Search: 18.8.3.2

Apache Traffic Server contains a vulnerability that can cause it to stall a chunked transfer it processes. This issue affects multiple specific versions of the Traffic Server package. The vulnerability has a medium severity rating with a CVSS score of 5.3, indicating it can impact availability but does not affect confidentiality or integrity.

Apache Traffic Server contains a critical vulnerability (CVE-2026-111809) that allows HTTP request smuggling via HEAD requests. This flaw can lead to high-impact integrity violations without requiring authentication. The vulnerability affects multiple specific versions of Traffic Server as listed. The CVSS score is 9.3, indicating critical severity. There is no indication of known exploits in the wild or available patches in the provided data.

Django REST framework versions prior to 3.18.2 have an uncontrolled resource consumption vulnerability in the DefaultContentNegotiation.get_accept_list method. An unauthenticated attacker can exploit this by sending requests with many distinct media types containing large quoted parameter values, causing excessive CPU usage and denial of service. The issue is fixed in version 3.18.2.

A vulnerability in django-rest-framework versions 3.12.0 through 3.18.1 causes TokenProxy.delete() to fail silently when attempting to revoke tokens. This occurs because the deletion query uses the proxy's user-id primary key instead of the token-string primary key, resulting in zero deletions without error. Consequently, tokens may remain active and continue authenticating despite apparent revocation. The issue is fixed in version 3.18.2.

A vulnerability in django-rest-framework versions 3.6.4 up to but not including 3.18.2 allows remote unauthenticated clients to send highly compressed JSON request bodies that expand significantly in memory after initial size checks. This improper handling of compressed data can cause excessive memory consumption per worker, potentially leading to denial of service. The issue is fixed in version 3.18.2.

Apache Traffic Server versions including 5.3.0-2ubuntu1 through 9.2.3+ds-1+deb12u1build1 contain a critical vulnerability (CVE-2026-111816) where the server forwards a malformed 302 HTTP response improperly. This vulnerability has a high CVSS score of 9.3, indicating critical severity with potential impact on confidentiality and integrity. There is no public information on exploits in the wild or patch availability in the provided data.

Apache Traffic Server's experimental magick plugin contains a critical vulnerability that allows unauthenticated remote attackers to fully compromise the system. The flaw affects multiple specific versions of Traffic Server and has a maximum CVSS score of 10.0, indicating severe impact on confidentiality, integrity, and availability.

A high-severity vulnerability (CVE-2025-55702) affects Trafficserver versions including multiple Ubuntu package builds from 5.3.0-2ubuntu1 through 9.2.3+ds-1+deb12u1build1. The issue involves handling of POST requests with the Expect: 100-continue header and the origin header, potentially leading to a critical impact on confidentiality and integrity without requiring privileges or user interaction.

Apache Traffic Server versions including 5.3.0-2ubuntu1 through 9.2.3+ds-1+deb12u1build1 contain a vulnerability (CVE-2025-31699) that can cause an origin connection to be returned to the shared pool improperly. This vulnerability has a high severity with a CVSS score of 8.9, indicating a network attack vector with high impact on confidentiality and integrity and low impact on availability.

A heap-based buffer overflow vulnerability exists in the GStreamer rtpL16depay plugin (gst-plugins-good1.0) due to improper validation of RTP payload length. This flaw allows remote attackers to execute arbitrary code within the context of the affected process. Multiple specific versions of gst-plugins-good1.0 are affected. The vulnerability is rated critical with a CVSS score of 9.8.

A stack-based buffer overflow vulnerability exists in the APNG file parsing functionality of GIMP. This flaw allows for remote code execution when a specially crafted APNG file is processed. The vulnerability affects multiple specific versions of GIMP as listed. The CVSS v3.0 score is 7.8, indicating high severity with high impact on confidentiality, integrity, and availability.

A low-severity vulnerability (CVE-2026-114370) was identified in the PathResourceManager component of the Undertow web server. The flaw has a CVSS score of 3.7, indicating limited impact primarily on confidentiality. No known exploits are reported in the wild. Multiple specific versions of Undertow are affected.

CVE-2026-113795 is a medium severity vulnerability affecting multiple versions of pypdf2, a pure-Python PDF library. The vulnerability was published on October 23, 2026. The CVSS 4.0 score is 6.0, indicating a network attack vector with low attack complexity but requiring user interaction and partial attack complexity. The vulnerability impacts various Ubuntu package versions of pypdf2. No public exploit or known active exploitation is reported. No patch or remediation details are provided in the available data.

CVE-2026-113794 is a medium severity vulnerability affecting multiple versions of the pypdf2 library, a free and open-source pure-Python PDF library. The vulnerability is present in various released versions including some Ubuntu package builds. The CVSS 4.0 score is 6.0, indicating a moderate risk. No public exploit or known exploitation in the wild has been reported. Patch or remediation details are not provided in the available data.

CVE-2026-113793 is a medium severity vulnerability affecting multiple versions of pypdf2, a free and open-source pure-Python PDF library. The vulnerability was published on October 23, 2026. The CVSS 4.0 base score is 6.0, indicating a network attack vector with low attack complexity but requiring user interaction and resulting in high impact on availability. No public exploit code or known exploitation in the wild is reported. The affected versions include various specific builds from 1.23+git20141008-1 through 6.9.2-2 and others as listed. No patch or remediation information is provided in the source data, so the patch status is not confirmed.

CVE-2026-113792 is a medium severity vulnerability in pypdf2, a free and open-source pure-Python PDF library. The issue affects multiple specific versions of pypdf2, including various Ubuntu package versions. The CVSS 4.0 score is 6.0, indicating a network attack vector with low attack complexity but requiring user interaction and partial attack type privileges. No public exploits or known active exploitation have been reported.

CVE-2026-113791 is a medium severity vulnerability affecting multiple versions of pypdf2, a pure-Python PDF library. The vulnerability was published on October 23, 2026. It has a CVSS 4.0 base score of 6.0, indicating a network attack vector with low attack complexity and partial attack requirements. The vulnerability requires user interaction and results in high impact on availability. No public exploit or known active exploitation is reported. Multiple specific versions of pypdf2 are affected, including various Ubuntu package versions.

CVE-2026-113790 is a medium severity vulnerability affecting multiple versions of pypdf2, a free and open-source pure-Python PDF library. The vulnerability was published on October 23, 2026. It has a CVSS 4.0 base score of 6.0, indicating a network attack vector with low attack complexity but requiring user interaction and partial attack complexity. No public exploits or known exploitation in the wild have been reported. The affected versions include various builds from 1.23+git20141008-1 through 6.9.2-2 and others as listed. No patch or remediation information is provided in the source data.

CVE-2026-113789 is a medium severity vulnerability affecting multiple versions of pypdf2, a free and open-source pure-Python PDF library. The vulnerability was published on October 23, 2026. The CVSS 4.0 base score is 6.0, indicating a medium impact with network attack vector and low attack complexity. The vulnerability requires user interaction and privileges are not required for exploitation. No known exploits in the wild have been reported. The affected versions include various specific builds and releases of pypdf2, as listed.

A reachable exit vulnerability exists in NTPsec ntpd versions 1.1.4 through 1.2.5, allowing a remote attacker to cause a denial of service by crashing the daemon. This vulnerability impacts availability but does not affect confidentiality or integrity. The CVSS score is 7.5, indicating a high severity level.