Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 3 articles for you...
89
security advisoryfedoraimportantFedora 43 tinyproxy Important HTTP Request Smuggling Fix 2026-77f1ca9c8f
Backport upstream fixes for CVE-2026-54387 and CVE-2026-54388.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-77f1ca9c8f 2026-06-27 00:54:50.049783+00:00 -------------------------------------------------------------------------------- Name : tinyproxy Product : Fedora 43 Version : 1.11.2 Release : 8.fc43 URL : https://tinyproxy.github.io/ Summary : A small, efficient HTTP/SSL proxy daemon Description : tinyproxy is a small, efficient HTTP/SSL proxy daemon that is very useful in a small network setting, where a larger proxy like Squid would either be too resource intensive, or a security risk. -------------------------------------------------------------------------------- Update Information: Backport upstream fixes for CVE-2026-54387 and CVE-2026-54388. -------------------------------------------------------------------------------- ChangeLog: * Thu Jun 18 2026 Carl George - 1.11.2-8 - Backport upstream CVE fixes - Fixes CVE-2026-54387 - Fixes CVE-2026-54388 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2490299 - CVE-2026-54387 tinyproxy: HTTP Request Smuggling via CL/TE desynchronization [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2490299 [ 2 ] Bug #2490301 - CVE-2026-54388 tinyproxy: HTTP Request Smuggling via duplicate Content-Length headers [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2490301 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-77f1ca9c8f' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the FedoraProject can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jun 26, 2026
•Important
Fedora
172
security advisorydenial of servicearbitrary code executionUbuntu 26.04 Netty Key Security Update for Request Smuggling Flaws
Several security issues were fixed in Netty.. ========================================================================== Ubuntu Security Notice USN-8401-1 June 08, 2026 netty vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Netty. Software Description: - netty: event-driven asynchronous network application framework Details: It was discovered that Netty's HTTP proxy handler did not properly validate headers when constructing CONNECT requests. An attacker could possibly use this issue to inject arbitrary HTTP headers into CONNECT requests. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-42578) It was discovered that Netty's DNS codec did not properly enforce domain name constraints. An attacker could possibly use this issue to bypass domain name validation, or cause Netty to consume resources, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-42579) It was discovered that Netty did not correctly handle HTTP/1.0 requests containing both a Transfer-Encoding and Content-Length header. A remote attacker could possibly use this issue to perform HTTP request smuggling attacks. (CVE-2026-42581) Violeta Georgieva discovered that Netty incorrectly paired responses with requests when handling informational HTTP responses. A remote attacker could possibly use this issue to perform HTTP request smuggling attacks. (CVE-2026-42584) Violeta Georgieva discovered that Netty incorrectly parsed malformed Transfer-Encoding headers. A remote attacker could possibly use this issue to perform HTTP request smuggling attacks. (CVE-2026-42585) It was discovered thatNetty's Redis encoder did not validate CRLF characters. An attacker could possibly use this issue to inject arbitrary Redis commands. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-42586) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS libnetty-java 1:4.1.48-16ubuntu0.1~esm2 Available with Ubuntu Pro Ubuntu 24.04 LTS libnetty-java 1:4.1.48-9ubuntu0.1+esm3 Available with Ubuntu Pro Ubuntu 22.04 LTS libnetty-java 1:4.1.48-4+deb11u2ubuntu0.1+esm3 Available with Ubuntu Pro Ubuntu 20.04 LTS libnetty-java 1:4.1.45-1ubuntu0.1~esm6 Available with Ubuntu Pro Ubuntu 18.04 LTS libnetty-java 1:4.1.7-4ubuntu0.1+esm6 Available with Ubuntu Pro Ubuntu 16.04 LTS libnetty-java 1:4.0.34-1ubuntu0.1~esm4 Available with Ubuntu Pro Ubuntu 14.04 LTS libnetty-java 1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8401-1 CVE-2026-42578, CVE-2026-42579, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585, CVE-2026-42586 . Netty vulnerabilities in Ubuntu require updates to prevent request smuggling and denial of service attacks. Stay secure!. Ubuntu Netty security fix, request smuggling Ubuntu, Denial of Service Netty, security advisory update, arbitrary command injection. . Severity: Important. LinuxSecurity.com Team
Jun 08, 2026
•Important
Ubuntu
89
security advisoryfedoraimportantFedora 41: yq Important HTTP Proxy and Input Security Fixes 2025-d8a379a267
