RHSA-2026:65840

Axios is a promise based HTTP client for the browser and Node.js.

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have…

Arithmetic over induction variables in loops were not correctly checked for underflow or overflow.

gRPC-Go is the Go language implementation of gRPC.

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`.

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Prometheus is an open-source monitoring system and time series database.

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service.

The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading…