openSUSE 16 Security Update : gitoxide (openSUSE-SU-2026:21955-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21955-1 advisory. Changes in gitoxide: - CVE-2026-91986: gix-transport CR/LF/NUL injection into git-daemon connect request via crafted git URL path, allowing virtual-host...

Security update for gitoxide (moderate)

openSUSE security update: security update for gitoxide ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21955-1 Rating: moderate References: bsc1281749 Cross-References: CVE-2026-91986 CVSS scores: CVE-2026-91986 SUSE : 5.4...

OPENSUSE-SU-2026:21955-1 Security update for gitoxide

This update for gitoxide fixes the following issues: Changes in gitoxide: - CVE-2026-91986: gix-transport CR/LF/NUL injection into git-daemon connect request via crafted git URL path, allowing virtual-host spoofing boo1281749...

CVE-2026-91986

A flaw was found in gix-transport. This vulnerability allows a remote attacker to inject control characters, specifically NUL, Carriage Return CR, and Line Feed LF bytes, into git-daemon connect requests by crafting malicious git URLs. This injection can lead to spoofing of virtual hosts or the...

AZL-103266 CVE-2026-91986 affecting package rust 1.96.1-2

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and lo...

CVE-2026-91986 gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and lo...

CVE-2026-91986 gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and lo...

CVE-2026-91986 gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and lo...

CVE-2026-91986

gitoxide gix-transport versions before 0.59.2 fail to filter control characters in git-daemon connect requests. By crafting a malicious git URL, a remote attacker with no privileges can inject NUL, CR, or LF bytes into the connection. This allows injection of extra NUL-delimited protocol fields t...

PT-2026-92100

Name of the Vulnerable Software and Affected Versions gitoxide gix-transport versions prior to 0.59.2 Description The software fails to filter control characters in git-daemon connect requests. This allows attackers to inject NUL, CR, or LF bytes through specially crafted git URLs. Such injection...

Linux Distros Unpatched Vulnerability : CVE-2026-91986

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1x) is affected by multiple vulnerabilities due to Eclipse Jetty

Summary Eclipse Jetty is used by IBM Cloud Pak for Data System 1x to provide web application server functionality. CVE-2026-10051 affects Jetty's HTTP/1.1 request handling when trailers are retained across multiple requests on the same connection, potentially exposing sensitive information from...