11008 matches found
ALSA-2026:68235 Important: libsoup3 security update
Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications...
PT-2026-94074
Name of the Vulnerable Software and Affected Versions Docs versions prior to 5.4.1 Description An issue exists where websocket collaboration connections are not properly revoked when access is removed at the parent document level. This allows users whose access has been revoked to maintain...
libsoup security update
2.72.0-16.3 - Fix CVE-2026-15711: Reject oversized WebSocket control frames 2.72.0-16.2 - Backport patch for CVE-2026-15709...
PT-2026-94121
Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7 Description The live WebSocket transport authorizes a mount using the check view auth function instead of the standard Django View.dispatch chain. This causes standard Django authorization mechanisms—such as...
PT-2026-93884
Impact djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware, so on the live WebSocket/SSE path get current tenant was always None during mount and every event handler — and the tenant-awa...
RHEL 9 : libsoup (RHSA-2026:68234)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68234 advisory. The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: SoupWebsocketExtensionDeflate: libsoup: libsoup:...
PT-2026-93823
Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7 Description Isolation in djust.tenants was only enforced on the HTTP path. The current tenant was stored in threading.local and set exclusively by the TenantMiddleware, which is HTTP-only. Consequently, on the liv...
Moderate: libsoup security update
The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service CVE-2026-15709 libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denia...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS through the WebSocket decoder process. An attacker can exhaust server memory by sending oversized frames or fragmented messages without size limits. Details Denial of Service DoS describes a family of attacks, all...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS through the WebSocket decoder process. An attacker can exhaust server memory by sending oversized frames or fragmented messages without size limits. Details Denial of Service DoS describes a family of attacks, all...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS through the WebSocket decoder process. An attacker can exhaust server memory by sending oversized frames or fragmented messages without size limits. Details Denial of Service DoS describes a family of attacks, all...
CVE-2026-83480
Vulnerability in the Helidon product of Oracle Fusion Middleware component: WebSocket. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerabilit...
CVE-2026-83330
Vulnerability in the Helidon product of Oracle Fusion Middleware component: WebSocket. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerabilit...
CVE-2026-69210
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAXVALUE but permits negative 64-bit lengths. A remote client that completes a WebSocket handshake through an Ember server can send su...
EUVD-2026-79767
Vulnerability in the Helidon product of Oracle Fusion Middleware component: WebSocket. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerabilit...
CVE-2026-83480
CVE-2026-83480 affects the WebSocket component of Oracle Helidon (part of Oracle Fusion Middleware), versions 4.0.0 through 4.5.4 . An unauthenticated attacker with network access via HTTP can trigger a partial denial of service against the affected instance. The CVSS 3.1 base score is 5.3 (MEDIU...
EUVD-2026-79683
Vulnerability in the Helidon product of Oracle Fusion Middleware component: WebSocket. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerabilit...
CVE-2026-83330
CVE-2026-83330 is a Denial of Service vulnerability in the WebSocket component of Helidon (Oracle Fusion Middleware), affecting versions 4.0.0 through 4.5.4 . An unauthenticated remote attacker with network access via HTTP can cause a hang or frequently repeatable crash (complete DoS) of the affe...
CVE-2026-69210 Http4s: WebSocket decoder accepts negative length, causing infinite decode loop
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAXVALUE but permits negative 64-bit lengths. A remote client that completes a WebSocket handshake through an Ember server can send su...
CVE-2026-69210 Http4s: WebSocket decoder accepts negative length, causing infinite decode loop
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Integer.MAXVALUE but permits negative 64-bit lengths. A remote client that completes a WebSocket handshake through an Ember server can send su...