Most recent entries from all

fkie_cve-2026-85597

2026-10-30T14:30:28.675888+00:00

Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiting shared TLS resolution across multiple hostnames in a single router rule, causing the strict mTLS requirement to fall back to default options for all hosts.

GHSA-q42x-32f8-m4r5

2026-10-30T14:30:28.676012+00:00

Traefik before v2.11.55 contains a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiting shared TLS resolution across multiple hostnames in a single router rule, causing the strict mTLS requirement to fall back to default options for all hosts.

RHSA-2026:90321 — Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.31.0 Release.

2026-10-30T14:30:28.676047+00:00

zod: zod: Denial of service via unbounded array validation axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function bouncycastle: Bouncy Castle: Denial of Service via untrusted keystore length allocation undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcprov-jdk18on: org.bouncycastle/bc-fips: org.bouncycastle/bctls-fips: Bouncy Castle for Java: Denial of Service due to unbounded memory allocation io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service github.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction @fastify/static: @fastify/static: Information disclosure via route guard bypass org.eclipse.jetty/jetty-http: Jetty: HTTP request smuggling via crafted chunked requests undici: undici: Denial of Service via unrequested WebSocket subprotocol net/mail: golang: Go net/mail: Denial of Service via crafted email inputs github.com/open-teleme…