oss-security mailing list - 2026/04

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [year] [list]

oss-security mailing list - 2026/04

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 5	² 10	³ 7	⁴	⁵
⁶ 4	⁷ 14	⁸ 14	⁹ 30	¹⁰ 15	¹¹ 11	¹² 7
¹³ 12	¹⁴ 9	¹⁵ 9	¹⁶ 12	¹⁷ 17	¹⁸ 5	¹⁹ 4
²⁰ 9	²¹ 6	²² 8	²³ 2	²⁴	²⁵	²⁶
²⁷	²⁸	²⁹	³⁰

Messages by day:

April 1 (5 messages)

Re: [vim-security] Vim modeline bypass via various options affects Vim < 9.2.0276 (Salvatore Bonaccorso <carnil@...ian.org>)
Re: [vim-security] Vim tabpanel modeline escape affects Vim < 9.2.0272 (Christian Brabandt <cb@...bit.org>)
Re: Multiple vulnerabilities in AppArmor (Greg KH <greg@...ah.com>)
[vim-security] Path traversal issue with zip.vim and special crafted zip archives in Vim < v9.2.0280 (Christian Brabandt <cb@...bit.org>)
[CVE-2026-5271] Python install manager script aliases search path hijack (Alan Coopersmith <alan.coopersmith@...cle.com>)

April 2 (10 messages)

FW: libinput Security Advisory: multiple security issues in libinput (Peter Hutterer <peter.hutterer@...-t.net>)
Re: [vim-security] Vim tabpanel modeline escape affects Vim < 9.2.0272 (Christian Brabandt <cb@...bit.org>)
Announce: OpenSSH 10.3 released (Damien Miller <djm@....openbsd.org>)
Re: [vim-security] Vim tabpanel modeline escape affects Vim < 9.2.0272 (Christian Brabandt <cb@...bit.org>)
Re: [vim-security] Vim tabpanel modeline escape affects Vim < 9.2.0272 (Tianyu Chen <sweetyfish@...pin.org>)
[ANNOUNCE] ATS is vulnerable to HTTP requests with body (Masakazu Kitajo <maskit@...che.org>)
Re: [vim-security] Vim tabpanel modeline escape affects Vim < 9.2.0272 ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: [vim-security] Vim tabpanel modeline escape affects Vim < 9.2.0272 (Christian Brabandt <cb@...bit.org>)
Re: [vim-security] Vim tabpanel modeline escape affects Vim < 9.2.0272 (Solar Designer <solar@...nwall.com>)
[libc musl] - Algorithmic complexity DoS in iconv GB18030 decoder (Jens Jarl Nestén Hansen-Nord <jens@...ten.eu>)

April 3 (7 messages)

Re: [libc musl] - Algorithmic complexity DoS in iconv GB18030 decoder (Rich Felker <dalias@...c.org>)
Re: [libc musl] - Algorithmic complexity DoS in iconv GB18030 decoder (Rich Felker <dalias@...c.org>)
Re: Announce: OpenSSH 10.3 released (Agostino Sarubbo <ago@...too.org>)
Re: Announce: OpenSSH 10.3 released (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Re: Multiple vulnerabilities in AppArmor (Salvatore Bonaccorso <carnil@...ian.org>)
Re: [vim-security] Vim tabpanel modeline escape affects Vim < 9.2.0272 (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Announce: OpenSSH 10.3 released (Demi Marie Obenour <demiobenour@...il.com>)

April 6 (4 messages)

Heads-up: Upcoming Samba security releases (2026-04-09) (Douglas Bagnall <dbagnall@...ba.org>)
Re: Announce: OpenSSH 10.3 released (Damien Miller <djm@...drot.org>)
CVE-2026-34197: Apache ActiveMQ Broker, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans ("Christopher L. Shannon" <cshannon@...che.o…)
CVE-2026-33227: Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ Web: Improper Limitati… ("Christopher L. Shannon" <cshannon@...c…)

