum permitted age for thisUpdate, explicitly disabling the onl...

CVE-2026-111044 Disabled Sunshine clients can bypass revocation with a derived client certificate

Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate...

CVE-2026-111044 Disabled Sunshine clients can bypass revocation with a derived client certificate

Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate...

CVE-2026-111044

Sunshine , a self-hosted game stream host for Moonlight, is vulnerable to an incorrect authorization issue in versions 2026.329.165800 through 2026.906.222525 . The software accepts any client certificate chained to a stored paired-client certificate without verifying that the presented certifica...

CVE-2026-111044 Disabled Sunshine clients can bypass revocation with a derived client certificate

Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate...

RHLW-2026-2D8697B26CCD16C3 Lightwell Security Advisory: cxf-rt-rs-security-oauth2 4.2.2.rhlw-00006

Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-oauth2 4.2.2.rhlw-00006 with backported fixes for CVE-2026-57818, CVE-2026-63687, CVE-2026-68079, and CVE-2026-68481. CVE-2026-57818: Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider CVE-2026-63687:...

PyJWT: Non-canonical signature segments enable raw-token revocation bypass

SummaryPyJWT 2.13.0 accepts compact JWS signature segments containing characters thatare not in the Base64URL alphabet. Appending !!!! to a valid signature doesnot change the decoded signature bytes or authenticated claims, but it changesthe serialized token and its SHA-256 hash. An application...

PYSEC-2026-4147 PyJWT: Non-canonical signature segments enable raw-token revocation bypass

Summary PyJWT 2.13.0 accepts compact JWS signature segments containing characters that are not in the Base64URL alphabet. Appending !!!! to a valid signature does not change the decoded signature bytes or authenticated claims, but it changes the serialized token and its SHA-256 hash. An applicati...

PT-2026-105893

Summary PyJWT 2.13.0 accepts compact JWS signature segments containing characters that are not in the Base64URL alphabet. Appending !!!! to a valid signature does not change the decoded signature bytes or authenticated claims, but it changes the serialized token and its SHA-256 hash. An applicati...

Rocky Linux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.6:CLSA-2026:1774442729)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1774442729 advisory. - Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native and Tomcat's...

Rocky Linux 9 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (crlsa-2026_26323)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202626323 advisory. tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation CVE-2026-24734 Tenable has extracted the preceding description block...

AlmaLinux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.6:CLSA-2026:1774442729)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1774442729 advisory. - Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native and Tomcat's FF...