oss-security mailing list - 2026/08

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [year] [list]

oss-security mailing list - 2026/08

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹ 9	² 6
³ 14	⁴ 35	⁵ 19	⁶ 25	⁷ 8	⁸ 2	⁹ 13
¹⁰ 7	¹¹ 10	¹² 20	¹³ 14	¹⁴ 6	¹⁵ 4	¹⁶ 6
¹⁷ 2	¹⁸ 3	¹⁹ 7	²⁰ 21	²¹ 1	²² 6	²³ 5
²⁴ 14	²⁵ 1	²⁶	²⁷	²⁸	²⁹	³⁰
³¹

Messages by day:

August 1 (9 messages)

RE: OVSwrap (CVE-2026-64531): Linux kernel/OVS local root vulnerability (Thomas Ward <teward@...mas-ward.net>)
Rejected CVE reports against SQLite, libraw, ESP32-audioI2S (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: OVSwrap (CVE-2026-64531): Linux kernel/OVS local root vulnerability (Thomas Ward <teward@...ntu.com>)
Re: Some Changes to GNOME Security Tracking (Demi Marie Obenour <demiobenour@...il.com>)
Re: 33 Vulnerabilities in cJSON (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: Rails CVE-2026-66066: Possible arbitrary file read and remote code execution in Active Storage variant processing (Alan Coopersmith <alan.coopersmith@...cl…)
Re: Some Changes to GNOME Security Tracking (Peter Gutmann <pgut001@...auckland.ac.nz>)
CVE-2026-18536: Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP (Robert Rothenberg <robrwo@...il.com>)
Re: 33 Vulnerabilities in cJSON (Collin Funk <collin.funk1@...il.com>)

August 2 (6 messages)

Lean 4 kernel soundness bug: forging proofs via nested inductive projections (0 = 1 demonstrated) (Jonathan Brossard <endrazine@...il.com>)
[CVE requested] iwd <= 3.12: stack buffer overflow in the 802.11k beacon report handler, plus three parser/validation b… (Abhinav Agarwal <abhinavagarwal1996@gma…)
Re: Some Changes to GNOME Security Tracking (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: Some Changes to GNOME Security Tracking (Russ Allbery <eagle@...ie.org>)
Re: Some Changes to GNOME Security Tracking (Solar Designer <solar@...nwall.com>)
Re: Some Changes to GNOME Security Tracking (Demi Marie Obenour <demiobenour@...il.com>)

August 3 (14 messages)

Re: Some Changes to GNOME Security Tracking (Jacob Bachmeyer <jcb62281@...il.com>)
mpg123 release 1.33.7 with lots of security-relevant fixes ("Dr. Thomas Orgis" <thomas.orgis@...-hamburg.de>)
Re: Some Changes to GNOME Security Tracking (Yves-Alexis Perez <corsac@...ian.org>)
Re: RefluXFS: LPE in the Linux kernel via XFS reflink race (CVE-2026-64600) (Marco Benatto <mbenatto@...hat.com>)
CVE-2026-61372: Apache Jena Fuseki: Web requests using SPARQL Update can escape file restrictions (Andy Seaborne <andy@...che.org>)
Re: Some Changes to GNOME Security Tracking ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: Some Changes to GNOME Security Tracking ("Emily Shepherd" <emily@...coat.dev>)
Re: RefluXFS: LPE in the Linux kernel via XFS reflink race (CVE-2026-64600) ("Darrick J. Wong" <djwong@...nel.org>)
Re: Some Changes to GNOME Security Tracking (Sebastian Pipping <sebastian@...ping.org>)
CVE-2026-68979: Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates (David Handermann <exceptionfactory@...che.org>)
CVE-2026-62354: Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests (David Handermann <exceptionfactory@...che.org>)
CVE-2026-68980: Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion (David Handermann <exceptionfactory@...che.org>)
CVE-2026-68981: Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests (David Handermann <exceptionfactory@...che.org>)
OSSN-0104: Ironic-Python-Agent may fallback to mDNS unexpectedly (Jay Faulkner <jay@....cc>)

