Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions from 4.2.0.Final through 4.2.17.Final retain unbounded per-stream QPACK encoder state, which can cause unbounded heap growth and potential denial of service. The vulnerability is fixed in version 4.2.18.Final.
Netty's HTTP/3 codec versions 4.2.2.Final through 4.2.17.Final improperly handle HTTP/1 CONNECT authority-form request-targets during conversion to HTTP/3. This flaw allows an attacker to control the tunnel :authority in HTTP/3 CONNECT requests, potentially bypassing tunnel allow-lists, egress policies, backend selection, or audit controls. The issue is resolved in version 4.2.18.Final.
Netty's HTTP/3 codec versions 4.2.0.Final through 4.2.17.Final contain a vulnerability in the QPACK encoder-stream instruction decoder that allows an attacker to cause uncontrolled resource consumption. This can lead to unbounded heap growth and an OutOfMemoryError, resulting in denial of service. The issue is fixed in version 4.2.18.Final.
Netty versions from 4.2.11.Final up to but not including 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. This flaw allows attackers on the network path to bypass hostname authentication by presenting a certificate chain for a wrong hostname that the trust manager accepts. The vulnerability has a CVSS score of 7.5, indicating a medium severity level.
Netty's HTTP/3 codec versions 4.2.2.Final through 4.2.17.Final improperly prioritize the HTTP/1 Host header over the authority in an absolute-form HTTP/1 request-target when building the HTTP/3 :authority pseudo-header. This violates HTTP/1.1 rules and can cause authority confusion in HTTP/1-to-HTTP/3 gateways or proxies, potentially leading to incorrect virtual-host routing, allow-list checks, backend selection, cache key usage, and URL generation. The vulnerability impacts data integrity but does not affect code execution or availability. The issue is fixed in version 4.2.18.Final.
Netty's HttpServerCodec in versions 4.2.0.Final through 4.2.16.Final and up to 4.1.136.Final has a vulnerability where HTTP response parsing can become desynchronized. This occurs when a client sends a pipelined HTTP/1.1 GET request with an Expect: 100-continue header followed by a HEAD request. The 100 Continue response incorrectly consumes the queued GET method, causing the GET response body to be dropped and the HEAD response body to be misinterpreted as the GET body. This leads to response splitting and unsafe connection reuse. The issue is fixed in versions 4.2.17.Final and 4.1.137.Final.
Nodemailer versions 5.0.0 through 10.0.1 have a vulnerability in their DNS caching mechanism where the cache key is only the DNS host, but cache entries also store a caller-specific TLS servername. This causes the wrong SNI value to be sent when multiple TLS transports resolve the same host with different servernames, leading to incorrect certificate validation. An attacker able to prime the cache can cause a victim to connect to the attacker's TLS host and accept a malicious certificate, potentially exposing SMTP credentials. The issue is fixed in Nodemailer version 10.0.2.
Nodemailer versions before 10.0.2 have a vulnerability where deeply nested arrays in recipient fields (to, cc, bcc) are not properly flattened. This allows attackers to supply deeply nested JSON recipient arrays that cause recursive Array.toString() calls, leading to stack exhaustion and termination of the Node.js process. The vulnerability has a medium severity with a CVSS score of 5.9 and affects several specific versions including 6.3.0-2 through 6.7.0-2 and all versions prior to 10.0.2.
Nodemailer versions before 10.0.6 contain a denial of service vulnerability caused by a regex pattern in the addressparser free-text fallback. This vulnerability results in quadratic backtracking when processing crafted email header values with long whitespace-free runs, which can block the Node.js event loop and cause service unavailability.
Nodemailer versions from 9.1.0 up to but not including 10.0.9 have a vulnerability in the address parser. This flaw mishandles email addresses with quoted local-parts followed by RFC 5322 comments, causing trailing comment-separated domain atoms to remain in the normalized address. This can lead to malformed recipient addresses in the SMTP envelope. The issue is fixed in Nodemailer version 10.0.9.
CVE-2026-100657 is a vulnerability record that has been rejected as a duplicate and therefore does not represent a unique security flaw. It is associated with certain software versions between 4.0.0 and 4.2.17. No patch or remediation information is provided, and there are no known exploits in the wild.
CVE-2026-100656 is a vulnerability entry that has been rejected as a duplicate and does not represent a unique security issue. It is associated with versions >=4.2.0.Final and <4.2.18.Final, as well as versions <=4.1.137.Final. No patch or remediation information is provided, and no known exploits are reported in the wild.
CVE-2026-100655 is a vulnerability entry that has been rejected as a duplicate and does not have unique technical details or a patch available. It is associated with CWE-770, indicating a potential resource exhaustion or similar issue, but no specific exploit or impact details are provided.
The MCP Server for WordPress plugin versions before 1.8.2 contains a vulnerability in the verification of the WordPress REST API nonce for cookie-authenticated requests. This flaw allows unauthenticated attackers to perform actions restricted to administrators by tricking a logged-in administrator into visiting a maliciously crafted page. Such actions include creating new administrator accounts. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery).
The MCP Server for WordPress plugin versions before 1.8.2 lacks proper ownership or capability checks on its workflow create, update, and delete REST API routes. This flaw allows users with the Contributor role to modify, delete, and create site-wide workflow configurations, including those created by administrators. The vulnerability has a low CVSS score of 2.7 and does not impact confidentiality or availability but allows limited integrity modification.
The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users' private, draft, pending and scheduled content.
A race condition vulnerability in the Linux kernel's cgroup subsystem involving iteration over dying tasks with zero reference count has been resolved. The issue arises because iterators may attempt to access tasks that have already been freed, leading to potential use-after-free scenarios. The fix adds checks to skip tasks whose usage count has dropped to zero during iteration, preventing unsafe resurrection of such tasks.
This entry provides Indicators of Compromise (IOCs) related to ThreatFox for the date 2026-09-26. It is categorized as OSINT related to network activity and payload delivery but does not specify a particular malware or exploit. No affected software versions or technical details are provided.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including an update to the 'hugo' package version 0.166.0-0.1.hum1 for aarch64 and x86_64 architectures. This update addresses multiple vulnerabilities identified by several CVEs. The advisory provides updated RPMs to fix bugs and enhance security. No explicit CVSS score is provided, but the severity is marked as high.
A vulnerability in python-WebOb (CVE-2026-54770) allows an unauthenticated attacker who can influence an application's redirect target to redirect users to attacker-controlled hosts. This can facilitate phishing attacks or theft of OAuth and SSO tokens. The issue affects specific versions of python-WebOb used in certain SUSE Linux Enterprise and Ubuntu distributions. The severity is assessed as medium with a CVSS score of 6.1.