Most recent entries from all

ALSA-2026:7080 — Important: nodejs22 security update

Affected: AlmaLinux:10: nodejs-docs

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547) * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996) * minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904) * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526) * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229) * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525) * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528) * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the Re…

bdu:2026-12833

BELL-CVE-2026-27135

Affected: Alpaquita:23: nghttp2, Alpaquita:25: nghttp2, Alpaquita:stream: nghttp2, BellSoft Hardened Containers:23: nghttp2, BellSoft Hardened Containers:25: nghttp2, BellSoft Hardened Containers:stream: nghttp2

certfr-2026-avi-0341 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoqu…

certfr-2026-avi-0341

CLEANSTART-2026-CI31043 — nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C

Affected: CleanStart: nghttp2

Security vulnerability affects the nghttp2 package. nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C.

EUVD-2026-364719

fkie_cve-2026-27135

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.

ICSA-26-209-04 — Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP

Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant).

Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

msrc_CVE-2026-27135 — nghttp2 Denial of service: Assertion failure due to the missing state validation

msrc_CVE-2026-27135

OESA-2026-1754 — nghttp2 security update

Affected: openEuler:20.03-LTS-SP4: nghttp2, openEuler:22.03-LTS-SP4: nghttp2, openEuler:24.03-LTS: nghttp2, openEuler:24.03-LTS-SP1: nghttp2, openEuler:24.03-LTS-SP2: nghttp2, openEuler:24.03-LTS-SP3: nghttp2

The framing layer of HTTP/2 is implemented as a form of reusable C library. On top of that, we have implemented HTTP/2 client, server and proxy. We have also developed load test and benchmarking tool for HTTP/2. Security Fix(es):

A security vulnerability exists in nghttp2 library where missing state validation leads to assertion failure, which can be exploited by attackers to cause denial of service.(CVE-2026-27135)

openSUSE-SU-2026:10437-1 — libnghttp2-14-1.68.1-1.1 on GA media

libnghttp2-14-1.68.1-1.1 on GA media

RHSA-2026:10065 — Red Hat Security Advisory: Red Hat Update Infrastructure 5.1 security update

libxslt: Processing web content may disclose sensitive information nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing python: Python: Command-line option injection in webbrowser.open() via crafted URLs libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing net/url: Incorrect parsing of IPv6 host literals in net/url vim: Vim: Arbitrary code execution via 'helpfile' option processing nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination NGINX: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled NGINX: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin vim: Vim: Denial of service and information disclosure via crafted swap file nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files vim: Vim: Arbitrary code execution via command injection in glob() function

SSA-019113 — SSA-019113: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.6

Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant).

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

SUSE-SU-2026:1056-1 — Security update for nghttp2

Security update for nghttp2

UBUNTU-CVE-2026-27135

Affected: Ubuntu:Pro:16.04:LTS: nghttp2, Ubuntu:Pro:18.04:LTS: nghttp2, Ubuntu:Pro:20.04:LTS: nghttp2, Ubuntu:22.04:LTS: nghttp2, Ubuntu:24.04:LTS: nghttp2, Ubuntu:25.10: nghttp2, Ubuntu:26.04:LTS: nghttp2

VDE-2026-088 — METTLER TOLEDO: LabX Standard and Enterprise Report on External Component Analysis - v21.4

The vulnerabilities found in LabX Standard versions 21.3.22 - 21.4.23 are CVE-2025-69419, CVE-2026-0915, CVE-2025-15467, CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Standard v21.4.25.

The vulnerabilities found in LabX Enterprise versions 21.3.22 - 21.4.23 are CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Enterprise v21.4.25

All other vulnerabilities are to be fixed in the upcoming releases.

WID-SEC-W-2026-0775 — nghttp2: Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in nghttp2 ausnutzen, um einen Denial of Service Angriff durchzuführen.