August 4 (35 messages)

Re: Some Changes to GNOME Security Tracking (Aaron Rainbolt <arraybolt3@...il.com>)
Bouncy Castle 1.85 release fixes 32 CVEs (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Bouncy Castle 1.85 release fixes 32 CVEs (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: Some Changes to GNOME Security Tracking (Greg KH <greg@...ah.com>)
Re: Some Changes to GNOME Security Tracking (Albert Veli <albert.veli@...il.com>)
Django CVE-2026-15307, CVE-2026-15337, CVE-2026-15830, and CVE-2026-15920 (Natalia Bidart <nataliabidart@...ngoproject.com>)
Re: Bouncy Castle 1.85 release fixes 32 CVEs (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-66257: Apache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion (Robbie Gemmell <robbie@...che.org>)
CVE-2026-66273: Apache Qpid Proton-J: Type size/count handling can lead to excessive allocation pre-authentication (Robbie Gemmell <robbie@...che.org>)
CVE-2026-66274: Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow (Robbie Gemmell <robbie@...che.org>)
CVE-2026-66275: Apache Qpid Proton-J: Incoming session flow control window can be exceeded (Robbie Gemmell <robbie@...che.org>)
CVE-2026-66276: Apache Qpid Proton-J: Unbounded disposition range handling can lead to denial of service (Robbie Gemmell <robbie@...che.org>)
CVE-2026-66277: Apache Qpid Proton-J: Unable to govern the maximum number of transfer frames per incoming delivery (Robbie Gemmell <robbie@...che.org>)
CVE-2026-68060: Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication (Daniil Kirilyuk <dakirily@...che.org>)
CVE-2026-68073: Apache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflow (Daniil Kirilyuk <dakirily@...che.org>)
CVE-2026-68074: Apache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion (Daniil Kirilyuk <dakirily@...che.org>)
CVE-2026-68075: Apache Qpid Broker-J: Incoming session flow control window can be exceeded (Daniil Kirilyuk <dakirily@...che.org>)
CVE-2026-68077: Apache Qpid Broker-J: Unbounded disposition range handling can lead to denial of service (Daniil Kirilyuk <dakirily@...che.org>)
CVE-2026-68078: Apache Qpid Broker-J: Unable to govern the maximum number of transfer frames per incoming delivery (Daniil Kirilyuk <dakirily@...che.org>)
CVE-2026-68080: Apache Qpid Broker-J: Unbounded echo flow responses can lead to denial of service (Daniil Kirilyuk <dakirily@...che.org>)
CVE-2026-67465: Apache Qpid Proton Dotnet: Unbounded symbol value caching can lead to pre-authentication resource exhaust… ("Timothy A. Bish" <tabish@...che.org>)
CVE-2026-67551: Apache Qpid Proton Dotnet: Type size/count handling can lead to excessive allocation pre-authentication ("Timothy A. Bish" <tabish@...che.org>)
CVE-2026-67552: Apache Qpid Proton Dotnet: Unbounded type nesting can lead to pre-authentication stackoverflow ("Timothy A. Bish" <tabish@...che.org>)
CVE-2026-67553: Apache Qpid Proton Dotnet: Incoming session flow control window can be exceeded ("Timothy A. Bish" <tabish@...che.org>)
CVE-2026-67554: Apache Qpid Proton Dotnet: Unbounded disposition range handling can lead to denial of service ("Timothy A. Bish" <tabish@...che.org>)
CVE-2026-67555: Apache Qpid Proton Dotnet: Unable to govern the maximum number of transfer frames per incoming delivery ("Timothy A. Bish" <tabish@...che.org>)
CVE-2026-67588: Apache Qpid ProtonJ2: Unbounded symbol value caching can lead to pre-authentication resource exhaustion ("Timothy A. Bish" <tabish@...che.org>)
CVE-2026-67589: Apache Qpid ProtonJ2: Type size/count handling can lead to excessive allocation pre-authentication ("Timothy A. Bish" <tabish@...che.org>)
CVE-2026-67590: Apache Qpid ProtonJ2: Unbounded type nesting can lead to pre-authentication stackoverflow ("Timothy A. Bish" <tabish@...che.org>)
CVE-2026-67591: Apache Qpid ProtonJ2: Incoming session flow control window can be exceeded ("Timothy A. Bish" <tabish@...che.org>)
CVE-2026-67592: Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming delivery ("Timothy A. Bish" <tabish@...che.org>)
Re: Some Changes to GNOME Security Tracking (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Some Changes to GNOME Security Tracking (Francis Perron <francis@...uxfoundation.org>)
CVE-2026-66901: Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration v… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-66902: Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via… (Robert Rothenberg <rrwo@...nsec.org>)

