Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 67 articles for you...
202
security advisorydenial of servicearbitrary code executionopenSUSE python-aiohttp Important Denial of Service Fix 2026-21098-1
An update that solves 11 vulnerabilities and has 11 bug fixes can now be installed.. openSUSE security update: security update for python-aiohttp ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21098-1 Rating: important References: * bsc#1261320 * bsc#1261321 * bsc#1261322 * bsc#1261329 * bsc#1261331 * bsc#1261332 * bsc#1261334 * bsc#1261335 * bsc#1261343 * bsc#1267471 * bsc#1267561 Cross-References: * CVE-2026-22815 * CVE-2026-34513 * CVE-2026-34514 * CVE-2026-34516 * CVE-2026-34517 * CVE-2026-34518 * CVE-2026-34519 * CVE-2026-34520 * CVE-2026-34525 * CVE-2026-34993 * CVE-2026-47265 CVSS scores: * CVE-2026-22815 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-22815 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-34513 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-34513 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-34514 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L * CVE-2026-34514 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2026-34516 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-34516 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-34517 ( SUSE ): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2026-34517 ( SUSE ): 2.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-34518 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2026-34518 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-34519 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-34519 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-34520 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-34520 ( SUSE ): 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-34525 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N * CVE-2026-34525 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N * CVE-2026-34993 ( SUSE ): 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-47265 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 16.0 ------------------------------------------------------------- An update that solves 11 vulnerabilities and has 11 bug fixes can now be installed. Description: This update for python-aiohttp fixes the following issues - CVE-2026-22815: insufficient header/trailer handling can cause a denial of service (bsc#1261320). - CVE-2026-34513: unbounded DNS cache can cause a denial of service (bsc#1261321). - CVE-2026-34514: content_type parameter manipulation can lead to header Injection (bsc#1261322). - CVE-2026-34516: excessive multipart headers can cause a denial of service (bsc#1261329). - CVE-2026-34517: large multipart form fields can cause a denial of service (bsc#1261331). - CVE-2026-34518: retained Cookie and Proxy-Authorization headers during redirects can lead to information disclosure (bsc#1261332). - CVE-2026-34519: reason parameter can be use to perform header injection (bsc#1261334). - CVE-2026-34520: improper character handling can lead to header injection (bsc#1261335). - CVE-2026-34525: multiple Host headers can potentially lead to security bypass (bsc#1261343). - CVE-2026-34993: arbitrary code execution via loading untrusted input in CookieJar.load() (bsc#1267471). - CVE-2026-47265: cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect (bsc#1267561). Patch instructions: To install this openSUSE security update use the suse recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 16.0 zypper in -tpatch openSUSE-Leap-16.0-963=1 Package List: - openSUSE Leap 16.0: python313-aiohttp-3.11.16-160000.5.1 References: * https://www.suse.com/security/cve/CVE-2026-22815.html * https://www.suse.com/security/cve/CVE-2026-34513.html * https://www.suse.com/security/cve/CVE-2026-34514.html * https://www.suse.com/security/cve/CVE-2026-34516.html * https://www.suse.com/security/cve/CVE-2026-34517.html * https://www.suse.com/security/cve/CVE-2026-34518.html * https://www.suse.com/security/cve/CVE-2026-34519.html * https://www.suse.com/security/cve/CVE-2026-34520.html * https://www.suse.com/security/cve/CVE-2026-34525.html * https://www.suse.com/security/cve/CVE-2026-34993.html * https://www.suse.com/security/cve/CVE-2026-47265.html . An important security update for openSUSE addresses 11 issues in python-aiohttp, enhancing protection against attacks.. openSUSE advisory, python-aiohttp update, security patch, Linux vulnerabilities. . Severity: Important. LinuxSecurity.com Team
Jun 30, 2026
•Important
OpenSUSE
202
security advisorydenial of serviceimportantopenSUSE Rmt-Server Important Rack Denial of Service Fix 2026-2487-1
An update that solves 10 vulnerabilities and has one security fix can now be installed.. # Security update for rmt-server Announcement ID: SUSE-SU-2026:2487-1 Release Date: 2026-06-22T12:08:32Z Rating: important References: * bsc#1246976 * bsc#1261388 * bsc#1261398 * bsc#1261406 * bsc#1261417 * bsc#1261426 * bsc#1261436 * bsc#1261447 * bsc#1261458 * bsc#1261466 * bsc#1261471 Cross-References: * CVE-2026-26961 * CVE-2026-26962 * CVE-2026-34230 * CVE-2026-34763 * CVE-2026-34785 * CVE-2026-34786 * CVE-2026-34826 * CVE-2026-34829 * CVE-2026-34830 * CVE-2026-34831 CVSS scores: * CVE-2026-26961 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-26961 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-26961 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-26961 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-26962 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-26962 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-26962 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-26962 ( NVD ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-34230 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-34230 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-34230 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-34230 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-34763 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-34763 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2026-34763 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2026-34785 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-34785 ( SUSE ): 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-34785 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-34786 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-34786 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-34786 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-34826 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-34826 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-34826 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-34826 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-34829 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-34829 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-34829 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-34830 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-34830 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-34830 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-34830 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-34831 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-34831 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-34831 ( NVD ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-34831 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affected Products: * openSUSE Leap 15.5 * Public Cloud Module 15-SP5 * Public Cloud Module 15-SP6 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP5 LTSS * SUSELinux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server 15 SP6 LTSS * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that solves 10 vulnerabilities and has one security fix can now be installed. ## Description: This update for rmt-server fixes the following issues * CVE-2026-26961: rack: mismatch in header handling can allow to smuggle multipart content (bsc#1261398). * CVE-2026-26962: rack: improper unfolding of folded multipart headers can lead to header injection or response splitting (bsc#1261471). * CVE-2026-34230: rack: crafted Accept-Encoding header can cause a denial of service (bsc#1261388). * CVE-2026-34763: rack: failing of the prefix stripping can lead to information disclosure (bsc#1261406). * CVE-2026-34785: rack: prefix matching can expose unintended files under the static root (bsc#1261417). * CVE-2026-34786: rack: URL-encoded path mismatch can lead to `header_rules` bypass (bsc#1261426). * CVE-2026-34826: rack: multipart byte range processing can allow denial of service (bsc#1261436). * CVE-2026-34829: rack: multipart parsing without `Content-Length` header allows unbounded chunked file uploads (bsc#1261447). * CVE-2026-34830: rack: crafted `X-Accel-Mapping`headers can lead to regex injection (bsc#1261458). * CVE-2026-34831: rack: `Content-Length` mismatch can lead to incorrectly framed error responses (bsc#1261466). Changes for rmt-server: * Updated to version 2.27 ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server for SAP Applications 15 SP6 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-2487=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-2487=1 * SUSE LinuxEnterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-2487=1 * Public Cloud Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP5-2026-2487=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-2487=1 * Public Cloud Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP6-2026-2487=1 * openSUSE Leap 15.5 zypper in -t patch SUSE-2026-2487=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-2487=1 * SUSE Linux Enterprise Server 15 SP6 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-2487=1 ## Package List: * Public Cloud Module 15-SP5 (aarch64 ppc64le s390x x86_64) * rmt-server-debugsource-2.27-150500.3.47.1 * rmt-server-debuginfo-2.27-150500.3.47.1 * rmt-server-pubcloud-2.27-150500.3.47.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64) * rmt-server-2.27-150500.3.47.1 * rmt-server-debuginfo-2.27-150500.3.47.1 * rmt-server-config-2.27-150500.3.47.1 * rmt-server-debugsource-2.27-150500.3.47.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * rmt-server-debugsource-2.27-150500.3.47.1 * rmt-server-2.27-150500.3.47.1 * rmt-server-config-2.27-150500.3.47.1 * rmt-server-debuginfo-2.27-150500.3.47.1 * rmt-server-pubcloud-2.27-150500.3.47.1 * Public Cloud Module 15-SP6 (aarch64 ppc64le s390x x86_64) * rmt-server-debugsource-2.27-150500.3.47.1 * rmt-server-debuginfo-2.27-150500.3.47.1 * rmt-server-pubcloud-2.27-150500.3.47.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64) * rmt-server-debugsource-2.27-150500.3.47.1 * rmt-server-2.27-150500.3.47.1 * rmt-server-debuginfo-2.27-150500.3.47.1 * rmt-server-config-2.27-150500.3.47.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5(aarch64 x86_64) * rmt-server-debugsource-2.27-150500.3.47.1 * rmt-server-2.27-150500.3.47.1 * rmt-server-debuginfo-2.27-150500.3.47.1 * rmt-server-config-2.27-150500.3.47.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64 x86_64) * rmt-server-2.27-150500.3.47.1 * rmt-server-debuginfo-2.27-150500.3.47.1 * rmt-server-config-2.27-150500.3.47.1 * rmt-server-debugsource-2.27-150500.3.47.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64) * rmt-server-2.27-150500.3.47.1 * rmt-server-debuginfo-2.27-150500.3.47.1 * rmt-server-config-2.27-150500.3.47.1 * rmt-server-debugsource-2.27-150500.3.47.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64) * rmt-server-2.27-150500.3.47.1 * rmt-server-debuginfo-2.27-150500.3.47.1 * rmt-server-config-2.27-150500.3.47.1 * rmt-server-debugsource-2.27-150500.3.47.1 ## References: * https://www.suse.com/security/cve/CVE-2026-26961.html * https://www.suse.com/security/cve/CVE-2026-26962.html * https://www.suse.com/security/cve/CVE-2026-34230.html * https://www.suse.com/security/cve/CVE-2026-34763.html * https://www.suse.com/security/cve/CVE-2026-34785.html * https://www.suse.com/security/cve/CVE-2026-34786.html * https://www.suse.com/security/cve/CVE-2026-34826.html * https://www.suse.com/security/cve/CVE-2026-34829.html * https://www.suse.com/security/cve/CVE-2026-34830.html * https://www.suse.com/security/cve/CVE-2026-34831.html * https://bugzilla.suse.com/show_bug.cgi?id=1246976 * https://bugzilla.suse.com/show_bug.cgi?id=1261388 * https://bugzilla.suse.com/show_bug.cgi?id=1261398 * https://bugzilla.suse.com/show_bug.cgi?id=1261406 * https://bugzilla.suse.com/show_bug.cgi?id=1261417 * https://bugzilla.suse.com/show_bug.cgi?id=1261426 * https://bugzilla.suse.com/show_bug.cgi?id=1261436 * https://bugzilla.suse.com/show_bug.cgi?id=1261447 * https://bugzilla.suse.com/show_bug.cgi?id=1261458 *https://bugzilla.suse.com/show_bug.cgi?id=1261466 * https://bugzilla.suse.com/show_bug.cgi?id=1261471 . An important update for openSUSE fixes multiple issues in rmt-server, addressing ten vulnerabilities effectively.. openSUSE Update,rmt-server Patch,Security Critical Update,SUSE Vulnerability Fix. . Severity: Important. LinuxSecurity.com Team
Jun 22, 2026
•Important
OpenSUSE
89
security advisoryfedoracriticalFedora 43 perl-HTTP-Tiny Critical Header Smuggling Fix CVE-2026-7010
0.094 - fix to prevent invalid characters in all headers, and prevent header smuggling (CVE-2026-7010). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-3bfb774625 2026-06-05 04:07:33.979891+00:00 -------------------------------------------------------------------------------- Name : perl-HTTP-Tiny Product : Fedora 43 Version : 0.094 Release : 1.fc43 URL : https://metacpan.org/release/HTTP-Tiny Summary : Small, simple, correct HTTP/1.1 client Description : This is a very simple HTTP/1.1 client, designed for doing simple GET requests without the overhead of a large framework like LWP::UserAgent. It is more correct and more complete than HTTP::Lite. It supports proxies (currently only non-authenticating ones) and redirection. It also correctly resumes after EINTR. -------------------------------------------------------------------------------- Update Information: 0.094 - fix to prevent invalid characters in all headers, and prevent header smuggling (CVE-2026-7010) -------------------------------------------------------------------------------- ChangeLog: * Wed May 20 2026 Jitka Plesnikova - 0.094-1 - 0.094 bump (rhbz#2478249) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2478249 - perl-HTTP-Tiny-0.094 is available https://bugzilla.redhat.com/show_bug.cgi?id=2478249 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-3bfb774625' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jun 05, 2026
•Critical
Fedora
202
security advisorydenial of serviceimportantopenSUSE 2026-0174-1 cpp-httplib Important Denial of Service
An update that fixes 5 vulnerabilities is now available.. openSUSE Security Update: Security update for cpp-httplib ______________________________________________________________________________ Announcement ID: openSUSE-SU-2026:0174-1 Rating: important References: #1255835 #1256518 #1259220 #1259221 #1259373 Cross-References: CVE-2026-21428 CVE-2026-22776 CVE-2026-28434 CVE-2026-28435 CVE-2026-29076 CVSS scores: CVE-2026-21428 (SUSE): 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N CVE-2026-22776 (SUSE): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2026-28434 (SUSE): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVE-2026-28435 (SUSE): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2026-29076 (SUSE): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected Products: openSUSE Backports SLE-15-SP7 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for cpp-httplib fixes the following issues: - CVE-2026-21428: Fixed a server-side request forgery via header injection (boo#1255835) - CVE-2026-22776: Fixed unsafe handling of compressed HTTP request that could cause a denial of service (boo#1256518) - CVE-2026-28434: Fixed that the default exception handler could leak e.what() to clients via EXCEPTION_WHAT response header (boo#1259221) - CVE-2026-28435: Fixed a payload size limit bypass via gzip decompression in ContentReader (streaming) that could lead to denial of service (boo#1259220) - CVE-2026-29076: Fixed denial of service via crafted HTTP POST request (boo#1259373) Patch Instructions: To install this openSUSE Security Update use the SUSE recommendedinstallation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP7: zypper in -t patch openSUSE-2026-174=1 Package List: - openSUSE Backports SLE-15-SP7 (aarch64 i586 ppc64le s390x x86_64): cpp-httplib-devel-0.20.1-bp157.2.6.1 libcpp-httplib0_20-0.20.1-bp157.2.6.1 References: https://www.suse.com/security/cve/CVE-2026-21428.html https://www.suse.com/security/cve/CVE-2026-22776.html https://www.suse.com/security/cve/CVE-2026-28434.html https://www.suse.com/security/cve/CVE-2026-28435.html https://www.suse.com/security/cve/CVE-2026-29076.html https://bugzilla.suse.com/1255835 https://bugzilla.suse.com/1256518 https://bugzilla.suse.com/1259220 https://bugzilla.suse.com/1259221 https://bugzilla.suse.com/1259373 . An openSUSE advisory covering security fixes for cpp-httplib addressing multiple vulnerabilities. Updates recommended.. openSUSE advisory, cpp-httplib security, denial of service, header injection, server-side request forgery. . Severity: Important. LinuxSecurity.com Team
May 22, 2026
•Important
OpenSUSE
202
security advisorydenial of servicesoftware updateopenSUSE RMT-Server Important Denial of Service Fix SUSE-SU-2026-1964-1
An update that solves 10 vulnerabilities and has one security fix can now be installed.. # Security update for rmt-server Announcement ID: SUSE-SU-2026:1964-1 Release Date: 2026-05-18T08:10:10Z Rating: important References: * bsc#1246976 * bsc#1261388 * bsc#1261398 * bsc#1261406 * bsc#1261417 * bsc#1261426 * bsc#1261436 * bsc#1261447 * bsc#1261458 * bsc#1261466 * bsc#1261471 Cross-References: * CVE-2026-26961 * CVE-2026-26962 * CVE-2026-34230 * CVE-2026-34763 * CVE-2026-34785 * CVE-2026-34786 * CVE-2026-34826 * CVE-2026-34829 * CVE-2026-34830 * CVE-2026-34831 CVSS scores: * CVE-2026-26961 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-26961 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-26961 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-26961 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-26962 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-26962 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-26962 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-26962 ( NVD ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-34230 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-34230 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-34230 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-34230 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-34763 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-34763 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2026-34763 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2026-34785 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-34785 ( SUSE ): 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-34785 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-34786 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-34786 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-34786 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2026-34826 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2026-34826 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-34826 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-34826 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-34829 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-34829 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-34829 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-34830 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-34830 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-34830 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-34830 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-34831 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-34831 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-34831 ( NVD ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-34831 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affected Products: * openSUSE Leap 15.4 * Public Cloud Module 15-SP4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS * SUSE Linux Enterprise Server for SAPApplications 15 SP4 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves 10 vulnerabilities and has one security fix can now be installed. ## Description: This update for rmt-server fixes the following issues * CVE-2026-26961: rack: mismatch in header handling can allow to smuggle multipart content (bsc#1261398). * CVE-2026-26962: rack: improper unfolding of folded multipart headers can lead to header injection or response splitting (bsc#1261471). * CVE-2026-34230: rack: crafted Accept-Encoding header can cause a denial of service (bsc#1261388). * CVE-2026-34763: rack: failing of the prefix stripping can lead to information disclosure (bsc#1261406). * CVE-2026-34785: rack: prefix matching can expose unintended files under the static root (bsc#1261417). * CVE-2026-34786: rack: URL-encoded path mismatch can lead to `header_rules` bypass (bsc#1261426). * CVE-2026-34826: rack: multipart byte range processing can allow denial of service (bsc#1261436). * CVE-2026-34829: rack: multipart parsing without `Content-Length` header allows unbounded chunked file uploads (bsc#1261447). * CVE-2026-34830: rack: crafted `X-Accel-Mapping`headers can lead to regex injection (bsc#1261458). * CVE-2026-34831: rack: `Content-Length` mismatch can lead to incorrectly framed error responses (bsc#1261466). Other fixes: * Update to version 2.27 ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2026-1964=1 * Public Cloud Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP4-2026-1964=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-1964=1 * SUSE Linux Enterprise High Performance ComputingLTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-1964=1 * SUSE Linux Enterprise Server 15 SP4 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-1964=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-1964=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * rmt-server-pubcloud-2.27-150400.3.54.1 * rmt-server-2.27-150400.3.54.1 * rmt-server-debuginfo-2.27-150400.3.54.1 * rmt-server-debugsource-2.27-150400.3.54.1 * rmt-server-config-2.27-150400.3.54.1 * Public Cloud Module 15-SP4 (aarch64 ppc64le s390x x86_64) * rmt-server-debuginfo-2.27-150400.3.54.1 * rmt-server-debugsource-2.27-150400.3.54.1 * rmt-server-pubcloud-2.27-150400.3.54.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * rmt-server-debuginfo-2.27-150400.3.54.1 * rmt-server-config-2.27-150400.3.54.1 * rmt-server-debugsource-2.27-150400.3.54.1 * rmt-server-2.27-150400.3.54.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * rmt-server-debuginfo-2.27-150400.3.54.1 * rmt-server-config-2.27-150400.3.54.1 * rmt-server-debugsource-2.27-150400.3.54.1 * rmt-server-2.27-150400.3.54.1 * SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64) * rmt-server-debuginfo-2.27-150400.3.54.1 * rmt-server-config-2.27-150400.3.54.1 * rmt-server-debugsource-2.27-150400.3.54.1 * rmt-server-2.27-150400.3.54.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * rmt-server-debuginfo-2.27-150400.3.54.1 * rmt-server-config-2.27-150400.3.54.1 * rmt-server-debugsource-2.27-150400.3.54.1 * rmt-server-2.27-150400.3.54.1 ## References: * https://www.suse.com/security/cve/CVE-2026-26961.html * https://www.suse.com/security/cve/CVE-2026-26962.html * https://www.suse.com/security/cve/CVE-2026-34230.html *https://www.suse.com/security/cve/CVE-2026-34763.html * https://www.suse.com/security/cve/CVE-2026-34785.html * https://www.suse.com/security/cve/CVE-2026-34786.html * https://www.suse.com/security/cve/CVE-2026-34826.html * https://www.suse.com/security/cve/CVE-2026-34829.html * https://www.suse.com/security/cve/CVE-2026-34830.html * https://www.suse.com/security/cve/CVE-2026-34831.html * https://bugzilla.suse.com/show_bug.cgi?id=1246976 * https://bugzilla.suse.com/show_bug.cgi?id=1261388 * https://bugzilla.suse.com/show_bug.cgi?id=1261398 * https://bugzilla.suse.com/show_bug.cgi?id=1261406 * https://bugzilla.suse.com/show_bug.cgi?id=1261417 * https://bugzilla.suse.com/show_bug.cgi?id=1261426 * https://bugzilla.suse.com/show_bug.cgi?id=1261436 * https://bugzilla.suse.com/show_bug.cgi?id=1261447 * https://bugzilla.suse.com/show_bug.cgi?id=1261458 * https://bugzilla.suse.com/show_bug.cgi?id=1261466 * https://bugzilla.suse.com/show_bug.cgi?id=1261471 . Security update for openSUSE addresses 10 issues in rmt-server. Important fix for denial of service vulnerabilities.. openSUSE update rmt-server denial of service important. . Severity: Important. LinuxSecurity.com Team
May 18, 2026
•Important
OpenSUSE
100
security advisorydenial of serviceSuSESUSE 2026 cpp-httplib Important Denial of Service and Injection Risks
An update that solves five vulnerabilities can now be installed.. # Security update for cpp-httplib Announcement ID: SUSE-SU-2026:21599-1 Release Date: 2026-05-08T10:00:52Z Rating: important References: * bsc#1255835 * bsc#1256518 * bsc#1259220 * bsc#1259221 * bsc#1259373 Cross-References: * CVE-2026-21428 * CVE-2026-22776 * CVE-2026-28434 * CVE-2026-28435 * CVE-2026-29076 CVSS scores: * CVE-2026-21428 ( SUSE ): 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N * CVE-2026-21428 ( NVD ): 7.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-21428 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2026-22776 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-22776 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-22776 ( NVD ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-22776 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-28434 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-28434 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2026-28434 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2026-28435 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-28435 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-28435 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-29076 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-29076 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-29076 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * SUSE Linux Enterprise Server 16.0 * SUSE Linux Enterprise Server for SAP applications 16.0 An update that solves five vulnerabilities can now be installed. ## Description: This update for cpp-httplib fixes the following issues * CVE-2026-21428: server-side request forgery via header injection (bsc#1255835). * CVE-2026-22776: unsafe handling of compressed HTTP request can cause a denial of service (bsc#1256518). * CVE-2026-28434: default exception handler may leak e.what() to clients via EXCEPTION_WHAT response header (bsc#1259221). * CVE-2026-28435: payload size limit bypass via gzip decompression in ContentReader (streaming) can lead to denial of service (bsc#1259220). * CVE-2026-29076: denial of service via crafted HTTP POST request (bsc#1259373). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 16.0 zypper in -t patch SUSE-SLES-16.0-724=1 * SUSE Linux Enterprise Server for SAP applications 16.0 zypper in -t patch SUSE-SLES-16.0-724=1 ## Package List: * SUSE Linux Enterprise Server 16.0 (aarch64 ppc64le s390x x86_64) * libcpp-httplib0_22-debuginfo-0.22.0-160000.5.1 * cpp-httplib-debugsource-0.22.0-160000.5.1 * libcpp-httplib0_22-0.22.0-160000.5.1 * SUSE Linux Enterprise Server for SAP applications 16.0 (ppc64le x86_64) * libcpp-httplib0_22-debuginfo-0.22.0-160000.5.1 * cpp-httplib-debugsource-0.22.0-160000.5.1 * libcpp-httplib0_22-0.22.0-160000.5.1 ## References: * https://www.suse.com/security/cve/CVE-2026-21428.html * https://www.suse.com/security/cve/CVE-2026-22776.html * https://www.suse.com/security/cve/CVE-2026-28434.html * https://www.suse.com/security/cve/CVE-2026-28435.html * https://www.suse.com/security/cve/CVE-2026-29076.html * https://bugzilla.suse.com/show_bug.cgi?id=1255835 *https://bugzilla.suse.com/show_bug.cgi?id=1256518 * https://bugzilla.suse.com/show_bug.cgi?id=1259220 * https://bugzilla.suse.com/show_bug.cgi?id=1259221 * https://bugzilla.suse.com/show_bug.cgi?id=1259373 . Five critical vulnerabilities fixed in cpp-httplib for SUSE. Recommended updates to ensure system security.. SUSE patch cpp-httplib update important. . Severity: Important. LinuxSecurity.com Team
May 15, 2026
•Important
SuSE
100
security advisorydenial of serviceSuSESUSE Linux 15 SP7 Python311 Important Security Issues Advisory 2026-1349-1
An update that solves 15 vulnerabilities can now be installed.. # Security update for python311 Announcement ID: SUSE-SU-2026:1349-1 Release Date: 2026-04-15T13:36:10Z Rating: important References: * bsc#1252974 * bsc#1254400 * bsc#1254401 * bsc#1254997 * bsc#1257029 * bsc#1257031 * bsc#1257042 * bsc#1257046 * bsc#1257181 * bsc#1259240 * bsc#1259611 * bsc#1259734 * bsc#1259735 * bsc#1259989 * bsc#1260026 Cross-References: * CVE-2025-11468 * CVE-2025-12084 * CVE-2025-13462 * CVE-2025-13836 * CVE-2025-13837 * CVE-2025-15282 * CVE-2025-6075 * CVE-2026-0672 * CVE-2026-0865 * CVE-2026-1299 * CVE-2026-2297 * CVE-2026-3479 * CVE-2026-3644 * CVE-2026-4224 * CVE-2026-4519 CVSS scores: * CVE-2025-11468 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2025-11468 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2025-11468 ( NVD ): 5.7 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-12084 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-12084 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2025-12084 ( NVD ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-12084 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2025-13462 ( SUSE ): 2.0 CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2025-13462 ( SUSE ): 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N * CVE-2025-13462 ( NVD ): 2.0 CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-13836 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-13836 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2025-13836 ( NVD ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-13836 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2025-13837 ( SUSE ): 2.1 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-13837 ( SUSE ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2025-13837 ( NVD ): 2.1 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-13837 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2025-15282 ( SUSE ): 5.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2025-15282 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H * CVE-2025-15282 ( NVD ): 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-6075 ( SUSE ): 1.8 CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-6075 ( SUSE ): 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L * CVE-2025-6075 ( NVD): 1.8 CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-6075 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2026-0672 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-0672 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2026-0672 ( NVD ): 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-0865 ( SUSE ): 5.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-0865 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H * CVE-2026-0865 ( NVD ): 5.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-1299 ( SUSE ): 8.