oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

oss-security mailing list - 2026/01

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 6	² 3	³ 5	⁴
⁵ 14	⁶ 5	⁷ 9	⁸ 7	⁹ 2	¹⁰ 1	¹¹ 2
¹² 7	¹³ 5	¹⁴ 3	¹⁵ 7	¹⁶ 9	¹⁷ 4	¹⁸ 2
¹⁹	²⁰	²¹	²²	²³	²⁴	²⁵
²⁶	²⁷	²⁸	²⁹	³⁰	³¹

Messages by day:

January 1 (6 messages)

Re: Re: Best practices for signature verifcation (Collin Funk <collin.funk1@...il.com>)
Re: Re: Best practices for signature verifcation (Demi Marie Obenour <demiobenour@...il.com>)
Re: Systemd vsock sshd (Pat Gunn <pgunn01@...il.com>)
Re: Best practices for signature verifcation (Simon Josefsson <simon@...efsson.org>)
Re: Re: Best practices for signature verifcation (Ali Polatel <alip@...sys.org>)
Re: Best practices for signature verifcation (Clemens Lang <cllang@...hat.com>)

January 2 (3 messages)

Re: Systemd vsock sshd (wish42offcl98@...teo.org)
Re: Best practices for signature verifcation (Soatok Dreamseeker <soatok.dhole@...il.com>)
Re: Re: Best practices for signature verifcation (Peter Gutmann <pgut001@...auckland.ac.nz>)

January 3 (5 messages)

Re: Re: Best practices for signature verifcation (Demi Marie Obenour <demiobenour@...il.com>)
Re: Systemd vsock sshd (Greg Dahlman <dahlman@...il.com>)
Re: Systemd vsock sshd (Carlos Rodriguez-Fernandez <carlosrodrifernandez@...il.com>)
Re: Re: Best practices for signature verifcation (Demi Marie Obenour <demiobenour@...il.com>)
Re: Best practices for signature verifcation (Demi Marie Obenour <demiobenour@...il.com>)

January 5 (14 messages)

CVE-2025-66518: Apache Kyuubi: Unauthorized directory access due to missing path normalization (Akira Ajisaka <aajisaka@...che.org>)
Re: Re: Best practices for signature verifcation (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: Many vulnerabilities in GnuPG (Stephan Verbücheln <stephan@...buecheln.ch>)
GnuPG ticket T7900 (was: Many vulnerabilities in GnuPG) (Werner Koch <wk@...pg.org>)
Re: Re: Best practices for signature verifcation (Valtteri Vuorikoski <vuori@...com.org>)
Re: Re: Best practices for signature verifcation (Jeffrey Walton <noloader@...il.com>)
CVE-2025-68280: Apache SIS: XML External Entity (XXE) vulnerability (Martin Desruisseaux <desruisseaux@...che.org>)
Re: Best practices for signature verifcation (Clemens Lang <cllang@...hat.com>)
Re: Re: Best practices for signature verifcation (Morten Linderud <morten@...derud.pw>)
Buffer overflow in /bin/su from UNIX v4 (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: CVE-2025-68280: Apache SIS: XML External Entity (XXE) vulnerability (Sebastian Pipping <sebastian@...ping.org>)
Re: Best practices for signature verifcation (Demi Marie Obenour <demiobenour@...il.com>)
Re: Re: Best practices for signature verifcation (Demi Marie Obenour <demiobenour@...il.com>)
Multiple vulnerabilities in aiohttp (Sam Bull <9m199i@...bull.org>)

January 6 (5 messages)

Re: Buffer overflow in /bin/su from UNIX v4 (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: Re: Best practices for signature verifcation (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: Re: Best practices for signature verifcation (Taavi Eomäe <taavi@...e.ee>)
Re: [External] : Buffer overflow in /bin/su from UNIX v4 (Casper Dik <casper.dik@...cle.com>)
Fwd: [FD] zlib v1.3.1.2 Global Buffer Overflow in TGZfname() of zlib untgz Utility via Unbounded strcpy() on User-Suppl… (Alan Coopersmith <alan.coopersmith@...c…)

