oss-security mailing list - 2026/10

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2026/10

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 30	² 8	³	⁴ 2
⁵ 17	⁶ 3	⁷ 33	⁸ 10	⁹ 21	¹⁰ 8	¹¹ 1
¹² 7	¹³ 12	¹⁴ 12	¹⁵ 12	¹⁶ 39	¹⁷ 6	¹⁸ 6
¹⁹ 6	²⁰ 39	²¹ 31	²² 34	²³ 31	²⁴ 10	²⁵
²⁶ 20	²⁷ 10	²⁸ 25	²⁹ 4	³⁰ 18	³¹ 5

Messages by day:

October 1 (30 messages)

CVE-2026-88789: Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/styles… (James Netherton <jamesnetherton@...che.…)
CVE-2026-78242: Apache APISIX: data-mask may fail to redact request headers in logger output (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-82806: Apache APISIX: cross-request permission pollution via static permission list mutation (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-94212: Apache APISIX: unauthenticated impersonation issue in saml-auth (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-94220: Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-94250: Apache APISIX: Batch response aggregation can exhaust worker memory (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-94269: Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-94276: Apache APISIX: Openid-connect introspection validation issue (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-102504: Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels… (Stig Palmquist <stig@...g.io>)
CVE-2026-102505: Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_g… (Stig Palmquist <stig@...g.io>)
CVE-2026-42356: Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories (Eric Covener <covener@...che.org>)
CVE-2026-42528: Apache HTTP Server: mod_dav shared lock overflow (Eric Covener <covener@...che.org>)
CVE-2026-46729: Apache HTTP Server: mod_heartmonitor denial of service (Eric Covener <covener@...che.org>)
CVE-2026-47360: Apache HTTP Server: mod_session: Session cookie not removed during internal redirect (Eric Covener <covener@...che.org>)
CVE-2026-48005: Apache HTTP Server: mod_auth_digest reauthentication attack (Eric Covener <covener@...che.org>)
CVE-2026-56153: Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char (Eric Covener <covener@...che.org>)
CVE-2026-56154: Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...} (Eric Covener <covener@...che.org>)
CVE-2026-56449: Apache HTTP Server: mod_proxy_html: crash in dump_content (Eric Covener <covener@...che.org>)
CVE-2026-57941: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy (Eric Covener <covener@...che.org>)
CVE-2026-58415: Apache HTTP Server: mod_dav_fs property database read access (Eric Covener <covener@...che.org>)
CVE-2026-59685: Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTE… (Eric Covener <covener@...che.org>)
CVE-2026-59797: Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function (Eric Covener <covener@...che.org>)
CVE-2026-63045: Apache HTTP Server: mod_proxy_ftp PASV address handling (Eric Covener <covener@...che.org>)
CVE-2026-63292: Apache HTTP Server: mod_vhost_alias stack overflow (Eric Covener <covener@...che.org>)
CVE-2026-63686: Apache HTTP Server: mod_xml2enc crash on charset conversion failure (Eric Covener <covener@...che.org>)
CVE-2026-63718: Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling (Eric Covener <covener@...che.org>)
CVE-2026-73636: Apache HTTP Server: mod_auth_digest one-time-nonce replay attack (Eric Covener <covener@...che.org>)
CVE-2026-73637: Apache HTTP Server: mod_auth_digest DoS attack (Eric Covener <covener@...che.org>)
CVE-2026-79768: Apache HTTP Server: mod_userdir information disclosure (Eric Covener <covener@...che.org>)
CVE-2026-93546: Apache HTTP Server: mod_dav_fs namespace overflow (Eric Covener <covener@...che.org>)

October 2 (8 messages)

CVE-2026-102795: Apache Traffic Server: SNI to Host header matching policy is not properly enforced (supersedes CVE-2026-41… (Masakazu Kitajo <maskit@...che.org>)
CVE-2026-59265: Apache OpenOffice: Opening a malicious document can lead to system takeover (Dave Fisher <wave@...che.org>)
CVE-2026-102731: Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode (Emmanuel Lécharny <elecharny@...che.org>)
CVE-2026-103552: Apache Directory LDAP API: A unbound client can send a deeply nested search filter that overflows the … (Emmanuel Lécharny <elecharny@...che.or…)
CVE-2026-103877: Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements (Emmanuel Lécharny <elecharny@...che.org>)
CVE-2026-103878: Apache Directory LDAP API: Injection of plaintext responses during StartTLS (Emmanuel Lécharny <elecharny@...che.org>)
CVE-2026-103880: Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords (Emmanuel Lécharny <elecharny@...che.org>)
CVE-2026-103885: Apache Directory LDAP API: Denial of service via crafted telephone number values (Emmanuel Lécharny <elecharny@...che.org>)

October 4 (2 messages)

Apache Thrift 0.25.0: 61 CVEs fixed (combined announcement) (Jens Geyer <jensg@...che.org>)
cloud computing provider disclosures (Jan Schaumann <jschauma@...meister.org>)

October 5 (17 messages)

Re: cloud computing provider disclosures (Jonathan Wright <jonathan@...alinux.org>)
Re: cloud computing provider disclosures (Demi Marie Obenour <demiobenour@...il.com>)
Re: cloud computing provider disclosures (Aaron Rainbolt <arraybolt3@...il.com>)
Re: cloud computing provider disclosures (Katie <katie@...ricane.ca>)
openjpeg 2.4.0 through 2.5.4 and git master: heap buffer overflow in opj_dwt_encode_and_deinterleave_v() (reversible 5/… ("Security @ Red Eagle Tech" <security@r…)
[cups] Multiple security fixes in incoming new version 2.4.20 (Zdenek Dohnal <zdohnal@...hat.com>)
CVE-2019-25777: YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which c… (Stig Palmquist <stig@...g.io>)
CVE-2017-20285: YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes (Stig Palmquist <stig@...g.io>)
CVE-2026-19954: Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for th… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-104711: Apache Struts: OGNL injection in the legacy RESTful action mapper (Lukasz Lenart <lukaszlenart@...che.org>)
CVE-2026-104712: Apache Struts: Disproportionate response size when rendering BigDecimal request parameters (Lukasz Lenart <lukaszlenart@...che.org>)
CVE-2026-104713: Apache Struts: Unbounded request body read in the REST plugin (Lukasz Lenart <lukaszlenart@...che.org>)
CVE-2026-104714: Apache Struts: Shared message formatter exposes date and time values across concurrent requests (Lukasz Lenart <lukaszlenart@...che.org>)
Re: cloud computing provider disclosures (Jan Schaumann <jschauma@...meister.org>)
Re: cloud computing provider disclosures (Jeremy Stanley <fungi@...goth.org>)
libexpat 2.9.0 fixes two vulnerabilities (Sebastian Pipping <sebastian@...ping.org>)
Fwd: [Freeipmi-announce] FreeIPMI 1.6.20 Released (Chad Dougherty <crd@...rew.cmu.edu>)

