Cloudsmith - Repositories - Tetrate (tetrate) - getistio-containers (getistio-containers) - pilot

Package Search Help

You can use boolean logic (e.g. AND/OR/NOT) for complex search queries. For more help and examples, see the search documentation.

Search by package name:
my-package _(implicit)
name:my-package _(explicit)

Search by package filename:
filename:my-package.ext

Search by package tag:
tag:latest

Search by package version:
version:1.0.0 prerelease:true _{(prereleases)}
prerelease:false _{(no prereleases)}

Search by package architecture:
architecture:x86_64

Search by package distribution:
distribution:el

Search by package license:
license:MIT

Search by package format:
format:deb

Search by package status:
status:in_progress

Search by package file checksum:
checksum:5afba

Search by package security status:
severity:critical

Search by package vulnerabilities:
vulnerabilities:>1
vulnerabilities:<1000

Search by # of package downloads:
downloads:>8
downloads:<100

Search by package type:
type:binary
type:source

Search by package size (bytes):
size:>50000
size:<10000

Search by dependency name/version:
dependency:log4j
dependency:log4j=1.0.0
dependency:log4j>1.0.0

Search by uploaded date:
uploaded:>"1 day ago"
uploaded:<"August 14, 2022 EST"

Search by entitlement token (identifier):
entitlement:3lKPVJPosCsY

Search by policy violation:
policy_violated:true
deny_policy_violated:true
license_policy_violated:true
vulnerability_policy_violated:true

Search by repository:
repository:repo-name

Search by last download date:
last_downloaded:<"30 days ago"
last_downloaded:>"August 14, 2022 EST"

Search queries for all Debian-specific (and related) package types

Search by component:
deb_component:unstable

Search queries for all Maven-specific (and related) package types

Search by group ID:
maven_group_id:org.apache

Search queries for all Docker-specific (and related) package types

Search by image digest:
docker_image_digest:sha256:7c5..6d4
(full hashref only)

Search by layer digest:
docker_layer_digest:sha256:4c4..ae4
(full hashref only)

Search queries for all Generic-specific package types

Search by file path:
generic_filepath:path/to/file.txt

Search by directory:
generic_directory:path/to

Field type modifiers (depending on the type, you can influence behaviour)

For all queries, you can use:
~foo for negation

For string queries, you can use:
^foo to anchor to start of term
foo$ to anchor to end of term
foo*bar for fuzzy matching

For number/date or version queries, you can use:
>foo for values greater than
>=foo for values greater / equal
<foo for values less than
<=foo for values less / equal

Need a secure and centralised artifact repository to deliver Alpine, Cargo, CocoaPods, Composer, Conan, Conda, CRAN, Dart, Debian, Docker, Generic, Go, Helm, Hex, HuggingFace, LuaRocks, Maven, MCP, npm, NuGet, P2, Python, RedHat, Ruby, Swift, Terraform, Vagrant, VSX, Raw & More packages?

Cloudsmith is the new standard in Package / Artifact Management and Software Distribution.

With support for all major package formats, you can trust us to manage your software supply chain.

Start My Free Trial

Set Me Up

Public — tetrate (Tetrate) / getistio-containers

Tetrate Istio Distro project (formerly GetIstio) container images registry

pilot 6aa8ecbca5a7aebbe16b594f010…

Download

One-liner (summary)

A certifiably-awesome package curated by Bender Rodriguez, hosted by Cloudsmith.

Description

A certifiably-awesome package curated by Bender Rodriguez, hosted by Cloudsmith.

License

Unknown

Size

74.1 MB

Downloads

Status	Completed
Checksum (MD5)	f92a1b5fadbe42db43f4094a7cd98fae
Checksum (SHA-1)	8bb4f01cf1c723d4dbf3a5b8f97c3c7322641553
Checksum (SHA-256)	6aa8ecbca5a7aebbe16b594f010e2ba8fb66625cb91046ec051fa8a64e7b1d8b
Checksum (SHA-512)	ba26bb8a69bbacd129849b5042608fdc9da00ae2e6f5878fc994606872a5f80f9e…
GPG Signature	Download
GPG Fingerprint	7490c226a7c21a19bb1d09e800b3a57eef287d7b
Storage Region	Dublin, Ireland
Type	Binary (contains binaries and binary artifacts)
Uploaded At	3 months, 2 weeks ago
Uploaded By
Slug Id	pilot-5qs1
Unique Id	bfKaiwHB8nQh
Version (Raw)	6aa8ecbca5a7aebbe16b594f010e2ba8fb66625cb91046ec051fa8a64e7b1d8b
Version (Parsed)	Type: Unknown
	docker-specific metadata
Image Digest	sha256:6aa8ecbca5a7aebbe16b594f010e2ba8fb66625cb91046ec051fa8a64e7b1d8b
Config Digest	sha256:9a57beed3ee08c27c636fdf5b7cc91b4667646a4c0dd30a227f9c859577ad236
V1 OCI Index Digest	sha256:f55f21280a751d0a12b1fe3f08abd244eb5a8fa0f3de4f4b985e3a970e12f632
V1 Distribution (Signed) Digest	sha256:8f1b9ad866301e72f0fbf81e91e38e8e3285f286b6ca47a539a3304bc5b947a7
V1 OCI Digest	sha256:61a4063ee200434cf97576742a213dcc91738cfe1f9b4e3207c69c5a168d3485
V2 Distribution List Digest	sha256:8679f406f1838fc77e6d8739b00b0649dc2cd1dffa3110a18069c6c51a16d890
V1 Distribution Digest	sha256:b4b2980222827d109f08f87de505beb84638d7729092f793c4178ff1bb9f58de
V2 Distribution Digest	sha256:6aa8ecbca5a7aebbe16b594f010e2ba8fb66625cb91046ec051fa8a64e7b1d8b
	extended metadata
Manifest Type	V2 Distribution
Architecture	amd64
Config	Entrypoint /usr/local/bin/pilot-discovery Env PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin User 1337:1337 Working Dir /
Created	2026-04-09 22:02:27 UTC
Os	linux

