10.0Crítica KEV Usada en ransomware

CVE-2021-44228Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Apache Software Foundation Apache Log4j2 Publicada: 2021-12-10 03:00 (hace 4 años)

Explotación conocida — Apache Log4j2 Remote Code Execution Vulnerability

CISA confirmó el 10.12.2021 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 24.12.2021.

Acción requerida: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available. https://nvd.nist.gov/vuln/detail/CVE-2021-44228

Descripción

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Debilidad (CWE): CWE-502 CWE-400 CWE-20 CWE-917

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
Apache Software Foundation	Apache Log4j2	2.0-beta9 – < log4j-core*
apache	log4j	2.0.1 – < 2.3.1
apple	xcode	< 13.3
bentley	synchro	6.1 – < 6.2.4.2
bentley	synchro 4d	< 6.4.3.2
cisco	advanced malware protection virtual private cloud appliance	< 3.5.4
cisco	automated subsea tuning	< 2.1.0
cisco	broadworks	< 2021.11_1.162
cisco	business process automation	< 3.0.000.115
cisco	cloud connect	< 12.6\(1\)
cisco	cloudcenter	< 4.10.0.16
cisco	cloudcenter cost optimizer	< 5.5.2
cisco	cloudcenter suite	4.10.0.15
cisco	cloudcenter suite admin	< 5.3.1
cisco	cloudcenter workload manager	< 5.5.2
cisco	common services platform collector	< 2.9.1.3
cisco	connected mobile experiences	—
cisco	contact center domain manager	< 12.5\(1\)
cisco	contact center management portal	< 12.5\(1\)
cisco	crosswork data gateway	< 2.0.2
cisco	crosswork network automation	2.0.0
cisco	crosswork network controller	< 2.0.1
cisco	crosswork optimization engine	< 2.0.1
cisco	crosswork platform infrastructure	< 4.0.1
cisco	crosswork zero touch provisioning	< 2.0.1
cisco	customer experience cloud agent	< 1.12.1
cisco	cx cloud agent	001.012
cisco	cyber vision	4.0.2
cisco	cyber vision sensor management extension	< 4.0.3
cisco	data center network manager	< 11.3\(1\)
cisco	dna center	< 2.1.2.8
cisco	dna spaces	< 2.5
cisco	dna spaces connector	—
cisco	emergency responder	< 11.5\(4\)
cisco	enterprise chat and email	< 12.0\(1\)
cisco	evolved programmable network manager	≤ 4.1.1
cisco	finesse	< 12.6\(1\)
cisco	fog director	—
cisco	fxos	6.2.3
cisco	identity services engine	< 2.4.0
cisco	integrated management controller supervisor	< 2.3.2.1
cisco	intersight virtual appliance	< 1.0.9-361
cisco	iot operations dashboard	—
cisco	mobility services engine	—
cisco	network assurance engine	< 6.0.2
cisco	network dashboard fabric controller	11.0(1)
cisco	network insights for data center	6.0(2.1914)
cisco	network services orchestrator	< 5.3.5.1
cisco	nexus dashboard	< 2.1.2
cisco	nexus insights	< 6.0.2
cisco	optical network controller	< 1.1.0
cisco	packaged contact center enterprise	< 11.6
cisco	paging server	< 14.4.1
cisco	prime service catalog	< 12.1
cisco	sd-wan vmanage	< 20.3.4.1
cisco	secure firewall threat defense	6.2.3
cisco	smart phy	< 3.2.1
cisco	ucs central	< 2.0\(1p\)
cisco	ucs central software	2.0
cisco	ucs director	< 6.8.2.0
cisco	unified communications manager	< 11.5\(1\)
cisco	unified communications manager im and presence service	< 11.5\(1\)
cisco	unified communications manager im & presence service	11.5(1)
cisco	unified computing system	006.008(001.000)
cisco	unified contact center enterprise	< 11.6\(2\)
cisco	unified contact center express	< 12.5\(1\)
cisco	unified contact center management portal	12.6(1)
cisco	unified customer voice portal	< 11.6
cisco	unified intelligence center	< 12.6\(1\)
cisco	unified sip proxy	< 10.2.1v2
cisco	unified workforce optimization	< 11.5\(1\)
cisco	unity connection	< 11.5\(1\)
cisco	video surveillance manager	7.14(1.26)
cisco	video surveillance operations manager	< 7.14.4
cisco	virtual topology system	< 2.6.7
cisco	virtualized infrastructure manager	< 3.2.0
cisco	virtualized voice browser	< 12.5\(1\)
cisco	wan automation engine	< 7.3.0.2
cisco	webex meetings server	< 3.0
cisco	workload optimization manager	< 3.2.1
debian	debian linux	9.0
fedoraproject	fedora	34
intel	computer vision annotation tool	—
intel	datacenter manager	< 5.1
intel	genomics kernel library	—
intel	oneapi sample browser	—
intel	secure device onboard	—
intel	system studio	—
netapp	active iq unified manager	—
netapp	brocade san navigator	—
netapp	cloud insights	—
netapp	cloud manager	—
netapp	cloud secure agent	—
netapp	oncommand insight	—
netapp	ontap tools	—
netapp	snapcenter	—
netapp	solidfire enterprise sds	—
netapp	solidfire & hci storage node	—
percussion	rhythmyx	≤ 7.3.2
siemens	6bk1602-0aa12-0tp0 firmware	< 2.7.0
siemens	6bk1602-0aa22-0tp0 firmware	< 2.7.0
siemens	6bk1602-0aa32-0tp0 firmware	< 2.7.0
siemens	6bk1602-0aa42-0tp0 firmware	< 2.7.0
siemens	6bk1602-0aa52-0tp0 firmware	< 2.7.0
siemens	capital	< 2019.1
siemens	comos	< 10.4.2
siemens	desigo cc advanced reports	3.0
siemens	desigo cc info center	5.0
siemens	e-car operation center	< 2021-12-13
siemens	energy engage	3.1
siemens	energyip	8.5
siemens	energyip prepay	< 3.8.0.12
siemens	gma-manager	< 8.6.2j-398
siemens	head-end system universal device integration system	—
siemens	industrial edge management	—
siemens	industrial edge management hub	< 2021-12-13
siemens	logo! soft comfort	—
siemens	mendix	—
siemens	mindsphere	< 2021-12-16
siemens	navigator	< 2021-12-13
siemens	nx	—
siemens	opcenter intelligence	3.2 – < 3.5
siemens	operation scheduler	≤ 1.1.3
siemens	sentron powermanager	4.1
siemens	siguard dsa	4.2 – < 4.4.1
siemens	sipass integrated	2.80
siemens	siveillance command	≤ 4.16.2.1
siemens	siveillance control pro	—
siemens	siveillance identity	1.5
siemens	siveillance vantage	—
siemens	siveillance viewpoint	—
siemens	solid edge cam pro	—
siemens	solid edge harness design	< 2020
siemens	spectrum power 4	< 4.70
siemens	spectrum power 7	< 2.30
siemens	sppa-t3000 ses3000 firmware	—
siemens	teamcenter	—
siemens	vesys	< 2019.1
siemens	xpedition enterprise	—
siemens	xpedition package integrator	—
snowsoftware	snow commander	< 8.10.0
snowsoftware	vm access proxy	< 3.6
sonicwall	email security	< 10.0.13