October 6 (3 messages)

CVE-2026-104380: Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an … (Timothy Legge <timlegge@...nsec.org>)
Announce: OpenSSH 10.6 released (Damien Miller <djm@....openbsd.org>)
Django CVE-2026-77050, CVE-2026-84429, CVE-2026-87890, and CVE-2026-87975 (Sarah Boyce <sarahboyce@...ngoproject.com>)

October 7 (33 messages)

CVE-2026-96659: Foreman: excessive Viewer permissions on preview (fixed in 3.19.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-96658: Foreman: Safemode bypass leading to RCE (fixed in 3.19.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-56098: Katello: Registry Proxy authorization bypass (fixed in 4.21.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-56097: Katello: SQL injection in Registry Proxy labels (fixed in 4.21.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-12545: Hammer CLI: editor command injection (fixed in 3.19.1, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-12544: Foreman: SSTI and unsafe deserialization in configuration (fixed in 3.19.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-12542: Foreman: command injection in foreman-tail (fixed in 3.19.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-12541: Foreman: command injection in foreman-rake database tasks (fixed in 3.19.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-12540: Foreman: command injection in foreman-rake errors:fetch_log (fixed in 3.19.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-12423: Foreman: provisioning token validation flaw (fixed in 3.19.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-12405: Foreman Remote Execution: command injection via effective_user (fixed in 16.6.6, 17.2.2, 18.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-94114: Apache Commons BCEL: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser ("Gary D. Gregory" <ggregory@...che.org>)
CVE-2026-105111: Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS ("Gary D. Gregory" <ggregory@...che.org>)
CVE-2026-105239: Apache log4net: NUL character truncates EventLogAppender records (Jan Friedrich <freeandnil@...che.org>)
CVE-2026-105241: Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch (Jan Friedrich <freeandnil@...che.org>)
CVE-2026-105242: Apache log4net: Request validation failure drops the event in the aspnet-request converter (Jan Friedrich <freeandnil@...che.org>)
CVE-2026-105243: Apache log4net: Oversize EventLogAppender record silently discarded (Jan Friedrich <freeandnil@...che.org>)
CVE-2026-105240: Apache log4net: NUL character truncates OutputDebugStringAppender records (Jan Friedrich <freeandnil@...che.org>)
CVE-2026-105244: Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content (Jan Friedrich <freeandnil@...che.org>)
CVE-2026-90466: Apache Impala: Path traversal executes JARs outside trusted paths (Michael Smith <michaelsmith@...che.org>)
CVE-2026-93684: Apache Impala: Stored XSS in Impala query plans (Michael Smith <michaelsmith@...che.org>)
CVE-2026-97720: Apache Impala: Impala Executor Webserver Auth Bypass (Michael Smith <michaelsmith@...che.org>)
FW: X.Org Security Advisory: multiple security issues in X.Org X server (Peter Hutterer <peter.hutterer@...-t.net>)
CVE-2026-78243: Apache YuniKorn: LDAP Group provider panics on lowercase attribute name (Wilfred Spiegelenburg <wilfreds@...che.org>)
CVE-2026-92393: Apache YuniKorn: Admission control bypass via workload UPDATE operation (Wilfred Spiegelenburg <wilfreds@...che.org>)
CVE-2026-97146: Apache YuniKorn: Admission control bypass via system label forgery (Wilfred Spiegelenburg <wilfreds@...che.org>)
CVE-2026-92414: Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens (Julian Reschke <reschke@...che.org>)
CVE-2026-92415: Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies… (Julian Reschke <reschke@...che.org>)
CVE-2026-103371: Apache Geode: Management REST API: Insertion of Sensitive Information into Log File (Jinwoo Hwang <jinwoo@...che.org>)
[OSSA-2026-043] OpenStack Zaqar: Zaqar WebSocket project substitution allows cross-project queue access (CVE-2026-pendi… (Goutham Pacha Ravi <gouthampravi@...il.…)
Re: [OSSA-2026-043] OpenStack Zaqar: Zaqar WebSocket project substitution allows cross-project queue access (CVE-2026-1… (Goutham Pacha Ravi <gouthampravi@...il.…)
[OSSN-0109] Cross-project metric association bypass in Gnocchi (Goutham Pacha Ravi <gouthampravi@...il.com>)
tor-0.4.9.14 released (Sam James <sam@...too.org>)

October 8 (10 messages)

CVE-2026-66082: Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow） (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-66084: Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-66087: Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-71183: Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords… (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-71895: Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-71896: Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information… (Wenjun Ruan <wenjun@...che.org>)
Re: CVE-2026-59265: Apache OpenOffice: Opening a malicious document can lead to system takeover (Demi Marie Obenour <demiobenour@...il.com>)
OpenJPEG: heap-buffer-overflow write fixed on master since Feb 2026, still present in every release (2.5.3, 2.5.4) (TheSecguy <thesecguy45@...il.com>)
Fwd: Go 1.27.2 and Go 1.26.9 are released (Alan Coopersmith <alan.coopersmith@...cle.com>)
Fwd: Vulnerabilities in golang.org/x/net (Alan Coopersmith <alan.coopersmith@...cle.com>)

October 9 (21 messages)

[OSSA-2026-044] OpenStack Mistral: Four authorization and privilege vulnerabilities in Mistral (CVE-2026-93858, CVE-2026-938… (Jeremy Stanley <fungi@...goth.org>)
[OSSN-0110] Ironic can leak basic auth credentials to image server (Jay Faulkner <jay@....cc>)
Xen Security Advisory 522 v1 (CVE-2026-98375) - Linux xen-netfront: backend can crash guest via malformed RX packets (Xen.org security team <security@....org>)
CVE-2026-71575: Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-73179: Apache CXF: JPA authorization-code consume is non-atomic (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-78384: Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb) (Colm O hEigeartaigh <coheigea@...che.org…)
CVE-2026-79650: Apache CXF: OIDC RP Open Redirect (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-86463: Apache CXF: FIQL Query Parser Denial of Service (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-97468: Apache CXF: Authentication bypass via weak cache keys for validated STS tokens (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-97791: Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state b… (Colm O hEigeartaigh <coheigea@...che.or…)
CVE-2026-100227: Apache CXF: XML Signature wrapping in JAX-RS XML Security (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-107937: Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of servic… (Colm O hEigeartaigh <coheigea@...che.or…)
CVE-2026-107938: Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification. (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-108039: Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character l… (Colm O hEigeartaigh <coheigea@...che.or…)
Re: OpenJPEG: heap-buffer-overflow write fixed on master since Feb 2026, still present in every release (2.5.3, 2.5.4) (Stuart Henderson <stu@...cehopper.org>)
CVE-2026-103412: Apache Camel Karavan: project file name path traversal when committing a project to Git (Andrea Cosentino <acosentino@...che.org>)
CVE-2026-103413: Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml (Andrea Cosentino <acosentino@...che.org>)
Multiple CVEs for illumos and distros: door server processes (Dan McDonald <danmcd@...decomputer.com>)
CVE for illumos and distros: VMM/BHYVE (Dan McDonald <danmcd@...decomputer.com>)
Unfixed vulnerabilities in Cyrus SASL (Alan Coopersmith <alan.coopersmith@...cle.com>)
mutt 2.4.3 released, fixes CVE-2026-107570 (Alan Coopersmith <alan.coopersmith@...cle.com>)

