oss-security mailing list - 2026/07

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [year] [list]

oss-security mailing list - 2026/07

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 11	² 2	³ 5	⁴ 10	⁵ 30
⁶ 17	⁷ 18	⁸ 14	⁹ 4	¹⁰ 8	¹¹ 1	¹² 2
¹³ 9	¹⁴ 16	¹⁵ 6	¹⁶ 5	¹⁷ 13	¹⁸ 2	¹⁹
²⁰ 18	²¹ 10	²² 20	²³ 7	²⁴	²⁵	²⁶
²⁷	²⁸	²⁹	³⁰	³¹

Messages by day:

July 1 (11 messages)

OFFIS DCMTK: 5 CISA-coordinated DICOM vulnerabilities (Abhinav Agarwal <abhinavagarwal1996@...il.com>)
Re: hostapd: OOB write in Wi-Fi 7 MLD association parsing (pre-auth DoS) (Abhinav Agarwal <abhinavagarwal1996@...il.com>)
CVE-2026-54428: Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK (Oleg Kalnichevski <olegk@...che.org>)
CVE-2026-54399: Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration (Oleg Kalnichevski <olegk@...che.org>)
check_icmp (Monitoring Plugins): host-count overflow leads to heap buffer overflow in setuid-root binary (Holger Weiß <holger.weiss@...berlin.de>)
CVE-2026-56016: CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sour… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2025-15646: HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion (Robert Rothenberg <rrwo@...nsec.org>)
Fwd: libevent 2.1.13-stable contains several security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)
Vinyl Cache / Varnish Cache HTTP/2 parsing deficiency [CVE-2026-50052] (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-54161: NUT upsmon: remote OS command injection via ups.alarm in NOTIFYCMD - fixed in PR #3499 (affects 2.8.3–2.8… (pro Err0r <yijiahuang8980@...il.com>)
Re: check_icmp (Monitoring Plugins): host-count overflow leads to heap buffer overflow in setuid-root binary (Michael Orlitzky <michael@...itzky.com>)

July 2 (2 messages)

CVE-2026-43503: Analysis of the "DirtyClone" Linux LPE (Dirty Frag family variant) (Or Peles <orp@...og.com>)
Re: Fwd: Node.js security updates for all active release lines, June 2026 (Alan Coopersmith <alan.coopersmith@...cle.com>)

July 3 (5 messages)

CVE-2026-47896: Apache Lucene.Net: Unauthenticated arbitrary file read on the Lucene.Net.Replicator replication server (Paul Irwin <paulirwin@...che.org>)
CVE-2026-47897: Apache Lucene.Net: Arbitrary file write from malicious server to Lucene.Net.Replicator client (Paul Irwin <paulirwin@...che.org>)
CVE-2026-47898: Apache Lucene.Net: XXE vulnerability in Lucene.Net.Analysis.Common PatternParser (Paul Irwin <paulirwin@...che.org>)
CVE-2026-56015: Net::IP::LPM versions through 1.10 for Perl allow a heap out-of-bounds read via an unbounded prefix length (Robert Rothenberg <rrwo@...nsec.org>)
pandemic of incomplete error handling in the OpenSSL ecosystem (Julian Andres Klode <julian.klode@...onical.com>)

July 4 (10 messages)

[CVE request] Apache Kafka OAUTHBEARER authentication bypass via signed JWT clock skew (vulnerable 4.0.0 - 4.0.x, no maintainer … (xylove21 <xylove21@...ton.me>)
[CVE request] Apache APISIX 3.16.0 JWT-Auth Algorithm Confusion (Authentication Bypass, CVSS 9.8 CRITICAL) — no maintainer respo… (xylove21 <xylove21@...ton.me>)
[CONFIDENTIAL] cert-manager v1.15-v1.17+main — Reflected SSRF via Issuer.spec.vault.server (CVSS 7.2 HIGH) (xylove21 <xylove21@...ton.me>)
Wasm OCI Image Fetcher Bearer Realm SSRF Bypass (xylove21 <xylove21@...ton.me>)
Re: Wasm OCI Image Fetcher Bearer Realm SSRF Bypass (Solar Designer <solar@...nwall.com>)
Re: Wasm OCI Image Fetcher Bearer Realm SSRF Bypass (h <h@...er.ee>)
Re: Wasm OCI Image Fetcher Bearer Realm SSRF Bypass (Solar Designer <solar@...nwall.com>)
CVE-2026-49297: Apache Airflow Google provider: Path traversal via GCS object names → local/SFTP filesystem (GCSToSFTPOpera… (Shahar Epstein <shahar@...che.org>)
CVE-2026-12746: Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state pa… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-12740: Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter (Robert Rothenberg <rrwo@...nsec.org>)

July 5 (30 messages)

CVE-2026-14570: Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random g… (Timothy Legge <timlegge@...nsec.org>)
CVE-2026-40047: Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-40859: Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInp… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-42527: Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based inf… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-43865: Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast inst… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-46453: Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypas… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-46454: Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a Heade… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-46455: Apache Camel: Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE ch… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-46456: Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inboun… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-46457: Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configure… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-46584: Apache Camel: Camel-Mail: The mail producer applied attacker-supplied mail.smtp.* / mail.smtps.* messag… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-46585: Apache Camel: Camel-Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCE… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-46590: Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-46591: Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolat… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-46592: Apache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationN… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-46726: Apache Camel: Camel-Vertx-Websocket: The inbound consumer maps externally-supplied WebSocket query and … (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-48203: Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixe… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-48204: Apache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that byp… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-48205: Apache Camel: Camel-DNS: The dns.* and term Exchange header constants used non-Camel-prefixed names tha… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-48206: Apache Camel: Camel-JIRA: A set of non-Camel-prefixed Exchange header constants (IssueKey, ProjectKey, … (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-49086: Apache Camel: Camel-Dapr: The Dapr Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and to… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-49097: Apache Camel: Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-pref… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-49098: Apache Camel: Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used … (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-49099: Apache Camel: Camel-Salesforce: Non-Camel-prefixed Exchange header constants (sObjectQuery, sObjectSear… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-49365: Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing e… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-53913: Apache Camel: Camel-Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its … (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-55993: Apache Camel: Camel-Atmosphere-Websocket: The inbound consumer maps externally-supplied WebSocket query… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-55994: Apache Camel: Camel-Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into … (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-56139: Apache Camel: Camel-Undertow: The muteException consumer option defaulted to false, so a processing err… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-56140: Apache Camel: Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy t… (Andrea Cosentino <acosentino@...che.org…)

July 6 (17 messages)

Re: Wasm OCI Image Fetcher Bearer Realm SSRF Bypass (Eli Schwartz <eschwartz@...too.org>)
CVE-2026-14803: Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder (Stig Palmquist <stig@...g.io>)
CVE-2026-13705: Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via … (Stig Palmquist <stig@...g.io>)
CVE-2026-13708: Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 marker… (Stig Palmquist <stig@...g.io>)
Announce: OpenSSH 10.4 released (Damien Miller <djm@....openbsd.org>)
Security Considerations for Statsd Clients (Robert Rothenberg <rrwo@...nsec.org>)
Januscape: Guest-to-Host Escape in KVM/x86 (CVE-2026-53359) (Hyunwoo Kim <imv4bel@...il.com>)
c-ares 1.34.7 release: CVE-2026-33630, GHSA-pjmc-gx33-gc76, GHSA-jv8r-gqr9-68wj (Brad House <brad@...d-house.com>)
CVE-2026-43825: Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModel (Richard Zowalla <rzo1@...che.org>)
CVE-2026-24012: Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query (Haonan Hou <haonan@...che.org>)
CVE-2026-24013: Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC (Haonan Hou <haonan@...che.org>)
CVE-2026-24014: Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write (Haonan Hou <haonan@...che.org>)
CVE-2026-43866: Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder (Andrea Cosentino <acosentino@...che.org>)
CVE-2026-43867: Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metad… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-46587: Apache Camel: Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operat… (Federico Mariani <fmariani@...che.org>)
CVE-2026-46588: Apache Camel: CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operatio… (Federico Mariani <fmariani@...che.org>)
CVE-2026-49042: Apache Camel: langchain4j-tools: filter tool argument headers against declared parameters (Federico Mariani <fmariani@...che.org>)

July 7 (18 messages)

