Lucene search
+L

6412 matches found

RedHat Linux
RedHat Linux
added 2026/08/11 5:41 p.m.4 views

undertow: undertow-websockets: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket...

7.5CVSS5.4AI score0.00476EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
added 2026/08/11 11:50 a.m.8 views

CVE-2026-69243

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...

7CVSS5.7AI score0.00275EPSS
SaveExploits1References7
OSV
OSV
added 2026/08/11 9:17 a.m.6 views

DEBIAN-CVE-2026-15565

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket...

7.5CVSS5.5AI score0.00476EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/11 9:17 a.m.6 views

CVE-2026-15565

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket...

7.5CVSS0.00476EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/11 8:49 a.m.39 views

CVE-2026-15565 Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket...

7.5CVSS0.00476EPSS
SaveExploits0References3
CVE
CVE
added 2026/08/11 8:49 a.m.38 views

CVE-2026-15565

CVE-2026-15565 affects Undertow: a flaw enables a remote attacker to cause Out of Memory on a websockets endpoint without authentication for any @ServerEndpoint class that has an @OnMessage method, resulting in Denial of Service. The issue impacts the availability of the service (CVSS v3.1: AV:N/...

7.5CVSS5.4AI score0.00476EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/11 8:49 a.m.8 views

EUVD-2026-55988

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket...

7.5CVSS5.5AI score0.00476EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/08/11 8:49 a.m.7 views

CVE-2026-15565

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket...

7.5CVSS5.4AI score0.00476EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/08/11 8:49 a.m.11 views

CVE-2026-15565

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket...

7.5CVSS5.4AI score0.00476EPSS
SaveExploits0References4
IBM Security Bulletins
IBM Security Bulletins
added 2026/08/11 6:57 a.m.8 views

Security Bulletin: Vulnerability in Spring-core affects IBM Netezza Appliance

Summary The Spring-core package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2026-41838 Vulnerability Details CVEID:CVE-2026-41838 DESCRIPTION: IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which...

7.5CVSS7.4AI score0.00171EPSS
SaveExploits0Affected Software1
NVD
NVD
added 2026/08/11 1:17 a.m.6 views

CVE-2026-58237

WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low privileges could exploit this to access restricted functionality. Successful exploitation could allow the attacker to read sensitive information and perform limited...

5.9CVSS0.00215EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/11 12:12 a.m.8 views

EUVD-2026-55869

WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low privileges could exploit this to access restricted functionality. Successful exploitation could allow the attacker to read sensitive information and perform limited...

5.9CVSS5.2AI score0.00215EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/11 12:12 a.m.37 views

CVE-2026-58237

CVE-2026-58237 concerns multiple vulnerabilities in SAP Business AI Platform (Approuter). The WebSocket component allegedly fails to perform sufficient authorization checks in certain functionality, allowing a low-privileged attacker to access restricted functionality and potentially read sensiti...

5.9CVSS5.2AI score0.00215EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/08/11 12:0 a.m.2 views

PT-2026-70867

A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an Upgrade: websocket header. An unauthenticated attacker can exploit this by sending a specially crafted HTTP POST request to the /federated...

7.5CVSS5.4AI score0.0041EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/08/11 12:0 a.m.3 views

PT-2026-70902

CivetWeb commit 4a4f0c95 contains a heap and stack buffer overflow vulnerability in the read websocket function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USE ZLIB and MG EXPERIMENTAL INTERFACES are defined. Attackers can...

8.3CVSS5.8AI score0.00467EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/08/11 12:0 a.m.3 views

PT-2026-70029

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description The WebSocket component of SAP Approuter fails to perform sufficient authorization checks within certain functionality. This allows an attacker with low privileges to access restricted...

5.9CVSS5.1AI score0.00215EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/08/11 12:0 a.m.3 views

PT-2026-70878

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and...

8.8CVSS5.3AI score0.00385EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/08/11 12:0 a.m.3 views

PT-2026-70095

Name of the Vulnerable Software and Affected Versions Undertow affected versions not specified Description A flaw exists where a remote, unauthenticated attacker can trigger an Out of Memory condition on websockets endpoints. This occurs on any @ServerEndpoint class containing an @OnMessage metho...

7.5CVSS5.2AI score0.00476EPSS
SaveExploits0References6
NVD
NVD
added 2026/08/10 10:17 p.m.6 views

CVE-2026-72918

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the stream-notify-user stream in the WebSocket protocol allows an authenticated user to write arbitrary notification bodies because the sender ...

5.4CVSS0.002EPSS
SaveExploits0References1
OSV
OSV
added 2026/08/10 9:42 p.m.14 views

CVE-2026-72918 Rocket.Chat: Insecure implementation of websocket notifications

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the stream-notify-user stream in the WebSocket protocol allows an authenticated user to write arbitrary notification bodies because the sender ...

5.4CVSS5.4AI score
SaveExploits0References3
Rows per page
Query Builder