August 5 (19 messages)

FW: X.Org Security Advisory: multiple security issues in libXfont2 (Peter Hutterer <peter.hutterer@...-t.net>)
Re: Bouncy Castle 1.85 release fixes 32 CVEs (TvT <tvtreeck@...atec.de>)
Multiple vulnerabilities in Jenkins and Jenkins plugins (Daniel Beck <ml@...kweb.net>)
CVE-2026-61483: Apache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow DoS (Piotr Karwasz <pkarwasz@...che.org>)
CVE-2026-61484: Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS (Piotr Karwasz <pkarwasz@...che.org>)
CVE-2026-61485: Apache Lucy: Freezer/InStream deserialization bomb - unbounded allocation reading an index (Piotr Karwasz <pkarwasz@...che.org>)
CVE-2026-61486: Apache Lucy: stack-buffer-overflow in JSON parser error reporter on malformed input (Piotr Karwasz <pkarwasz@...che.org>)
CVE-2026-54876: OpenSSL: Client-Side Memory Leak in OCSP Response Checking (Norbert Pócs <norbertp@...nssl.org>)
CVE-2026-48834: Apache Answer: Denial of service via crafted Accept-Language header parsing (Enxin Xie <linkinstar@...che.org>)
CVE-2026-48911: Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow (Enxin Xie <linkinstar@...che.org>)
CVE-2026-48912: Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary… (Enxin Xie <linkinstar@...che.org>)
CVE-2026-50749: Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending re… (Enxin Xie <linkinstar@...che.org>)
CVE-2026-60023: Apache Answer: Unauthorized disclosure of deleted or pending answer content (Enxin Xie <linkinstar@...che.org>)
CVE-2026-60053: Apache Answer: Residual Administrative API Key Access After Role or Account Revocation (Enxin Xie <linkinstar@...che.org>)
ejabberd 26.07 released with several security fixes (Eddie Chapman <eddie@...k.net>)
[OSSA-2026-033] Ironic Portgroup shard filter bypasses project scope (CVE-2026-71201) (Jay Faulkner <jay@....cc>)
Re: [OSSA-2026-007] OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean (CVE-2026-4… (Goutham Pacha Ravi <gouthampravi@...il.…)
Re: [OSSA-2026-030] OpenStack Swift: S3API header authorization bypass (CVE-2026-71191, CVE-2026-71192) (Goutham Pacha Ravi <gouthampravi@...il.com>)
Re: [OSSA-2026-031] OpenStack Swift: Proxy denial of service via Accept header (CVE-2026-71190) (Goutham Pacha Ravi <gouthampravi@...il.com>)

