AlmaLinux 9.6 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1781096989)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781096989 advisory. - Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires...

Rocky Linux 9.6 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1781096989)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781096989 advisory. - Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires...

AlmaLinux 9.2 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1780910915)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780910915 advisory. - Attacker can upload a malicious Sieve script over ManageSieve service or locally to bypass configured CPU time limits for Sieve up...

PT-2026-95846

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters t embedded in the username. Because the audit log uses tab-separated key=value format...

Linux Distros Unpatched Vulnerability : CVE-2026-84439

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending ...

DEBIAN-CVE-2026-84439

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...

CVE-2026-84439

An unauthenticated attacker can perform a log injection attack on Apache ZooKeeper (versions 3.9.0 through 3.9.5 and 3.8.0 through 3.8.6 ) when audit logging is enabled (zookeeper.audit.enable=true). By sending a digest authentication request containing tab characters ( ) in the username, an atta...

CVE-2026-84439

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...

EUVD-2026-80333

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...

CVE-2026-84439 Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...

CVE-2026-84439 Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...

CVE-2026-84439: Improper Output Neutralization for Logs

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...

SUSE CVE-2026-89672

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp-mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvcdecodesetaclargs fills in argp-aclaccess only when NFSACL is set in the request mask and argp-acldefault...

Astra Linux – Vulnerability in dovecot

The attacker can use the IMAP SETACL command to inject the “anyone” permission into the user’s dovecot-acl file, even if imapaclallowanyone is set to “no”. This causes folders to be sent to all users. The impact is limited to being able to send folders to other users; no unexpected access is...

Linux Distros Unpatched Vulnerability : CVE-2026-89672

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: gate nfs2 setacl by argp-mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvcdecodesetaclargs fills in...

CVE-2026-89672

A flaw was found in the Linux kernel's Network File System NFS server daemon nfsd. When processing NFSACL version 2 SETACL requests, the system could unintentionally remove a directory's default Access Control List ACL or both access and default ACLs. This occurs because the setposixacl function ...

CVE-2026-89671

A flaw was found in the Linux kernel's Network File System version 3 NFSv3 server daemon nfsd. The nfsd3procsetacl function unconditionally processes Access Control List ACL update requests, even when the client's request does not specify an ACL to be set. A remote attacker could exploit this by...

AZL-100827 CVE-2026-89671 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs3 setacl by argp-mask nfsd3procsetacl calls setposixacl unconditionally for both ACLTYPEACCESS and ACLTYPEDEFAULT, passing argp-aclaccess and argp-acldefault verbatim. The NFSv3 ACL decoder only populates those...

AZL-100368 CVE-2026-89672 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp-mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvcdecodesetaclargs fills in argp-aclaccess only when NFSACL is set in the request mask and argp-acldefault...

CVE-2026-89672

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp-mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvcdecodesetaclargs fills in argp-aclaccess only when NFSACL is set in the request mask and argp-acldefault...