Security advisories

medium2026-05-07

CVE-2026-42592-Gotenberg's DNS rebinding bypasses SSRF validation on Chromium URL conversion routes

gotenberg/gotenberg · GHSA-2pmr-289p-44r3

high2026-05-07

CVE-2026-42591-Gotenberg has a Server-Side Request Forgery (SSRF) Issue

gotenberg/gotenberg · GHSA-rm4c-xj6x-49mw

high2026-05-07

CVE-2026-42590-Gotenberg's ExifTool group-prefix syntax bypasses dangerous-tag blocklist

gotenberg/gotenberg · GHSA-7v3r-m9c8-r855

critical2026-05-07

CVE-2026-42589-Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection

gotenberg/gotenberg · GHSA-rqgh-gxv4-6657

critical2026-05-07

CVE-2026-44484-Compromise of PyTorch Lightning PyPi Package Versions

lightning-ai/pytorch-lightning · GHSA-w37p-236h-pfx3

high2026-05-07

CVE-2026-42587-Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS

netty/netty · GHSA-f6hv-jmp6-3vwv

medium2026-05-07

CVE-2026-42586-Netty Redis Codec Encoder has a CRLF Injection Issue

netty/netty · GHSA-rgrr-p7gp-5xj7

medium2026-05-07

CVE-2026-42585-Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding

netty/netty · GHSA-38f8-5428-x5cv

high2026-05-07

CVE-2026-42584-Netty has HttpClientCodec response desynchronization

netty/netty · GHSA-57rv-r2g8-2cj3

high2026-05-07

CVE-2026-42583-Netty Lz4FrameDecoder is vulnerable to resource exhaustion

netty/netty · GHSA-mj4r-2hfc-f8p6

high2026-05-07

CVE-2026-42582-Netty HTTP/3 QPACK literal unbounded allocation

netty/netty · GHSA-2c5c-chwr-9hqw

medium2026-05-07

CVE-2026-42581-Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

netty/netty · GHSA-xxqh-mfjm-7mv9

medium2026-05-07

CVE-2026-42580-Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsing

netty/netty · GHSA-m4cv-j2px-7723

high2026-05-07

CVE-2026-42579-Netty has a DNS Codec Input Validation Bypass (Encoder + Decoder)

netty/netty · GHSA-cm33-6792-r9fm

low2026-05-07

CVE-2026-42578-Netty has HTTP Header Injection via HttpProxyHandler Disabled Validation (Incomplete Fix CVE-2025-67735)

netty/netty · GHSA-45q3-82m4-75jr

low2026-05-07

OpenSearch has ineffective TLS certificate hostname verification

opensearch-project/security · GHSA-x5hg-x4gv-j98m

medium2026-05-07

CVE-2026-44216-wasmtime has a panic when allocating a table exceeding the size of the host's address space

bytecodealliance/wasmtime · GHSA-p8xm-42r7-89xg

medium2026-05-07

OpenSearch Security plugin: DLS not applied on documents linked by has_child or has_parent relation

opensearch-project/security · GHSA-x83w-23jp-g6pw

low2026-05-07

OpenSearch vulnerable to improper authorization for Rollover Requests

opensearch-project/security · GHSA-22vx-2x23-98w6

low2026-05-07

OpenSearch has a bypass of REST Layer Authorization Using Malformed Paths

opensearch-project/security · GHSA-83x9-vc3c-hghc