Astra Linux – Vulnerability in Containerd

Containerd is an open-source container runtime. Prior to versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where no limit was applied could cause a denial of service. This bug ha...

Astra Linux – Vulnerability in python-webob

WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user will be redirected to using Python’s urlparse function, and joining that parsed URL to the base URL. However, the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: tty: ngsm: Fixed a use-after-free in gsmcleanupmux. Bug: KASAN: Slab-use-after-free in gsmcleanupmux+0x77b/0x7b0. drivers/tty/ngsm.c:3160 ngsm Read of size 8 at addr ffff88815fe99c00 by task poc/3379. CPU: 0; UID: 0; PID: 3379...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ntfs: Check overflow when iterating ATTRRECORDs The kernel iterates over ATTRRECORDS in mft records in ntfsattrfind. Since ATTRRECORDS are adjacent to each other, the kernel can access the next ATTRRECORD from the end address of...

Astra Linux – Vulnerability in Chromium

Incorrect security user interfaces in Page Info in Google Chrome on iOS prior to version 88.0.4324.96 allowed a remote attacker to spoof the security user interface through a crafted HTML page...

Astra Linux – Vulnerability in node-browserify-sign

“browserify-sign” is a package that duplicates the functionality of Node’s crypto public key functions. Much of this functionality is based on Fedor Indutny’s work on “indutny/tls.js”. There is a issue with upper-bound checking in the “dsaVerify” function, which allows an attacker to create...

Astra Linux – Vulnerability in Containerd

In containerd a industry-standard container runtime, before versions 1.3.10 and 1.4.4, containers launched through containerd’s CRI implementation via Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service that share the same image might receive incorrect...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: For SMP configurations, the requirement to enforce MITM Mutual Authentication, Mutual Encryption before generating the pairing response must be applied. Currently, the smpcmdpairingreq function generates the pairing...

Astra Linux – Vulnerability in exiv2

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit this vulnerability to cause a denial of...

CVE-2026-100351 kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from...

CVE-2026-100351 kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from...

CVE-2026-100351

The kin-openapi Go project (versions 0.144.0 through 0.147.0 ) contains a security requirement bypass in the openapi3filter.ValidationHandler . The vulnerability stems from an interpretation conflict: the handler validates operations based on the decoded URL.Path , while a downstream gorilla/mux ...

CVE-2026-100351 kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from...

CLSA-2026-1792079338 TuxCare security update for org.springframework.security (2 CVEs)

TuxCare rebuilt 21 org.springframework.security packages to address 2 CVEs. Fixed in 5.8.16-tuxcare.16...

CLSA-2026-1792078146 TuxCare security update for org.springframework.amqp (3 CVEs)

TuxCare rebuilt 5 org.springframework.amqp packages to address 3 CVEs. Fixed in 2.3.16-tuxcare.2...

CLSA-2026-1792078119 TuxCare security update for org.springframework.amqp (4 CVEs)

TuxCare rebuilt 7 org.springframework.amqp packages to address 4 CVEs. Fixed in 3.1.12-tuxcare.7...

ROOT-APP-MAVEN-CVE-2021-22112 CVE-2021-22112 in org.springframework.security:spring-security-web - Patched by Root

Root has patched CVE-2021-22112 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-22732 CVE-2026-22732 in org.springframework.security:spring-security-web - Patched by Root

Root has patched CVE-2026-22732 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2022-22978 CVE-2022-22978 in org.springframework.security:spring-security-web - Patched by Root

Root has patched CVE-2022-22978 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-38821 CVE-2024-38821 in org.springframework.security:spring-security-web - Patched by Root

Root has patched CVE-2024-38821 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...