CVE-2026-33264: Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize… (Rahul Vats <rahulvats@...che.org>)
CVE-2026-48828: Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key (Rahul Vats <rahulvats@...che.org>)
CVE-2026-48891: Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.sou… (Rahul Vats <rahulvats@...che.org>)
CVE-2026-48892: Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options (Rahul Vats <rahulvats@...che.org>)
CVE-2026-49296: Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id} (Rahul Vats <rahulvats@...che.org>)
CVE-2026-49487: Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs (Rahul Vats <rahulvats@...che.org>)
Foreman: multiple vulnerabilities fixed in 3.18.2 and 3.19.1 (CVE-2026-5135, CVE-2026-5136, CVE-2026-5138, CVE-2026-5142) (Ondrej Gajdusek <ogajduse@...hat.com>)
Re: Wasm OCI Image Fetcher Bearer Realm SSRF Bypass (yan xu <xuy0515@...il.com>)
Re: Wasm OCI Image Fetcher Bearer Realm SSRF Bypass (Solar Designer <solar@...nwall.com>)
Django CVE-2026-48588, CVE-2026-53877, and CVE-2026-53878 (Jacob Walls <jwalls@...ngoproject.com>)
Re: [CVE request] Cilium ClusterNetworkPolicy matchExpressions Values silently dropped — 0-day in v1.20.0-pre releases… (Feroz Salam <feroz.salam@...valent.com>)
Re: [CVE request] Cilium ClusterNetworkPolicy matchExpressions Values silently dropped — 0-day in v1.20.0-pre releases, no… (Solar Designer <solar@...nwall.com>)
CVE-2026-7017: HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets (Robert Rothenberg <rrwo@...nsec.org>)
Re: [CVE request] Cilium ClusterNetworkPolicy matchExpressions Values silently dropped — 0-day in v1.20.0-pre releases, no ma… (Joe Stringer <joe@...valent.com>)
Re: [CVE request] Cilium ClusterNetworkPolicy matchExpressions Values silently dropped — 0-day in v1.20.0-pre releases, no… (Solar Designer <solar@...nwall.com>)
CVE-2026-14380: DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-14740: DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL co… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-14895: String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service (Robert Rothenberg <rrwo@...nsec.org>)

July 8 (14 messages)

FW: X.Org Security Advisory: multiple security issues in libXfont2 (Peter Hutterer <peter.hutterer@...-t.net>)
FW: X.Org Security Advisory: multiple security issues X.Org X server and Xwayland (Peter Hutterer <peter.hutterer@...-t.net>)
[OSSA-2026-025] Ironic: RBAC Bypass in IPMI Raw Command Execution (CVE-2026-54423) (Jay Faulkner <jay@....cc>)
[OSSA-2026-026] Ironic: Insufficient Access Controls regarding parent/child nodes (Jay Faulkner <jay@....cc>)
CVE-2026-41042: Apache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, whic… (Jerry Shao <jshao@...che.org>)
CVE-2026-14454: Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-49145: App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc (Stig Palmquist <stig@...g.io>)
CVE-2026-49146: App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ack… (Stig Palmquist <stig@...g.io>)
CVE-2026-49147: App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several o… (Stig Palmquist <stig@...g.io>)
Go 1.26.5 and Go 1.25.12 fix CVE-2026-39822 & CVE-2026-42505 (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-57111: Apache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-Origin (Junkai Xue <jxue@...che.org>)
Linux: GhostLock / CVE-2026-43499 / stack-UAF and LPE in kernels 2.6.39 till 7.1 ("Dr. Thomas Orgis" <thomas.orgis@...-hamburg.de>)
CVE-2026-46242 ("Bad Epoll") local privilege escalation on Linux, including Android (Jan Schaumann <jschauma@...meister.org>)
Re: CVE-2026-46242 ("Bad Epoll") local privilege escalation on Linux, including Android (Jan Engelhardt <ej@...i.de>)

July 9 (4 messages)

Re: Linux: GhostLock / CVE-2026-43499 / stack-UAF and LPE in kernels 2.6.39 till 7.1 (Solar Designer <solar@...nwall.com>)
Re: Linux: GhostLock / CVE-2026-43499 / stack-UAF and LPE in kernels 2.6.39 till 7.1 (Vega Agent <vega@...usec.ai>)
HTSlib <= 1.23.1 Multiple vulnerabilities in file reading code (Robert Davies <rmd@...ger.ac.uk>)
[CVE-2026-15308] Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (Alan Coopersmith <alan.coopersmith@...cle.com>)

July 10 (8 messages)