pilot d15bf603805e21e26ddca5b6b89555bf66fe81b…	image amd64 linux 116.5 MB — 1 week ago	6
pilot e85ed534bbb9e96b32d102e62e0d2aae69d8bbe…	image arm64 linux 31.3 MB — 1 week ago	2
pilot 8a5e4e3bb06ac7b147e6d274c06a48b6eaf96fc…	image arm64 linux 112.1 MB — 1 week ago	1
pilot eb83653f5049b8e79f43b5ff134a0d609b2f495…	image amd64 linux 115.6 MB — 1 week ago	1
pilot fff723598e75f8b1fbc97624e6493ded29a0172…	image amd64 linux 76.4 MB — 1 month ago	1
pilot 894ebe9153911a2a8163deae0af9d8c9b70004f…	image arm64 linux 71.0 MB — 1 month ago	1
pilot 99a4f0a040a6dc8f21946a3dd7a2ad292bf5e22…	image arm64 linux 33.0 MB — 1 month ago	1
pilot ebf8c8d5cbe6de81ba8f02fb1de93f276d47e8a…	image amd64 linux 123.4 MB — 1 month ago	51
pilot a7c06d6750a1b514095affae6c4594490703289…	image arm64 linux 121.9 MB — 1 month ago	23
pilot d88bda3a2117e6f38875937698beed52a867490…	image amd64 linux 35.9 MB — 1 month ago	1
pilot 6aa8ecbca5a7aebbe16b594f010e2ba8fb66625…	image amd64 linux 74.1 MB — 3 months, 2 weeks ago	1
pilot 1b793af58c409a948c8b71c36b0c2a7fdbc3ab1…	image amd64 linux 35.2 MB — 4 days, 2 hours ago	1
pilot 36f25c774c10324f09279504a8818ec8b020691…	image amd64 linux 116.8 MB — 4 days, 2 hours ago	4
pilot 2f30c795b83eb9bfe4217a2a717446ff7b5a4cf…	image arm64 linux 71.0 MB — 6 days, 22 hours ago	1
pilot 0e8d029d2f0c2308abf6bdea47e71afa601881d…	image arm64 linux 33.0 MB — 6 days, 22 hours ago	1
pilot 39dccaaa99dd1a337822410b2e7bcd07c5f684a…	image amd64 linux 117.6 MB — 6 days, 22 hours ago	9
pilot 02ec8208980daf4c2b9023e014bd8d1369c430a…	image amd64 linux 35.9 MB — 1 week ago	1
pilot 592f1c913db3633b31739d9703311e63064f5c1…	image arm64 linux 112.9 MB — 1 week ago	6
pilot 679bcddce98fb2b21d6c81a17f796e84f12fec3…	image amd64 linux 35.0 MB — 1 week ago	1
pilot 475ad423c3654450a276a310582f3a392ca25f7…	image amd64 linux 36.9 MB — 1 month ago	1