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-1299 ( SUSE ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N * CVE-2026-1299 ( NVD ): 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-2297 ( SUSE ): 5.7 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-2297 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N * CVE-2026-2297 ( NVD ): 5.7 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-3479 ( SUSE ): 2.0 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-3479 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N * CVE-2026-3479 ( NVD ): 0.0 CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-3644 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-3644 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-3644 ( NVD ): 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-4224 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-4224 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-4224 ( NVD ): 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-4519 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N * CVE-2026-4519 ( SUSE ): 6.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N * CVE-2026-4519 ( NVD ): 7.0 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affected Products: * Basesystem Module 15-SP7 * openSUSE Leap 15.6 * Python 3 Module 15-SP7 * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server 15 SP6 LTSS * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 An update that solves 15 vulnerabilities can now be installed. ## Description: This update for python311 fixes the following issues: * Updated to Python 3.11.15 * CVE-2025-6075: If the value passed to os.path.expandvars() is user- controlled aperformance degradation is possible when expanding environment variables (bsc#1252974). * CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively unfoldable characters (bsc#1257029). * CVE-2025-12084: cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service (bsc#1254997). * CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined (bsc#1259611). * CVE-2025-13836: When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length (bsc#1254400). * CVE-2025-13837: When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues (bsc#1254401). * CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046). * CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel (bsc#1257031). * CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers (bsc#1257042). * CVE-2026-1299: header injection when an email is serialized due to improper newline quoting in `BytesGenerator` (bsc#1257181). * CVE-2026-2297: cpython: incorrectly handled hook in FileLoader can lead to validation bypass (bsc#1259240). * CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989). * CVE-2026-3644: incomplete control character validation in http.cookies (bsc#1259734). * CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735). * CVE-2026-4519: leading dashes in URLs are accepted by the `webbrowser.open()` API and allow for web browser command line option injection (bsc#1260026). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methodslike YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch SUSE-2026-1349=1 openSUSE-SLE-15.6-2026-1349=1 * Basesystem Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-1349=1 * Python 3 Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Python3-15-SP7-2026-1349=1 * SUSE Linux Enterprise Server 15 SP6 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1349=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1349=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586) * python311-tk-debuginfo-3.11.15-150600.3.53.1 * python311-testsuite-3.11.15-150600.3.53.1 * python311-debugsource-3.11.15-150600.3.53.1 * python311-base-3.11.15-150600.3.53.1 * python311-curses-3.11.15-150600.3.53.1 * python311-tk-3.11.15-150600.3.53.1 * libpython3_11-1_0-3.11.15-150600.3.53.1 * python311-base-debuginfo-3.11.15-150600.3.53.1 * python311-core-debugsource-3.11.15-150600.3.53.1 * python311-testsuite-debuginfo-3.11.15-150600.3.53.1 * python311-doc-devhelp-3.11.15-150600.3.53.1 * python311-doc-3.11.15-150600.3.53.1 * python311-tools-3.11.15-150600.3.53.1 * python311-curses-debuginfo-3.11.15-150600.3.53.1 * python311-3.11.15-150600.3.53.1 * python311-debuginfo-3.11.15-150600.3.53.1 * python311-idle-3.11.15-150600.3.53.1 * python311-devel-3.11.15-150600.3.53.1 * libpython3_11-1_0-debuginfo-3.11.15-150600.3.53.1 * python311-dbm-debuginfo-3.11.15-150600.3.53.1 * python311-dbm-3.11.15-150600.3.53.1 * openSUSE Leap 15.6 (x86_64) * libpython3_11-1_0-32bit-debuginfo-3.11.15-150600.3.53.1 * python311-32bit-debuginfo-3.11.15-150600.3.53.1 * python311-32bit-3.11.15-150600.3.53.1 * python311-base-32bit-3.11.15-150600.3.53.1 * python311-base-32bit-debuginfo-3.11.15-150600.3.53.1 *libpython3_11-1_0-32bit-3.11.15-150600.3.53.1 * openSUSE Leap 15.6 (aarch64_ilp32) * python311-base-64bit-3.11.15-150600.3.53.1 * python311-64bit-3.11.15-150600.3.53.1 * python311-64bit-debuginfo-3.11.15-150600.3.53.1 * libpython3_11-1_0-64bit-3.11.15-150600.3.53.1 * libpython3_11-1_0-64bit-debuginfo-3.11.15-150600.3.53.1 * python311-base-64bit-debuginfo-3.11.15-150600.3.53.1 * Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64) * libpython3_11-1_0-debuginfo-3.11.15-150600.3.53.1 * libpython3_11-1_0-3.11.15-150600.3.53.1 * python311-base-3.11.15-150600.3.53.1 * python311-base-debuginfo-3.11.15-150600.3.53.1 * python311-core-debugsource-3.11.15-150600.3.53.1 * Python 3 Module 15-SP7 (aarch64 ppc64le s390x x86_64) * python311-tk-debuginfo-3.11.15-150600.3.53.1 * python311-3.11.15-150600.3.53.1 * python311-debuginfo-3.11.15-150600.3.53.1 * python311-core-debugsource-3.11.15-150600.3.53.1 * python311-idle-3.11.15-150600.3.53.1 * python311-tk-3.11.15-150600.3.53.1 * python311-tools-3.11.15-150600.3.53.1 * python311-devel-3.11.15-150600.3.53.1 * python311-debugsource-3.11.15-150600.3.53.1 * python311-curses-3.11.15-150600.3.53.1 * python311-dbm-debuginfo-3.11.15-150600.3.53.1 * python311-dbm-3.11.15-150600.3.53.1 * python311-curses-debuginfo-3.11.15-150600.3.53.