CVE-2026-28564: Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials (Haonan Hou <haonan@...che.org>)
CVE-2026-40005: Apache IoTDB: Path Traversal in Pipe File Transfer Receiver (Haonan Hou <haonan@...che.org>)
CVE-2026-40006: Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver (Haonan Hou <haonan@...che.org>)
CVE-2026-40007: Apache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language prefix parser causes per… (Haonan Hou <haonan@...che.org>)
CVE-2026-40008: Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC (Haonan Hou <haonan@...che.org>)
CVE-2026-40009: Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_aud… (Haonan Hou <haonan@...che.org>)
CVE-2026-40452: Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authentica… (Haonan Hou <haonan@...che.org>)
CVE-2026-40454: Apache IoTDB C++ client: Out-of-bounds reads in C++ client TsBlock deserializer crash client process on malforme… (Haonan Hou <haonan@...che.org>)

July 11 (1 message)

CVE-2026-49844: Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson() (Piotr Karwasz <pkarwasz@...che.org>)

July 12 (2 messages)

Skillable SCORM launch: userId parameter not validated against session token allows allocation bypass and cross-user DoS (gregdurys.security@...ton.me)
Re: Skillable SCORM launch: userId parameter not validated against session token allows allocation bypass and cross-user DoS (Solar Designer <solar@...nwall.com>)

July 13 (9 messages)

CVE-2026-41041: Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL cons… (Jerry Shao <jshao@...che.org>)
CVE-2026-49876: Apache Gravitino: Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network a… (Yu Qi <yuqi4733@...che.org>)
CVE-2026-58065: Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key … (Vincent Beck <vincbeck@...che.org>)
CVE-2026-59245: Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (acc… (Vincent Beck <vincbeck@...che.org>)
CVE-2026-13221: Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more th… (Stig Palmquist <stig@...g.io>)
CVE-2026-57432: Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read … (Stig Palmquist <stig@...g.io>)
CVE-2026-57433: Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record (Stig Palmquist <stig@...g.io>)
2 CVEs Crypt::OpenSSL::X509 versions before 2.1.3 (Timothy Legge <timlegge@...nsec.org>)
new af_alg exploit in the wild? (Bernd Zeimetz <bernd@...d.de>)

July 14 (16 messages)

Re: new af_alg exploit in the wild? (Vincent Lefevre <vincent@...c17.net>)
Re: new af_alg exploit in the wild? (Solar Designer <solar@...nwall.com>)
CVE-2026-58319: Apache Doris: Improper Authentication in Frontend HTTP API (Mingyu Chen <morningman@...che.org>)
CVE-2026-62390: Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API (Li Yang <liyang@...che.org>)
CVE-2026-62392: Apache Kylin: OS Command Injection via Async Query API (Li Yang <liyang@...che.org>)
CVE-2026-62393: Apache Kylin: Improper authorization in job information retrieval (Li Yang <liyang@...che.org>)
CVE-2026-59083: Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass (Mark Thomas <markt@...che.org>)
CVE-2026-59084: Apache Tomcat: EncryptInterceptor requirements not clearly documented (Mark Thomas <markt@...che.org>)
CVE-2026-15043: DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-49488: Apache OpenMeetings: Arbitrary File Read (Maxim Solodovnik <solomax@...che.org>)
Re: new af_alg exploit in the wild? (Simon McVittie <smcv@...ian.org>)
Xen Security Advisory 498 v2 (CVE-2026-42491) - XAPI: Missing TLS verification in some SDKs (Xen.org security team <security@....org>)
CVE-2026-60082: DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-60081: DBI::ProfileData versions before 1.651 for Perl do not limit the path index (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-15392: DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted loc… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-15747: Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a… (Stig Palmquist <stig@...g.io>)

July 15 (6 messages)

CVE-2026-35152: Apache Fineract: SQL injection in runreports endpoint (Terence Monteiro <terencemo@...che.org>)
CVE-2026-56287: Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File D… (Terence Monteiro <terencemo@...che.org>)
CVE-2026-57821: Apache Fineract: Office list: SQL Injection via Subquery in orderBy (Terence Monteiro <terencemo@...che.org>)
SELinux Userspace Utilities: Local Denial-of-Service Attack Vectors in seunshare in release 3.10 (Matthias Gerstner <mgerstner@...e.de>)
CVE-2026-26032: Apache Ivy: PackagerResolver path traversal vulnerability (Stefan Bodewig <bodewig@...che.org>)
Multiple vulnerabilities in ntfs-3g (Rostislav <rostislav@...era.com>)