August 6 (25 messages)

rust-in-peace: results from agent-assisted Rust OSS vulnerability research (Sergei G <serg.gordey@...il.com>)
PowerDNS Security Advisory 2026-11 for PowerDNS Authoritative Server, Recursor and dnsdist: A crafted DNS packet can ca… (Otto Moerbeek <otto.moerbeek@...erdns.c…)
CVE-2026-64564: Linux SCTP ASCONF transport UAF leading to local privilege escalation and container escape (Fourie Zhang <littleddfu@...il.com>)
Re: CVE-2026-64564: Linux SCTP ASCONF transport UAF leading to local privilege escalation and container escape ("Emily Shepherd" <emily@...coat.dev>)
Re: Some Changes to GNOME Security Tracking (Jan Schaumann <jschauma@...meister.org>)
Zapscape: Guest-to-Host Escape in KVM/x86 (CVE-2026-64561) (Hyunwoo Kim <imv4bel@...il.com>)
CVE-2026-64640: Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations valid… (Alexandre Dutra <adutra@...che.org>)
CVE-2025-49506: Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack (Eric Covener <covener@...che.org>)
CVE-2026-32327: Apache Portable Runtime Utility: apr-util XML stack recursion crash (Eric Covener <covener@...che.org>)
CVE-2026-34191: Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle (Eric Covener <covener@...che.org>)
CVE-2026-34501: Apache Portable Runtime Utility: Heap buffer overflow in APR redis client (Eric Covener <covener@...che.org>)
CVE-2026-34502: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (Eric Covener <covener@...che.org>)
Re: CVE-2026-64564: Linux SCTP ASCONF transport UAF leading to local privilege escalation and container escape (Solar Designer <solar@...nwall.com>)
CVE-2026-54225: Apache CXF: Denial of Service attack via large attachments (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-57819: Apache CXF: No default restriction on the amount of form parameters per message (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-64958: Apache CXF: Denial of service via message header attachments (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-65432: Apache CXF: XXE via WSDL/XSD import parsing (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-66909: Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-57817: Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-57818: Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-61466: Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-63687: Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-65583: Apache CXF: Self-issued ID token claims validation skipped (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-68079: Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-68481: Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider (Colm O hEigeartaigh <coheigea@...che.org>)

August 7 (8 messages)

Re: CVE-2026-64564: Linux SCTP ASCONF transport UAF leading to local privilege escalation and container escape (fourie <littleddfu@...il.com>)
Re: CVE-2026-64564: Linux SCTP ASCONF transport UAF leading to local privilege escalation and container escape ("Dr. Thomas Orgis" <thomas.orgis@...-hamburg.de…)
CVE-2026-71558: Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization (Chaokun Yang <chaokunyang@...che.org>)
CVE-2026-71559: Apache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadata (Chaokun Yang <chaokunyang@...che.org>)
CVE-2026-71560: Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path (Chaokun Yang <chaokunyang@...che.org>)
CVE-2026-19082: Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zer… (Stig Palmquist <stig@...g.io>)
CVE-2026-17435: File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating f… (Robert Rothenberg <rrwo@...nsec.org>)
Re: CVE-2026-64564: Linux SCTP ASCONF transport UAF leading to local privilege escalation and container escape (fourie <littleddfu@...il.com>)

August 8 (2 messages)

Re: CVE-2026-16277 & CVE-2026-16461: buffer overflows in rpcinfo (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-61899: Apache Tapestry: Possible classpath file download through URL manipulation (Thiago Henrique De Paula Figueiredo <thiagohp@...che.org>)

August 9 (13 messages)

CVE-2026-17510: Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute v… (Timothy Legge <timlegge@...nsec.org>)
CVE-2026-28672: Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder (Velmurugan Periasamy <vel@...che.org>)
CVE-2026-32227: Apache Ranger: SQL Injection vulnerability in lookup functionality (Velmurugan Periasamy <vel@...che.org>)
CVE-2026-40920: Apache Ranger: Privilege Escalation via URL Parameter (Velmurugan Periasamy <vel@...che.org>)
CVE-2026-42537: Apache Ranger: Remote Code Execution via JDBC URL Injection (Velmurugan Periasamy <vel@...che.org>)
CVE-2026-44416: Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation (Velmurugan Periasamy <vel@...che.org>)
CVE-2026-55799: Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator (Velmurugan Periasamy <vel@...che.org>)
CVE-2026-55814: Apache Ranger: Download APIs expose plugin data without authentication (Velmurugan Periasamy <vel@...che.org>)
CVE-2026-65942: Apache Ranger: Clients accept TLS certificates issued for other hostnames (Velmurugan Periasamy <vel@...che.org>)
CVE-2026-65945: Apache Ranger: Logs contain replayable JWT bearer tokens (Velmurugan Periasamy <vel@...che.org>)
CVE-2026-65948: Apache Ranger: UnixAuth lacks brute-force protection (Velmurugan Periasamy <vel@...che.org>)
CVE-2026-15534: Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an u… (Stig Palmquist <stig@...g.io>)
Re: CVE-2026-15534: Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression mat… (Sevan Janiyan <venture37@...klan.co.uk>)