Last scanned

3 months, 2 weeks ago

Scan result

Vulnerable

Vulnerability count

Max. severity

High

Target:	bfKaiwHB8nQh.sbom-cyclonedx.json (redhat 9.7)
HIGH	CVE-2026-27135: nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available. Package Name: libnghttp2 Installed Version: 1.43.0-6.el9 Fixed Version: References: www.openwall.com access.redhat.com github.com github.com nvd.nist.gov www.cve.org
HIGH	CVE-2026-35535: sudo: Sudo: Privilege escalation due to failure in privilege drop calls In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation. Package Name: sudo Installed Version: 1.9.5p2-13.el9 Fixed Version: References: access.redhat.com bugs.debian.org bugs.launchpad.net github.com nvd.nist.gov ubuntu.com ubuntu.com ubuntu.com www.cve.org www.qualys.com
MEDIUM	CVE-2025-5278: coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data. Package Name: coreutils-single Installed Version: 8.32-39.el9 Fixed Version: References: www.openwall.com www.openwall.com www.openwall.com access.redhat.com bugzilla.redhat.com cgit.git.savannah.gnu.org cgit.git.savannah.gnu.org nvd.nist.gov security-tracker.debian.org www.cve.org
MEDIUM	CVE-2025-13034: curl: Public key pinning bypass via QUIC and GnuTLS allows server impersonation When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool,curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper check, thus not noticing a possible impostor. To skip this check, the connection had to be done with QUIC with ngtcp2 built to use GnuTLS and the user had to explicitly disable the standard certificate verification. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: access.redhat.com curl.se curl.se nvd.nist.gov ubuntu.com www.cve.org
MEDIUM	CVE-2025-14017: curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se nvd.nist.gov ubuntu.com ubuntu.com www.cve.org
MEDIUM	CVE-2026-1965: curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. One underlying reason being that Negotiate sometimes authenticates connections and not requests, contrary to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second request wrongly reused the same connection and since it then sees that the Negotiate negotiation is already made, it just sends the request over that connection thinking it uses the user2 credentials when it is in fact still using the connection authenticated for user1... The set of authentication methods to use is set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus mitigate this problem, by using one of the following libcurl options to alter how connections are or are not reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the curl_multi API). Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: access.redhat.com curl.se curl.se nvd.nist.gov ubuntu.com ubuntu.com www.cve.org
MEDIUM	CVE-2026-3783: curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org
MEDIUM	CVE-2026-3784: curl: curl: Unauthorized access due to improper HTTP proxy connection reuse curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org
MEDIUM	CVE-2026-3805: curl: curl: Arbitrary code execution or Denial of Service via use-after-free in SMB request handling When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com www.cve.org
MEDIUM	CVE-2026-4046: glibc: glibc: Denial of Service via iconv() function with specific character sets The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them. Package Name: glibc Installed Version: 2.34-231.el9_7.10 Fixed Version: References: access.redhat.com nvd.nist.gov packages.fedoraproject.org sourceware.org sourceware.org www.cve.org
MEDIUM	CVE-2026-4437: glibc: glibc: Incorrect DNS response parsing via crafted DNS server response Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer. Package Name: glibc Installed Version: 2.34-231.el9_7.10 Fixed Version: References: access.redhat.com nvd.nist.gov sourceware.org www.cve.org
MEDIUM	CVE-2026-4046: glibc: glibc: Denial of Service via iconv() function with specific character sets The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them. Package Name: glibc-common Installed Version: 2.34-231.el9_7.10 Fixed Version: References: access.redhat.com nvd.nist.gov packages.fedoraproject.org sourceware.org sourceware.org www.cve.org
MEDIUM	CVE-2026-4437: glibc: glibc: Incorrect DNS response parsing via crafted DNS server response Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer. Package Name: glibc-common Installed Version: 2.34-231.el9_7.10 Fixed Version: References: access.redhat.com nvd.nist.gov sourceware.org www.cve.org
MEDIUM	CVE-2026-4046: glibc: glibc: Denial of Service via iconv() function with specific character sets The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them. Package Name: glibc-minimal-langpack Installed Version: 2.34-231.el9_7.10 Fixed Version: References: access.redhat.com nvd.nist.gov packages.fedoraproject.org sourceware.org sourceware.org www.cve.org
MEDIUM	CVE-2026-4437: glibc: glibc: Incorrect DNS response parsing via crafted DNS server response Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer. Package Name: glibc-minimal-langpack Installed Version: 2.34-231.el9_7.10 Fixed Version: References: access.redhat.com nvd.nist.gov sourceware.org www.cve.org
MEDIUM	CVE-2025-13034: curl: Public key pinning bypass via QUIC and GnuTLS allows server impersonation When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool,curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper check, thus not noticing a possible impostor. To skip this check, the connection had to be done with QUIC with ngtcp2 built to use GnuTLS and the user had to explicitly disable the standard certificate verification. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: access.redhat.com curl.se curl.se nvd.nist.gov ubuntu.com www.cve.org
MEDIUM	CVE-2025-14017: curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se nvd.nist.gov ubuntu.com ubuntu.com www.cve.org
MEDIUM	CVE-2026-1965: curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. One underlying reason being that Negotiate sometimes authenticates connections and not requests, contrary to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second request wrongly reused the same connection and since it then sees that the Negotiate negotiation is already made, it just sends the request over that connection thinking it uses the user2 credentials when it is in fact still using the connection authenticated for user1... The set of authentication methods to use is set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus mitigate this problem, by using one of the following libcurl options to alter how connections are or are not reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the curl_multi API). Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: access.redhat.com curl.se curl.se nvd.nist.gov ubuntu.com ubuntu.com www.cve.org
MEDIUM	CVE-2026-3783: curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org
MEDIUM	CVE-2026-3784: curl: curl: Unauthorized access due to improper HTTP proxy connection reuse curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org
MEDIUM	CVE-2026-3805: curl: curl: Arbitrary code execution or Denial of Service via use-after-free in SMB request handling When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com www.cve.org
MEDIUM	CVE-2025-5351: libssh: Double Free Vulnerability in libssh Key Export Functions A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed. Package Name: libssh Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com bugzilla.redhat.com nvd.nist.gov ubuntu.com www.cve.org www.libssh.org
MEDIUM	CVE-2025-5372: libssh: Incorrect Return Code Handling in ssh_kdf() in libssh A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability. Package Name: libssh Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov ubuntu.com www.cve.org www.libssh.org
MEDIUM	CVE-2025-8114: libssh: NULL Pointer Dereference in libssh KEX Session ID Calculation A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash. Package Name: libssh Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com bugzilla.redhat.com git.libssh.org git.libssh.org nvd.nist.gov ubuntu.com www.cve.org www.libssh.org
MEDIUM	CVE-2026-0964: libssh: Improper sanitation of paths received from SCP servers A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences. This is the same issue as in OpenSSH, tracked as CVE-2019-6111. Package Name: libssh Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com bugzilla.redhat.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org www.libssh.org
MEDIUM	CVE-2026-0966: libssh: Buffer underflow in ssh_get_hexa() on invalid input The API function `ssh_get_hexa()` is vulnerable, when 0-lenght input is provided to this function. This function is used internally in `ssh_get_fingerprint_hash()` and `ssh_print_hexa()` (deprecated), which is vulnerable to the same input (length is provided by the calling application). The function is also used internally in the gssapi code for logging the OIDs received by the server during GSSAPI authentication. This could be triggered remotely, when the server allows GSSAPI authentication and logging verbosity is set at least to SSH_LOG_PACKET (3). This could cause self-DoS of the per-connection daemon process. Package Name: libssh Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com bugzilla.redhat.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org www.libssh.org
MEDIUM	CVE-2026-3731: libssh: libssh: Denial of Service via out-of-bounds read in SFTP extension name handler A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component. Package Name: libssh Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com gitlab.com nvd.nist.gov ubuntu.com vuldb.com vuldb.com vuldb.com www.cve.org www.libssh.org www.libssh.org
MEDIUM	CVE-2025-5351: libssh: Double Free Vulnerability in libssh Key Export Functions A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed. Package Name: libssh-config Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com bugzilla.redhat.com nvd.nist.gov ubuntu.com www.cve.org www.libssh.org
MEDIUM	CVE-2025-5372: libssh: Incorrect Return Code Handling in ssh_kdf() in libssh A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability. Package Name: libssh-config Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov ubuntu.com www.cve.org www.libssh.org
MEDIUM	CVE-2025-8114: libssh: NULL Pointer Dereference in libssh KEX Session ID Calculation A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash. Package Name: libssh-config Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com bugzilla.redhat.com git.libssh.org git.libssh.org nvd.nist.gov ubuntu.com www.cve.org www.libssh.org
MEDIUM	CVE-2026-0964: libssh: Improper sanitation of paths received from SCP servers A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences. This is the same issue as in OpenSSH, tracked as CVE-2019-6111. Package Name: libssh-config Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com bugzilla.redhat.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org www.libssh.org
MEDIUM	CVE-2026-0966: libssh: Buffer underflow in ssh_get_hexa() on invalid input The API function `ssh_get_hexa()` is vulnerable, when 0-lenght input is provided to this function. This function is used internally in `ssh_get_fingerprint_hash()` and `ssh_print_hexa()` (deprecated), which is vulnerable to the same input (length is provided by the calling application). The function is also used internally in the gssapi code for logging the OIDs received by the server during GSSAPI authentication. This could be triggered remotely, when the server allows GSSAPI authentication and logging verbosity is set at least to SSH_LOG_PACKET (3). This could cause self-DoS of the per-connection daemon process. Package Name: libssh-config Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com bugzilla.redhat.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org www.libssh.org
MEDIUM	CVE-2026-3731: libssh: libssh: Denial of Service via out-of-bounds read in SFTP extension name handler A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component. Package Name: libssh-config Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com gitlab.com nvd.nist.gov ubuntu.com vuldb.com vuldb.com vuldb.com www.cve.org www.libssh.org www.libssh.org
MEDIUM	CVE-2026-22185: OpenLDAP: OpenLDAP LMDB: Denial of Service and Information Disclosure via Heap Buffer Underflow OpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and including 0.9.14, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition. Package Name: openldap Installed Version: 2.6.8-4.el9 Fixed Version: References: access.redhat.com bugs.openldap.org nvd.nist.gov seclists.org seclists.org www.cve.org www.openldap.org www.vulncheck.com
MEDIUM	CVE-2026-28390: openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. Package Name: openssl Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: access.redhat.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com www.cve.org www.openwall.com
MEDIUM	CVE-2026-31790: openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result, if RSA encryption fails, encapsulation can still return success to the caller, set the output lengths, and leave the caller to use the contents of the ciphertext buffer as if a valid KEM ciphertext had been produced. If applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an attacker-supplied invalid RSA public key without first validating that key, then this may cause stale or uninitialized contents of the caller-provided ciphertext buffer to be disclosed to the attacker in place of the KEM ciphertext. As a workaround calling EVP_PKEY_public_check() or EVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate the issue. The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue. Package Name: openssl Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: access.redhat.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com www.cve.org www.openwall.com
MEDIUM	CVE-2026-28390: openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. Package Name: openssl-libs Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: access.redhat.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com www.cve.org www.openwall.com
MEDIUM	CVE-2026-31790: openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result, if RSA encryption fails, encapsulation can still return success to the caller, set the output lengths, and leave the caller to use the contents of the ciphertext buffer as if a valid KEM ciphertext had been produced. If applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an attacker-supplied invalid RSA public key without first validating that key, then this may cause stale or uninitialized contents of the caller-provided ciphertext buffer to be disclosed to the attacker in place of the KEM ciphertext. As a workaround calling EVP_PKEY_public_check() or EVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate the issue. The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue. Package Name: openssl-libs Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: access.redhat.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com www.cve.org www.openwall.com
MEDIUM	CVE-2026-2100: p11-kit: p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states. Package Name: p11-kit Installed Version: 0.25.3-3.el9_5 Fixed Version: References: access.redhat.com bugzilla.redhat.com github.com nvd.nist.gov www.cve.org
MEDIUM	CVE-2026-2100: p11-kit: p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states. Package Name: p11-kit-trust Installed Version: 0.25.3-3.el9_5 Fixed Version: References: access.redhat.com bugzilla.redhat.com github.com nvd.nist.gov www.cve.org
LOW	CVE-2024-11053: curl: curl netrc password leak When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com curl.se curl.se cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org hackerone.com linux.oracle.com linux.oracle.com nvd.nist.gov security.netapp.com security.netapp.com security.netapp.com ubuntu.com www.cve.org www.oracle.com
LOW	CVE-2024-7264: curl: libcurl: ASN.1 date parser overread libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the time fraction, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com curl.se curl.se cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com hackerone.com linux.oracle.com linux.oracle.com nvd.nist.gov security.netapp.com security.netapp.com security.netapp.com ubuntu.com ubuntu.com www.cve.org www.oracle.com
