tomcat: Apache Tomcat denial of service

A denial of service flaw was found in Apache Tomcat. A race condition during connection closure could trigger a JVM crash when using the APR/Native connector, leading to a denial of service. This issue was particularly noticeable with client-initiated closures of HTTP/2 connections...

CRI-O has Potential High Memory Consumption from File Read

There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a hi...

GHSA-8F93-J3FX-72F3 CRI-O has Potential High Memory Consumption from File Read

There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a hi...

CVE-2025-4437

CVE-2025-4437 affects CRI-O (container runtime); Fedora advisories indicate cri-o1.33 up to version 1.33.5 fixes. The vulnerability arises when container runs with securityContext.runAsUser set to a non-existent user, causing CRI-O to read /etc/passwd into memory and potentially trigger memory ex...

CVE-2025-4437 Cri-o: large /etc/passwd file may lead to denial of service

There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a hi...

org.apache.eventmesh:eventmesh-connector-knative (>=1.7.0-release, <=1.8.0-release), org.apache.eventmesh:eventmesh-starter (>=1.6.0-release, <=1.11.0-release) potentially affected by CVE-2024-39954 via org.apache.eventmesh:eventmesh-runtime (>=1.6.0-release, <=1.11.0-release)

org.apache.eventmesh:eventmesh-runtime MAVEN version =1.6.0-release, =1.7.0-release, =1.6.0-release, =1.11.0-release Source cves: CVE-2024-39954 Source advisory: SNYK:JAVA-ORGAPACHEEVENTMESH-12028708...

Apache EventMesh Vulnerable to Server-Side Request Forgery in WebhookUtil.java

Server-Side Request Forgery SSRF in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch, which fixes th...

org.apache.eventmesh:eventmesh-connector-knative (>=1.7.0-release, <=1.8.0-release), org.apache.eventmesh:eventmesh-starter (>=1.6.0-release, <=1.11.0-release) potentially affected by CVE-2024-39954 via org.apache.eventmesh:eventmesh-runtime (>=1.6.0-release, <=1.11.0-release)

org.apache.eventmesh:eventmesh-runtime MAVEN version =1.6.0-release, =1.7.0-release, =1.6.0-release, =1.11.0-release Source cves: CVE-2024-39954 Source advisory: OSV:GHSA-HF86-8X8V-H7VC...

org.apache.eventmesh:eventmesh-connector-knative (>=1.7.0-release, <=1.8.0-release), org.apache.eventmesh:eventmesh-starter (>=1.6.0-release, <=1.11.0-release) potentially affected by CVE-2024-39954 via org.apache.eventmesh:eventmesh-runtime (>=1.6.0-release, <=1.11.0-release)

org.apache.eventmesh:eventmesh-runtime MAVEN version =1.6.0-release, =1.7.0-release, =1.6.0-release, =1.11.0-release Source cves: CVE-2024-39954 Source advisory: GHSA-HF86-8X8V-H7VC...

CVE-2024-39954

CWE-918 Server-Side Request Forgery SSRF in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch , which...

CVE-2024-39954 Apache EventMesh Runtime: SSRF

CWE-918 Server-Side Request Forgery SSRF in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch , which...

CVE-2024-39954 Apache EventMesh Runtime: SSRF

CWE-918 Server-Side Request Forgery SSRF in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch , which...

CVE-2024-39954 Apache EventMesh Runtime: SSRF

CWE-918 Server-Side Request Forgery SSRF in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch , which...

CVE-2024-39954

CWE-918 Server-Side Request Forgery SSRF in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch , which...

CVE-2024-39954

The org.apache.eventmesh:eventmesh-runtime component is vulnerable to a Server-Side Request Forgery (SSRF) (CWE-918) within the WebhookUtil.java file. The root cause is the improper validation of user-supplied URLs due to unsafe handling in the module, which allows an attacker to send crafted req...

Linux Distros Unpatched Vulnerability : CVE-2019-5739

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated...

CVE-2024-39954: Server-Side Request Forgery (SSRF)

CWE-918 Server-Side Request Forgery SSRF in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch , which...

PT-2025-34042

Name of the Vulnerable Software and Affected Versions: CRI-O affected versions not specified Description: CRI-O is susceptible to a denial-of-service issue. When a container is launched with securityContext.runAsUser set to a non-existent user, CRI-O attempts to create the user by reading the...

AZL-66455 CVE-2025-38610 affecting package kernel for versions less than 6.6.104.2-1

In the Linux kernel, the following vulnerability has been resolved: powercap: dtpmcpu: Fix NULL pointer dereference in getpdpoweruw The getpdpoweruw function can crash with a NULL pointer dereference when emcpuget returns NULL. This occurs when a CPU becomes impossible during runtime, causing...

CVE-2025-38610

CVE-2025-38610 affects the Linux kernel powercap codebase, specifically the dtpm_cpu path. The vulnerability is caused by a NULL dereference in get_pd_power_uw() when em_cpu_get() returns NULL, which can occur if a CPU becomes unavailable at runtime and get_cpu_device() yields NULL, propagating t...