oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

oss-security mailing list - 2026/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 4	² 5	³ 6	⁴ 7	⁵ 5	⁶ 4
⁷ 2	⁸ 24	⁹ 2	¹⁰	¹¹	¹²	¹³
¹⁴	¹⁵	¹⁶	¹⁷	¹⁸	¹⁹	²⁰
²¹	²²	²³	²⁴	²⁵	²⁶	²⁷
²⁸	²⁹	³⁰

Messages by day:

September 1 (4 messages)

Re: CVE-2026-19873: HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count fr… (Robert Rothenberg <rrwo@...nsec.org>)
FreeRDP <= 3.30.0: five server-side vulnerabilities fixed in 3.31.0, pre-auth RCE demonstrated (Samuel Page <sam@...ar.io>)
CVE-2026-80205 : ReDoS in NLTK Text.findall() (CVSS 8.7 High) (Aditi Bhatnagar <aditi@...gridsec.com>)
CVE-2026-32773: Apache Spark: XSS Vulnerability in Spark Web 3.5.4 (Holden Karau <holden@...che.org>)

September 2 (5 messages)

CVE-2026-81928: Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re… (Timothy Legge <timlegge@...nsec.org>)
[SECURITY ADVISORIES] curl 8.22.0 (Daniel Stenberg <daniel@...x.se>)
Re: Fwd: [Announce] Libgcrypt 1.12.3 released (Sam James <sam@...too.org>)
Multiple vulnerabilities in Jenkins and Jenkins plugins (Kevin Guerroudj <kguerroudj@...udbees.com>)
Fwd: Vulnerabilities in golang.org/x/crypto (Alan Coopersmith <alan.coopersmith@...cle.com>)

September 3 (6 messages)

CVE-2026-80530: Linux XFS EXCHANGE_RANGE reflink flag clearing leading to local privilege escalation (Lin Jiapeng <ljp1205831794@...il.com>)
[OSSA-2026-038] OpenStack Glance: Multiple SSRF vulnerabilities in web-download and HTTP image APIs (CVE-2026-71196, CV… (Goutham Pacha Ravi <gouthampravi@...il.…)
CVE-2026-80180: Apache Allura: Stored XSS via markdown HTML processing (Dave Brondsema <dave@...ndsema.net>)
CVE-2026-80181: Apache Allura: Server-side request forgery (Dave Brondsema <dave@...ndsema.net>)
CVE-2026-80190: Apache Allura: Stored XSS via code repositories (Dave Brondsema <dave@...ndsema.net>)
CVE-2026-81270: Apache Allura: Information exposure via search (Dave Brondsema <dave@...ndsema.net>)

September 4 (7 messages)

CVE-2026-71216: Apache SkyWalking: PagerDuty alarm hook transmits the integration routing key over cleartext HTTP (Kai Wan <wankai@...che.org>)
CVE-2026-85229: Apache SkyWalking: CWE-79 stored XSS in Booster UI dashboard widgets (incomplete fix of CVE-2025-54057) (Sheng Wu <wusheng@...che.org>)
CVE-2026-82309: Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per valid… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-52691: Apache Griffin Hive Metastore Module: SQL Injection Vulnerability in Hive Metastore Module (Arnout Engelen <engelen@...che.org>)
Vulnerabilities fixed in libxml2-2.15.4 (Sam James <sam@...too.org>)
Vulnerability fixes in util-linux-2.42.3 (Sam James <sam@...too.org>)
pcre2 version 10.48 released with security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)

September 5 (5 messages)

Re: Fwd: [Freeipmi-announce] FreeIPMI 1.6.19 Released (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Vulnerability fixes in util-linux-2.42.3 (Salvatore Bonaccorso <carnil@...ian.org>)
Re: pcre2 version 10.48 released with security fixes (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Vulnerabilities fixed in libxml2-2.15.4 (Salvatore Bonaccorso <carnil@...ian.org>)
Fwd: Security vulnerabilities fixed in WeeChat 4.10.1 (Sam James <sam@...too.org>)

September 6 (4 messages)

CVE-2026-86219: Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses vi… (Timothy Legge <timlegge@...nsec.org>)
CVE-2026-78254: Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write (Stefan Bodewig <bodewig@...che.org>)
Fwd: [mapserver-announce] security release available: MapServer 8.6.6 (Sam James <sam@...too.org>)
CVE-2026-86304: MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assert… (Timothy Legge <timlegge@...nsec.org>)

September 7 (2 messages)

CVE-2026-86287: Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-16028: Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state… (Robert Rothenberg <rrwo@...nsec.org>)

September 8 (24 messages)

Linux kernel LPEs: ZcopyReaper (CVE-2026-43502) and 20 more (Yuan Tan <yuant@...usec.ai>)
CVE-2026-84939: Apache FreeMarker: A malformed locale may be exploitable for path traversal attacks (Dániel Dékány <ddekany@...che.org>)
CVE-2026-41869: Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API) (Sebastian Nagel <snagel@...che.org>)
CVE-2026-41870: Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST AP… (Sebastian Nagel <snagel@...che.org>)
CVE-2026-41871: Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API) (Sebastian Nagel <snagel@...che.org>)
Xen Security Advisory 509 v3 (CVE-2026-62437) - x86: DMs may cause mem leak by IRQ binding (Xen.org security team <security@....org>)
Xen Security Advisory 510 v3 (CVE-2026-79602) - x86: improper handling of HVM emulation return codes (Xen.org security team <security@....org>)
Xen Security Advisory 511 v3 (CVE-2026-79603) - Unconditionally do TLB flushing ahead of page scrubbing (Xen.org security team <security@....org>)
Xen Security Advisory 512 v3 (CVE-2026-79604) - oxenstored: Unbounded accumulation of watches (Xen.org security team <security@....org>)
Xen Security Advisory 513 v3 (CVE-2026-79605,CVE-2026-79606) - Out-of-bounds accesses in Tapdisk (Xen.org security team <security@....org>)
CVE-2026-73334: Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validati… (Gidon Gershinsky <gg5070@...il.com>)
CVE-2026-74761: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId (Matt Pavlovich <mattrpav@...che.org>)
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant aut… (Niko Oliveira <onikolas@...che.org>)
Re: Linux kernel LPEs: ZcopyReaper (CVE-2026-43502) and 20 more ("Dr. Thomas Orgis" <thomas.orgis@...-hamburg.de>)
CVE-2026-19872: HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rende… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-85484: HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels int… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-85485: HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-85630: HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping usi… (Robert Rothenberg <rrwo@...nsec.org>)
Re: Linux kernel LPEs: ZcopyReaper (CVE-2026-43502) and 20 more (Dominique Martinet <asmadeus@...ewreck.org>)
Fwd: Tor Project Forum: Security Release 0.4.9.12 (Sam James <sam@...ct.info>)
CVE-2026-54048: Apache Impala: Avro Schema URL Server-Side Request Forgery (Michael Smith <michaelsmith@...che.org>)
CVE-2026-56207: Apache Impala: SAML authentication bypass via forged bearer token (Michael Smith <michaelsmith@...che.org>)
CVE-2026-57866: Apache Impala: Secrets Exfiltration via SSRF (Michael Smith <michaelsmith@...che.org>)
CVE-2026-65181: Apache Impala: RCE via External Data Source Class Loading (Michael Smith <michaelsmith@...che.org>)

September 9 (2 messages)

Security fixes in libfuse-3.18.3 (Sam James <sam@...too.org>)
libpcap 1.10.7 fixes 7 vulnerabilities (Denis Ovsienko <denis@...ienko.info>)

59 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.