29231 matches found
CVE-2026-19953
URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded RFC 5891, so a label...
CVE-2026-50572
A flaw was found in Envoy. In the external authorization extauthz HTTP client, completing an authorization request can send a rejection response and destroy the client while its completion handler is still executing. A remote attacker could exploit this timing condition to trigger a use-after-fre...
CVE-2026-73549
A flaw was found in Envoy. An attacker could cause a Denial of Service DoS by sending network requests using scoped Internet Protocol version 6 IPv6 client addresses. Due to improper parsing when copying network addresses in original destination routing configurations and HTTP/3 connections, the...
CVE-2026-73553
A flaw was found in Envoy. A remote, unauthenticated attacker can exploit this vulnerability to bypass access controls and reach protected backend endpoints. When path parameter stripping is enabled, Envoy strips parameters prior to routing requests but evaluates Role-Based Access Control RBAC...
CVE-2026-73552
A flaw was found in Envoy. When evaluating regular expressions in role-based access control RBAC policies, Envoy improperly treats non-UTF-8 characters in HTTP header values as non-matching input. A remote attacker can exploit this flaw by sending requests with specially crafted HTTP headers to...
CVE-2026-73548
A flaw was found in Envoy. This vulnerability allows an unauthenticated remote attacker to cause information disclosure through cross-user response poisoning. By sending request data during a generic HTTP upgrade before the upstream server accepts the connection upgrade, the premature data is...
CVE-2026-73547
A flaw was found in Envoy. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by crashing the Envoy process. When the external authorization filter is configured to modify query parameters, it fails to verify whether a request path header exists before...
CVE-2026-73546
A flaw was found in Envoy. The administrative HTML statistics interface does not properly encode dynamic statistic names before displaying them, leading to a stored cross-site scripting XSS vulnerability. A remote attacker can exploit this by sending crafted requests that cause Envoy to store...
CVE-2026-73513
A flaw was found in Envoy. A malicious upstream server can cause a Denial of Service DoS by sending HTTP/2 response trailers that lack the end-of-stream flag to a proxy configured with the optional oghttp2 codec. This malformed response corrupts the stream state and causes a use-after-free memory...
CVE-2026-73512
A flaw was found in Envoy. A remote attacker can cause a Denial of Service DoS by triggering a use-after-free memory vulnerability in the QUIC HTTP datagram handler. When HTTP/3 datagrams and the Capsule Protocol are enabled, stream recreation events such as internal redirects can leave the handl...
CGA-MX67-F7JR-JC7J
Bulletin has no description...
CVE-2026-80221
No description is available for this CVE...
CVE-2026-77849
No description is available for this CVE...
CVE-2026-80220
No description is available for this CVE...
SUSE CVE-2026-49275
unknown...
SUSE CVE-2026-68546
unknown...
SUSE CVE-2026-68547
unknown...
DEBIAN-CVE-2026-19873
HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. When a Repeatable element has countername set, its process method reads the repeat count from the named query string parameter, checks only that it is ...