LOW	CVE-2024-9681: curl: HSTS subdomain overwrites parent cache entry When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is a subdomain of the second host. (The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS accesses done as the cache needs to have entries for the domains involved to trigger this problem.) When `x.example.com` responds with `Strict-Transport-Security:` headers, this bug can make the subdomain's expiry timeout bleed over and get set for the parent domain `example.com` in curl's HSTS cache. The result of a triggered bug is that HTTP accesses to `example.com` get converted to HTTPS for a different period of time than what was asked for by the origin server. If `example.com` for example stops supporting HTTPS at its expiry time, curl might then fail to access `http://example.com` until the (wrongly set) timeout expires. This bug can also expire the parent's entry earlier, thus making curl inadvertently switch back to insecure HTTP earlier than otherwise intended. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: seclists.org seclists.org seclists.org seclists.org seclists.org seclists.org seclists.org seclists.org www.openwall.com access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov security.netapp.com ubuntu.com www.cve.org
LOW	CVE-2025-14524: curl: Information disclosure via cross-protocol redirect with OAuth2 bearer token When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com www.cve.org
LOW	CVE-2025-14819: curl: libcurl: Improper certificate validation due to cached TLS settings reuse When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se nvd.nist.gov ubuntu.com www.cve.org
LOW	CVE-2025-15079: curl: Host verification bypass during SSH transfers When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org
LOW	CVE-2025-15224: curl: libssh key passphrase bypass without agent set When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org
LOW	CVE-2024-25260: elfutils: global-buffer-overflow exists in the function ebl_machine_flag_name in eblmachineflagname.c elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c. Package Name: elfutils-libelf Installed Version: 0.193-1.el9 Fixed Version: References: access.redhat.com github.com nvd.nist.gov sourceware.org sourceware.org ubuntu.com www.cve.org
LOW	CVE-2025-1371: elfutils: GNU elfutils eu-read readelf.c handle_dynamic_symtab null pointer dereference A vulnerability has been found in GNU elfutils 0.192 and classified as problematic. This vulnerability affects the function handle_dynamic_symtab of the file readelf.c of the component eu-read. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is identified as b38e562a4c907e08171c76b8b2def8464d5a104a. It is recommended to apply a patch to fix this issue. Package Name: elfutils-libelf Installed Version: 0.193-1.el9 Fixed Version: References: access.redhat.com nvd.nist.gov sourceware.org sourceware.org sourceware.org ubuntu.com vuldb.com vuldb.com vuldb.com www.cve.org www.gnu.org
LOW	CVE-2025-1376: elfutils: GNU elfutils eu-strip elf_strptr.c elf_strptr denial of service A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue. Package Name: elfutils-libelf Installed Version: 0.193-1.el9 Fixed Version: References: access.redhat.com nvd.nist.gov sourceware.org sourceware.org sourceware.org vuldb.com vuldb.com vuldb.com www.cve.org www.gnu.org
LOW	CVE-2025-1377: elfutils: GNU elfutils eu-strip strip.c gelf_getsymshndx denial of service A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is recommended to apply a patch to fix this issue. Package Name: elfutils-libelf Installed Version: 0.193-1.el9 Fixed Version: References: access.redhat.com nvd.nist.gov sourceware.org sourceware.org sourceware.org ubuntu.com vuldb.com vuldb.com vuldb.com www.cve.org www.gnu.org
LOW	CVE-2023-4156: gawk: heap out of bound read in builtin.c A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information. Package Name: gawk Installed Version: 5.1.0-6.el9 Fixed Version: References: access.redhat.com bugzilla.redhat.com git.savannah.gnu.org mail.gnu.org mail.gnu.org nvd.nist.gov ubuntu.com www.cve.org
LOW	CVE-2026-4438: glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification. Package Name: glibc Installed Version: 2.34-231.el9_7.10 Fixed Version: References: access.redhat.com nvd.nist.gov sourceware.org www.cve.org
LOW	CVE-2026-4438: glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification. Package Name: glibc-common Installed Version: 2.34-231.el9_7.10 Fixed Version: References: access.redhat.com nvd.nist.gov sourceware.org www.cve.org
LOW	CVE-2026-4438: glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification. Package Name: glibc-minimal-langpack Installed Version: 2.34-231.el9_7.10 Fixed Version: References: access.redhat.com nvd.nist.gov sourceware.org www.cve.org
LOW	CVE-2024-11053: curl: curl netrc password leak When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com curl.se curl.se cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org hackerone.com linux.oracle.com linux.oracle.com nvd.nist.gov security.netapp.com security.netapp.com security.netapp.com ubuntu.com www.cve.org www.oracle.com
LOW	CVE-2024-7264: curl: libcurl: ASN.1 date parser overread libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the time fraction, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com curl.se curl.se cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com hackerone.com linux.oracle.com linux.oracle.com nvd.nist.gov security.netapp.com security.netapp.com security.netapp.com ubuntu.com ubuntu.com www.cve.org www.oracle.com
LOW	CVE-2024-9681: curl: HSTS subdomain overwrites parent cache entry When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is a subdomain of the second host. (The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS accesses done as the cache needs to have entries for the domains involved to trigger this problem.) When `x.example.com` responds with `Strict-Transport-Security:` headers, this bug can make the subdomain's expiry timeout bleed over and get set for the parent domain `example.com` in curl's HSTS cache. The result of a triggered bug is that HTTP accesses to `example.com` get converted to HTTPS for a different period of time than what was asked for by the origin server. If `example.com` for example stops supporting HTTPS at its expiry time, curl might then fail to access `http://example.com` until the (wrongly set) timeout expires. This bug can also expire the parent's entry earlier, thus making curl inadvertently switch back to insecure HTTP earlier than otherwise intended. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: seclists.org seclists.org seclists.org seclists.org seclists.org seclists.org seclists.org seclists.org www.openwall.com access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov security.netapp.com ubuntu.com www.cve.org
LOW	CVE-2025-14524: curl: Information disclosure via cross-protocol redirect with OAuth2 bearer token When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com www.cve.org
LOW	CVE-2025-14819: curl: libcurl: Improper certificate validation due to cached TLS settings reuse When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. This could make libcurl find and accept a trust chain that it otherwise would not. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se nvd.nist.gov ubuntu.com www.cve.org
LOW	CVE-2025-15079: curl: Host verification bypass during SSH transfers When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org
LOW	CVE-2025-15224: curl: libssh key passphrase bypass without agent set When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org
LOW	CVE-2022-27943: binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new. Package Name: libgcc Installed Version: 11.5.0-11.el9 Fixed Version: References: access.redhat.com gcc.gnu.org gcc.gnu.org gcc.gnu.org gcc.gnu.org gcc.gnu.org lists.fedoraproject.org nvd.nist.gov sourceware.org www.cve.org
LOW	CVE-2025-11961: libpcap: libpcap: Memory corruption via malformed MAC-48 address input pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer. Package Name: libpcap Installed Version: 14:1.10.0-4.el9 Fixed Version: References: access.redhat.com github.com nvd.nist.gov www.cve.org
LOW	CVE-2025-4878: libssh: Use of uninitialized variable in privatekey_from_file() A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption. Package Name: libssh Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com bugzilla.redhat.com git.libssh.org git.libssh.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org
LOW	CVE-2025-8277: libssh: Memory Exhaustion via Repeated Key Exchange in libssh A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability. Package Name: libssh Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com bugzilla.redhat.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org
