curl: curl: Information disclosure due to secure cookie attribute bypass

A flaw was found in curl. When a Set-Cookie: header uses a tab character instead of a space before the Secure attribute, curl incorrectly stores the cookie without the Secure flag. This can lead to information disclosure, as the cookie may then be sent over unencrypted HTTP connections to the sam...

curl: curl: Authentication bypass in OpenLDAP SASL negotiation via Man-in-the-Middle (MITM) attack

A flaw was found in libcurl's SASL Simple Authentication and Security Layer negotiation for LDAP Lightweight Directory Access Protocol authentication when using the OpenLDAP backend. An incomplete handshake sequence can be misinterpreted as a successful cryptographic verification. A remote...

curl: libcurl: Use-after-free in HTTP/2 Server Push with shared connections

A flaw was found in libcurl. When libcurl handles HTTP/2 Server Push streams and the parent handle shares connections, a use-after-free vulnerability can occur during the cleanup process. This could lead to application crashes, resulting in a denial of service...

curl: curl: Public key pinning bypass allows unauthenticated connections

A flaw was found in libcurl, a client-side URL transfer library. When public key pinning is configured, but standard peer verification is explicitly disabled, libcurl incorrectly allows connections to proceed without enforcing the public key pinning. This bypass enables unauthenticated connection...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: curl: curl-8.22.0-0.1.hum1 aarch64, x8664 libcurl-8.22.0-0.1.hum1 aarch64, x8664 libcurl-devel-8.22.0-0.1.hum1 aarch64, x8664 libcurl-minimal-8.22.0-0.1.hum1 aarch64, x8664 curl-8.22.0-0.1.hum1.s...

curl: curl: Incorrect HTTPS connection reuse with Native CA Store

A flaw was found in libcurl. This vulnerability allows libcurl to incorrectly reuse an existing HTTPS connection for a given hostname, even when a different Native CA Store setting CURLSSLOPTNATIVECA is specified for the new connection. This could potentially lead to a client trusting a malicious...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.97 bug fix and security update

Red Hat OpenShift Container Platform release 4.12.97 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...

erlang: Erlang OTP: Denial of Service via crafted SCTP ERROR chunk

A flaw was found in Erlang OTP Open Telecom Platform erts, specifically within the inetdrv component. An unauthenticated remote attacker can exploit a stack-based buffer overflow vulnerability by sending a specially crafted Stream Control Transmission Protocol SCTP ERROR chunk. This can lead to a...

erlang: Erlang OTP public_key: Certificate validation bypass allows hostname spoofing

A flaw was found in Erlang OTP publickey. This improper certificate validation vulnerability allows a subordinate Certificate Authority CA with restricted DNS nameConstraints to bypass these restrictions. By issuing a leaf certificate that lacks a Subject Alternative Name SAN but contains a craft...

erlang: Erlang OTP ssh: Denial of Service via infinite loop in SFTP channel

A flaw was found in the Erlang OTP ssh Secure Shell component, specifically within its SFTP SSH File Transfer Protocol module. An authenticated SFTP user can exploit this vulnerability by sending specially crafted extended data on an open channel. This action triggers an infinite loop in the...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: erlang27: erlang27-27.3.4.17-1.hum1 aarch64, x8664 erlang27-asn1-27.3.4.17-1.hum1 aarch64, x8664 erlang27-commontest-27.3.4.17-1.hum1 aarch64, x8664 erlang27-compiler-27.3.4.17-1.hum1 aarch64,...

erlang: Erlang/OTP: Denial of Service in TLS 1.3 session ticket handling

A flaw was found in Erlang/OTP's SSL Secure Sockets Layer application. An unauthenticated remote attacker can send a specially crafted ClientHello message to a TLS 1.3 server with session tickets enabled. This can permanently disrupt the server's ability to handle session tickets, leading to a...

erlang: Erlang OTP: Authentication bypass due to improper OCSP certificate validation

A flaw was found in Erlang OTP's publickey application, specifically in the Online Certificate Status Protocol OCSP response verification. A remote attacker who has obtained the private key of an expired Certificate Authority CA-designated OCSP responder certificate can forge OCSP responses. This...

erlang: erlang-inets: erlang-ftp: Erlang/OTP ftp: Server-Side Request Forgery (SSRF) via unvalidated PASV response IP address

A flaw was found in Erlang/OTP's FTP File Transfer Protocol client, specifically within the ftpinternal module. A remote attacker, by operating a malicious or compromised FTP server, could exploit an unvalidated IP address in the server's passive mode PASV response. This vulnerability, known as...

erlang: Erlang OTP ssh: Information disclosure via symlink resolution in SFTP

A flaw was found in Erlang OTP ssh, specifically within the sshsftpd module. An authenticated SFTP client can exploit this vulnerability by creating a symbolic link symlink inside a restricted directory chroot that points to the root directory. When the client reads this symlink, the sshsftpd...

erlang: Erlang SSL: Unauthenticated data injection during TLS handshake

A flaw was found in Erlang's SSL Secure Sockets Layer component. A network-positioned attacker can exploit this vulnerability by injecting unauthenticated plaintext data into a client's TLS Transport Layer Security handshake. The client application may then process this injected data as if it wer...

erlang: Erlang OTP public_key: Certificate chain forgery via improper trust chain validation

A flaw was found in Erlang OTP's publickey module. This vulnerability CWE-295, related to improper certificate validation, allows a non-Certificate Authority CA certificate to be accepted as an intermediate issuer. A remote attacker, holding an end-entity certificate issued by a trusted CA, can...