October 10 (8 messages)

3 Vulnerabilities in GNU Aspell before 0.60.8.3 (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-103501: Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption … (Lee Rhodes <leerho@...che.org>)
CVE-2026-103513: Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows m… (Lee Rhodes <leerho@...che.org>)
CVE-2026-103634: Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch deserialization allows … (Lee Rhodes <leerho@...che.org>)
CVE-2026-103635: Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial… (Lee Rhodes <leerho@...che.org>)
CVE-2026-103636: Apache DataSketches: datasketches-cpp: Out-of-bounds read in VarOpt union deserialization allows denial of ser… (Lee Rhodes <leerho@...che.org>)
CVE-2026-107373: ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-107794: ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list (Robert Rothenberg <rrwo@...nsec.org>)

October 11 (1 message)

Incomplete fix for Emacs CVE-2026-79992 (Sean Whitton <spwhitton@...hitton.name>)

October 12 (7 messages)

Unpatched credential leak in kubernetes/cloud-provider-gcp (auth-provider-gcp) - CVE requested (CAN-2026-2039459) (Nebojša Jaćović <nebojsa.jacovic@...il.co…)
Unpatched cross-namespace secret exfiltration in GoogleCloudPlatform/k8s-config-connector - CVE requested (CAN-2026-203… (Nebojša Jaćović <nebojsa.jacovic@gma…)
CVE-2026-92116: Apache Allura: OAuth1 missing callback validation (Dave Brondsema <dave@...ndsema.net>)
CVE-2026-92119: Apache Allura: REST API Mass Assignment (Dave Brondsema <dave@...ndsema.net>)
CVE-2026-92120: Apache Allura: Oauth1 Replay Attack (Dave Brondsema <dave@...ndsema.net>)
[vim-security] Arbitrary Code Execution via Ruby Omni-Completion in Vim < 9.2.1177 (Christian Brabandt <cb@...bit.org>)
[vim-security] Command Execution via Rmd Syntax Highlighting in Vim < 9.2.1178 (Christian Brabandt <cb@...bit.org>)

October 13 (12 messages)

Fwd: Announcing FreeType version 2.15.0 (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-107460: Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding (Shuxin Pan <psxjoy@...che.org>)
Xen Security Advisory 514 v2 (CVE-2026-79607) - Xenstore: Guests can crash xenstored during Live Update (Xen.org security team <security@....org>)
Xen Security Advisory 515 v2 (CVE-2026-79608) - x86/AMD: ineffectual Zenbleed workaround (Xen.org security team <security@....org>)
Xen Security Advisory 516 v2 (CVE-2026-79609) - x86: XPTI may break on huge-memory systems (Xen.org security team <security@....org>)
Xen Security Advisory 517 v2 (CVE-2026-79610) - grant-table: double version change race (Xen.org security team <security@....org>)
Xen Security Advisory 518 v2 (CVE-2026-79611) - VMX: VMentry failure with branch tracing and blocked states (Xen.org security team <security@....org>)
Xen Security Advisory 519 v2 (CVE-2026-102699,CVE-2026-102702) - Arm: multiple issues with GNTTABOP_cache_flush (Xen.org security team <security@....org>)
Xen Security Advisory 520 v2 (CVE-2026-102700) - gnttab: cache-flush handling may cause page reference leak (Xen.org security team <security@....org>)
Xen Security Advisory 521 v2 (CVE-2026-102701) - tapdisk: Out-of-bounds access in tap_ctl_connect_xenblkif() (Xen.org security team <security@....org>)
Nix and Lix: multiple vulnerabilities leading to local root privilege escalation - October 2026 (Thomas GERBET <thomas@...bet.me>)
rsyslog RainerScript replace() output length overflow (GHSA-48f2-29wv-5jgc) (Rainer Gerhards <rgerhards@...adiscon.com>)

October 14 (12 messages)

Hex 2.5.2 released with security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-74580: Linux vhost stale IOTLB cache leading to LPE and VM escape (fourie <littleddfu@...il.com>)
[SECURITY ADVISORIES] curl 8.23.0 (Daniel Stenberg <daniel@...x.se>)
Re: Incomplete fix for Emacs CVE-2026-79992 (Sam James <sam@...too.org>)
Re: libpng 1.6.59: Use-after-free vulnerability fixed: CVE-2026-46675 (Sam James <sam@...too.org>)
Godot 4.x: heap out-of-bounds read in OptimizedTranslation message lookup (Tomasz Kaye <tomasz.brain@...il.com>)
DPDK security advisory: Multiple vulnerabilities in vhost/vhost-crypto/vDPA/GSO libraries (Maxime Coquelin <maxime.coquelin@...hat.com>)
Godot 4.x: heap out-of-bounds write via negative string length in binary resource loader (Tomasz Kaye <tomasz.brain@...il.com>)
Godot 4.x: heap out-of-bounds write in Radiance HDR image loader (Tomasz Kaye <tomasz.brain@...il.com>)
Upcoming Node.js security release 2026/10/21 (Antoine du Hamel <duhamelantoine1995@...il.com>)
Multiple TLS libraries: X.509 Name Constraints enforcement bypasses (CVE-2026-34073, CVE-2026-3833, CVE-2026-5263, CVE-2026-338… (Oleh Konko <security@...al.org>)
NSD 4.15.3 security release (Willem Toorop <willem@...etlabs.nl>)

October 15 (12 messages)

Re: Incomplete fix for Emacs CVE-2026-79992 (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Godot 4.x: heap out-of-bounds read in OptimizedTranslation message lookup (Tomasz Kaye <tomasz.brain@...il.com>)
Re: Godot 4.x: heap out-of-bounds write via negative string length in binary resource loader (Tomasz Kaye <tomasz.brain@...il.com>)
Re: Godot 4.x: heap out-of-bounds write in Radiance HDR image loader (Tomasz Kaye <tomasz.brain@...il.com>)
linux kernel: PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999) (Jan Schaumann <jschauma@...meister.org>)
[vim-security] Ex Command Execution via Cargo Quickfix Hooks in Vim < 9.2.1201 (Christian Brabandt <cb@...bit.org>)
FOLLOW-UP: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10) (eddyflores100@...il.com)
Re: FOLLOW-UP: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10) (Solar Designer <solar@...nwall.com>)
CVE-2026-92228: Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log rea… (Jarek Potiuk <potiuk@...che.org>)
CVE-2026-94134: Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default (Jarek Potiuk <potiuk@...che.org>)
CVE-2026-94135: Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default (Jarek Potiuk <potiuk@...che.org>)
CVE-2026-96806: Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddlewa… (Jarek Potiuk <potiuk@...che.org>)