LOW	CVE-2026-0965: libssh: libssh: Denial of Service via improper configuration file handling A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations. Package Name: libssh Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com bugzilla.redhat.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org
LOW	CVE-2026-0967: libssh: libssh: Denial of Service via inefficient regular expression processing A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the `match_pattern()` function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client. Package Name: libssh Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com bugzilla.redhat.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org www.libssh.org
LOW	CVE-2026-0968: libssh: libssh: Denial of Service due to malformed SFTP message A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes. Package Name: libssh Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com bugzilla.redhat.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org www.libssh.org
LOW	CVE-2025-4878: libssh: Use of uninitialized variable in privatekey_from_file() A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption. Package Name: libssh-config Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com bugzilla.redhat.com git.libssh.org git.libssh.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org
LOW	CVE-2025-8277: libssh: Memory Exhaustion via Repeated Key Exchange in libssh A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability. Package Name: libssh-config Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com bugzilla.redhat.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org
LOW	CVE-2026-0965: libssh: libssh: Denial of Service via improper configuration file handling A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations. Package Name: libssh-config Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com bugzilla.redhat.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org
LOW	CVE-2026-0967: libssh: libssh: Denial of Service via inefficient regular expression processing A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the `match_pattern()` function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client. Package Name: libssh-config Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com bugzilla.redhat.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org www.libssh.org
LOW	CVE-2026-0968: libssh: libssh: Denial of Service due to malformed SFTP message A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes. Package Name: libssh-config Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com bugzilla.redhat.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org www.libssh.org
LOW	CVE-2025-13151: libtasn1: libtasn1: Denial of Service via stack-based buffer overflow in asn1_expend_octet_string Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string. Package Name: libtasn1 Installed Version: 4.16.0-9.el9 Fixed Version: References: www.openwall.com access.redhat.com gitlab.com gitlab.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.kb.cert.org
LOW	CVE-2023-50495: ncurses: segmentation fault via _nc_wrap_entry() NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry(). Package Name: ncurses-base Installed Version: 6.2-12.20210508.el9 Fixed Version: References: access.redhat.com lists.fedoraproject.org lists.fedoraproject.org lists.gnu.org lists.gnu.org nvd.nist.gov security.netapp.com ubuntu.com www.cve.org
LOW	CVE-2023-50495: ncurses: segmentation fault via _nc_wrap_entry() NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry(). Package Name: ncurses-libs Installed Version: 6.2-12.20210508.el9 Fixed Version: References: access.redhat.com lists.fedoraproject.org lists.fedoraproject.org lists.gnu.org lists.gnu.org nvd.nist.gov security.netapp.com ubuntu.com www.cve.org
LOW	CVE-2024-13176: openssl: Timing side-channel in ECDSA signature computation Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low. The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue. Package Name: openssl Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.openssl.org github.openssl.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov openssl-library.org security.netapp.com security.netapp.com security.netapp.com ubuntu.com ubuntu.com ubuntu.com www.cve.org www.oracle.com
LOW	CVE-2024-41996: openssl: remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key. Package Name: openssl Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: access.redhat.com dheatattack.gitlab.io dheatattack.gitlab.io gist.github.com github.com nvd.nist.gov openssl-library.org www.cve.org
LOW	CVE-2025-9232: openssl: Out-of-bounds read in HTTP client no_proxy handling Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary. Package Name: openssl Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: www.openwall.com access.redhat.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org
LOW	CVE-2026-2673: openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defer their use until specifically requested by the server. If an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to interpolate the built-in default group list into its own configuration, perhaps adding or removing specific elements, then an implementation defect causes the 'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups were treated as a single sufficiently secure 'tuple', with the server not sending a Hello Retry Request (HRR) even when a group in a more preferred tuple was mutually supported. As a result, the client and server might fail to negotiate a mutually supported post-quantum key agreement group, such as 'X25519MLKEM768', if the client's configuration results in only 'classical' groups (such as 'X25519' being the only ones in the client's initial keyshare prediction). OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS 1.3 key agreement group on TLS servers. The old syntax had a single 'flat' list of groups, and treated all the supported groups as sufficiently secure. If any of the keyshares predicted by the client were supported by the server the most preferred among these was selected, even if other groups supported by the client, but not included in the list of predicted keyshares would have been more preferred, if included. The new syntax partitions the groups into distinct 'tuples' of roughly equivalent security. Within each tuple the most preferred group included among the client's predicted keyshares is chosen, but if the client supports a group from a more preferred tuple, but did not predict any corresponding keyshares, the server will ask the client to retry the ClientHello (by issuing a Hello Retry Request or HRR) with the most preferred mutually supported group. The above works as expected when the server's configuration uses the built-in default group list, or explicitly defines its own list by directly defining the various desired groups and group 'tuples'. No OpenSSL FIPS modules are affected by this issue, the code in question lies outside the FIPS boundary. OpenSSL 3.6 and 3.5 are vulnerable to this issue. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released. OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue. Package Name: openssl Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: www.openwall.com access.redhat.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com www.cve.org