erlang: Erlang/OTP: Authentication bypass allows arbitrary code execution via improper IP address validation

A flaw was found in Erlang/OTP. The inettlsdist:checkip/1 function, responsible for enforcing a LAN allowlist for Erlang distribution over TLS, incorrectly uses inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. This allows an unauthenticated attacker, possessing a...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

Important: Red Hat Security Advisory: grafana-pcp security update

An update for grafana-pcp is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter: opentelemetry-collector-contrib: OpenTelemetry Sentry Exporter: Path traversal allows unauthorized access to Sentry API endpoints

A flaw was found in the OpenTelemetry Sentry exporter. A remote attacker can exploit a path traversal vulnerability by manipulating the service.name attribute. This allows the attacker to craft malicious Sentry API URLs, potentially gaining unauthorized access to sensitive administrative or...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: opentelemetry-collector-contrib: opentelemetry-collector-contrib-0.160.0-0.1.hum1 aarch64, x8664 opentelemetry-collector-contrib-0.160.0-0.1.hum1.src src...

github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver: OpenTelemetry Collector Contrib githubreceiver: Unauthorized data injection via authentication bypass

A flaw was found in the OpenTelemetry Collector Contrib's githubreceiver component. An unauthenticated attacker can bypass authentication mechanisms, including required headers and HMAC validation, when the 'Secret' field is empty. This allows the attacker to submit arbitrary webhook payloads,...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: composer: composer-2.10.3-1.hum1 noarch composer-2.10.3-1.hum1.src src...

composer: Composer: Arbitrary code execution via malicious Perforce source URL

A flaw was found in Composer. A malicious dependency package from a custom Composer repository or an untrusted composer.lock file could exploit a vulnerability in how Composer handles Perforce source URLs. By setting source.type to perforce and source.url to an rsh: or jsh: P4PORT value, an...

composer: Composer: Security bypass allows execution of unauthorized binaries via symlinked paths

A flaw was found in Composer, a dependency manager for PHP. A malicious or compromised dependency can bypass existing security measures designed to prevent unauthorized binary path execution. This can occur when Composer processes untrusted cached data or older build artifacts, allowing it to...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.97 bug fix and security update

Red Hat OpenShift Container Platform release 4.12.97 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: Red Hat OpenShift GitOps v1.21.4 security update

Important: Red Hat OpenShift GitOps v1.21.4 security update An update is now available for Red Hat OpenShift GitOps. Bug Fixes and Enhancements: GITOPS-10472 GITOPS-10477...

Important: Red Hat Security Advisory: Red Hat OpenShift GitOps v1.20.7 security update

Important: Red Hat OpenShift GitOps v1.20.7 security update An update is now available for Red Hat OpenShift GitOps. Bug Fixes and Enhancements: GITOPS-10464 GITOPS-10466 GITOPS-7957...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.19.2

cert-manager Operator for Red Hat OpenShift 1.19.2 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

Important: Red Hat Security Advisory: Red Hat OpenShift GitOps v1.19.7 security update

Important: Red Hat OpenShift GitOps v1.19.7 security update An update is now available for Red Hat OpenShift GitOps...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.19.2

cert-manager Operator for Red Hat OpenShift 1.19.2 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.97 security and extras update

Red Hat OpenShift Container Platform release 4.12.97 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a security impact of Low...

Important: Red Hat Security Advisory: rhc security update

An update for rhc is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

org.apache.tomcat/tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak

A flaw was found in Apache Tomcat. This vulnerability, an uncontrolled resource consumption issue, arises from an allocation leak in the HTTP/2 backlog tracking when a stream is reset. A remote attacker could exploit this to cause a Denial of Service DoS, making the server unresponsive or...

tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition

A flaw was found in Apache Tomcat. A Time-of-check Time-of-use TOCTOU race condition exists when creating Unix domain sockets. This vulnerability allows an unauthorized local user to exploit the timing window to gain access to the Unix domain socket. This could lead to information disclosure or...

Apache Tomcat: Apache Tomcat: Security constraint bypass due to improper access control

A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potential...

tomcat: Apache Tomcat: Improper Authorization allows bypass of declarative role constraints

A flaw was found in Apache Tomcat. This improper authorization vulnerability occurs because security-role-ref definitions are incorrectly used as role aliases within the Realm, in addition to their correct usage with Request.isUserInRole. This misconfiguration allows for a bypass of declarative...

tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing

A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve's N flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls...

Apache Tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation

A flaw was found in Apache Tomcat. This improper input validation vulnerability, stemming from an incomplete fix for CVE-2026-32990, allows for an HTTP/2 no-authority bypass of strict Server Name Indication SNI validation. This could potentially lead to unauthorized access or misrouting of reques...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: tomcat10: tomcat10-10.1.59-0.1.hum1 noarch tomcat10-admin-webapps-10.1.59-0.1.hum1 noarch tomcat10-common-10.1.59-0.1.hum1 noarch tomcat10-docs-webapp-10.1.59-0.1.hum1 noarch...

tomcat: Apache Tomcat: Authenticated WebSocket session persists after HTTP session termination

A flaw was found in Apache Tomcat. This vulnerability, categorized as Insufficient Session Expiration, occurs when an authenticated HTTP session's ID is modified after a WebSocket connection has been established. Under these conditions, the WebSocket session fails to terminate as expected when th...

org.apache.tomcat/tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass

A flaw was found in Apache Tomcat. This incorrect authorization vulnerability occurs within the FORM authentication process, allowing a user to bypass security constraints. This bypass enables unauthorized access to resources via a GET request, even when those resources are intended to be...