oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

oss-security mailing list - 2026/02

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹
² 3	³ 2	⁴ 1	⁵ 2	⁶	⁷ 2	⁸ 2
⁹ 8	¹⁰ 4	¹¹	¹² 2	¹³ 2	¹⁴	¹⁵
¹⁶ 1	¹⁷ 8	¹⁸ 7	¹⁹ 7	²⁰ 6	²¹	²² 1
²³ 3	²⁴ 16	²⁵ 9	²⁶ 4	²⁷ 13	²⁸

Messages by day:

February 2 (3 messages)

CVE-2026-23794: Apache Syncope: Reflected XSS on Enduser Login (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-23795: Apache Syncope: Console XXE on Keymaster parameters (Francesco Chicchiriccò <ilgrosso@...che.org>)
[kubernetes] Multiple issues in ingress-nginx (Tabitha Sable <tabitha.c.sable@...il.com>)

February 3 (2 messages)

Django CVE-2025-13473, CVE-2025-14550, CVE-2026-1207, CVE-2026-1285, CVE-2026-1287, and CVE-2026-1312 (Jacob Walls <jwalls@...ngoproject.com>)
Re: Systemd vsock sshd (Bastian Blank <bblank@...nkmo.de>)

February 4 (1 message)

CVE-2026-24735: Apache Answer: Revision API Improper Access Control leads to Information Disclosure (Enxin Xie <linkinstar@...che.org>)

February 5 (2 messages)

NGINX < 1.29.5, 1.28.2 MitM injection CVE-2026-1642 (Jan Schaumann <jschauma@...meister.org>)
[vim-security] buffer overflow in helpfile option handling affects Vim <9.1.2132 (Christian Brabandt <cb_home@....de>)

February 7 (2 messages)

On patch vs commit messages (Sam James <sam@...too.org>)
Go 1.25.7 and Go 1.24.13 are released with 2 CVE fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)

February 8 (2 messages)

CVE-2026-23903: Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems (Lenny Primak <lprimak@...che.org>)
CVE-2026-23901: Apache Shiro: Brute force attack possible to determine valid user names (Lenny Primak <lprimak@...che.org>)

February 9 (8 messages)

Re: On patch vs commit messages (Florian Weimer <fweimer@...hat.com>)
CVE-2026-22922: Apache Airflow: Airflow externalLogUrl Permission Bypass (Ephraim Anierobi <ephraimanierobi@...che.org>)
CVE-2026-24098: Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors (Ephraim Anierobi <ephraimanierobi@...che.org>)
CVE-2026-24343: Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath Expressions (Qingran Zhao <zhaoqingran@...che.org>)
CVE-2026-23906: Apache Druid: Authentication Bypass via LDAP Anonymous Bind (Karan Kumar <karan@...che.org>)
gnutls 3.8.12 fixes CVE-2026-1584 & CVE-2025-14831 (Alan Coopersmith <alan.coopersmith@...cle.com>)
libpng 1.6.55: Heap buffer overflow vulnerability fixed: CVE-2026-25646 (Cosmin Truta <ctruta@...il.com>)
FreeRDP fixes 12 CVEs in 3.22.0 release (Alan Coopersmith <alan.coopersmith@...cle.com>)

February 10 (4 messages)

Re: FreeRDP fixes 12 CVEs in 3.22.0 release (Solar Designer <solar@...nwall.com>)
PowerDNS Security Advisory 2026-01: Crafted zones can lead to increased resource usage in Recursor (Otto Moerbeek <otto.moerbeek@...erdns.com>)
CVE-2026-25506: MUNGE 0.5-0.5.17 buffer overflow allowing key leakage (Chris Dunlap <chris.m.dunlap@...il.com>)
PyCA cryptography 46.0.5 released with fix for CVE-2026-26007 (Alan Coopersmith <alan.coopersmith@...cle.com>)

February 12 (2 messages)

Pillow 12.1.1 released with fix for CVE-2026-25990 (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2025-33042: Apache Avro Java SDK: Code injection on Java generated code (Ryan Skraba <rskraba@...che.org>)

February 13 (2 messages)

CVE-2025-40905: WWW::OAuth 1.000 and earlier for Perl uses insecure rand() function for cryptographic functions (Alan Coopersmith <alan.coopersmith@...cle.com>)
[vim-security] NetBeans specialKeys Stack Buffer Overflow with Vim <9.1.2148 (Christian Brabandt <cb@...bit.org>)

February 16 (1 message)

CVE-2026-25903: Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates (David Handermann <exceptionfactory@...che.org>)

February 17 (8 messages)

