https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 03:42:40 +0000 https://vulnerability.circl.lu/vuln/cleanstart-2026-ee87307 <p><strong>Affected:</strong> CleanStart: argo-workflows</p> <p>CVE-2026-54490 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: argo-workflows</p> <p>CVE-2026-54490 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> https://vulnerability.circl.lu/vuln/cleanstart-2026-ee87307 https://vulnerability.circl.lu/vuln/fkie_cve-2026-54490 <p>websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames&#39; length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.</p> <p>websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames&#39; length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-54490 https://vulnerability.circl.lu/vuln/ghsa-mp7j-qc5w-4988 <p><strong>Affected:</strong> npm: websocket-driver</p> <p>### Impact</p> <p>If this library is used in tandem with the `permessage-deflate` extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size. This is because this limit is checked against the message frames&#39; length headers, which give the size of the compressed data, not the size after decompression. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage.</p> <p>### Patches</p> <p>The issue has been patched in version 0.7.5, by checking the length of messages after they are processed by incoming extensions. All users should upgrade to this version.</p> <p>### Workarounds</p> <p>No known workarounds exist.</p> <p>### Acknowledgements</p> <p>This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.</p> <p><strong>Affected:</strong> npm: websocket-driver</p> <p>### Impact</p> <p>If this library is used in tandem with the `permessage-deflate` extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size. This is because this limit is checked against the message frames&#39; length headers, which give the size of the compressed data, not the size after decompression. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage.</p> <p>### Patches</p> <p>The issue has been patched in version 0.7.5, by checking the length of messages after they are processed by incoming extensions. All users should upgrade to this version.</p> <p>### Workarounds</p> <p>No known workarounds exist.</p> <p>### Acknowledgements</p> <p>This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.</p> https://vulnerability.circl.lu/vuln/ghsa-mp7j-qc5w-4988 https://vulnerability.circl.lu/vuln/opensuse-su-2026:21448-1 <p>Security update for agama-web-ui</p> <p>Security update for agama-web-ui</p> https://vulnerability.circl.lu/vuln/opensuse-su-2026:21448-1 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-54490 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: node-websocket-driver, Ubuntu:18.04:LTS: node-websocket-driver, Ubuntu:20.04:LTS: node-websocket-driver, Ubuntu:22.04:LTS: node-websocket-driver, Ubuntu:24.04:LTS: node-websocket-driver, Ubuntu:26.04:LTS: node-websocket-driver</p> <p>websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames&#39; length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: node-websocket-driver, Ubuntu:18.04:LTS: node-websocket-driver, Ubuntu:20.04:LTS: node-websocket-driver, Ubuntu:22.04:LTS: node-websocket-driver, Ubuntu:24.04:LTS: node-websocket-driver, Ubuntu:26.04:LTS: node-websocket-driver</p> <p>websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames&#39; length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-54490