openSUSE 16 Security Update : rpcbind (openSUSE-SU-2026:21975-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21975-1 advisory. This update for rpcbind fixes the following issue: - CVE-2026-94640: unbounded memory allocation in statistics tracking allows for unauthenticated remot...

immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations

A flaw was found in Immutable.js, a library providing persistent immutable data structures. This vulnerability occurs when specific List operations, such as Listset or ListsetSize, are provided with an index or size value within a particular large range. An attacker could exploit this by providin...

Rocky Linux 8 [CIQ] Security Update: hivex / hivex-debuginfo / hivex-debugsource / hivex-devel / etc (crlsa-2024_3253)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20243253 advisory. libvirt: negative gnew0 length can lead to unbounded memory allocation CVE-2024-2494 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 9 [CIQ] Security Update: libvirt / libvirt-client / libvirt-client-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_2560)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20242560 advisory. The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition,...

Rocky Linux 9 [CIQ] Security Update: cyrus-imapd / cyrus-imapd-debuginfo / cyrus-imapd-debugsource / etc (crlsa-2024_9195)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20249195 advisory. cyrus-imapd: unbounded memory allocation by sending many LITERALs in a single command CVE-2024-34055 Tenable has extracted the preceding description block directly...

CVE-2026-103471 restbed through 5.0.0 Denial of Service via Unbounded Header Buffering

restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers can open TCP connections and stream bytes indefinitely without sending the header delimiter, forcing the server to allocate...

EUVD-2026-89017

urllib3: HTTPResponse.stream/readchunked buffers an unbounded chunk-size line into memory...

AlmaLinux 9.2 [TuxCare] Security Update: cyrus-imapd / cyrus-imapd-devel / cyrus-imapd-doc-extra / etc (ALMALINUX9.2:CLSA-2026:1779119949)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779119949 advisory. - Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many...

Linux Distros Unpatched Vulnerability : CVE-2026-97689

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memor...

AlmaLinux 9.2 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.2:CLSA-2025:1764331947)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1764331947 advisory. - tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted...

CVE-2026-97689

urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a...

DEBIAN-CVE-2026-97689

urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a...

CVE-2026-97689

urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a...

SUSE-SU-2026:23946-1 Security update for rpcbind

This update for rpcbind fixes the following issue: - CVE-2026-94640: unbounded memory allocation in statistics tracking allows for unauthenticated remote denial of service bsc1282326...

CVE-2026-97689 urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a...

PT-2026-102668

Name of the Vulnerable Software and Affected Versions urllib3 versions 1.10.3 through 2.7.x Description The HTTPResponse.read chunked and HTTPResponse.stream methods can allocate unbounded memory. This occurs because the streaming chunk parser buffers the chunk-size field without a length bound...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2024-56339 DESCRIPTION: IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in soupsieve (CVE-2026-49476, CVE-2026-49477)

Summary Multiple vulnerabilities in the soupsieve CSS selector parsing library CVE-2026-49476, CVE-2026-49477 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 2.9.1 on Windows and version 2.9.2 on Linux. Vulnerability Details CVEID:CVE-2026-494...

CVE-2026-67235: Allocation of Resources Without Limits or Throttling

RabbitMQ is a messaging and streaming broker. Prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15, The content-header BodySize a uint64 was stored without validation against maxmessagesize. The size check ran only when assembly completed. By declaring bodysize = 2^63-1 and then streaming...

CVE-2026-94640 Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service

A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a large number of unique requests. The rpcbind service records previously unseen RPC Remote Procedure Call statistics in unbounded in-memory lists, leading to...