[OSSA-2026-002] OpenStack Nova: calls qemu-img without format restrictions for resize (CVE-2026-24708) (Jeremy Stanley <fungi@...goth.org>)
Re: [OSSA-2026-002] OpenStack Nova: calls qemu-img without format restrictions for resize (CVE-2026-24708) (Salvatore Bonaccorso <carnil@...ian.org>)
Re: [OSSA-2026-002] OpenStack Nova: calls qemu-img without format restrictions for resize (CVE-2026-24708) (Jeremy Stanley <fungi@...goth.org>)
CVE-2026-25087: Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering (Antoine Pitrou <apitrou@...che.org>)
zlib security audit by 7asecurity (Sam James <sam@...too.org>)
Re: CVE-2026-25506: MUNGE 0.5-0.5.17 buffer overflow allowing key leakage (Sam James <sam@...too.org>)
[OSSA-2026-002] OpenStack Nova: calls qemu-img without format restrictions for resize (CVE-2026-24708) errata 1 (Jeremy Stanley <fungi@...goth.org>)
Re: zlib security audit by 7asecurity (Simon Josefsson <simon@...efsson.org>)

February 18 (7 messages)

Re: Re: zlib security audit by 7asecurity (Jan Engelhardt <ej@...i.de>)
Re: Re: zlib security audit by 7asecurity (Sevan Janiyan <venture37@...klan.co.uk>)
Re: zlib security audit by 7asecurity (Steffen Nurpmeso <steffen@...oden.eu>)
Multiple vulnerabilities in Jenkins (Daniel Beck <ml@...kweb.net>)
Re: Re: zlib security audit by 7asecurity (Sevan Janiyan <venture37@...klan.co.uk>)
CVE-2026-25747: Apache Camel: Deserialization of Untrusted Data in Camel LevelDB (Andrea Cosentino <acosentino@...che.org>)
CVE-2026-23552: Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy (Andrea Cosentino <acosentino@...che.org>)

February 19 (7 messages)

Re: Re: zlib security audit by 7asecurity (Sevan Janiyan <venture37@...klan.co.uk>)
MIT/Heimdal Kerberos credentials cache type FILE risks (Solar Designer <solar@...nwall.com>)
Re: Systemd vsock sshd (Solar Designer <solar@...nwall.com>)
Default IV & other issues in aes-js & pyaes modules, & strongMan VPN manager (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Default IV & other issues in aes-js & pyaes modules, & strongMan VPN manager (Soatok Dreamseeker <soatok.dhole@...il.com>)
Re: MIT/Heimdal Kerberos credentials cache type FILE risks (Jacob Bachmeyer <jcb62281@...il.com>)
Re: MIT/Heimdal Kerberos credentials cache type FILE risks (Russ Allbery <eagle@...ie.org>)

February 20 (6 messages)

Re: MIT/Heimdal Kerberos credentials cache type FILE risks (Russ Allbery <eagle@...ie.org>)
Re: MIT/Heimdal Kerberos credentials cache type FILE risks (Jacob Bachmeyer <jcb62281@...il.com>)
Re: MIT/Heimdal Kerberos credentials cache type FILE risks (Jacob Bachmeyer <jcb62281@...il.com>)
Re: MIT/Heimdal Kerberos credentials cache type FILE risks (Russ Allbery <eagle@...ie.org>)
OpenSC, ghostscript, cgif issues from the recent Anthropic disclosure (Joe Malcolm <jmalcolm@...eus.com>)
Re: OpenSC, ghostscript, cgif issues from the recent Anthropic disclosure (Eli Schwartz <eschwartz@...too.org>)

February 22 (1 message)

Re: MIT/Heimdal Kerberos credentials cache type FILE risks ("Tim Wadhwa-Brown (twadhwab)" <twadhwab@...co.com>)

February 23 (3 messages)

CVE-2026-26079/CVE-2026-25916: Roundcube vulns prior to 1.5.13/1.6.13 (Valtteri Vuorikoski <vuori@...com.org>)
CVE-2025-27555: Apache Airflow: Connection Secrets not masked in UI when Connection are added via Airflow cli (Jarek Potiuk <potiuk@...che.org>)
CVE-2024-56373: Apache Airflow: SSTI to Code Execution in Airflow through Shared DB Information (Jarek Potiuk <potiuk@...che.org>)

February 24 (16 messages)

Re: Telnetd Vulnerability Report (Justin Swartz <justin.swartz@...ingedge.co.za>)
Re: Telnetd Vulnerability Report (Solar Designer <solar@...nwall.com>)
Re: Telnetd Vulnerability Report (Solar Designer <solar@...nwall.com>)
CVE-2026-23969: Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering (Daniel Gaspar <dpgaspar@...che.org>)
CVE-2026-23980: Apache Superset: Improper Neutralization of Special Elements used in a SQL Command (Daniel Gaspar <dpgaspar@...che.org>)
CVE-2026-23982: Apache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass (Daniel Gaspar <dpgaspar@...che.org>)
CVE-2026-23983: Apache Superset: Sensitive Data Exposure via REST API (disabled by default) (Daniel Gaspar <dpgaspar@...che.org>)
CVE-2026-23984: Apache Superset: SQLLab Read-Only Bypass on PostgreSQL (Daniel Gaspar <dpgaspar@...che.org>)
Re: Telnetd Vulnerability Report (Ron Ben Yizhak <ron.benyizhak@...ebreach.com>)
Re: Re: Telnetd Vulnerability Report (kf503bla@...k.com)
Re: Telnetd Vulnerability Report (Solar Designer <solar@...nwall.com>)
Re: Telnetd Vulnerability Report ("Lyndon Nerenberg (VE7TFX/VE6BBM)" <lyndon@...hanc.ca>)
Unsound Workshop at ECOOP 2026 (Jan Bessai <jan.bessai@...dortmund.de>)
Re: Unsound Workshop at ECOOP 2026 (Solar Designer <solar@...nwall.com>)
Re: Telnetd Vulnerability Report (Vincent Lefevre <vincent@...c17.net>)
Re: Telnetd Vulnerability Report (Eddie Chapman <eddie@...k.net>)

February 25 (9 messages)

Re: Telnetd Vulnerability Report (Justin Swartz <justin.swartz@...ingedge.co.za>)
Re: Telnetd Vulnerability Report (Eddie Chapman <eddie@...k.net>)
Re: Re: Telnetd Vulnerability Report (Marco Moock <mm@...fdsl.de>)
Re: Telnetd Vulnerability Report (kf503bla@...k.com)
Re: Telnetd Vulnerability Report (Solar Designer <solar@...nwall.com>)
Re: OpenSSL Security Advisory (updated text for CVE-2025-15467) (Tomas Mraz <tomas@...nssl.org>)
Re: Telnetd Vulnerability Report (Steffen Nurpmeso <steffen@...oden.eu>)
Re: Telnetd Vulnerability Report (Marco Moock <mm@...fdsl.de>)
Re: Telnetd Vulnerability Report ("Lyndon Nerenberg (VE7TFX/VE6BBM)" <lyndon@...hanc.ca>)

February 26 (4 messages)

Re: Telnetd Vulnerability Report (Steffen Nurpmeso <steffen@...oden.eu>)
CVE-2026-27900 - Sensitive Information Exposure in Debug Logs of Terraform Provider for Linode ("Liang, Zhiwei" <zliang@...mai.com>)
Re: Re: Telnetd Vulnerability Report (Florian Weimer <fweimer@...hat.com>)
Re: Telnetd Vulnerability Report (Albert Veli <albert.veli@...il.com>)

February 27 (13 messages)

Re: Telnetd Vulnerability Report ("Lyndon Nerenberg (VE7TFX/VE6BBM)" <lyndon@...hanc.ca>)
Re: Re: Telnetd Vulnerability Report (Demi Marie Obenour <demiobenour@...il.com>)
CVE-2026-28372: Telnetd Vulnerability Report (Guillem Jover <guillem@...ian.org>)
OSEC-2026-01 in the OCaml runtime: Buffer Over-Read in OCaml Marshal Deserialization (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: OSEC-2026-01 in the OCaml runtime: Buffer Over-Read in OCaml Marshal Deserialization (Florian Weimer <fweimer@...hat.com>)
[vim-security] OS Command Injection in netrw affects Vim < 9.2.0073 (Christian Brabandt <cb@...bit.org>)
[vim-security] Heap-based Buffer Overflow in Emacs tags parsing affects Vim < 9.2.0074 (Christian Brabandt <cb@...bit.org>)
[vim-security] Heap-based Buffer Underflow in Emacs tags parsing affects Vim < 9.2.0075 (Christian Brabandt <cb@...bit.org>)
[vim-security] Heap-based Buffer Overflow and OOB Read in :terminal affects Vim < 9.2.0076 (Christian Brabandt <cb@...bit.org>)
[vim-security] Multiple Vulnerabilities in Swap File Recovery affect Vim < 9.2.0077 (Christian Brabandt <cb@...bit.org>)
[vim-security] Stack-buffer-overflow in build_stl_str_hl() affects Vim < 9.2.0078 (Christian Brabandt <cb@...bit.org>)
CVE-2026-3255: HTTP::Session2 versions before 1.12 for Perl may generate weak session ids using the rand() function (Robert Rothenberg <rob@...tmail.net>)
Fwd: CVE-2018-25160: HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids,… (Robert Rothenberg <rrwo@...n.org>)

103 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.