Referencias y parches

https://logging.apache.org/log4j/2.x/security.html Release NotesVendor Advisory
[oss-security] 20211210 CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints mailing-listMailing ListMitigationThird Party Advisory
[oss-security] 20211210 Re: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints mailing-listMailing ListMitigationThird Party Advisory
20211210 Vulnerability in Apache Log4j Library Affecting Cisco Products: December 2021 vendor-advisoryThird Party Advisory
[oss-security] 20211210 Re: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints mailing-listMailing ListThird Party Advisory
https://security.netapp.com/advisory/ntap-20211210-0007/ Third Party Advisory
http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html Third Party AdvisoryVDB Entry
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 Third Party Advisory
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html Third Party Advisory
DSA-5020 vendor-advisoryMailing ListThird Party Advisory
[debian-lts-announce] 20211212 [SECURITY] [DLA 2842-1] apache-log4j2 security update mailing-listMailing ListThird Party Advisory
FEDORA-2021-f0f501d01f vendor-advisoryRelease Notes
Microsoft’s Response to CVE-2021-44228 Apache Log4j 2 vendor-advisoryPatchThird Party AdvisoryVendor Advisory
[oss-security] 20211213 Re: CVE-2021-4104: Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 mailing-listMailing ListThird Party Advisory
[oss-security] 20211213 CVE-2021-4104: Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 mailing-listMailing ListThird Party Advisory
[oss-security] 20211214 CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack mailing-listMailing ListThird Party Advisory
VU#930724 third-party-advisoryThird Party AdvisoryUS Government Resource
https://twitter.com/kurtseifried/status/1469345530182455296 Broken LinkExploitThird Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf Third Party Advisory
http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html Third Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html ExploitThird Party AdvisoryVDB Entry
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html Third Party Advisory
[oss-security] 20211215 Re: CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack mailing-listMailing ListThird Party Advisory
http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html Third Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html Third Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html Third Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html Broken LinkThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html Third Party AdvisoryVDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf Third Party Advisory
FEDORA-2021-66d6c484f3 vendor-advisoryRelease Notes
http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html ExploitThird Party AdvisoryVDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html PatchThird Party Advisory
http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html ExploitThird Party AdvisoryVDB Entry
https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md Broken LinkProductUS Government Resource
http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Re… ExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-E… ExploitThird Party AdvisoryVDB Entry
20220314 APPLE-SA-2022-03-14-7 Xcode 13.3 mailing-listMailing ListThird Party Advisory
https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001 Third Party Advisory
https://github.com/cisagov/log4j-affected-db Third Party Advisory
https://support.apple.com/kb/HT213189 Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228 ExploitThird Party Advisory
https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html ExploitThird Party Advisory
20220721 Open-Xchange Security Advisory 2022-07-21 mailing-listMailing ListThird Party Advisory
http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Inject… Third Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html ExploitThird Party AdvisoryVDB Entry