Add shell-completions Update to 4.47.1 and adopt go-vendor-tools. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-d8a379a267 2025-09-07 01:12:58.236453+00:00 -------------------------------------------------------------------------------- Name : yq Product : Fedora 41 Version : 4.47.1 Release : 2.fc41 URL : https://github.com/mikefarah/yq Summary : Yq is a portable command-line YAML, JSON, XML, CSV, TOML and properties processor Description : Yq is a portable command-line YAML, JSON, XML, CSV, TOML and properties processor. -------------------------------------------------------------------------------- Update Information: Add shell-completions Update to 4.47.1 and adopt go-vendor-tools -------------------------------------------------------------------------------- ChangeLog: * Fri Aug 29 2025 Mikel Olasagasti Uranga - 4.47.1-2 - Add shell completions * Thu Aug 21 2025 Romain Geissler - 4.47.1-1 - Upgrade to upstream version 4.47.1 and use vendoring (rhbz#2282002). * Fri Aug 15 2025 Maxwell G - 4.43.1-7 - Rebuild for golang-1.25.0 * Fri Jul 25 2025 Fedora Release Engineering - 4.43.1-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2352349 - CVE-2025-22870 yq: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net [fedora-41] https://bugzilla.redhat.com/show_bug.cgi?id=2352349 [ 2 ] Bug #2360619 - CVE-2025-22872 yq: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net [fedora-41] https://bugzilla.redhat.com/show_bug.cgi?id=2360619 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-d8a379a267' at the command line. For more information,refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Sep 07, 2025
•Important
Fedora
89
security advisoryfedoraimportantFedora 41: Apptainer Important HTTP Proxy Security Issue 2025-5b1e8725d7
Update to upstream 1.4.2, fix CVE-2025-22870. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-5b1e8725d7 2025-08-17 00:56:38.337503+00:00 -------------------------------------------------------------------------------- Name : apptainer Product : Fedora 41 Version : 1.4.2 Release : 1.fc41 URL : https://apptainer.org Summary : Application and environment virtualization formerly known as Singularity Description : Apptainer provides functionality to make portable containers that can be used across host environments. -------------------------------------------------------------------------------- Update Information: Update to upstream 1.4.2, fix CVE-2025-22870 -------------------------------------------------------------------------------- ChangeLog: * Fri Aug 8 2025 Dave Dykstra - 1.4.2 - Update to upstream 1.4.2 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2352134 - CVE-2025-22870 apptainer: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net [fedora-41] https://bugzilla.redhat.com/show_bug.cgi?id=2352134 [ 2 ] Bug #2387209 - apptainer-1.4.2 is available https://bugzilla.redhat.com/show_bug.cgi?id=2387209 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-5b1e8725d7' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailinglist --
Aug 17, 2025
•Important
Fedora
89
security advisoryfedoracriticalFedora 41: FEDORA-2025-333708f4ce critical: golang-x-perf memory issue
Security update. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-333708f4ce 2025-06-15 01:06:28.140374+00:00 -------------------------------------------------------------------------------- Name : golang-x-perf Product : Fedora 41 Version : 0 Release : 0.28.20250326git02a15fd.fc41 URL : https://github.com/golang/perf Summary : Performance measurement, storage, and analysis Description : This package holds the source for various tools related to performance measurement, storage, and analysis. - cmd/benchstat contains a command-line tool that computes and 7 compares statistics about benchmarks. - cmd/benchsave contains a command-line tool for publishing benchmark results. - storage contains the benchmark result storage system. - analysis contains the https://perf.golang.org/ benchmark result analysis system. -------------------------------------------------------------------------------- Update Information: Security update -------------------------------------------------------------------------------- ChangeLog: * Fri Mar 28 2025 Alejandro Sáez - 0-0.28 - Update to newer version, migrate to vendor-tools * Fri Jan 17 2025 Fedora Release Engineering - 0-0.26 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild * Mon Sep 2 2024 Miroslav Suchý - 0-0.25 - convert license to SPDX -------------------------------------------------------------------------------- References: [ 1 ] Bug #2348825 - CVE-2025-22868 golang-x-perf: Unexpected memory consumption during token parsing in golang.org/x/oauth2 [fedora-41] https://bugzilla.redhat.com/show_bug.cgi?id=2348825 [ 2 ] Bug #2352286 - CVE-2025-22870 golang-x-perf: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net [fedora-41] https://bugzilla.redhat.com/show_bug.cgi?id=2352286 -------------------------------------------------------------------------------- This update can be installed with the "dnf"update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-333708f4ce' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- . Important security patch for golang-x-perf resolving memory management flaws and vulnerabilities related to proxy evasion.. Fedora Update,golang-x-perf,security update. . Severity: Critical. LinuxSecurity.com Team
