Threats Tagged 'cve-2026-53712'

Red Hat has released security updates for its build of Quarkus, addressing multiple vulnerabilities including authentication downgrades, a heap buffer overflow causing denial of service, man-in-the-middle protection bypass, and unauthorized command execution due to improper certificate validation. These issues affect versions prior to 3.27.5. The update is rated as having an important security impact and includes fixes for CVE-2026-8484 among others. Users are advised to apply the 3.27.5 update to mitigate these vulnerabilities.

A vulnerability in com.ongres.scram:scram-client versions prior to 3.3 allows a TLS man-in-the-middle attacker to silently downgrade SCRAM authentication from SCRAM-SHA-256-PLUS (with channel binding) to SCRAM-SHA-256 (without channel binding). This occurs when the server presents an X.509 certificate using modern signature algorithms that the client cannot parse properly, causing fallback to a less secure authentication method without error. This can bypass strict channel binding policies in affected deployments.