20221208 Intel Data Center Manager <= 5.1 Local Privileges Escalation mailing-listExploitMailing ListThird Party Advisory
http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html Third Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44228 Third Party AdvisoryUS Government Resource

Coincidencias CPE (NVD) (60)

cpe:2.3:o:siemens:6bk1602-0aa12-0tp0_firmware:*:*:*:*:*:*:*:* < 2.7.0
cpe:2.3:o:siemens:6bk1602-0aa22-0tp0_firmware:*:*:*:*:*:*:*:* < 2.7.0
cpe:2.3:o:siemens:6bk1602-0aa32-0tp0_firmware:*:*:*:*:*:*:*:* < 2.7.0
cpe:2.3:o:siemens:6bk1602-0aa42-0tp0_firmware:*:*:*:*:*:*:*:* < 2.7.0
cpe:2.3:o:siemens:6bk1602-0aa52-0tp0_firmware:*:*:*:*:*:*:*:* < 2.7.0
cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* ≥ 2.0.1 < 2.3.1
cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* ≥ 2.4.0 < 2.12.2
cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* ≥ 2.13.0 < 2.15.0
cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:*
cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*
cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*
cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:*
cpe:2.3:o:siemens:sppa-t3000_ses3000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:capital:*:*:*:*:*:*:*:* < 2019.1
cpe:2.3:a:siemens:capital:2019.1:-:*:*:*:*:*:*
cpe:2.3:a:siemens:capital:2019.1:sp1912:*:*:*:*:*:*
cpe:2.3:a:siemens:comos:*:*:*:*:*:*:*:* < 10.4.2
cpe:2.3:a:siemens:desigo_cc_advanced_reports:3.0:*:*:*:*:*:*:*
cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.0:*:*:*:*:*:*:*
cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.1:*:*:*:*:*:*:*
cpe:2.3:a:siemens:desigo_cc_advanced_reports:4.2:*:*:*:*:*:*:*
cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.0:*:*:*:*:*:*:*
cpe:2.3:a:siemens:desigo_cc_advanced_reports:5.1:*:*:*:*:*:*:*
cpe:2.3:a:siemens:desigo_cc_info_center:5.0:*:*:*:*:*:*:*
cpe:2.3:a:siemens:desigo_cc_info_center:5.1:*:*:*:*:*:*:*
cpe:2.3:a:siemens:e-car_operation_center:*:*:*:*:*:*:*:* < 2021-12-13
cpe:2.3:a:siemens:energy_engage:3.1:*:*:*:*:*:*:*
cpe:2.3:a:siemens:energyip:8.5:*:*:*:*:*:*:*
cpe:2.3:a:siemens:energyip:8.6:*:*:*:*:*:*:*
cpe:2.3:a:siemens:energyip:8.7:*:*:*:*:*:*:*
cpe:2.3:a:siemens:energyip:9.0:*:*:*:*:*:*:*
cpe:2.3:a:siemens:energyip_prepay:*:*:*:*:*:*:*:* < 3.8.0.12
cpe:2.3:a:siemens:gma-manager:*:*:*:*:*:*:*:* < 8.6.2j-398
cpe:2.3:a:siemens:head-end_system_universal_device_integration_system:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:industrial_edge_management:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:industrial_edge_management_hub:*:*:*:*:*:*:*:* < 2021-12-13
cpe:2.3:a:siemens:logo\!_soft_comfort:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:mendix:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:mindsphere:*:*:*:*:*:*:*:* < 2021-12-16
cpe:2.3:a:siemens:navigator:*:*:*:*:*:*:*:* < 2021-12-13
cpe:2.3:a:siemens:nx:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:opcenter_intelligence:*:*:*:*:*:*:*:* ≥ 3.2 < 3.5
cpe:2.3:a:siemens:operation_scheduler:*:*:*:*:*:*:*:* ≤ 1.1.3
cpe:2.3:a:siemens:sentron_powermanager:4.1:*:*:*:*:*:*:*
cpe:2.3:a:siemens:sentron_powermanager:4.2:*:*:*:*:*:*:*
cpe:2.3:a:siemens:siguard_dsa:*:*:*:*:*:*:*:* ≥ 4.2 < 4.4.1
cpe:2.3:a:siemens:sipass_integrated:2.80:*:*:*:*:*:*:*
cpe:2.3:a:siemens:sipass_integrated:2.85:*:*:*:*:*:*:*
cpe:2.3:a:siemens:siveillance_command:*:*:*:*:*:*:*:* ≤ 4.16.2.1
cpe:2.3:a:siemens:siveillance_control_pro:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:siveillance_identity:1.5:*:*:*:*:*:*:*
cpe:2.3:a:siemens:siveillance_identity:1.6:*:*:*:*:*:*:*
cpe:2.3:a:siemens:siveillance_vantage:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:siveillance_viewpoint:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:solid_edge_cam_pro:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:solid_edge_harness_design:*:*:*:*:*:*:*:* < 2020
cpe:2.3:a:siemens:solid_edge_harness_design:2020:*:*:*:*:*:*:*
cpe:2.3:a:siemens:solid_edge_harness_design:2020:-:*:*:*:*:*:*
cpe:2.3:a:siemens:solid_edge_harness_design:2020:sp2002:*:*:*:*:*:*
cpe:2.3:a:siemens:spectrum_power_4:*:*:*:*:*:*:*:* < 4.70

Puntuación CVSS

10.0Crítica

Fuente: CISA-ADP · CVSS 3.1

Vector de ataque: Red
Complejidad: Baja
Privilegios: Ninguno
Interacción del usuario: Ninguna
Alcance: Cambiado
Confidencialidad: Alto
Integridad: Alto
Disponibilidad: Alto

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Todas las puntuaciones (4)

CISA-ADP	CVSS 3.1	10.0Crítica
nvd	CVSS 3.1	10.0Crítica
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	10.0Crítica
nvd	CVSS 2.0	9.3Alta

EPSS (probabilidad de explotación en 30 días)

100.00%

superior al 100 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: active
Automatizable: yes
Impacto técnico: total

Cronología

ID reservado2021-11-26
Publicada2021-12-10 03:00
Llegó a IP-DB2026-10-24 23:34
Añadida a KEV2021-12-10
Última actualización2026-08-11 22:33

Asignada por (CNA): apache
Estado en NVD: Analyzed

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — Debian

9.2Crítica

CVE-2026-111497 KEV hace 12 días

Out-of-Bounds Write in Google Brotli Decoder

Google Brotli; Siemens Heliox Dual Port 60kW; Siemens Heliox Flex Pro; Siemens SICHARGE FLEX

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

83%EPSS

8.4Alta

CVE-2026-77118 hace 2 meses

Out-of-bounds write in GraphicsMagick PCD decoder

GraphicsMagick Group GraphicsMagick; Debian graphicsmagick; Fedora Project GraphicsMagick

A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and never checks it against the end of the heap-allocated…

6.0Media

CVE-2026-12996 hace 3 meses

OpenVPN OpenVPN

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry

5.6Media

CVE-2026-14355 hace 4 meses

ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD

php php

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation …

3.7Baja

CVE-2026-56968 hace 4 meses

GNU GNU SASL

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.

7.5Alta

CVE-2026-49975 hace 4 meses

Apache HTTP Server: mod_http2 denial of service

Apache Software Foundation Apache HTTP Server; Red Hat JBoss Core Services for RHEL 8; Red Hat JBoss Core Services on RHEL 7; Red Hat Red Hat Enterprise Linux 10

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

33%EPSS