August 10 (7 messages)

CVE-2026-44630: Apache IoTDB: RPC service denial of service via unchecked Thrift string length (Haonan Hou <haonan@...che.org>)
Roundcube webmail: Many security fixes in 1.6.18 / 1.7.3 (Hanno Böck <hanno@...eck.de>)
CVE-2026-59774: Arbitrary file read via the Org-mode #+INCLUDE directive in Gitea and Forgejo (Tianyu Chen <billchenchina2001@...il.com>)
CVE-2026-68870: Apache Airflow Microsoft Azure provider: microsoft.azure Key Vault backend: team-scope guard bypass resolves … (Jarek Potiuk <potiuk@...che.org>)
CVE-2026-68871: Apache Airflow Yandex provider: yandex Lockbox backend: team-scope guard bypass resolves another team's Connec… (Jarek Potiuk <potiuk@...che.org>)
CVE-2026-68872: Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves anothe… (Jarek Potiuk <potiuk@...che.org>)
actix-multipart: field parser hangs indefinitely after EOF on a truncated boundary prefix, leaking the connection slot (Sergei G <serg.gordey@...il.com>)

August 11 (10 messages)

Announce: OpenSSH 10.5 released (Damien Miller <djm@....openbsd.org>)
PSIRTSUPT-20460 [security] critical vulnerabilities patched in svxlink (RCE) (Thibault Guittet <jira@...hat.atlassian.net>)
The GNU C Library security advisories update for 2026-04-28 (Adhemerval Zanella Netto <adhemerval.zanella@...aro.org>)
CVE-2026-69223: Apache Allura: Server-side request forgery (Dave Brondsema <dave@...ndsema.net>)
libexpat 2.8.3 fixes CVE-2026-72522 (denial of service) (Sebastian Pipping <sebastian@...ping.org>)
[OSSA-2026-034] OpenStack Designate: Cross-tenant DNS zone overlap and mDNS DoS via pool scheduling (CVE-2026-71193, CV… (Goutham Pacha Ravi <gouthampravi@...il.…)
[OSSN-0105] OpenStack Glance legacy Tasks import bypasses image import URI filtering (Goutham Pacha Ravi <gouthampravi@...il.com>)
[OSSN-0106] Ironic API ramdisk endpoints require network-level access controls (Jay Faulkner <jay@....cc>)
Flatpak 1.18.1 fixes multiple vulnerabilities (Simon McVittie <smcv@...ian.org>)
xdg-dbus-proxy: GHSA-r7hp-698j-2h6c: broadcast message filtering bypass (Simon McVittie <smcv@...ian.org>)

August 12 (20 messages)

