OpenSSL, Go, and Apache HttpClient security fixes

Several security advisories landed covering OpenSSL, the Go toolchain, Apache HttpClient, Perl, and OpenStack components. The issues include denial of service conditions, a TLS hostname verification failure, incorrect regex results, and authorization flaws.

OpenSSL QUIC server memory growth

OpenSSL published a low severity advisory for CVE-2026-14456 affecting QUIC server channel handling. Unbounded growth of an internal queue can exhaust memory and produce a denial of service. Operators running OpenSSL based QUIC servers should apply the fix.

Go 1.26.6 and 1.25.13 security releases

The Go project released 1.26.6 and 1.25.13 with ten security fixes. One fix addresses a case in which a GOPROXY can bypass sumdb tile verification. Users of the affected Go toolchains should upgrade to obtain the corrections.

Ironic Python Agent container controls

OSSN-0107 reports that the container HardwareManager security model in Ironic Python Agent 11.x was misimplemented. Container execution controls did not behave as intended during hardware management. The flaw is fixed in current releases and was not backported.

Perl Aho-Corasick regex match error

CVE-2026-19487 covers Perl versions from 5.9.4 before 5.41.9. A stale failure flag can end the Aho-Corasick prescan early in S_find_byclass, producing incorrect regular expression match results. Software that depends on precise match outcomes should move to a corrected Perl release.

Apache HttpClient async TLS hostname check

CVE-2026-71290 states that TLS hostname verification is silently disabled by default on the async transport in Apache HttpComponents Client. The default configuration can permit man in the middle attacks. The issue is fixed in HttpClient 5.6.4.

Apache HttpClient connection pool exhaustion

CVE-2026-64607 describes a connection leak in Apache HttpClient 5.x classic I/O when Content-Encoding decoding fails. Leaked connections can exhaust the pool and cause denial of service. Affected deployments should upgrade to a fixed release.

OpenStack Octavia QoS policy lock

OSSA-2026-035 reports an authorization flaw in OpenStack Octavia that lets authenticated users obtain a lock blocking QoS policy deletion. A CVE identifier is still pending. Operators running Octavia should review the advisory and apply the provided remediation.

Perl Form::Processor HtmlArea method dispatch

CVE-2026-13051 affects Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360. An HTML::Tidy diagnostic passed to add_error as a Locale::Maketext template can enable attacker selected method dispatch and resource exhaustion. Users of this niche CPAN module should update if they depend on it.