July 16 (5 messages)

CVE-2026-57074: XML::Bare versions through 0.53 for Perl have an unbounded character lookahead (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-13401: XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-57073: HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-13397: HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes (Robert Rothenberg <rrwo@...nsec.org>)
CERT VU#885548 - Denial-of-service vulnerability in HTTP/2 servers via stalled flow-control conditions (Alan Coopersmith <alan.coopersmith@...cle.com>)

July 17 (13 messages)

CVE-2026-13713: YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while sti… (Paul Johnson <paul@...j.net>)
CVE-2026-57075: YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck_… (Paul Johnson <paul@...j.net>)
CVE-2026-57076: YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table… (Paul Johnson <paul@...j.net>)
CVE-2026-57077: YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len (Paul Johnson <paul@...j.net>)
CVE-2026-59173: Apache Traffic Server is vulnerable to stalled HTTP/2 flow-control (Masakazu Kitajo <maskit@...che.org>)
CVE-2026-62764: Apache Accumulo: A user can trigger a graceful shutdown of services without the relevant system permiss… (Christopher Tubbs <ctubbsii@...che.org>)
Re: SELinux Userspace Utilities: Local Denial-of-Service Attack Vectors in seunshare in release 3.10 (Matthias Gerstner <mgerstner@...e.de>)
CVE-2026-13410: Dancer::Plugin::Auth::Google versions through 0.07 for Perl have TLS verification disabled (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-13082: GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-14741: HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_d… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-9537: Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison (Robert Rothenberg <rrwo@...nsec.org>)
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability (Alan Coopersmith <alan.coopersmith@...cle.com>)
Cyrus IMAP 3.12.3 fixed 9 CVEs (Alan Coopersmith <alan.coopersmith@...cle.com>)

July 18 (2 messages)

OpenSSL "HollowByte" DoS via attacker-controlled memory allocation size in glibc (Jan Schaumann <jschauma@...meister.org>)
User prompt injection (CSRF) of the llama-server's Web UI (llama.cpp) (Gabriel Corona <gabriel.corona@...e.fr>)

July 20 (18 messages)

CVE-2026-61548: rsyslog mmpstrucdata stack overflow (Rainer Gerhards <rgerhards@...adiscon.com>)
CVE-2026-53362, CVE-2026-53366: OOB write in UDP MSG_SPLICE_PAGES fragment-boundary handling in Linux kernel (Wongi Lee <qw3rtyp0@...il.com>)
CVE-2026-16235: Crypt::Password versions through 0.28 for Perl generate insecure random values for salts (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-6656: Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-13577: Dancer2 versions through 2.1.0 for Perl generate insecure session ids when CSPRNG modules are unavailable (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-53405: Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-53421: Apache Syncope: Remote Code Execution via Scripted Connector (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-57308: Apache Syncope: SQL injection vulnerability in Audit Events search (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-62183: Apache Syncope: User self-service privilege escalation (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-62418: Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-63071: Apache Syncope: RCE via Groovy Sandbox bypass (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-64193: Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-64194: Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains (Robert Rothenberg <rrwo@...nsec.org>)
Re: dnsmasq vulnerabilities, including attacker DNS redirect, privilege escalation, and heap manipulation (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-56452: Apache MINA SSHD: Path traversal in SCP file reception (Thomas Wolf <twolf@...che.org>)
CVE-2026-56623: Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows (Thomas Wolf <twolf@...che.org>)
CVE-2026-56624: Apache MINA SSHD: SSH certificate options lack validations (Thomas Wolf <twolf@...che.org>)
CVE-2026-58624: Apache MINA SSHD: Remote execution of JGit commands can write files on the server (Thomas Wolf <twolf@...che.org>)

July 21 (10 messages)

LPE in snapd and other vulnerabilities (Eduardo Barretto <eduardo.barretto@...onical.com>)
Re: LPE in snapd and other vulnerabilities (Qualys Security Advisory <qsa@...lys.com>)
CVE-2026-60080: Apache Fory: Rust MetaString heap use-after-free (Chaokun Yang <chaokunyang@...che.org>)
CVE-2026-64606: Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface (Chaokun Yang <chaokunyang@...che.org>)
CVE-2026-64608: Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths (Chaokun Yang <chaokunyang@...che.org>)
CVE-2026-64609: Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization (Chaokun Yang <chaokunyang@...che.org>)
libssh 0.12.1 and 0.11.5 security releases (Alan Coopersmith <alan.coopersmith@...cle.com>)
432 Linux kernel CVEs (Jan Schaumann <jschauma@...meister.org>)
Multiple vulnerabilities fixed in various Data::*::Shared modules for Perl (Robert Rothenberg <rrwo@...nsec.org>)
Re: 432 Linux kernel CVEs (Steffen Nurpmeso <steffen@...oden.eu>)