Re: Announce: OpenSSH 10.5 released (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-19566: Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounde… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-68868: Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every tea… (Jarek Potiuk <potiuk@...che.org>)
CVE-2026-54183: Apache Airflow: Airflow Variables were not masked in the UI for authenticated users (Rahul Vats <rahulvats@...che.org>)
CVE-2026-58076: Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerializa… (Rahul Vats <rahulvats@...che.org>)
CVE-2026-59242: Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint (Rahul Vats <rahulvats@...che.org>)
CVE-2026-59244: Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI (Rahul Vats <rahulvats@...che.org>)
CVE-2026-65017: Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass… (Rahul Vats <rahulvats@...che.org>)
CVE-2026-67260: Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserializat… (Rahul Vats <rahulvats@...che.org>)
CVE-2026-67587: Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadg… (Rahul Vats <rahulvats@...che.org>)
CVE-2026-68076: Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection (Rahul Vats <rahulvats@...che.org>)
CVE-2026-68968: Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill … (Rahul Vats <rahulvats@...che.org>)
CVE-2026-68969: Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext (Rahul Vats <rahulvats@...che.org>)
CVE-2026-68970: Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI (Rahul Vats <rahulvats@...che.org>)
CVE-2026-68971: Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints (Rahul Vats <rahulvats@...che.org>)
CVE-2026-73237: Apache Allura: XSS in markdown pipeline (Dave Brondsema <dave@...ndsema.net>)
CVE-2026-73238: Apache Allura: XSS in code display (Dave Brondsema <dave@...ndsema.net>)
CVE-2026-73239: Apache Allura: Missing permission checks IDOR (Dave Brondsema <dave@...ndsema.net>)
CVE-2026-73240: Apache Allura: Git command injection (Dave Brondsema <dave@...ndsema.net>)
Linux kernel: Guest-to-Host DoS via TAP (Dongli Zhang <dongli.zhang@...cle.com>)

August 13 (14 messages)

rsync 3.5.0 released with fixes for 33 CVEs (Andrew Tridgell <tridge60@...il.com>)
CVE-2026-16770: PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the s… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-17431: PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path… (Robert Rothenberg <rrwo@...nsec.org>)
OpenSSL Security Advisory (Tomas Mraz <tomas@...nssl.foundation>)
CVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion Do… (Oleg Kalnichevski <olegk@...che.org>)
CVE-2026-71290: Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default … (Oleg Kalnichevski <olegk@...che.org>)
CVE-2026-66256: Apache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSo… (Arnout Engelen <engelen@...che.org>)
CVE-2026-19487: Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure fl… (Stig Palmquist <stig@...g.io>)
CVE-2022-4993: HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource ex… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-13048: Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-13051: Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected meth… (Robert Rothenberg <rrwo@...nsec.org>)
[OSSA-2026-035] OpenStack Octavia: Unauthorized QoS policy deletion lock (CVE pending) (Jeremy Stanley <fungi@...goth.org>)
Go 1.26.6 and Go 1.25.13 are released with 10 security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)
[OSSN-0107] Ironic-Python-Agent: Container HardwareManager Security Model Misimplemented (Jay Faulkner <jay@....cc>)

August 14 (6 messages)

Info-ZIP test option (-T) command injection (Harry Sintonen <sintonen@....fi>)
IXP Manager: Authenticated IDOR / BOLA + Mass Assignment in API Key Update Allows Overwrite of Other Users’ API Keys (… (Bakabaka_9 <qilunuobakabaka9@...il.com>)
croc: Arbitrary File Deletion via received filename, chainable to RCE (fixed in 11.0.3) (Souiri Anas <anassouiri07@...il.com>)
croc: Arbitrary File Deletion via received filename, chainable to RCE (fixed in 11.0.3) (Souiri Anas <anassouiri07@...il.com>)
CVE Request: BlueZ AVRCP Out-of-Bounds Read (CWE-125) (Elman Shahbazov <shahbazovelman97@...il.com>)
Re: CVE Request: BlueZ AVRCP Out-of-Bounds Read (CWE-125) (Alan Coopersmith <alan.coopersmith@...cle.com>)

August 15 (4 messages)

Re: GNU Inetutils talkd buffer overflow with long DNS names. (Collin Funk <collin.funk1@...il.com>)
CVE-2026-73193: DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparou… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-73194: DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-15689: Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via … (Timothy Legge <timlegge@...nsec.org>)