LOW	CVE-2026-2673: openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defer their use until specifically requested by the server. If an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to interpolate the built-in default group list into its own configuration, perhaps adding or removing specific elements, then an implementation defect causes the 'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups were treated as a single sufficiently secure 'tuple', with the server not sending a Hello Retry Request (HRR) even when a group in a more preferred tuple was mutually supported. As a result, the client and server might fail to negotiate a mutually supported post-quantum key agreement group, such as 'X25519MLKEM768', if the client's configuration results in only 'classical' groups (such as 'X25519' being the only ones in the client's initial keyshare prediction). OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS 1.3 key agreement group on TLS servers. The old syntax had a single 'flat' list of groups, and treated all the supported groups as sufficiently secure. If any of the keyshares predicted by the client were supported by the server the most preferred among these was selected, even if other groups supported by the client, but not included in the list of predicted keyshares would have been more preferred, if included. The new syntax partitions the groups into distinct 'tuples' of roughly equivalent security. Within each tuple the most preferred group included among the client's predicted keyshares is chosen, but if the client supports a group from a more preferred tuple, but did not predict any corresponding keyshares, the server will ask the client to retry the ClientHello (by issuing a Hello Retry Request or HRR) with the most preferred mutually supported group. The above works as expected when the server's configuration uses the built-in default group list, or explicitly defines its own list by directly defining the various desired groups and group 'tuples'. No OpenSSL FIPS modules are affected by this issue, the code in question lies outside the FIPS boundary. OpenSSL 3.6 and 3.5 are vulnerable to this issue. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released. OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue. Package Name: openssl-fips-provider Installed Version: 3.0.7-8.el9 Fixed Version: References: www.openwall.com access.redhat.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com www.cve.org
LOW	CVE-2026-2673: openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defer their use until specifically requested by the server. If an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to interpolate the built-in default group list into its own configuration, perhaps adding or removing specific elements, then an implementation defect causes the 'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups were treated as a single sufficiently secure 'tuple', with the server not sending a Hello Retry Request (HRR) even when a group in a more preferred tuple was mutually supported. As a result, the client and server might fail to negotiate a mutually supported post-quantum key agreement group, such as 'X25519MLKEM768', if the client's configuration results in only 'classical' groups (such as 'X25519' being the only ones in the client's initial keyshare prediction). OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS 1.3 key agreement group on TLS servers. The old syntax had a single 'flat' list of groups, and treated all the supported groups as sufficiently secure. If any of the keyshares predicted by the client were supported by the server the most preferred among these was selected, even if other groups supported by the client, but not included in the list of predicted keyshares would have been more preferred, if included. The new syntax partitions the groups into distinct 'tuples' of roughly equivalent security. Within each tuple the most preferred group included among the client's predicted keyshares is chosen, but if the client supports a group from a more preferred tuple, but did not predict any corresponding keyshares, the server will ask the client to retry the ClientHello (by issuing a Hello Retry Request or HRR) with the most preferred mutually supported group. The above works as expected when the server's configuration uses the built-in default group list, or explicitly defines its own list by directly defining the various desired groups and group 'tuples'. No OpenSSL FIPS modules are affected by this issue, the code in question lies outside the FIPS boundary. OpenSSL 3.6 and 3.5 are vulnerable to this issue. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released. OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue. Package Name: openssl-fips-provider-so Installed Version: 3.0.7-8.el9 Fixed Version: References: www.openwall.com access.redhat.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com www.cve.org
LOW	CVE-2024-13176: openssl: Timing side-channel in ECDSA signature computation Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low. The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue. Package Name: openssl-libs Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.openssl.org github.openssl.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov openssl-library.org security.netapp.com security.netapp.com security.netapp.com ubuntu.com ubuntu.com ubuntu.com www.cve.org www.oracle.com
LOW	CVE-2024-41996: openssl: remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key. Package Name: openssl-libs Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: access.redhat.com dheatattack.gitlab.io dheatattack.gitlab.io gist.github.com github.com nvd.nist.gov openssl-library.org www.cve.org
LOW	CVE-2025-9232: openssl: Out-of-bounds read in HTTP client no_proxy handling Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary. Package Name: openssl-libs Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: www.openwall.com access.redhat.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org
LOW	CVE-2026-2673: openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defer their use until specifically requested by the server. If an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to interpolate the built-in default group list into its own configuration, perhaps adding or removing specific elements, then an implementation defect causes the 'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups were treated as a single sufficiently secure 'tuple', with the server not sending a Hello Retry Request (HRR) even when a group in a more preferred tuple was mutually supported. As a result, the client and server might fail to negotiate a mutually supported post-quantum key agreement group, such as 'X25519MLKEM768', if the client's configuration results in only 'classical' groups (such as 'X25519' being the only ones in the client's initial keyshare prediction). OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS 1.3 key agreement group on TLS servers. The old syntax had a single 'flat' list of groups, and treated all the supported groups as sufficiently secure. If any of the keyshares predicted by the client were supported by the server the most preferred among these was selected, even if other groups supported by the client, but not included in the list of predicted keyshares would have been more preferred, if included. The new syntax partitions the groups into distinct 'tuples' of roughly equivalent security. Within each tuple the most preferred group included among the client's predicted keyshares is chosen, but if the client supports a group from a more preferred tuple, but did not predict any corresponding keyshares, the server will ask the client to retry the ClientHello (by issuing a Hello Retry Request or HRR) with the most preferred mutually supported group. The above works as expected when the server's configuration uses the built-in default group list, or explicitly defines its own list by directly defining the various desired groups and group 'tuples'. No OpenSSL FIPS modules are affected by this issue, the code in question lies outside the FIPS boundary. OpenSSL 3.6 and 3.5 are vulnerable to this issue. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released. OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue. Package Name: openssl-libs Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: www.openwall.com access.redhat.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com www.cve.org
LOW	CVE-2022-41409: pcre2: negative repeat value in a pcre2test subject line leads to inifinite loop Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input. Package Name: pcre2 Installed Version: 10.40-6.el9 Fixed Version: References: access.redhat.com github.com github.com github.com nvd.nist.gov www.cve.org
LOW	CVE-2022-41409: pcre2: negative repeat value in a pcre2test subject line leads to inifinite loop Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input. Package Name: pcre2-syntax Installed Version: 10.40-6.el9 Fixed Version: References: access.redhat.com github.com github.com github.com nvd.nist.gov www.cve.org
LOW	CVE-2026-27171: zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition. Package Name: zlib Installed Version: 1.2.11-40.el9 Fixed Version: References: 7asecurity.com 7asecurity.com access.redhat.com github.com github.com nvd.nist.gov ostif.org www.cve.org

