Exploit for CVE-2026-106070

node-cve-2026-106070-check Standalon...

CVE-2026-106070

A flaw in the Node.js "zlib.ZipFile" API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When "zipEntry.modified" is read on an archive whose local header does not match its central directory, either directly or while...

SUSE SLES15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2026:4809-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4809-1 advisory. - CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression bsc1277111. - CVE-2026-15806:...

Node.js 26.x < 26.12.1 Multiple Vulnerabilities

The version of Node.js installed on the remote host is prior to 26.12.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Wednesday, October 21, 2026 Security Releases advisory. - The ZipFile implementation returns attacker-controlled prefix bytes after a failed ZIP...

Security update for python311

This update for python311 fixes the following issues: CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression bsc1277111. CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme bsc1276223. CVE-2026-17084: StringPrep...

Security update for python310

This update for python310 fixes the following issues: CVE-2026-7210: xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection bsc1264962. CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression bsc1277111. CVE-2026-15806:...

SUSE-SU-2026:24138-1 Security update for python311

This update for python311 fixes the following issues: - CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression bsc1277111. - CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination bsc1276227...

Rocky Linux 8 [CIQ] Security Update: Cython-debugsource / PyYAML-debugsource / numpy-debugsource / etc Multiple Vulnerabilities (crlsa-2025_23530)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202523530 advisory. python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used CVE-2024-5642 python: Virtual environment venv activation scripts don't...

Rocky Linux 10.1 [CIQ] Security Update: python-unversioned-command / python3 / python3-debug / etc (crlsa-2025_23940)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202523940 advisory. cpython: python: Python zipfile End of Central Directory EOCD Locator record offset not checked CVE-2025-8291 Tenable has extracted the preceding description...

Rocky Linux 9 [CIQ] Security Update: python3.12 / python3.12-debug / python3.12-debuginfo / etc (crlsa-2025_23323)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202523323 advisory. cpython: python: Python zipfile End of Central Directory EOCD Locator record offset not checked CVE-2025-8291 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: python3.12 / python3.12-debug / python3.12-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_0123)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20260123 advisory. cpython: python: Python zipfile End of Central Directory EOCD Locator record offset not checked CVE-2025-8291 cpython: python: cpython: Quadratic algorithm...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.2:CLSA-2024:1732700855)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1732700855 advisory. - There is a HIGH severity vulnerability affecting the CPython zipfile module affecting zipfile.Path. Note that the more common API...

Rocky Linux 8 [CIQ] Security Update: python3.12 / python3.12-debug / python3.12-debuginfo / etc (crlsa-2024_4243)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20244243 advisory. python: The zipfile module is vulnerable to zip-bombs leading to denial of service CVE-2024-0450 Tenable has extracted the preceding description block directly from...

AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1741126677)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1741126677 advisory. - An issue was found in the CPython zipfile module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The...

Rocky Linux 9 [CIQ] Security Update: python3.12 / python3.12-debug / python3.12-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_9190)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20249190 advisory. python: The zipfile module is vulnerable to zip-bombs leading to denial of service CVE-2024-0450 python: incorrect IPv4 and IPv6 private ranges CVE-2024-40...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.2:CLSA-2024:1734642829)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1734642829 advisory. - An issue was found in the CPython zipfile module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile modu...

Rocky Linux 9 [CIQ] Security Update: python3.11 / python3.11-debug / python3.11-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_9192)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20249192 advisory. python: The zipfile module is vulnerable to zip-bombs leading to denial of service CVE-2024-0450 python: cpython: Iterating over a malicious ZIP file may...

Security update for python311

This update for python311 fixes the following issues: CVE-2026-9669: crafted input can cause a stack buffer overflow bsc1267974. CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression bsc1277111. CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL...

SUSE-SU-2026:4396-1 Security update for python311

This update for python311 fixes the following issues: - CVE-2026-9669: crafted input can cause a stack buffer overflow bsc1267974. - CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression bsc1277111. - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one...

Security update for python310

This update for python310 fixes the following issues: CVE-2026-9669: crafted input can cause a stack buffer overflow bsc1267974. CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression bsc1277111. CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL...