Linux Distros Unpatched Vulnerability : CVE-2026-84783

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is...

Fedora 45 : python-quart-trio / python-streamlink / python-urllib3 (2026-9a652403b1)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-9a652403b1 advisory. Update python-urllib3 to version 2.8.0, fixing three security issues: - The TLS configuration for HTTPS proxies could be ignored or overridden. Rated high...

Amazon Linux 2 : nginx (ALASNGINX1-2026-016)

The version of nginx installed on the remote host is prior to 1.30.5-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NGINX1-2026-016 advisory. NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with OpenSSL versions =...

CVE-2026-84783: Use After Free

Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is still using it. Impact summary: A remote, unauthenticated peer could crash a multi-threaded TLS client, or a multi-threaded TLS server...

CVE-2026-102758: Buffer Over-read

The nxsecurex509asn1tlvblockparse function parses ASN.1 TLV tag-length-value blocks out of DER-encoded data. It is the primitive underneath all X.509 certificate parsing in NetX Secure, and therefore runs on certificates supplied by a remote peer during the TLS handshake. The function reads the...

CVE-2026-72897: Out-of-bounds Write

Issue summary: A TLS server that calls SSLsetSSLCTX to switch a connection to a different SSLCTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was created...

CVE-2026-72897: Out-of-bounds Write

Issue summary: A TLS server that calls SSLsetSSLCTX to switch a connection to a different SSLCTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was created...

FreeBSD Security Advisory - FreeBSD-SA-26:67.ktls

FreeBSD Security Advisory - Remote DoS via receive-side kernel TLS. A remote TLS 1.3 peer can send a specially crafted record to trigger a kernel panic, resulting in a Denial of Service DoS...

RHEL 10 : java-21-ibm-semeru-certified-jdk (RHSA-2026:72888)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72888 advisory. The IBM Semeru Runtime Certified Edition 21 runtime environment. Security Fixes: OpenJDK: Improve Resource Resolving 2026-08 Security Upda...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Erlang vulnerabilities (USN-8827-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8827-1 advisory. It was discovered that the Erlang Port Mapper Daemon did not properly handle slow...

Fedora 44 : python-streamlink / python-urllib3 (2026-700dc0d93d)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-700dc0d93d advisory. Update python-urllib3 to version 2.8.0, fixing three security issues: - The TLS configuration for HTTPS proxies could be ignored or overridden. Rated high...

PT-2026-102666

Name of the Vulnerable Software and Affected Versions urllib3 versions 1.26.0 through 2.7.x Description Target-server TLS settings are incorrectly applied to the HTTPS proxy connection, causing configuration paths to fail to remain separated. This occurs when an application uses an HTTPS proxy an...

PT-2026-102647

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description Processing a certificate containing numerous nameRelativeToCRLIssuer CRL distribution points can cause disproportionate heap growth when X.509 extensions are cached. A malicious peer can send...

PT-2026-102653

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description A TLS server may experience an out-of-bounds read and a fixed-value out-of-bounds write on the server heap when calling the SSL set SSL CTX function to switch a connection to a different SSL...

CVE-2026-35189: Allocation of Resources Without Limits or Throttling

Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of...

ALSA-2026:73428 Important: nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

PT-2026-102771

Name of the Vulnerable Software and Affected Versions NetX Secure TLS affected versions not specified Description NetX Secure TLS accepts empty application-data records without verifying the message authentication code MAC. Within the nx secure verify mac function, a decrypted application record...

CVE-2026-102728: Buffer Over-read

Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating that the message is long enough to contain them. Both are bounded out-of-bounds reads on a remotely reachable path, both are reached from a TLS or DTLS client connecting to a...

Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake

Issue summary: A TLS server that calls SSLsetSSLCTX to switch a connection to a different SSLCTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was created...

FreeBSD -- Remote DoS via receive-side kernel TLS

Problem Description: TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followe...