August 16 (6 messages)

libmspack: heap buffer overflow in make_decode_table() (Huffman decode table construction) -- CVE requested (Sumit Chakraborty <sumit.ch2004@...il.com>)
CVE-2026-19349: Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.2… (Timothy Legge <timlegge@...nsec.org>)
CVE-2026-72887: Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-72888: Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module lo… (Robert Rothenberg <rrwo@...nsec.org>)
Fwd: OpenZFS Linux open zpool manipulation and escapes via unprivileged userns (Erica Windisch <erica@...disch.us>)
Re: Fwd: OpenZFS Linux open zpool manipulation and escapes via unprivileged userns (Aaron Rainbolt <arraybolt3@...il.com>)

August 17 (2 messages)

LyX security advisory (Pavel Sanda <sanda@....org>)
Re: [OSSA-2026-035] OpenStack Octavia: Unauthorized QoS policy deletion lock (CVE-2026-74248) errata 1 (Jeremy Stanley <fungi@...goth.org>)

August 18 (3 messages)

AI slop "Combined chain advisory — fallback.efi/SBAT/memdisk bypass" (Solar Designer <solar@...nwall.com>)
CPython [CVE-2026-17084] StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (Alan Coopersmith <alan.coopersmith@...cle.com>)
CPython [CVE-2026-15806] urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (Alan Coopersmith <alan.coopersmith@...cle.com…)

August 19 (7 messages)

Re: GNU Inetutils talkd buffer overflow with long DNS names. (Tristan <TristanInSec@...il.com>)
CVE-2026-72889: Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-75589: Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-… (Robert Rothenberg <rrwo@...nsec.org>)
Ceph 20.2.4 and Ceph 19.2.6 are released with 4 security fixes. (Sage McTaggart <sagemct@....com>)
[OSSA-2026-036] OpenStack Aodh and Watcher: Aodh cross-project alarm enumeration and Watcher webhook authorization bypa… (Goutham Pacha Ravi <gouthampravi@...il.…)
[OSSA-2026-008] ERRATA 2: Ironic Command Injection in IPMI Console Implementations (Jay Faulkner <jay@....cc>)
WebKitGTK and WPE WebKit Security Advisory WSA-2026-0005 (Adrian Perez de Castro <aperez@...lia.com>)

August 20 (21 messages)

CVE-2026-75628: Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because … (Timothy Legge <timlegge@...nsec.org>)
uutils coreutils 'stdbuf' uses LD_PRELOAD on a world-writable temporary file (Collin Funk <collin.funk1@...il.com>)
GNU Emacs vulnerability upon opening arbitrary file (Sam James <sam@...too.org>)
Multiple vulnerabilities fixed in libgit2-1.9.5, 1.9.7 (Sam James <sam@...too.org>)
Fwd: [pfx] Postfix stable release 3.11.6 and legacy releases 3.10.13, 3.9.14, 3.8.20, 3.7.22, 3.6.20, 3.5.27 (Sam James <sam@...too.org>)
Re: libmspack: heap buffer overflow in make_decode_table() (Huffman decode table construction) -- CVE requested (Sam James <sam@...too.org>)
Re: GNU Emacs vulnerability upon opening arbitrary file (Demi Marie Obenour <demiobenour@...il.com>)
rsyslog: omfile dynaFile containment hardening (GHSA-xmp9-244p-5ggv) (Rainer Gerhards <rgerhards@...adiscon.com>)
CVE-2026-63015: Apache InLong: Non-template responsible persons can view template information (Charles Zhang <dockerzhang@...che.org>)
CVE-2026-63016: Apache InLong: Ordinary users can create new packages (Charles Zhang <dockerzhang@...che.org>)
CVE-2026-63037: Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint (Charles Zhang <dockerzhang@...che.org>)
CVE-2026-63038: Apache InLong: SQL Injection via String Concatenation Vulnerability Report (Charles Zhang <dockerzhang@...che.org>)
CVE-2026-63039: Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService (Charles Zhang <dockerzhang@...che.org>)
CVE-2026-63040: Apache InLong: Missing authorization in StreamSource forceDelete (Charles Zhang <dockerzhang@...che.org>)
CVE-2026-63042: Apache InLong: Missing authorization on DataNode management endpoints (Charles Zhang <dockerzhang@...che.org>)
CVE-2026-63043: Apache InLong: Agent path traversal via unvalidated file source path (Charles Zhang <dockerzhang@...che.org>)
CVE-2026-63044: Apache InLong: Authenticated SSRF via POST /api/node/testConnection (Charles Zhang <dockerzhang@...che.org>)
CVE-2026-15743: Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-77176: Kata-containers: insufficient validation of createcontainer mount and storage rules in genpolicy (Manuel Huber <manuelh@...dia.com>)
[OSSN-0108] Multiple authentication vulnerabilities in Ceph affecting OpenStack (Goutham Pacha Ravi <gouthampravi@...il.com>)
[OSSA-2026-036] OpenStack Aodh and Watcher: Aodh cross-project alarm enumeration and Watcher webhook authorization bypa… (Goutham Pacha Ravi <gouthampravi@...il.…)