January 7 (9 messages)

wget2-2.2.1 released with security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)
[ADVISORY] curl CVE-2025-13034: No QUIC certificate pinning with GnuTLS (Daniel Stenberg <daniel@...x.se>)
[ADVISORY] curl CVE-2025-14017: broken TLS options for threaded LDAPS (Daniel Stenberg <daniel@...x.se>)
[ADVISORY] curl CVE-2025-14524: bearer token leak on cross-protocol redirect (Daniel Stenberg <daniel@...x.se>)
[ADVISORY] curl CVE-2025-14819: OpenSSL partial chain store policy bypass (Daniel Stenberg <daniel@...x.se>)
[ADVISORY] curl CVE-2025-15079: libssh global knownhost override (Daniel Stenberg <daniel@...x.se>)
[ADVISORY] curl CVE-2025-15224: libssh key passphrase bypass without agent set (Daniel Stenberg <daniel@...x.se>)
TLP: Polkit Authentication Bypass in Profiles Daemon in Version 1.9.0 (CVE-2025-67859) (Matthias Gerstner <mgerstner@...e.de>)
Foomuuri: Lack of Client Authorization and Input Verification allow Control over Firewall Configuration (CVE-2025-67603, … (Matthias Gerstner <mgerstner@...e.de>)

January 8 (7 messages)

CVE-2025-52435: Apache NimBLE: Invalid error handling in pause encryption procedure in NimBLE controller (Szymon Janc <janc@...che.org>)
CVE-2025-53470: Apache NimBLE: Out-of-Bounds Write Vulnerability in NimBLE HCI H4 driver (Szymon Janc <janc@...che.org>)
CVE-2025-53477: Apache NimBLE: NULL Pointer Dereference in NimBLE host HCI layer (Szymon Janc <janc@...che.org>)
CVE-2025-62235: Apache NimBLE: Incorrect handling of SMP Security Request could lead to undesirable pairing (Szymon Janc <janc@...che.org>)
Fwd: libtasn1-4.21.0 released [stable] - fixes CVE-2025-13151 (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Systemd vsock sshd (Solar Designer <solar@...nwall.com>)
Re: Systemd vsock sshd (Greg Dahlman <dahlman@...il.com>)

January 9 (2 messages)

InputPlumber: Lack of D-Bus Authorization and Input Verification allows UI Input Injection and Denial-of-Service (CVE-202… (Matthias Gerstner <mgerstner@...e.de>)
Net-SNMP snmptrapd vulnerability [CVE-2025-68615] (Alan Coopersmith <alan.coopersmith@...cle.com>)

January 10 (1 message)

The Curious Case of Stack Pivot Detection (Ali Polatel <alip@...sys.org>)

January 11 (2 messages)

Null Pointer Dereference in HarfBuzz (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2025-68493: Apache Struts: XXE vulnerability in outdated XWork component (Lukasz Lenart <lukaszlenart@...che.org>)

January 12 (7 messages)

Re: Null Pointer Dereference in HarfBuzz (Jacob Bachmeyer <jcb62281@...il.com>)
Re: CVE-2025-68493: Apache Struts: XXE vulnerability in outdated XWork component (Hanno Böck <hanno@...eck.de>)
Re: Null Pointer Dereference in HarfBuzz (Jan Engelhardt <ej@...i.de>)
Re: Null Pointer Dereference in HarfBuzz (Greg KH <greg@...ah.com>)
Re: Null Pointer Dereference in HarfBuzz (Vincent Lefevre <vincent@...c17.net>)
Re: CVE-2025-68493: Apache Struts: XXE vulnerability in outdated XWork component (Loganaden Velvindron <loganaden@...il.com>)
libpng 1.6.54: two heap buffer over-read vulnerabilities fixed: CVE-2026-22695, CVE-2026-22801 (Cosmin Truta <ctruta@...il.com>)

January 13 (5 messages)