Jun 15, 2025
•Critical
Fedora
100
security advisorysoftware patchsecurity fixSUSE: 2022:4633-1 Moderate Security Flaw in Curl HTTP Proxy
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4633-1 Rating: moderate References: #1206309 Cross-References: CVE-2022-43552 CVSS scores: CVE-2022-43552 (SUSE): 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Affected Products: SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Realtime Extension 15-SP3 openSUSE Leap 15.3 openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for curl fixes the following issues: - CVE-2022-43552: HTTP Proxy deny use-after-free (bsc#1206309). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-4633=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4633=1 - SUSE Linux Enterprise Realtime Extension 15-SP3: zypper in -t patch SUSE-SLE-Product-RT-15-SP3-2022-4633=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-4633=1 - SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-4633=1 Package List: - openSUSE Leap Micro 5.2 (aarch64 x86_64): curl-7.66.0-150200.4.45.1 curl-debuginfo-7.66.0-150200.4.45.1 curl-debugsource-7.66.0-150200.4.45.1 libcurl4-7.66.0-150200.4.45.1 libcurl4-debuginfo-7.66.0-150200.4.45.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): curl-7.66.0-150200.4.45.1 curl-debuginfo-7.66.0-150200.4.45.1 curl-debugsource-7.66.0-150200.4.45.1 libcurl-devel-7.66.0-150200.4.45.1 libcurl4-7.66.0-150200.4.45.1 libcurl4-debuginfo-7.66.0-150200.4.45.1 - openSUSE Leap 15.3 (x86_64): libcurl-devel-32bit-7.66.0-150200.4.45.1 libcurl4-32bit-7.66.0-150200.4.45.1 libcurl4-32bit-debuginfo-7.66.0-150200.4.45.1 - SUSE Linux Enterprise Realtime Extension 15-SP3 (x86_64): curl-7.66.0-150200.4.45.1 curl-debuginfo-7.66.0-150200.4.45.1 curl-debugsource-7.66.0-150200.4.45.1 libcurl-devel-7.66.0-150200.4.45.1 libcurl4-32bit-7.66.0-150200.4.45.1 libcurl4-32bit-debuginfo-7.66.0-150200.4.45.1 libcurl4-7.66.0-150200.4.45.1 libcurl4-debuginfo-7.66.0-150200.4.45.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): curl-7.66.0-150200.4.45.1 curl-debuginfo-7.66.0-150200.4.45.1 curl-debugsource-7.66.0-150200.4.45.1 libcurl4-7.66.0-150200.4.45.1 libcurl4-debuginfo-7.66.0-150200.4.45.1 - SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64): curl-7.66.0-150200.4.45.1 curl-debuginfo-7.66.0-150200.4.45.1 curl-debugsource-7.66.0-150200.4.45.1 libcurl4-7.66.0-150200.4.45.1 libcurl4-debuginfo-7.66.0-150200.4.45.1 References: https://www.suse.com/security/cve/CVE-2022-43552.html https://bugzilla.suse.com/1206309 . SUSE Security Patch for wget addresses a low level concern in the FTP service. Implement updates promptly to bolster system safety.. SUSE Linux Security Update,curl update,HTTP Proxy fixes. . LinuxSecurity.com Team
Dec 28, 2022
SuSE
197
security advisoryupdatedebianDebian 10: DLA-4001-1 Moderate: Privoxy Memory Leak Threats
Multiple vulnerabilites were discovered in privoxy, a privacy enhancing HTTP proxy, like memory leaks, dereference of a NULL-pointer, et al. . - ----------------------------------------------------------------------- Debian LTS Advisory DLA-2548-1
Feb 06, 2021
Debian LTS
197
security advisorydebiantinyproxyDebian 8 Jessie: DLA-2163-1 Moderate: Tinyproxy Security Fix
A minor security issue and a severe packaging bug have been fixed in tinyproxy, a lightweight http proxy daemon. . Package : tinyproxy Version : 1.8.3-3+deb8u1 CVE ID : CVE-2017-11747 Debian Bug : 870307 948283 A minor security issue and a severe packaging bug have been fixed in tinyproxy, a lightweight http proxy daemon. CVE-2017-11747 main.c in Tinyproxy created a /var/run/tinyproxy/tinyproxy.pid file after dropping privileges to a non-root account, which might have allowed local users to kill arbitrary processes by leveraging access to this non-root account for tinyproxy.pid modification before a root script executed a "kill `cat /run/tinyproxy/tinyproxy.pid`" command. OTHER Furthermore, a severe flaw had been discovered by Tim Duesterhus in Debian's init script for tinyproxy. With the tiny.conf configuration file having the PidFile option removed, the next run of logrotate (if installed) would have changed the owner of the system's base directory ("/") to tinyproxy:tinyproxy. For Debian 8 "Jessie", this problem has been fixed in version 1.8.3-3+deb8u1. These fixes were prepared by Mike Gabriel. We recommend that you upgrade your tinyproxy packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS Best, Utkarsh . Enhance your tinyproxy installation to resolve a significant security vulnerability alongside a critical bug in Debian LTS. Get crucial updates today!. tinyproxy Security Update, Debian LTS, HTTP Proxy Daemon, Packaging Bug, Minor Security Fix. . LinuxSecurity.com Team
Mar 31, 2020
Debian LTS
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!