August 21 (1 message)

Emacs zero-click local command execution via TRAMP (Sean Whitton <spwhitton@...hitton.name>)

August 22 (6 messages)

Re: OVSwrap (CVE-2026-64531): Linux kernel/OVS local root vulnerability (Kevin Riggle <kevinr@...plexsystems.group>)
CVE-2026-77781: Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys (Robert Rothenberg <rrwo@...nsec.org>)
Re: Emacs zero-click local command execution via TRAMP (nightmare.yeah27@...ecat.org)
[NotCVE-2026-0013] CHIRP Kenwood ITM Driver Eval Injection Allows Arbitrary Code Execution via Crafted Radio File (advisories@...cve.org)
CVE-2026-75870: Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a sessi… (Timothy Legge <timlegge@...nsec.org>)
CVE-2026-75866: Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scop… (Timothy Legge <timlegge@...nsec.org>)

August 23 (5 messages)

CVE-2026-41992 gzip 1.14 out-of-bounds memory buffer access (Paul Eggert <eggert@...ucla.edu>)
CVE-2026-75922: Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO … (Timothy Legge <timlegge@...nsec.org>)
Vulnerability in Kata Containers runtimes (both rust and go) (CVE-2026-50540) (Fabiano Fidencio <ffidencio@...dia.com>)
CVE-2026-19565: Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys f… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-78183: DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float (Robert Rothenberg <rrwo@...nsec.org>)

August 24 (14 messages)

Re: Vulnerability in Kata Containers runtimes (both rust and go) (CVE-2026-50540) (Solar Designer <solar@...nwall.com>)
BusyBox dpkg applet: OS command injection (Solar Designer <solar@...nwall.com>)
Re: Re: Emacs zero-click local command execution via TRAMP (Sam James <sam@...too.org>)
Re: Linux kernel: Guest-to-Host DoS via TAP (Greg KH <greg@...ah.com>)
CVE-2026-78331 / CVE-2026-78332: Multiple Vulnerabilities in NethServer ("Intilangelo, Andrea" <andrea@...ilangelo.it>)
CVE-2026-75099: Apache Allura: Unauthenticated REST disclosure (Dave Brondsema <dave@...ndsema.net>)
CVE-2026-59230: Apache Camel: Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message with… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-60093: Apache Camel: Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download targe… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-63621: Apache Camel: Camel-Knative: CloudEvent extension fields received in structured content mode were mappe… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-66906: Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download targe… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-66907: Apache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured down… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-66908: Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no i… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-71300: Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection (Andrea Cosentino <acosentino@...che.org>)
CVE-2026-78329: Apache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in fa… (Andrea Cosentino <acosentino@...che.org…)

August 25 (1 message)

Re: CVE-2026-41992 gzip 1.14 out-of-bounds memory buffer access (Solar Designer <solar@...nwall.com>)

258 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.