Re: Null Pointer Dereference in HarfBuzz (Jacob Bachmeyer <jcb62281@...il.com>)
NodeJS Security Releases (CVE-2025-55131, CVE-2025-55130, CVE-2025-59465, and others) (Jan Schaumann <jschauma@...meister.org>)
Re: Null Pointer Dereference in HarfBuzz (Jacob Bachmeyer <jcb62281@...il.com>)
Re: Null Pointer Dereference in HarfBuzz (Vincent Lefevre <vincent@...c17.net>)
CVE-2025-66169: Apache Camel: Cypher injection vulnerability in Camel-Neo4j component (Andrea Cosentino <acosentino@...che.org>)

January 14 (3 messages)

Re: NodeJS Security Releases (CVE-2025-55131, CVE-2025-55130, CVE-2025-59465, and others) (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: NodeJS Security Releases (CVE-2025-55131, CVE-2025-55130, CVE-2025-59465, and others) (Jan Schaumann <jschauma@...meister.org>)
Re: Null Pointer Dereference in HarfBuzz (Jacob Bachmeyer <jcb62281@...il.com>)

January 15 (7 messages)

[CVE-2026-22797] OpenStack keystonemiddleware: Privilege Escalation via Identity Headers in External OAuth2 Tokens (CVE-2026… (Jeremy Stanley <fungi@...goth.org>)
Re: The Curious Case of Stack Pivot Detection (Adam Zabrocki <pi3@....com.pl>)
Go 1.25.6 and Go 1.24.12 are released with 6 CVE fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Go 1.25.6 and Go 1.24.12 are released with 6 CVE fixes (Steffen Nurpmeso <steffen@...oden.eu>)
CVE-2025-68438: Apache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated (Ephraim Anierobi <ephraimanierobi@...che…)
CVE-2025-68675: Apache Airflow: proxy credentials for various providers might leak in task logs (Ephraim Anierobi <ephraimanierobi@...che.org>)
Re: Fwd: [FD] zlib v1.3.1.2 Global Buffer Overflow in TGZfname() of zlib untgz Utility via Unbounded strcpy() on User-S… (Alan Coopersmith <alan.coopersmith@...c…)

January 16 (9 messages)

Re: Re: Best practices for signature verifcation (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: [CVE-2026-22797] OpenStack keystonemiddleware: Privilege Escalation via Identity Headers in External OAuth2 Tokens … (Salvatore Bonaccorso <carnil@...ian.org…)
Re: [CVE-2026-22797] OpenStack keystonemiddleware: Privilege Escalation via Identity Headers in External OAuth2 Tokens (CVE… (Jeremy Stanley <fungi@...goth.org>)
CVE-2025-60021: Apache bRPC: Remote command injection vulnerability in heap builtin service (Guangming Chen <guangmingchen@...che.org>)
The GNU C Library security advisories update for 2026-01-16 (Siddhesh Poyarekar <siddhesh.poyarekar@...il.com>)
The GNU C Library security advisories update for 2026-01-16 (part 2) (Carlos O'Donell <carlos@...hat.com>)
Re: NodeJS Security Releases (CVE-2025-55131, CVE-2025-55130, CVE-2025-59465, and others) (Michel Lind <michel@...hel-slm.name>)
Re: NodeJS Security Releases (CVE-2025-55131, CVE-2025-55130, CVE-2025-59465, and others) (Jan Schaumann <jschauma@...meister.org>)
[OSSA-2026-001] OpenStack keystonemiddleware: Privilege Escalation via Identity Headers in External OAuth2 Tokens (CVE-2026-… (Jeremy Stanley <fungi@...goth.org>)

January 17 (4 messages)

Re: Re: Best practices for signature verifcation (Jacob Bachmeyer <jcb62281@...il.com>)
CVE-2025-68121: Regression and Incomplete Fix for Go TLS Session Resumption (Coia Prant <coiaprant@...il.com>)
Re: CVE-2025-68121: Regression and Incomplete Fix for Go TLS Session Resumption (Coia Prant <coiaprant@...il.com>)
Re: CVE-2025-8110 in Gogs self-hosted git service (Chad Dougherty <crd477@...oud.com>)

January 18 (2 messages)

Re: CVE-2025-8110 in Gogs self-hosted git service (Collin Funk <collin.funk1@...il.com>)
Re: CVE-2025-8110 in Gogs self-hosted git service (Michael Orlitzky <michael@...itzky.com>)

91 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.