October 16 (39 messages)

CVE-2026-63618: Apache Kylin: Low-Privilege Config Exposure (Li Yang <liyang@...che.org>)
CVE-2026-63619: Apache Kylin: Missing authorization and path-confinement on system meta dump (Li Yang <liyang@...che.org>)
CVE-2026-64610: Apache Kylin: Redis unsafe Java deserialization (Li Yang <liyang@...che.org>)
CVE-2026-64959: Apache Kylin: Missing authentication on certain cache API endpoints (Li Yang <liyang@...che.org>)
CVE-2026-68571: Apache Kylin: JDBC URL Whitelist Verification Bypass (Li Yang <liyang@...che.org>)
CVE-2026-68572: Apache Kylin: Unauthorized SQL execution to Spark SQL env (Li Yang <liyang@...che.org>)
CVE-2026-68573: Apache Kylin: Unauthenticated Metastore Cleanup (Li Yang <liyang@...che.org>)
CVE-2026-69076: Apache Kylin: Unauthorized cross-project job discard (Li Yang <liyang@...che.org>)
CVE-2026-69077: Apache Kylin: JobController allows unauthorized cross-project manipulation (Li Yang <liyang@...che.org>)
CVE-2026-69080: Apache Kylin: Broken Access Control in QuerySQLBlacklistController (Li Yang <liyang@...che.org>)
CVE-2026-108709: Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network) (Li Yang <liyang@...che.org>)
CVE-2026-108743: Apache Kylin: spark job OS command injection (Li Yang <liyang@...che.org>)
CVE-2026-108762: Apache Kylin: delete metadata backup path-confinement bypass (Li Yang <liyang@...che.org>)
CVE-2026-108764: Apache Kylin: job-driver UI proxy SSRF (Li Yang <liyang@...che.org>)
CVE-2026-108766: Apache Kylin: missing JDBC-config authorization (Li Yang <liyang@...che.org>)
CVE-2026-108771: Apache Kylin: unauthenticated broadcast API and polymorphic deserialization (Li Yang <liyang@...che.org>)
CVE-2026-108776: Apache Kylin: tables/names SparkSQL injection (Li Yang <liyang@...che.org>)
CVE-2026-108780: Apache Kylin: Potential JDBC source configuration validation issue (Li Yang <liyang@...che.org>)
CVE-2026-108823: Apache Kylin: Potential unauthenticated job metadata replacement (Li Yang <liyang@...che.org>)
CVE-2026-108833: Apache Kylin: default startup profile miss security settings (Li Yang <liyang@...che.org>)
CVE-2026-108837: Apache Kylin: Potential computed-column resource exhaustion (Li Yang <liyang@...che.org>)
CVE-2026-64943: Apache Answer: API keys logged in plaintext during authentication (Enxin Xie <linkinstar@...che.org>)
CVE-2026-64944: Apache Answer: Stored XSS via unsanitized HTML in imported question content (Enxin Xie <linkinstar@...che.org>)
CVE-2026-64945: Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show question… (Enxin Xie <linkinstar@...che.org>)
CVE-2026-67249: Apache Answer: Email Code Purpose Confusion May Allow Account Takeover (Enxin Xie <linkinstar@...che.org>)
CVE-2026-68482: Apache Answer: Improper Authorization in Question Invite User Lookup (Enxin Xie <linkinstar@...che.org>)
CVE-2026-71563: Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions (Enxin Xie <linkinstar@...che.org>)
CVE-2026-76994: Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles (Enxin Xie <linkinstar@...che.org>)
CVE-2026-79613: Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles (Enxin Xie <linkinstar@...che.org>)
CVE-2026-79620: Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata (Enxin Xie <linkinstar@...che.org>)
CVE-2026-79624: Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation (Enxin Xie <linkinstar@...che.org>)
CVE-2026-79633: Apache Answer: Missing Authorization Allows Mutations of Non-Public Content (Enxin Xie <linkinstar@...che.org>)
CVE-2026-86589: Apache Answer: User Center integration does not revoke first-login sessions after central account suspension (Enxin Xie <linkinstar@...che.org>)
CVE-2026-90910: Apache Answer: Reaction API authorization bypass for restricted content (Enxin Xie <linkinstar@...che.org>)
CVE-2026-104715: cifs-utils 4.2-7.8 mount-option injection in mount.cifs (Bharath SM <bharathsm.hsk@...il.com>)
Infinity Core: Linux Kernel Core LPEs (Hyunwoo Kim <imv4bel@...il.com>)
Fwd: X.Org Security Advisory: multiple security issues in X.Org X client libraries (Alan Coopersmith <alan.coopersmith@...cle.com>)
Text::CSV_XS versions before 1.65 for Perl (8 CVEs) (Stig Palmquist <stig@...g.io>)
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) (Solar Designer <solar@...nwall.com>)

October 17 (6 messages)

Re: FOLLOW-UP: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10) (eddyflores100@...il.com)
CVE-2025-55640: Heap Buffer Overflow in GPAC/MP4Box via stbl_AddSize on crafted MP4 with corrupted sample metadata ("Alexander A. Shvedov" <sigdevel@...amail.c…)
Re: FOLLOW-UP: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10) (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2025-55653: Divide by Zero in GPAC/MP4Box via gf_parse_lfrac on crafted MP4 with zero-denominator fraction ("Alexander A. Shvedov" <sigdevel@...amail.com>)
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) (Rihards Simanovics <security@...ffin-web.studio>)

October 18 (6 messages)

Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) (Martin Steigerwald <martin@...htvoll.de>)
Apache Camel: 38 CVEs fixed in 4.18.5, 4.22.1 and 4.23.0 (Andrea Cosentino <ancosen@...il.com>)
CVE-2026-78497: JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compi… (Robert Rothenberg <rrwo@...nsec.org>)
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) (Jan Schaumann <jschauma@...meister.org>)
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) ("David A. Wheeler" <dwheeler@...eeler.com>)

October 19 (6 messages)

Linux KVM/x86: stale SMM MMIO cache bypasses write tracking (Jinu Kim <kimjw04271234@...il.com>)
CVE-2026-88900: Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Ca… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-86467: Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account (Jarek Potiuk <potiuk@...che.org>)
Cpanel::JSON::XS versions before 4.80 for Perl (15 CVEs) (Stig Palmquist <stig@...g.io>)
CVE-2026-111946: Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the defaul… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-92287: Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host v… (Adam Reeve <areeve@...che.org>)

October 20 (39 messages)

eMudhra Intermediates Compromise (Dennis Jackson <djackson@...illa.com>)
CVE-2026-108086: Apache Cocoon: XEE could lead to SSRF and information disclosure (Arnout Engelen <engelen@...che.org>)
CVE-2026-108087: Apache Cocoon: SQL Injection (Arnout Engelen <engelen@...che.org>)
CVE-2026-108088: Apache Cocoon: Cross-user cache poisoning (Arnout Engelen <engelen@...che.org>)
CVE-2026-108089: Apache Cocoon: Unauthenticated access to diagnostic interfaces (Arnout Engelen <engelen@...che.org>)
CVE-2025-52290: FFmpeg NULL pointer dereference in avpriv_h264_has_num_reorder_frames ("Alexander A. Shvedov" <sigdevel@...amail.com>)
CVE-2025-55654: Use-after-free in GPAC/MP4Box gf_filter_pid_get_packet via crafted NHML export input ("Alexander A. Shvedov" <sigdevel@...amail.com>)
CVE-2025-55667: NULL pointer dereference in GPAC/MP4Box dump_isom_saps via crafted MP4 input ("Alexander A. Shvedov" <sigdevel@...amail.com>)
CVE-2025-60480: Heap buffer overflow in GPAC/MP4Box gf_odf_ac4_cfg_alternative_info via crafted AC-4 file ("Alexander A. Shvedov" <sigdevel@...amail.com>)
Roundcube webmail: multiple vulnerabilities prior to 1.6.20 / 1.7.5 (Valtteri Vuorikoski <vuori@...com.org>)
CVE-2026-86471: Apache CouchDB: Admin credentials leading to code execution as operating system user (Jan Lehnardt <jan@...che.org>)
CVE-2026-90797: Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session (Jan Lehnardt <jan@...che.org>)
CVE-2026-90798: Apache CouchDB: Replicator follows redirects indefinitely (Jan Lehnardt <jan@...che.org>)
CVE-2026-90799: Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence… (Jan Lehnardt <jan@...che.org>)
CVE-2026-90800: Apache CouchDB: Auth bypass in prefixed _users and _replicator databases (Jan Lehnardt <jan@...che.org>)
CVE-2026-107755: Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs (Jan Lehnardt <jan@...che.org>)
[OSSA-2026-045] Cinder: Cross-project information disclosure in Cinder Messages API (CVE-2026-93856) (Brian Rosmaita <rosmaita.fossdev@...il.com>)
[OSSA-2026-046] OpenStack Manila: Manila allows cross-project public-share and export-metadata changes (CVE-2026-71195) (Goutham Pacha Ravi <gouthampravi@...il.…)
Re: eMudhra Intermediates Compromise (Valtteri Vuorikoski <vuori@...com.org>)
[GHSA-6q48-6c7w-9gw2] CRITICAL security update for certifi, removal of emSign root certificate (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-74048: Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up (Mark Thomas <markt@...che.org>)
CVE-2026-74049: Apache Tomcat: Jasper JSTL plug-in implementation omits page abort (SKIP_PAGE) (Mark Thomas <markt@...che.org>)
CVE-2026-80353: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not… (Mark Thomas <markt@...che.org>)
CVE-2026-88041: Apache Tomcat: HTTP/2 trailer header cross-contamination (Mark Thomas <markt@...che.org>)
CVE-2026-93446: Apache Tomcat: Possible TLS 1.3 connection failures (Mark Thomas <markt@...che.org>)
CVE-2026-101296: Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms (Mark Thomas <markt@...che.org>)
CVE-2026-101356: Apache Tomcat: HTTP/2 request/response mix-up after error during async processing (Mark Thomas <markt@...che.org>)
CVE-2026-103119: Apache Tomcat: AJP response mix-up (Mark Thomas <markt@...che.org>)
Go 1.27.3 and Go 1.26.10 are released for CA certificate removal (Alan Coopersmith <alan.coopersmith@...cle.com>)
NSS 3.131.1 Release - Important Security Updates (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: eMudhra Intermediates Compromise (Jeffrey Walton <noloader@...il.com>)
Re: eMudhra Intermediates Compromise (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: eMudhra Intermediates Compromise (Jeffrey Walton <noloader@...il.com>)
Upcoming Critical PHP Security Release (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-28403, CVE-2026-28412: Textream (macOS) < 1.5.1 local WebSocket server: missing Origin check and unlimited conne… (Yusuf Can TURK <iamcanturk@...il.com>)
CVE-2026-113812: Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compro… (Stig Palmquist <stig@...g.io>)
CVE-2026-108518: DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is dest… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-111879: DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data do… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-85783: Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanza… (Robert Rothenberg <rrwo@...nsec.org>)

October 21 (31 messages)

CVE-2026-112202: Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images (Stig Palmquist <stig@...g.io>)
Bundled cert stores + eMudhra cert issue (nmap/ncat, texlive-infra) (Hanno Böck <hanno@...eck.de>)
Apache bRPC security advisory: 35 vulnerabilities fixed in 1.18.0 (Weibing Wang <wwbmmm@...che.org>)
Re: eMudhra Intermediates Compromise (Solar Designer <solar@...nwall.com>)
Re: eMudhra Intermediates Compromise (Solar Designer <solar@...nwall.com>)
CVE-2026-109618: PHP 8.2–8.5 RCE via OOM corruption (Jakub Zelenka <bukka@....net>)
CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state (Jakub Zelenka <bukka@....net>)
ISC has disclosed four vulnerabilities in BIND 9 (CVE-2026-19630, CVE-2026-94300, CVE-2026-96888, CVE-2026-97313) (Andoni Duarte Pintado <andoni@....org>)
PowerDNS Security Advisory 2026-12 for PowerDNS Recursor: Multiple issues (Otto Moerbeek <otto.moerbeek@...erdns.com>)
PowerDNS Security Advisory 2026-13: Crafted packet using compression pointers can lead to denial of service (Miod Vallat <miod.vallat@...erdns.com>)
Unbound: 1.26.2 addresses multiple CVE items (Yorgos Thessalonikefs <yorgos@...etlabs.nl>)
Re: Bundled cert stores + eMudhra cert issue (nmap/ncat, texlive-infra) (LN Liberda <lauren@...fisekai.rocks>)
Re: Bundled cert stores + eMudhra cert issue (nmap/ncat, texlive-infra) (Hanno Böck <hanno@...eck.de>)
Re: eMudhra Intermediates Compromise (Hanno Böck <hanno@...eck.de>)
Re: eMudhra Intermediates Compromise (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state (Aaron Rainbolt <arraybolt3@...il.com>)
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state (Yves-Alexis Perez <corsac@...ian.org>)
CVE-2026-107891: musl libc: multiple integer overflow in regcomp, possibly leading to incorrect allocation sizes and out-of-bound… (Rich Felker <dalias@...c.org>)
CVE-2026-41114: Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver (Haonan Hou <haonan@...che.org>)
CVE-2026-58663: Apache IoTDB: Auth Bypass in pipeTransfer() interface (Haonan Hou <haonan@...che.org>)
CVE-2026-59229: Apache IoTDB: Legacy Pipe Privilege Escalation (Haonan Hou <haonan@...che.org>)
CVE-2026-59562: Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC (Haonan Hou <haonan@...che.org>)
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state (Aaron Rainbolt <arraybolt3@...il.com>)
Pillow 13.0.0 fixes long list of vulnerabilities (Alan Coopersmith <alan.coopersmith@...cle.com>)
Apache Pulsar: 14 CVEs fixed in 4.0.14, 4.2.5 and 5.0.0 (combined announcement) (Lari Hotari <lhotari@...che.org>)
Apache Pulsar Manager: CVE-2026-105944, missing authentication and admin credential disclosure; end of life (Lari Hotari <lhotari@...che.org>)
CVE-2026-113811: Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cl… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-94140: Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because syn… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-94423: Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never chec… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-112921: Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-A… (Robert Rothenberg <rrwo@...nsec.org>)
Re: eMudhra Intermediates Compromise (Jakub Wilk <jwilk@...lk.net>)

October 22 (34 messages)

Header Accordions: QPACK amplification attacks against HTTP/3 servers (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state (Christian Fischer <christian.fischer@...enbone.net>)
one more reason to update libpcap to at least 1.10.7 (Denis Ovsienko <denis@...ienko.info>)
aide (>= 0.16 <= 0.19.4) improper handling of file names containing invalid UTF-8 byte sequences (AIDE detection bypass… (Hannes von Haugwitz <hannes@...haugwitz…)
aide (<= 0.19.4) improper comparison of hash values containing a null byte (AIDE detection bypass) [GHSA-6wc9-4w69-5jc5… (Hannes von Haugwitz <hannes@...haugwitz…)
[OSSA-2026-047] Ironic: Redfish vendor_passthru method allows path injection via ID (CVE-2026-90458) (Jay Faulkner <jay@....cc>)
[OSSA-2026-048] Ironic: Allows generic node update for maintenance setting (CVE-2026-89419) (Jay Faulkner <jay@....cc>)
Re: Upcoming Node.js security release 2026/10/21 (Alan Coopersmith <alan.coopersmith@...cle.com>)
[OSSN-0111] oslo.utils can log LUKS key material (Brian Rosmaita <rosmaita.fossdev@...il.com>)
CVE-2026-113582: Apache Abdera: XML external entity expansion in Atom document parsing (Piotr Karwasz <pkarwasz@...che.org>)
Re: eMudhra Intermediates Compromise (Stuart Henderson <stu@...cehopper.org>)
Comodo AAA Services Root and S/MIME (Hanno Böck <hanno@...eck.de>)
Unofficial backports for CVE-2026-109618 / CVE-2026-109619 to EOL PHP 7.3 (EL7) and 5.4/5.3 (Amazon Linux) (賴奇佑 <leon.lai@...ian.co.jp>)
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state (Nicolas Vigier <boklm@...s-attacks.org>)
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state (Jakub Zelenka <bukka@....net>)
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state (Lukas Tribus <lukas@...i.eu>)
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state (Emmanuel Fleury <emmanuel.fleury@...ordeaux.fr>)
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state (Emmanuel Fleury <emmanuel.fleury@...ordeaux.fr>)
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state (Markus Gschwendt <office+osssecurity@...out.at>)
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state ("Goetz T. Fischer" <g.fischer@...-c.de>)
CVE-2025-60469: NULL pointer dereference in GPAC/MP4Box AC-4 parser via crafted file ("Alexander A. Shvedov" <sigdevel@...amail.com>)
CVE-2025-60476: Heap use-after-free in GPAC/MP4Box AC-4 descriptor cleanup ("Alexander A. Shvedov" <sigdevel@...amail.com>)
CVE-2025-60478: Heap use-after-free in GPAC/MP4Box packet destruction via crafted MPEG-2 TS file ("Alexander A. Shvedov" <sigdevel@...amail.com>)
CVE-2025-60479: NULL pointer dereference in GPAC/MP4Box StatSFVec2f via crafted BIFS scene ("Alexander A. Shvedov" <sigdevel@...amail.com>)
CVE-2025-60496: Divide by zero in GPAC/MP4Box reframer via crafted truncated MP4 file ("Alexander A. Shvedov" <sigdevel@...amail.com>)
CVE-2025-71438: Out-of-bounds Read in GPAC/MP4Box via gf_odf_ac4_cfg_dsi_v1 on crafted AC-4 stream with invalid frame r… ("Alexander A. Shvedov" <sigdevel@...ama…)
CVE-2026-109618 / CVE-2026-109619: unofficial backport of the PHP OOM bailout / stale state fix to PHP 5.4.16 (EL7) and… (Oleksii Molchanov <oleksii.molchanov.pe…)
Information for Python users regarding eMudhra / emSign CA certificate security incident (Alan Coopersmith <alan.coopersmith@...cle.com>)
Python 3.15.1, 3.14.9 and 3.13.17 are out (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Comodo AAA Services Root and S/MIME (Steffen Nurpmeso <steffen@...oden.eu>)
Re: Information for Python users regarding eMudhra / emSign CA certificate security incident (Valtteri Vuorikoski <vuori@...com.org>)
Plone security fix 20261022: information disclosure ("Maurits van Rees (Plone)" <maurits@...ne.org>)
CPython: [CVE-2026-114583] tarfile.tar_filter path traversal bypass allows writing outside the extraction directory (Alan Coopersmith <alan.coopersmith@...cle.…)
CVE-2026-113873, CVE-2026-113874, CVE-2026-113875, CVE-2026-113876: HAPI FHIR cross-tenant partition override, authoriz… (Abhinav Agarwal <abhinavagarwal1996@gma…)

October 23 (31 messages)

