Important: Red Hat Security Advisory: pcs security update

An update for pcs is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...

python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding

A vulnerability was discovered in Tornado where it improperly handles HTTP requests containing duplicate Transfer-Encoding: chunked headers. When duplicate Transfer-Encoding headers are present in an incoming request, Tornado ignores them and treats the request as body-less, leaving the chunked...

Important: Red Hat Security Advisory: pcs security update

An update for pcs is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

RHEL 8 : pcs (RHSA-2026:84843)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84843 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: python-tornado:...

RHEL 8 : pcs (RHSA-2026:84844)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84844 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: python-tornado:...

ALSA-2026:84798 Important: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields CVE-2026-82397 python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding...

Important: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields CVE-2026-82397 python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding...

CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin

Summary A network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8sexternal headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports. The built-in k8sexternal transferer can emit an empty...

GHSA-74W3-63XV-X9MV CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin

Summary A network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8sexternal headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports. The built-in k8sexternal transferer can emit an empty...

CVE-2026-111383

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limit...

EUVD-2026-102564

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limit...

CVE-2026-111383

The Nezha monitoring tool (versions 2.0.13 before 2.3.15 ) is vulnerable to a resource exhaustion flaw. Authenticated users can exploit the /api/v1/ws/transfer WebSocket endpoint to open unbounded concurrent connections. Specifically, the ServerTransferClass.Subscribe function allows the creation...

CVE-2026-111383 Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limit...

Progress MOVEit Transfer < 2025.1.6 / 2026.0.x < 2026.0.4 Multiple Vulnerabilities (September 2026)

The version of Progress MOVEit Transfer installed on the remote host is prior to 2025.1.6 or 2026.0.x prior to 2026.0.4. It is, therefore, affected by multiple vulnerabilities, including: - Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer...

CVE-2026-111445: Incorrect Resource Transfer Between Spheres

Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey and existskey=. For existskey=, production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or...

CVE-2026-111383: Allocation of Resources Without Limits or Throttling

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limit...

Portable SDK for UPnP Devices – Resource Management Error Vulnerability

Portable SDK for UPnP Devices. Versions prior to 2.0.2 of the Portable SDK for UPnP Devices contain a resource management vulnerability. This vulnerability arises from the HTTP parser, which handles Transfer-Encoding: chunked. In this case, the value of parser-contentlength remains zero in...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fixed a NULL pointer dereference in amdgpudmi2cxfer. When ddcserviceconstruct is called, it explicitly checks both the link type and whether there is something on the link that will determine whether the pin is...

Astra Linux – Vulnerability in libcommons-net-java

Prior to Apache Commons Net 3.9.0, Net’s FTP client trusted the host based on the PASV response by default. A malicious server could redirect the Commons Net code to use a different host, but the user had to connect to the malicious server in the first place. This could result in the leakage of...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: spi: tegra210-quad: Protect currxfer in tegraqspicombinedseqxfer The currxfer field is read by the IRQ handler without holding a lock. This allows the IRQ handler to check whether a transfer is in progress. When clearing the...