1494089 matches found
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
In the Linux kernel, the following vulnerabilities have been resolved: Squashfs: sanity check for symbolic link sizes Syzkiller reports a bug named “KMSAN: uninit-value in picklink”. This issue is caused by an uninitialized page, which ultimately results from reading a corrupted symbolic link siz...
Astra Linux – Vulnerability in Tomcat9
Improper handling of the case sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: versions from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, and from 7.0.0 through 7.0.109. Older,...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: intelth: msu: Fix for vmalloced buffers After committing the change f5ff79fddf0e “dma-mapping: remove CONFIGDMAREMAP”, there is a possibility that DMA buffers may be allocated using vmalloc, which can affect the MMAP mapping code...
Astra Linux – Vulnerability in xrdp
xrdp is an open-source RDP server. In versions up to 0.10.5, xrdp does not implement verification for the Message Authentication Code MAC signature of encrypted RDP packets when using the “Classic RDP Security” layer. Although the sender correctly generates these signatures, the receiving side...
Astra Linux – Vulnerability in openimageio
There is a heap-out-of-bounds read vulnerability in the RLA format parser of OpenImageIO master-branch-9aeece7a and v2.3.19.0. More specifically, it relates to the handling of run-length encoded byte spans. A malformed RLA file can lead to an out-of-bounds read of heap metadata, potentially...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: In isotp.bind, there is a need to check the CAN address family. A missing check was added to prevent binds that use a non-AFCAN address family. Syzbot created some code that correctly determined the appropriate size of the sockad...
CVE-2026-100351 kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion
kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from...
CVE-2026-100351
The kin-openapi Go project (versions 0.144.0 through 0.147.0 ) contains a security requirement bypass in the openapi3filter.ValidationHandler . The vulnerability stems from an interpretation conflict: the handler validates operations based on the decoded URL.Path , while a downstream gorilla/mux ...
CVE-2026-100351 kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion
kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from...
CVE-2026-100351 kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion
kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from...
CLSA-2026-1792079338 TuxCare security update for org.springframework.security (2 CVEs)
TuxCare rebuilt 21 org.springframework.security packages to address 2 CVEs. Fixed in 5.8.16-tuxcare.16...
CLSA-2026-1792078146 TuxCare security update for org.springframework.amqp (3 CVEs)
TuxCare rebuilt 5 org.springframework.amqp packages to address 3 CVEs. Fixed in 2.3.16-tuxcare.2...
CLSA-2026-1792078119 TuxCare security update for org.springframework.amqp (4 CVEs)
TuxCare rebuilt 7 org.springframework.amqp packages to address 4 CVEs. Fixed in 3.1.12-tuxcare.7...
ROOT-APP-MAVEN-CVE-2021-22112 CVE-2021-22112 in org.springframework.security:spring-security-web - Patched by Root
Root has patched CVE-2021-22112 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2022-22978 CVE-2022-22978 in org.springframework.security:spring-security-web - Patched by Root
Root has patched CVE-2022-22978 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2024-38821 CVE-2024-38821 in org.springframework.security:spring-security-web - Patched by Root
Root has patched CVE-2024-38821 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-22732 CVE-2026-22732 in org.springframework.security:spring-security-web - Patched by Root
Root has patched CVE-2026-22732 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...
CLSA-2026-1792077802 TuxCare security update for org.springframework.amqp (3 CVEs)
TuxCare rebuilt 6 org.springframework.amqp packages to address 3 CVEs. Fixed in 2.4.4-tuxcare.1...