Threats Tagged 'cve-2026-72815'

This security update for the hauler component addresses multiple issues through version updates 2.0.3 and 2.1.0. The 2.1.0 release introduces concurrency improvements, signature verification enhancements, audit trails, integrity checks, and support for private/insecure registries. It also includes dependency updates that resolve known vulnerabilities. The 2.0.3 update includes backported fixes and vulnerability patches related to Kubernetes libraries, Helm dependencies, and golang grpc. No specific affected versions are stated.

This update for cloudflared fixes the following issues: Changes in cloudflared: - Update version to 2026.8.2 * Update vendor archive to fix github.com/go-chi/chi/v5 (boo#1276196, CVE-2026-72815, CVE-2026-72816, CVE-2026-72817) * Add OpenRC support * Migrate config renovate.json * Fix bugs

This update for cloudflared fixes the following issues: Changes in cloudflared: - Update version to 2026.8.2 * Update vendor archive to fix github.com/go-chi/chi/v5 (boo#1276196, CVE-2026-72815, CVE-2026-72816, CVE-2026-72817) * Add OpenRC support * Migrate config renovate.json * Fix bugs

This security update for v2ray-core addresses multiple vulnerabilities including CVE-2026-27017, CVE-2026-39821, CVE-2026-72815, CVE-2026-72816, and CVE-2026-72817. The update includes version upgrades to 5.53.0 and 5.51.2, which add new features and fix bugs related to gRPC transport, UDP connections, Wireguard TCP listener support, and other components. The golang.org/x/net module was also updated to version 0.55.0 to resolve additional issues. No specific affected versions were stated. The severity is assessed as high based on the vendor's classification.

go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.

This update includes the following RPMs: prometheus3.13: * prometheus3.13-3.13.2-0.2.hum1 (aarch64, x86_64) * prometheus3.13-3.13.2-0.2.hum1.src (src) Security Fix(es): prometheus3.13: * CVE-2026-69153

A security update for Red Hat Hardened Images RPMs addresses vulnerabilities including CVE-2026-72815, CVE-2026-72816, and CVE-2026-72817. Notably, CVE-2026-72816 involves an IP spoofing flaw in the go-chi/chi RealIP middleware, allowing remote attackers to supply arbitrary IP addresses in client-controlled headers, potentially bypassing IP-based access controls and evading rate limiting. The update includes new versions of spire1.15 packages for aarch64 and x86_64 architectures. No explicit patch details are provided for CVE-2026-72815 specifically. The vendor advisory indicates the update is available and provides guidance on mitigation for the IP spoofing issue.