SB2026101937 - Red Hat Enterprise Linux 8 update for pcs
Published: October 19, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-82397)
CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper validation of the number of fields in application/x-www-form-urlencoded body parsing when processing a crafted form request containing numerous separators. A remote attacker can send a specially crafted form request to cause a denial of service.
The synchronous parsing occurs on the event loop before request dispatch, causing other connections to wait.
2) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2024-14029)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform HTTP request smuggling.
The vulnerability exists due to inconsistent interpretation of HTTP requests in the Tornado HTTP request parser when processing requests with multiple Transfer-Encoding: chunked headers. A remote attacker can send a specially crafted request to perform HTTP request smuggling.
Exploitation requires Tornado to be deployed behind a proxy server that forwards requests containing multiple Transfer-Encoding: chunked headers.
Remediation
Install update from vendor's website.