Threats Tagged 'cve-2026-72817'

This security update for the hauler component addresses multiple issues through version updates 2.0.3 and 2.1.0. The 2.1.0 release introduces concurrency improvements, signature verification enhancements, audit trails, integrity checks, and support for private/insecure registries. It also includes dependency updates that resolve known vulnerabilities. The 2.0.3 update includes backported fixes and vulnerability patches related to Kubernetes libraries, Helm dependencies, and golang grpc. No specific affected versions are stated.

This update for cloudflared fixes the following issues: Changes in cloudflared: - Update version to 2026.8.2 * Update vendor archive to fix github.com/go-chi/chi/v5 (boo#1276196, CVE-2026-72815, CVE-2026-72816, CVE-2026-72817) * Add OpenRC support * Migrate config renovate.json * Fix bugs

This update for cloudflared fixes the following issues: Changes in cloudflared: - Update version to 2026.8.2 * Update vendor archive to fix github.com/go-chi/chi/v5 (boo#1276196, CVE-2026-72815, CVE-2026-72816, CVE-2026-72817) * Add OpenRC support * Migrate config renovate.json * Fix bugs

This security update for v2ray-core addresses multiple vulnerabilities including CVE-2026-27017, CVE-2026-39821, CVE-2026-72815, CVE-2026-72816, and CVE-2026-72817. The update includes version upgrades to 5.53.0 and 5.51.2, which add new features and fix bugs related to gRPC transport, UDP connections, Wireguard TCP listener support, and other components. The golang.org/x/net module was also updated to version 0.55.0 to resolve additional issues. No specific affected versions were stated. The severity is assessed as high based on the vendor's classification.

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs.

A security update for Red Hat Hardened Images RPMs addresses vulnerabilities including CVE-2026-72815, CVE-2026-72816, and CVE-2026-72817. Notably, CVE-2026-72816 involves an IP spoofing flaw in the go-chi/chi RealIP middleware, allowing remote attackers to supply arbitrary IP addresses in client-controlled headers, potentially bypassing IP-based access controls and evading rate limiting. The update includes new versions of spire1.15 packages for aarch64 and x86_64 architectures. No explicit patch details are provided for CVE-2026-72815 specifically. The vendor advisory indicates the update is available and provides guidance on mitigation for the IP spoofing issue.