April 7 (14 messages)

Re: Announce: OpenSSH 10.3 released (Demi Marie Obenour <demiobenour@...il.com>)
Re: Announce: OpenSSH 10.3 released (Damien Miller <djm@...drot.org>)
Re: Announce: OpenSSH 10.3 released (Demi Marie Obenour <demiobenour@...il.com>)
libcap-2.77 (since libcap-2.04) has TOCTOU privilege escalation issue ("Andrew G. Morgan" <morgan@...nel.org>)
Re: Heads-up: Upcoming Samba security releases (2026-04-09) (Douglas Bagnall <dbagnall@...ba.org>)
CVE-2026-35554: Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition (Manikumar <manikumar@...che.org>)
CVE-2026-27314: Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass (Michael Semb Wever <mck@...che.org>)
CVE-2026-27315: Apache Cassandra: cqlsh history sensitive information leak (Michael Semb Wever <mck@...che.org>)
CASSANDRA-21202: CVE-2026-32588: Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing (Michael Semb Wever <mck@...che.org>)
Django CVE-2026-3902, CVE-2026-4277, CVE-2026-4292, CVE-2026-33033, and CVE-2026-33034 (Jacob Walls <jwalls@...ngoproject.com>)
OpenSSL Security Advisory (Tomas Mraz <tomas@...nssl.foundation>)
[OSSA-2026-005] Keystone: Restricted application credentials can create EC2 credentials (CVE-2026-33551) (Jeremy Stanley <fungi@...goth.org>)
[vim-security] Netbeans command injection in Vim < v9.2.0316 (Christian Brabandt <cb@...bit.org>)
Re: libcap-2.77 (since libcap-2.04) has TOCTOU privilege escalation issue (Christian Göttsche <cgoettsche@...tendoof.de>)

April 8 (14 messages)

systemd-journald in systemd 259 does not escape characters in emerg messages that are wall'd to other user's terminals (Aaron Rainbolt <arraybolt3@...eup.net>)
Multiple CVEs disclosed in CUPS (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Multiple CVEs disclosed in CUPS (Peter Gutmann <pgut001@...auckland.ac.nz>)
Fwd: [siren] Severity: High – Potential Malicious Campaign Underway Targeting Open Source Developers via Slack (Solar Designer <solar@...nwall.com>)
Re: Axios Supply-Chain Attack [v1.14.1] [0.30.4] --> plain-crypto-js [4.2.0][4.2.1] (Solar Designer <solar@...nwall.com>)
CVE-2026-5082: Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-5083: Ado::Sessions versions through 0.935 for Perl generates insecure session ids (Robert Rothenberg <rrwo@...nsec.org>)
Re: [EXTERN] Re: Multiple CVEs disclosed in CUPS ("Schwedas, Sven" <Sven.Schwedas@...z.at>)
Re: libcap-2.77 (since libcap-2.04) has TOCTOU privilege escalation issue ("Andrew G. Morgan" <morgan@...nel.org>)
Re: systemd-journald in systemd 259 does not escape characters in emerg messages that are wall'd to other user's termina… (Aaron Rainbolt <arraybolt3@...eup.net>)
Re: Fwd: [siren] Severity: High – Potential Malicious Campaign Underway Targeting Open Source Developers via Slack (Stuart D Gathman <stuart@...hman.org>)
PyCA cryptography 46.0.7 released, fixes CVE-2026-39892 (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Re: Heads-up: Upcoming Samba security releases (2026-04-09) (Douglas Bagnall <dbagnall@...ba.org>)
Go 1.26.2 and Go 1.25.9 are released with 10 security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)

April 9 (30 messages)

X41 Advisory X41-2026-001: Guardrail Sandbox Escape in LiteLLM (Markus Vervier <markus.vervier@...-dsec.de>)
libpng 1.6.57: Use-after-free vulnerability fixed: CVE-2026-34757 (Cosmin Truta <ctruta@...il.com>)
4 security fixes in Flatpak, including critical CVE-2026-34078: Complete sandbox escape leading to host file access and code… (Solar Designer <solar@...nwall.com>)
lftp 4.9.3 does not filter non-printable characters in the output to the terminal (Vincent Lefevre <vincent@...c17.net>)
Re: libcap-2.77 (since libcap-2.04) has TOCTOU privilege escalation issue (Solar Designer <solar@...nwall.com>)
Re: libcap-2.77 (since libcap-2.04) has TOCTOU privilege escalation issue ("Andrew G. Morgan" <morgan@...nel.org>)
Re: libcap-2.77 (since libcap-2.04) has TOCTOU privilege escalation issue (Solar Designer <solar@...nwall.com>)
Re: 4 security fixes in Flatpak, including critical CVE-2026-34078: Complete sandbox escape leading to host file access and co… (Simon McVittie <smcv@...ian.org>)
CVE-2026-34538: Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure) (Rahul Vats <rahulvats@...che.org>)
CVE-2026-33005: Apache OpenMeetings: Insufficient checks in FileWebService (Maxim Solodovnik <solomax@...che.org>)
CVE-2026-33266: Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt (Maxim Solodovnik <solomax@...che.org>)
CVE-2026-34020: Apache OpenMeetings: Login Credentials Passed via GET Query Parameters (Maxim Solodovnik <solomax@...che.org>)
Re: systemd-journald in systemd 259 does not escape characters in emerg messages that are wall'd to other user's termin… (Salvatore Bonaccorso <carnil@...ian.org…)
Re: libcap-2.77 (since libcap-2.04) has TOCTOU privilege escalation issue ("Andrew G. Morgan" <morgan@...nel.org>)
Re: libcap-2.77 (since libcap-2.04) has TOCTOU privilege escalation issue (Tianyu Chen <sweetyfish@...pin.org>)
CVE-2025-57735: Apache Airflow: Airflow Logout Not Invalidating JWT (Rahul Vats <rahulvats@...che.org>)
CVE-2026-39304: Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handlin… ("Christopher L. Shannon" <cshannon@...c…)
CVE-2026-40046: Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT contro… ("Christopher L. Shannon" <cshannon@...c…)
Re: [libc musl] - Algorithmic complexity DoS in iconv GB18030 decoder (Jens Jarl Nestén Hansen-Nord <jens@...ten.eu>)
CVE-2026-24880: Apache Tomcat: Request smuggling via invalid chunk extension (Mark Thomas <markt@...che.org>)
CVE-2026-25854: Apache Tomcat: Occasionally open redirect (Mark Thomas <markt@...che.org>)
CVE-2026-29129: Apache Tomcat: TLS cipher order is not preserved (Mark Thomas <markt@...che.org>)
CVE-2026-29145: Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled (Mark Thomas <markt@...che.org>)
CVE-2026-29146: Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default (Mark Thomas <markt@...che.org>)
CVE-2026-32990: Apache Tomcat: Fix for CVE-2025-66614 is incomplete (Mark Thomas <markt@...che.org>)
CVE-2026-34483: Apache Tomcat: Incomplete escaping of JSON access logs (Mark Thomas <markt@...che.org>)
CVE-2026-34486: Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor (Mark Thomas <markt@...che.org>)
CVE-2026-34487: Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token (Mark Thomas <markt@...che.org>)
CVE-2026-34500: Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (Mark Thomas <markt@...che.org>)
[OSSA-2026-006] OpenStack Skyline: DOM-based XSS in Skyline Console via unsanitized instance console log rendering (CVE… (Goutham Pacha Ravi <gouthampravi@...il.…)

April 10 (15 messages)

Re: systemd-journald in systemd 259 does not escape characters in emerg messages that are wall'd to other user's terminal… (Aaron Rainbolt <arraybolt3@...il.com>)
Re: X41 Advisory X41-2026-001: Guardrail Sandbox Escape in LiteLLM (Solar Designer <solar@...nwall.com>)
Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes (Solar Designer <solar@...nwall.com>)
Re: systemd-journald in systemd 259 does not escape characters in emerg messages that are wall'd to other user's terminals (Vincent Lefevre <vincent@...c17.net>)
CVE-2026-4631 [cockpit] Unauthenticated remote code execution due to SSH command-line argument injection (Jelle van der Waa <jelle@...aa.nl>)
CVE-2026-34477: Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verifi… (Piotr Karwasz <pkarwasz@...che.org>)
CVE-2026-34478: Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility (Piotr Karwasz <pkarwasz@...che.org>)
CVE-2026-34479: Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidd… (Piotr Karwasz <pkarwasz@...che.org>)
CVE-2026-34480: Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters (Piotr Karwasz <pkarwasz@...che.org>)
CVE-2026-34481: Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTempla… (Piotr Karwasz <pkarwasz@...che.org>)
CVE-2026-40021: Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbid… (Piotr Karwasz <pkarwasz@...che.org>)
CVE-2026-40023: Apache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to un… (Piotr Karwasz <pkarwasz@...che.org>)
CVE-2026-40200: musl libc: stack corruption in qsort with sufficiently large inputs (Rich Felker <dalias@...c.org>)
xdg-desktop-portal GHSA-rqr9-jwwf-wxgj: Trashing of arbitrary host files (Simon McVittie <smcv@...ian.org>)
xdg-dbus-proxy CVE-2026-34080: Eavesdrop filter bypass allows message interception (Simon McVittie <smcv@...ian.org>)

April 11 (11 messages)

CVE-2026-40198: Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass (Stig Palmquist <stig@...g.io>)
CVE-2026-40199: Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypas… (Stig Palmquist <stig@...g.io>)
[kubernetes] CVE-2026-3865: CSI Driver for SMB path traversal via subDir may delete unintended directories on the SMB s… (Vinayak Goyal <vinayakankugoyal@...il.c…)
CPython [CVE-2026-1502] HTTP client proxy tunnel headers not validated for CR/LF (Alan Coopersmith <alan.coopersmith@...cle.com>)
CPython [CVE-2026-3446] Base64 decoding stops at first padded quad by default (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-35537+more: Roundcube arbitrary write + ID/XSS/etc. prior to 1.6.14 (Valtteri Vuorikoski <vuori@...com.org>)
Re: CVE-2026-35537+more: Roundcube arbitrary write + ID/XSS/etc. prior to 1.6.14 (Valtteri Vuorikoski <vuori@...com.org>)
LibRaw 0.22.1 Release with security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)
Avahi: Reachable assertion in transport_flags_from_domain (CVE-2026-34933) (Alan Coopersmith <alan.coopersmith@...cle.com>)
GNU tar: listing/extraction desynchronization allows hidden file injection (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: GNU tar: listing/extraction desynchronization allows hidden file injection (Collin Funk <collin.funk1@...il.com>)

April 12 (7 messages)

Re: GNU tar: listing/extraction desynchronization allows hidden file injection (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: GNU tar: listing/extraction desynchronization allows hidden file injection (Solar Designer <solar@...nwall.com>)
Re: GNU tar: listing/extraction desynchronization allows hidden file injection (Collin Funk <collin.funk1@...il.com>)
Security Audit of Hex, the Erlang package manager (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: GNU tar: listing/extraction desynchronization allows hidden file injection (Paul Eggert <eggert@...ucla.edu>)
CVE-2026-35337: Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling (Richard Zowalla <rzo1@...che.org>)
CVE-2026-35565: Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Storm UI (Richard Zowalla <rzo1@...che.org>)

April 13 (12 messages)

Re: Security Audit of Hex, the Erlang package manager (Alexander Patrakov <patrakov@...il.com>)
CVE-2026-5085: Solstice::Session versions through 1440 for Perl generates session ids insecurely (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2025-54057: Apache SkyWalking: Stored XSS vulnerability (Zhenxu Ke <kezhenxu94@...che.org>)
CVE-2026-34476: Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server (Qiuxia Fan <qiuxiafan@...che.org>)
CVE-2026-34884: Apache SkyWalking MCP: SSRF via set_skywalking_url Tool and GraphQL Expression Injection in MCP Server (Qiuxia Fan <qiuxiafan@...che.org>)
CVE-2025-66236: Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI (Rahul Vats <rahulvats@...che.org>)
CVE-2026-33858: Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API (Rahul Vats <rahulvats@...che.org>)
CVE-2026-39816: Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService (David Handermann <exceptionfactory@...che.org>)
Re: Security Audit of Hex, the Erlang package manager (Alan Coopersmith <alan.coopersmith@...cle.com>)
[CVE-2026-6100] CPython: Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use … (Alan Coopersmith <alan.coopersmith@...c…)
[CVE-2026-4786] CPython: Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.… (Alan Coopersmith <alan.coopersmith@...c…)
CVE-2026-5086: Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks (Robert Rothenberg <rrwo@...nsec.org>)

April 14 (9 messages)

CVE-2026-31923: Apache APISIX: Openid-connect `tls_verify` field is disabled by default (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-31924: Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-31908: Apache APISIX: forward auth plugin allows header injection (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-33929: Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code (Tilman Hausherr <tilman@...che.org>)
wolfSSL ML-DSA: same-process heap reuse exposes private signing material, enabling signature forgery (Abhinav Agarwal <abhinavagarwal1996@...il.com>)
wolfSSL 5.9.1 CVE and non-CVE fixes (Solar Designer <solar@...nwall.com>)
[disclosure] Multiple unpatched CVEs in libav (unmaintained FFmpeg fork, last update 2019) (yangjincheng1998@...il.com)
Fwd: X.Org Security Advisory: multiple security issues X.Org X server and Xwayland (Olivier Fourdan <ofourdan@...hat.com>)
[OSSA-2026-007] OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean (CVE PENDING) (Goutham Pacha Ravi <gouthampravi@...il.c…)

April 15 (9 messages)

CVE-2025-54550: Apache Airflow: RCE by race condition in example_xcom dag (Jarek Potiuk <potiuk@...che.org>)
CVE-2026-30778: Apache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information… (Kai Wan <wankai@...che.org>)
CVE-2026-25219: Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users … (Jarek Potiuk <potiuk@...che.org>)
CVE-2026-5088: Apache::API::Password versions through v0.5.2 for Perl can generate insecure random values for salts (Robert Rothenberg <rrwo@...nsec.org>)
Re: CVE-2026-5088: Apache::API::Password versions through v0.5.2 for Perl can generate insecure random values for salts (Jacques Deguest <jack@...uest.jp>)
[CVE-2026-5713] CPython: Out-of-bounds read/write during remote debugging when connecting to malicious target (Alan Coopersmith <alan.coopersmith@...cle.com>)
[vim-security] Command injection via backtick expansion in tag filenames in Vim < v9.2.0357 (Christian Brabandt <cb@...bit.org>)
7 vulnerabilities disclosed & patched in jq (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Fwd: X.Org Security Advisory: multiple security issues X.Org X server and Xwayland (Alan Coopersmith <alan.coopersmith@...cle.com>)

April 16 (12 messages)

Re: 7 vulnerabilities disclosed & patched in jq (Collin Funk <collin.funk1@...il.com>)
UAF in rsync 3.4.1 and below (Przemyslaw Frasunek <przemyslaw@...sunek.com>)
cosmic-greeter: Unsafe File System Operations in User Home Directories (CVE-2026-25704) (Matthias Gerstner <mgerstner@...e.de>)
Re: UAF in rsync 3.4.1 and below (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2025-27363: FontForge affected by FreeType heap-buffer-overflow; upstream maintainer declines under Community-guidelines #D1 (yangjincheng1998@...il.com)
Apache Kvrocks affected by CVE-2024-31449 and CVE-2025-49844 (Redis Lua); fixed but no formal advisory (yangjincheng1998@...il.com)
CVE-2026-31987: Apache Airflow: JWT token appearing in logs (Rahul Vats <rahulvats@...che.org>)
Re: Apache Kvrocks affected by CVE-2024-31449 and CVE-2025-49844 (Redis Lua); fixed but no formal advisory (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: UAF in rsync 3.4.1 and below (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Apache Kvrocks affected by CVE-2024-31449 and CVE-2025-49844 (Redis Lua); fixed but no formal advisory (yangjincheng1998@...il.com)
Re: Apache Kvrocks affected by CVE-2024-31449 and CVE-2025-49844 (Redis Lua); fixed but no formal advisory (Solar Designer <solar@...nwall.com>)
Re: [CVE-2026-33691] OWASP CRS whitespace padding bypass vulnerability (cyber security <cs7778503@...il.com>)

April 17 (17 messages)

Re: Apache Kvrocks affected by CVE-2024-31449 and CVE-2025-49844 (Redis Lua); fixed but no formal advisory (yangjincheng1998@...il.com)
CVE-2026-33557: Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication (Luke Chen <showuon@...che.org>)
CVE-2026-33558: Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output (Luke Chen <showuon@...che.org>)
CVE-2025-66335: Apache Doris MCP Server: MCP SQL inject (Mingyu Chen <morningman@...che.org>)
CVE-2026-30912: Apache Airflow: Exposing stack trace in case of constraint error (Rahul Vats <rahulvats@...che.org>)
CVE-2026-32690: Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1 (Rahul Vats <rahulvats@...che.org>)
CVE-2026-30898: Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf (Rahul Vats <rahulvats@...che.org>)
CVE-2026-32228: Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to (Rahul Vats <rahulvats@...che.org>)
CVE-2026-25917: Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5) (Rahul Vats <rahulvats@...che.org>)
Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes (Matthias Ferdinand <ml.oss-security@...dv.net>)
cups: 8 various moderate vulnerabilities (Zdenek Dohnal <zdohnal@...hat.com>)
ngtcp2: qlog_parameters_set_transport_params_stack_overflow [CVE-2026-40170] (Alan Coopersmith <alan.coopersmith@...cle.com>)
Xen Security Advisory 488 v1 - x86: Floating Point Divider State Sampling (Xen.org security team <security@....org>)
CVE-2026-40948: Apache Airflow Keycloak Provider: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager (Jarek Potiuk <potiuk@...che.org>)
Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes (Eli Schwartz <eschwartz@...too.org>)
lcms2 <= 2.18 CubeSize() integer overflow: stock Ubuntu 24.04 Poppler / evince-thumbnailer / OpenJDK crashers (differen… (Abhinav Agarwal <abhinavagarwal1996@gma…)
Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes (Sam James <sam@...too.org>)

April 18 (5 messages)

Re: lcms2 <= 2.18 CubeSize() integer overflow: stock Ubuntu 24.04 Poppler / evince-thumbnailer / OpenJDK crashers (diff… (Abhinav Agarwal <abhinavagarwal1996@gma…)
Re: [CVE-2026-33691] OWASP CRS whitespace padding bypass vulnerability (cyber security <cs7778503@...il.com>)
Re: [CVE-2026-33691] OWASP CRS whitespace padding bypass vulnerability (cyber security <cs7778503@...il.com>)
Re: [CVE-2026-33691] OWASP CRS whitespace padding bypass vulnerability (Solar Designer <solar@...nwall.com>)
CVE-2026-41113: RCE in sagredo fork of qmail (Alan Coopersmith <alan.coopersmith@...cle.com>)

April 19 (4 messages)

[CVE REQUEST] terminal-controller-mcp: trivially bypassable command blocklist enables unrestricted RCE (CVSS 10.0) (Pico 🧬 <pico@...al.dev>)
Re: [CVE REQUEST] terminal-controller-mcp: trivially bypassable command blocklist enables unrestricted RCE (CVSS 10.0) (Alan Coopersmith <alan.coopersmith@...c…)
Re: CVE-2025-27363: FontForge affected by FreeType heap-buffer-overflow; upstream maintainer declines under Community-guidelines #D… (Sam James <sam@...too.org>)
Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes (Matthias Ferdinand <ml.oss-security@...dv.net>)

April 20 (9 messages)

Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes (Dimitri Ledkov <dimitri.ledkov@...inguard.dev>)
[ADVISORY] CVE-2026-5265: Heap Over-Read in ICMP Error Response Generation (Ales Musil <amusil@...hat.com>)
[ADVISORY] CVE-2026-5367: Heap over-read in OVN DHCPv6 Client ID processing (Ales Musil <amusil@...hat.com>)
Re: [ADVISORY] CVE-2026-5265: Heap Over-Read in ICMP Error Response Generation (Ales Musil <amusil@...hat.com>)
Re: [ADVISORY] CVE-2026-5367: Heap over-read in OVN DHCPv6 Client ID processing (Ales Musil <amusil@...hat.com>)
Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes (Morten Linderud <morten@...derud.pw>)
Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes (Demi Marie Obenour <demiobenour@...il.com>)
Fwd: [CVE-2026-3219] pip doesn't reject concatenated ZIP and tar archives (Alan Coopersmith <alan.coopersmith@...cle.com>)
The GNU C Library security advisories update for 2026-04-20 (Carlos O'Donell <carlos@...hat.com>)

April 21 (6 messages)

Libgcrypt security releases 1.12.2, 1.11.3, 1.10.x (Valtteri Vuorikoski <vuori@...com.org>)
Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes (Michael Orlitzky <michael@...itzky.com>)
Fwd: X.Org Security Advisory: CVE-2026-4367: libXpm Out-of-bounds read in xpmNextWord() (Olivier Fourdan <ofourdan@...hat.com>)
CVE-2026-40706: ntfs-3g 2022.10.3: Heap buffer overflow (Rostislav <rostislav@...era.com>)
CVE-2017-20230: Storable versions before 3.05 for Perl has a stack overflow (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2025-15638: Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt (Robert Rothenberg <rrwo@...nsec.org>)

April 22 (8 messages)

Re: CVE-2017-20230: Storable versions before 3.05 for Perl has a stack overflow (Sam James <sam@...too.org>)
Re: CVE-2017-20230: Storable versions before 3.05 for Perl has a stack overflow (Sam James <sam@...too.org>)
Re: UAF in rsync 3.4.1 and below (Sam James <sam@...too.org>)
Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes (Demi Marie Obenour <demiobenour@...il.com>)
[SECURITY] CVE-2026-40542: Apache HttpClient 5.6 SCRAM-SHA-256 mutual authentication bypass (Arturo Bernal <abernal@...che.org>)
CVE-2026-41651: TOCTOU vulnerability in PackageKit <= 1.3.4 leads to local root exploit (Matthias Klumpp <matthias@...stral.net>)
Re: CVE-2017-20230: Storable versions before 3.05 for Perl has a stack overflow (Steffen Nurpmeso <steffen@...oden.eu>)
[vim-security] OS Command Injection in netrw affects Vim < 9.2.0383 (Christian Brabandt <cb@...bit.org>)

April 23 (2 messages)

PowerDNS Security Advisory 2026-03 for PowerDNS Recursor: Multiple issues (Otto Moerbeek <otto.moerbeek@...erdns.com>)
CVE-2026-41564: CryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after forking (Stig Palmquist <stig@...g.io>)

210 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.