Re: Information for Python users regarding eMudhra / emSign CA certificate security incident (Eli Schwartz <eschwartz@...too.org>)
Re: Information for Python users regarding eMudhra / emSign CA certificate security incident (Stuart Henderson <stu@...cehopper.org>)
Re: CVE-2026-109618 / CVE-2026-109619: unofficial backport of the PHP OOM bailout / stale state fix to PHP 5.4.16 (EL7)… (Oleksii Molchanov <oleksii.molchanov.pe…)
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state (Christian Fischer <christian.fischer@...enbone.net>)
Re: CVE-2026-109618: PHP 8.2–8.5 RCE via OOM corruption (Christian Fischer <christian.fischer@...enbone.net>)
CVE-2026-90885: Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-94386: Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Toke… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-95628: Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incompl… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-95629: Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbi… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-95663: Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introsp… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-95664: Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header a… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-101259: Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions (Andrea Cosentino <acosentino@...che.org>)
CVE-2025-60487: NULL pointer dereference in GPAC/MP4Box gf_isom_get_esd via crafted XML input ("Alexander A. Shvedov" <sigdevel@...amail.com>)
CVE-2025-60489: NULL pointer dereference in GPAC/MP4Box dasher_insert_timeline_entry via crafted MP4 input ("Alexander A. Shvedov" <sigdevel@...amail.com>)
CVE-2025-60490: heap use-after-free in GPAC/MP4Box gf_filter_pid_send_event_downstream via crafted MPEG-2 TS input ("Alexander A. Shvedov" <sigdevel@...amail.c…)
CVE-2025-60491: heap use-after-free in GPAC/MP4Box dasher_flush_segment via crafted MPEG-2 TS input ("Alexander A. Shvedov" <sigdevel@...amail.com>)
CVE-2025-60492: uncontrolled recursion in GPAC/MP4Box BIFS decoder via crafted MP4 input ("Alexander A. Shvedov" <sigdevel@...amail.com>)
CVE-2025-60494: invalid memory read in GPAC/MP4Box gf_props_equal_internal via crafted MP4 input ("Alexander A. Shvedov" <sigdevel@...amail.com>)
CVE-2025-60497: NULL pointer dereference in GPAC/MP4Box GetESD via crafted MP4 input ("Alexander A. Shvedov" <sigdevel@...amail.com>)
CVE-2026-115721: Apache Vysper: Unbounded allocation (Thomas Wolf <twolf@...che.org>)
CVE-2026-115748: Apache Vysper: Authorization bypass (Thomas Wolf <twolf@...che.org>)
Re: Information for Python users regarding eMudhra / emSign CA certificate security incident (Sam Bull <9m199i@...bull.org>)
PHP Informational advisory: Session upload progress (CVE-2026-115560) (Alan Coopersmith <alan.coopersmith@...cle.com>)
Ruby Regexp compilation fixes related to GitLab's CVE's (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Upcoming Node.js security release 2026/10/21 (Jan Schaumann <jschauma@...meister.org>)
nginx RCEs CVE-2026-93479, CVE-2026-15176 (Jan Schaumann <jschauma@...meister.org>)
CVE-2026-113877: HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges m… (Robert Rothenberg <rrwo@...nsec.org>)
Re: Godot 4.x: heap out-of-bounds write in Radiance HDR image loader (Tomasz Kaye <tomasz.brain@...il.com>)
Re: Godot 4.x: heap out-of-bounds write via negative string length in binary resource loader (Tomasz Kaye <tomasz.brain@...il.com>)
Re: Godot 4.x: heap out-of-bounds read in OptimizedTranslation message lookup (Tomasz Kaye <tomasz.brain@...il.com>)
CVE-2026-115936: IO::Compress::Brotli versions from 0.004001 before 0.023 for Perl bundle a brotli library with an out-of-… (Timothy Legge <timlegge@...nsec.org>)

October 24 (10 messages)

jxrlib: memory bugs on damaged JPEG XR files, fixed in mircomir/jxrlib 1.4.4, still in most distributions ("Joachim Rütter" <mynetx1@...il.com>)
Re: eMudhra Intermediates Compromise (Jeffrey Walton <noloader@...il.com>)
Re: Upcoming Node.js security release 2026/10/21 (Michael Orlitzky <michael@...itzky.com>)
CVE-2026-114629: Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlen… (Robert Rothenberg <rrwo@...nsec.org>)
[CVE-2026-115557] Distrust compromised intermediate certificates in Python ssl module (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Brotli CVE-2026-111497 (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-111813 etc: Multiple vulnerabilities in Apache Traffic Server prior to 9.2.16/10.1.5/10.2.1 (Valtteri Vuorikoski <vuori@...com.org>)
Re: openjpeg 2.4.0 through 2.5.4 and git master: heap buffer overflow in opj_dwt_encode_and_deinterleave_v() (reversibl… ("Security @ Red Eagle Tech" <security@r…)
PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618) (Roman Kuligin <romaka@...ox.lv>)
CVE-2025-60493: GPAC/MP4Box: NULL Pointer Dereference in check_media_profile via Crafted MP4 Input ("Alexander A. Shvedov" <sigdevel@...amail.com>)

October 26 (20 messages)

CVE-2025-60477: GPAC/MP4Box: NULL Pointer Dereference in gf_filter_pid_resolve_file_template_ex on crafted MP4 with spe… ("Alexander A. Shvedov" <sigdevel@...ama…)
CVE-2026-72844: Lean 4 kernel soundness bug — forging proofs via nested inductive projections (0 = 1 demonstrated) (Jonathan Brossard <endrazine@...il.com>)
CVE-2026-72711: Lean 4 kernel soundness bug — inference cache poisoning via opaque declarations (0 = 1 demonstrated) (Jonathan Brossard <endrazine@...il.com>)
CVE-2026-72703: Rocq guard checker accepts non-terminating fixpoint via unchecked cross-calls (0 = 1 demonstrated) (Jonathan Brossard <endrazine@...il.com>)
CVE-2026-72704: Rocq guard checker trusts corrupted recursive tree after transport (0 = 1 demonstrated) — 0-day (Jonathan Brossard <endrazine@...il.com>)
CVE-2026-72705: Rocq guard checker accepts fixpoint passed as higher-order argument (0 = 1 demonstrated) (Jonathan Brossard <endrazine@...il.com>)
CVE-2026-72714: Rocq universe checking state desynchronised after module close (0 = 1 demonstrated) — 0-day (Jonathan Brossard <endrazine@...il.com>)
CVE-2020-37268: Rocq/Coq Print Assumptions omits unsafe universe checking inlined through Parameter Inline (0 = 1 demons… (Jonathan Brossard <endrazine@...il.com>)
Re: PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618) (Demi Marie Obenour <demiobenour@...il.com>)
CVE-2026-115825: HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declarin… (Robert Rothenberg <rrwo@...nsec.org>)
Starman versions before 0.4019 for Perl (4 CVEs) (Robert Rothenberg <rrwo@...nsec.org>)
Re: Brotli CVE-2026-111497 (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Brotli CVE-2026-111497 (Alan Coopersmith <alan.coopersmith@...cle.com>)
GNU patch 2.8.1 released, fixes CVE-2026-115207 (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618) (Michael Orlitzky <michael@...itzky.com>)
Brotli CVE-2026-111497 and git-remote-https (Harry Sintonen <sintonen@....fi>)
CVE-2026-112818: git-annex cross-repository data exfiltration (Joey Hess <id@...yh.name>)
CVE-2025-60467: GPAC/MP4Box: Use-After-Free in gf_filter_pid_inst_swap_delete_task on crafted MPEG-2 TS file ("Alexander A. Shvedov" <sigdevel@...amail.com>)
Godot 4.x: arbitrary code execution via .po translation file Plural-Forms header (Tomasz Kaye <tomasz.brain@...il.com>)
CVE-2026-111422: Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the … (Hussein Awala <husseinawala@...che.org>)