July 22 (20 messages)

Re: 432 Linux kernel CVEs (Jan Schaumann <jschauma@...meister.org>)
Re: 432 Linux kernel CVEs (Peter Gutmann <pgut001@...auckland.ac.nz>)
CVE-2026-54432+more: Roundcube XSS/SSRF/etc prior to 1.6.17/1.7.2 (Valtteri Vuorikoski <vuori@...com.org>)
PortProtonQt: Custom Polkit Rule Allows Escalation of NetworkManager and UDisks2 Privileges (CVE-2026-59678) (Matthias Gerstner <mgerstner@...e.de>)
rsyslog v8.36.0 through v8.2606.0: imptcp regex-framing remote denial of service (Rainer Gerhards <rgerhards@...adiscon.com>)
PowerDNS Security Advisory 2026-10 for PowerDNS Recursor: Multiple issues (Otto Moerbeek <otto.moerbeek@...erdns.com>)
Unbound: 1.25.2 addresses multiple CVE items (Yorgos Thessalonikefs <yorgos@...etlabs.nl>)
ISC has disclosed nine vulnerabilities in BIND 9 (CVE-2026-10723, CVE-2026-10822, CVE-2026-11331, CVE-2026-11605, CVE-2026-11… (Michał Kępień <michal@....org>)
security release for Exim (Jeremy Harris <jgh@...m.org>)
Re: 432 Linux kernel CVEs (Greg KH <greg@...ah.com>)
Re: 432 Linux kernel CVEs (John Haxby <john.haxby@...il.com>)
Re: 432 Linux kernel CVEs (Stephan Verbücheln <stephan@...buecheln.ch>)
Re: 432 Linux kernel CVEs (Marcus Meissner <meissner@...e.de>)
RefluXFS: LPE in the Linux kernel via XFS reflink race (CVE-2026-64600) (Qualys Security Advisory <qsa@...lys.com>)
Re: CVE-2026-53362, CVE-2026-53366: OOB write in UDP MSG_SPLICE_PAGES fragment-boundary handling in Linux kernel (Solar Designer <solar@...nwall.com>)
Re: 432 Linux kernel CVEs ("David A. Wheeler" <dwheeler@...eeler.com>)
CVE-2026-13089: OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-contr… (Robert Rothenberg <rrwo@...nsec.org>)
Re: RefluXFS: LPE in the Linux kernel via XFS reflink race (CVE-2026-64600) (Qualys Security Advisory <qsa@...lys.com>)
Re: RefluXFS: LPE in the Linux kernel via XFS reflink race (CVE-2026-64600) (Marco Benatto <mbenatto@...hat.com>)
Re: 432 Linux kernel CVEs (Steffen Nurpmeso <steffen@...oden.eu>)

July 23 (7 messages)

Serendipity blog software security fixes in 2.6.1 (Username takeover, XSS, ...) (Hanno Böck <hanno@...eck.de>)
Re: 432 Linux kernel CVEs (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: PowerDNS Security Advisory 2026-10 for PowerDNS Recursor: Multiple issues (Otto Moerbeek <otto.moerbeek@...erdns.com>)
[OSSA-2026-028] OpenStack Ironic Python Agent: Credential extraction via malicious container (CVE-2026-54422) (Goutham Pacha Ravi <gouthampravi@...il.com>)
[OSSA-2026-027] OpenStack Ironic Python Agent: Command execution via unsanitized config (CVE-2026-pending) (Goutham Pacha Ravi <gouthampravi@...il.com>)
Knot Resolver 6.3.0 DNS-over-QUIC heap buffer overflow (RCE) (Przemyslaw Frasunek <przemyslaw@...sunek.com>)
[OSSA-2026-029] OpenStack Zaqar: EXTRA-SPEC header bypasses Keystone authentication (CVE-2026-pending) (Goutham Pacha Ravi <gouthampravi@...il.com>)

228 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.