494 matches found
jarm
JARM Please read the initial JARM blog post for more information. JARM is an active Transport Layer Security TLS server fingerprinting tool. JARM fingerprints can be used to: Quickly verify that all servers in a group have the same TLS configuration. Group disparate servers on the internet by...
UBUNTU-CVE-2026-126051
A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext, the corresponding OpenSSL...
CVE-2026-126051
A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext, the corresponding OpenSSL...
Linux Distros Unpatched Vulnerability : CVE-2026-126051
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a...
nodejs: Node.js: Mutual TLS authorization bypass via incomplete SNI context configuration
A flaw was found in Node.js. When a Transport Layer Security TLS server configures a host-specific client Certificate Authority CA without providing an associated server certificate, the per-host client validation settings fail to apply. Consequently, the connection silently falls back to trustin...
nodejs: Node.js: Mutual TLS authorization bypass via incomplete SNI context configuration
A flaw was found in Node.js. When a Transport Layer Security TLS server configures a host-specific client Certificate Authority CA without providing an associated server certificate, the per-host client validation settings fail to apply. Consequently, the connection silently falls back to trustin...
ALPINE-CVE-2026-126051
A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext, the corresponding OpenSSL...
CVE-2026-126051
A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext, the corresponding OpenSSL...
DEBIAN-CVE-2026-126051
A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext, the corresponding OpenSSL...
EUVD-2026-123706
A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext, the corresponding OpenSSL...
CVE-2026-126051
A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext, the corresponding OpenSSL...
CVE-2026-126051
A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext, the corresponding OpenSSL...
nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames
A flaw was found in the Node.js TLS stack. Improper normalization of hostnames that use fullwidth Unicode digits to represent an IPv4 address can cause certificate hostname verification to accept a certificate that does not identify the intended peer. This may allow an attacker who can influence...
PT-2026-145425
Name of the Vulnerable Software and Affected Versions Node.js versions 24.x Node.js versions 26.x Description A use-after-destroy issue in the TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. This occurs when a TLS server utilizes...
CVE-2026-126051: nodejs node: A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated…
A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server.addContext, the corresponding OpenSSL...
ca-certificates: Fix of CVE-2026-114406
Comodo AAA Services root AAA Certificate Services is no longer trusted for TLS server authentication through the legacy bundle: it issued the Sectigo cross-signs of the compromised eMudhra intermediates Mozilla bug 2083449. Its legacy e-mail and code-signing trust is kept...
CVE-2026-103410
An Integer Overflow vulnerability in the DPI certificate scanner in Juniper Networks Session Smart Router allows an unauthenticated remote attacker to cause a denial of service via a specially crafted TLS server certificate...
PT-2026-128286
An Integer Overflow vulnerability in the DPI certificate scanner in Juniper Networks Session Smart Router allows an unauthenticated remote attacker to cause a denial of service via a specially crafted TLS server certificate...
Juniper Networks Session Smart Router digital error vulnerability
A security vulnerability exists in Juniper Networks Session Smart Router versions prior to 7.0.5, from 7.1.0 up to but not including 7.1.7, and from 7.2.0 up to but not including 7.2.3. This vulnerability stems from an integer overflow in the DPI certificate scanner; unauthenticated remote...
Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: php (UTSA-2026-143718)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143718 advisory. phpopensslmatcheswildcardname in ext/openssl/xpssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose...