CVE-2026-12549: Enterprise Linux: güvenlik açığı

Açıklama (NVD)

The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding.

Özet bilgiler

Ürün

Redhat Enterprise Linux

CVSS v3.1

4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

EPSS

%0,36 (yüzdelik 30)

CWE

CWE-805

Yama

Mevcut

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• access.redhat.com
• access.redhat.com
• bugzilla.redhat.com
• gitlab.gnome.org
• CWE-805