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64) * python311-tk-debuginfo-3.11.15-150600.3.53.1 * python311-3.11.15-150600.3.53.1 * python311-dbm-debuginfo-3.11.15-150600.3.53.1 * python311-debuginfo-3.11.15-150600.3.53.1 * python311-idle-3.11.15-150600.3.53.1 * python311-tk-3.11.15-150600.3.53.1 * python311-tools-3.11.15-150600.3.53.1 * python311-devel-3.11.15-150600.3.53.1 * libpython3_11-1_0-debuginfo-3.11.15-150600.3.53.1 * libpython3_11-1_0-3.11.15-150600.3.53.1 * python311-dbm-3.11.15-150600.3.53.1 * python311-debugsource-3.11.15-150600.3.53.1 *python311-base-3.11.15-150600.3.53.1 * python311-curses-3.11.15-150600.3.53.1 * python311-base-debuginfo-3.11.15-150600.3.53.1 * python311-core-debugsource-3.11.15-150600.3.53.1 * python311-curses-debuginfo-3.11.15-150600.3.53.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64) * python311-tk-debuginfo-3.11.15-150600.3.53.1 * python311-3.11.15-150600.3.53.1 * python311-dbm-debuginfo-3.11.15-150600.3.53.1 * python311-debuginfo-3.11.15-150600.3.53.1 * python311-idle-3.11.15-150600.3.53.1 * python311-tk-3.11.15-150600.3.53.1 * python311-tools-3.11.15-150600.3.53.1 * python311-devel-3.11.15-150600.3.53.1 * libpython3_11-1_0-debuginfo-3.11.15-150600.3.53.1 * libpython3_11-1_0-3.11.15-150600.3.53.1 * python311-dbm-3.11.15-150600.3.53.1 * python311-debugsource-3.11.15-150600.3.53.1 * python311-base-3.11.15-150600.3.53.1 * python311-curses-3.11.15-150600.3.53.1 * python311-base-debuginfo-3.11.15-150600.3.53.1 * python311-core-debugsource-3.11.15-150600.3.53.1 * python311-curses-debuginfo-3.11.15-150600.3.53.1 ## References: * https://www.suse.com/security/cve/CVE-2025-11468.html * https://www.suse.com/security/cve/CVE-2025-12084.html * https://www.suse.com/security/cve/CVE-2025-13462.html * https://www.suse.com/security/cve/CVE-2025-13836.html * https://www.suse.com/security/cve/CVE-2025-13837.html * https://www.suse.com/security/cve/CVE-2025-15282.html * https://www.suse.com/security/cve/CVE-2025-6075.html * https://www.suse.com/security/cve/CVE-2026-0672.html * https://www.suse.com/security/cve/CVE-2026-0865.html * https://www.suse.com/security/cve/CVE-2026-1299.html * https://www.suse.com/security/cve/CVE-2026-2297.html * https://www.suse.com/security/cve/CVE-2026-3479.html * https://www.suse.com/security/cve/CVE-2026-3644.html * https://www.suse.com/security/cve/CVE-2026-4224.html * https://www.suse.com/security/cve/CVE-2026-4519.html *https://bugzilla.suse.com/show_bug.cgi?id=1252974 * https://bugzilla.suse.com/show_bug.cgi?id=1254400 * https://bugzilla.suse.com/show_bug.cgi?id=1254401 * https://bugzilla.suse.com/show_bug.cgi?id=1254997 * https://bugzilla.suse.com/show_bug.cgi?id=1257029 * https://bugzilla.suse.com/show_bug.cgi?id=1257031 * https://bugzilla.suse.com/show_bug.cgi?id=1257042 * https://bugzilla.suse.com/show_bug.cgi?id=1257046 * https://bugzilla.suse.com/show_bug.cgi?id=1257181 * https://bugzilla.suse.com/show_bug.cgi?id=1259240 * https://bugzilla.suse.com/show_bug.cgi?id=1259611 * https://bugzilla.suse.com/show_bug.cgi?id=1259734 * https://bugzilla.suse.com/show_bug.cgi?id=1259735 * https://bugzilla.suse.com/show_bug.cgi?id=1259989 * https://bugzilla.suse.com/show_bug.cgi?id=1260026 . Effective patch updates for vulnerabilities in Python 3.11 for SUSE with details on critical issues and solutions.. Python Security Patch, SUSE Vulnerability Update, Denial of Service Fix, Header Injection Threat, Security Advisory 2026. . Severity: Important. LinuxSecurity.com Team
Apr 15, 2026
•Important
SuSE
203
security advisoryXSSDoSMageia 9 Python-Tornado Important Header Injection DoS Fix MGASA-2026-0092
MGASA-2026-0092 - Updated python-tornado packages fix security vulnerabilities. MGASA-2026-0092 - Updated python-tornado packages fix security vulnerabilities Publication date: 10 Apr 2026 URL: https://advisories.mageia.org/MGASA-2026-0092.html Type: security Affected Mageia releases: 9 CVE: CVE-2025-67724, CVE-2025-67725, CVE-2025-67726 Description: Tornado vulnerable to Header Injection and XSS via reason argument. (CVE-2025-67724) Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing. (CVE-2025-67725) Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters. (CVE-2025-67726) References: - https://bugs.mageia.org/show_bug.cgi?id=35326 - https://lists.debian.org/debian-security-announce/2026/msg00104.html - https://www.cve.org/CVERecord?id=CVE-2025-67724 - https://www.cve.org/CVERecord?id=CVE-2025-67725 - https://www.cve.org/CVERecord?id=CVE-2025-67726 SRPMS: - 9/core/python-tornado-6.3.2-1.3.mga9 . Updated python-tornado packages address Header Injection and DoS issues in Mageia 9 for improved security.. Mageia python-tornado Header Injection DoS XSS. . Severity: Important. LinuxSecurity.com Team
Apr 10, 2026
•Important
Mageia
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!