October 27 (10 messages)

Re: PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618) (Peter Wolanin <pwolanin@...il.com>)
Re: Fwd: X.Org Security Advisory: multiple security issues in X.Org X client libraries (Alan Coopersmith <alan.coopersmith@...cle.com>)
Seccomp denylist bypass via 32-bit syscall argument truncation (Ricardo Branco <rbranco@...e.de>)
Re: PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618) (Demi Marie Obenour <demiobenour@...il.com>)
Re: Fwd: X.Org Security Advisory: multiple security issues in X.Org X client libraries (Emilio Pozuelo Monfort <pochu@...ian.org>)
Multiple vulnerabilities in HTSlib <= 1.24 (Robert Davies <rmd@...ger.ac.uk>)
Multiple vulnerabilities in samtools <= 1.24 (Robert Davies <rmd@...ger.ac.uk>)
Godot 4.x: remote client crash via multiplayer spawn packet sync_len overflow (Tomasz Kaye <tomasz.brain@...il.com>)
Godot 3.x/4.x: remote crash via DTLS receive-callback heap buffer overflow (Tomasz Kaye <tomasz.brain@...il.com>)
Vulnerabilities in golang.org/x/net (Alan Coopersmith <alan.coopersmith@...cle.com>)

October 28 (25 messages)

Three TLS Bugs in GoAhead web server prior to 6.1.1 (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2025-60475: GPAC/MP4Box: Global Buffer Overflow Read in gf_ac4_parser_bs on crafted AC-4 stream ("Alexander A. Shvedov" <sigdevel@...amail.com>)
Re: Information for Python users regarding eMudhra / emSign CA certificate security incident (Kevin Riggle <kevinr@...plexsystems.group>)
CVE-2026-97631: Pre-boot RCE in EDK II PXE driver (Valtteri Vuorikoski <vuori@...com.org>)
Re: Information for Python users regarding eMudhra / emSign CA certificate security incident (Jakub Wilk <jwilk@...lk.net>)
Multiple vulnerabilities in Jenkins (Kevin Guerroudj <kguerroudj@...udbees.com>)
CVE-2026-83525: Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to … (Manikumar <manikumar@...che.org>)
CVE-2026-110952: Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default (Manikumar <manikumar@...che.org>)
CVE-2026-110985: Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint UR… (Manikumar <manikumar@...che.org>)
CVE-2026-111108: Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers (Manikumar <manikumar@...che.org>)
CVE-2026-111073: Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a brok… (Manikumar <manikumar@...che.org>)
CVE-2026-111115: Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request … (Manikumar <manikumar@...che.org>)
CVE-2026-111551: Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation (Manikumar <manikumar@...che.org>)
CVE-2026-111496: Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation (Manikumar <manikumar@...che.org>)
CVE-2026-115644: Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions (Manikumar <manikumar@...che.org>)
CVE-2026-116593: Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint (Manikumar <manikumar@...che.org>)
CVE-2026-112375: Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs (Manikumar <manikumar@...che.org>)
CVE-2026-114349: Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches (Manikumar <manikumar@...che.org>)
CVE-2026-102479: Request smuggling in Eclipse Vert.x HTTP/1.x decoder (Alan Coopersmith <alan.coopersmith@...cle.com>)
HTTP::Body versions before 1.24_01 for Perl (9 CVEs) (Robert Rothenberg <rrwo@...nsec.org>)
MIME-tools versions before 5.521 for Perl (10 CVEs) (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-105031: Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to th… (Andrew Stitcher <astitcher@...che.org>)
CVE-2026-105042: Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash (Andrew Stitcher <astitcher@...che.org>)
CVE-2026-114230: Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames (Andrew Stitcher <astitcher@...che.org>)
CVE-2026-115942: Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read (Andrew Stitcher <astitcher@...che.org>)

October 29 (4 messages)

[OSSA-2026-049] Ironic: Conductor DoS via gzip bomb configdrive (CVE-2026-115638) (Jay Faulkner <jay@....cc>)
[OSSA-2026-050] OpenStack keystonemiddleware: access_rules bypass via X-Service-Token (CVE-2026-115642) (Jeremy Stanley <fungi@...goth.org>)
CVE-2025-60482: GPAC/MP4Box: Heap Use-After-Free in AC-4 Descriptor Cleanup ("Alexander A. Shvedov" <sigdevel@...amail.com>)
CPython [CVE-2026-116566] socket.getaddrinfo() accepts embedded null bytes in host and port (Alan Coopersmith <alan.coopersmith@...cle.com>)

October 30 (18 messages)

Fwd: Protecting against CVE-2026-98432 when using Go programs (Alan Coopersmith <alan.coopersmith@...cle.com>)
Multiple vulnerabilities in Suricata before 8.0.8 (Victor Julien <lists@...iniac.net>)
CVE-2026-115943: Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions… (Stig Palmquist <stig@...g.io>)
CVE-2026-64618: Apache Fineract: SQL injection vulnerability in Search API (Terence Monteiro <terencemo@...che.org>)
CVE-2026-65874: Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints (Terence Monteiro <terencemo@...che.org>)
Re: Protecting against CVE-2026-98432 when using Go programs (John Haxby <john.haxby@...il.com>)
Non-OSS: Claude Code for VS Code extension compromised (Valtteri Vuorikoski <vuori@...com.org>)
CVE-2025-70102: dhcpcd: NULL Pointer Dereference in Configuration Option Parsing ("Alexander A. Shvedov" <sigdevel@...amail.com>)
Re: Non-OSS: Claude Code for VS Code extension compromised (Henri Salo <henri@...v.fi>)
CVE-2026-87768: DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-118988: CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-116130: HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_re… (Robert Rothenberg <rrwo@...nsec.org>)
Starlet versions before 0.33 for Perl (4 CVEs) (Robert Rothenberg <rrwo@...nsec.org>)
Business::GoCardless versions before 1.01 for Perl (3 CVEs) (Robert Rothenberg <rrwo@...nsec.org>)
CallBackery versions before 0.62.0 for Perl (10 CVEs) (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-73322: Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension … (Yash Mayya <yashmayya@...che.org>)
The GNU C Library security advisories update for 2026-10-30 (Adhemerval Zanella Netto <adhemerval.zanella@...aro.org>)
Re: CVE-2026-102508: Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent… (Abhinav Agarwal <abhinavagarwal1996@gma…)

October 31 (5 messages)

Fwd: GNU mtools 4.0.50 released, fixes CVE-2026-118384 (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-120135: Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default (Jens Geyer <jensg@...che.org>)
CVE-2026-118636: Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder (Emmanuel Lécharny <elecharny@...che.org>)
WebDyne for Perl (5 CVEs) (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-98432: init_on_free=1 as an additional interim mitigation (Rui Sousa <c3srm@...dex.com>)

460 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.