Package statistics are no longer available on cloudsmith.io. Please visit our new web app to access this feature.

These instructions assume you have setup the repository first (or read it).

To pull pilot @ reference/tag sha256:6aa8ecbca5a7aebbe16b594f010e2ba8fb66625cb91046ec051fa8a64e7b1d8b:

docker pull containers.istio.tetratelabs.com/pilot@sha256:6aa8ecbca5a7aebbe16b594f010e2ba8fb66625cb91046ec051fa8a64e7b1d8b

You can also pull the latest version of this image (if it exists):

docker pull containers.istio.tetratelabs.com/pilot:latest

To refer to this image after pulling in a Dockerfile, specify the following:

FROM containers.istio.tetratelabs.com/pilot@sha256:6aa8ecbca5a7aebbe16b594f010e2ba8fb66625cb91046ec051fa8a64e7b1d8b

Still stuck? Need help? Don't panic. Just contact us for help (even if you're not a customer).

Previous Version: 1b793af58c409a948c8…

Next Version: d88bda3a2117e6f3887…

	Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4 Command: ARG MICRO	32 bytes
	Digest: sha256:b584ae130cd863932d63706ad8c55f0f31bb85b263bba07cd6a7910788b533cd Command: COPY /micro . # buildkit	39.8 MB
	Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4 Command: ARG TARGETARCH	32 bytes
	Digest: sha256:caded015307d47e17f8c034736b0087e3de10de82afd9128f2941b548821c432 Command: COPY amd64/pilot-discovery /usr/local/bin/pilot-discovery # buildkit	34.3 MB
	Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4 Command: USER 1337:1337	32 bytes
	Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4 Command: ENTRYPOINT ["/usr/local/bin/pilot-discovery"]	32 bytes

pilot 6aa8ecbca5a7aebbe16b594f010…

One-liner (summary)

Description

License

Size

Downloads

Tags

Last scanned

Scan result

Vulnerability count

Max. severity

CVE-2026-27135: nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination

CVE-2026-35535: sudo: Sudo: Privilege escalation due to failure in privilege drop calls

CVE-2025-5278: coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification

CVE-2025-13034: curl: Public key pinning bypass via QUIC and GnuTLS allows server impersonation

CVE-2025-14017: curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers

CVE-2026-1965: curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication

CVE-2026-3783: curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect

CVE-2026-3784: curl: curl: Unauthorized access due to improper HTTP proxy connection reuse

CVE-2026-3805: curl: curl: Arbitrary code execution or Denial of Service via use-after-free in SMB request handling

CVE-2026-4046: glibc: glibc: Denial of Service via iconv() function with specific character sets

CVE-2026-4437: glibc: glibc: Incorrect DNS response parsing via crafted DNS server response

CVE-2026-4046: glibc: glibc: Denial of Service via iconv() function with specific character sets

CVE-2026-4437: glibc: glibc: Incorrect DNS response parsing via crafted DNS server response

CVE-2026-4046: glibc: glibc: Denial of Service via iconv() function with specific character sets

CVE-2026-4437: glibc: glibc: Incorrect DNS response parsing via crafted DNS server response

CVE-2025-13034: curl: Public key pinning bypass via QUIC and GnuTLS allows server impersonation

CVE-2025-14017: curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers

CVE-2026-1965: curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication

CVE-2026-3783: curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect

CVE-2026-3784: curl: curl: Unauthorized access due to improper HTTP proxy connection reuse

CVE-2026-3805: curl: curl: Arbitrary code execution or Denial of Service via use-after-free in SMB request handling

CVE-2025-5351: libssh: Double Free Vulnerability in libssh Key Export Functions

CVE-2025-5372: libssh: Incorrect Return Code Handling in ssh_kdf() in libssh

CVE-2025-8114: libssh: NULL Pointer Dereference in libssh KEX Session ID Calculation

CVE-2026-0964: libssh: Improper sanitation of paths received from SCP servers

CVE-2026-0966: libssh: Buffer underflow in ssh_get_hexa() on invalid input

CVE-2026-3731: libssh: libssh: Denial of Service via out-of-bounds read in SFTP extension name handler

CVE-2025-5351: libssh: Double Free Vulnerability in libssh Key Export Functions

CVE-2025-5372: libssh: Incorrect Return Code Handling in ssh_kdf() in libssh

CVE-2025-8114: libssh: NULL Pointer Dereference in libssh KEX Session ID Calculation

CVE-2026-0964: libssh: Improper sanitation of paths received from SCP servers

CVE-2026-0966: libssh: Buffer underflow in ssh_get_hexa() on invalid input

CVE-2026-3731: libssh: libssh: Denial of Service via out-of-bounds read in SFTP extension name handler

CVE-2026-22185: OpenLDAP: OpenLDAP LMDB: Denial of Service and Information Disclosure via Heap Buffer Underflow

CVE-2026-28390: openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing

CVE-2026-31790: openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key

CVE-2026-28390: openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing

CVE-2026-31790: openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key

CVE-2026-2100: p11-kit: p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters

CVE-2026-2100: p11-kit: p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters

CVE-2024-11053: curl: curl netrc password leak

CVE-2024-7264: curl: libcurl: ASN.1 date parser overread

CVE-2024-9681: curl: HSTS subdomain overwrites parent cache entry

CVE-2025-14524: curl: Information disclosure via cross-protocol redirect with OAuth2 bearer token

CVE-2025-14819: curl: libcurl: Improper certificate validation due to cached TLS settings reuse

CVE-2025-15079: curl: Host verification bypass during SSH transfers

CVE-2025-15224: curl: libssh key passphrase bypass without agent set

CVE-2024-25260: elfutils: global-buffer-overflow exists in the function ebl_machine_flag_name in eblmachineflagname.c

CVE-2025-1371: elfutils: GNU elfutils eu-read readelf.c handle_dynamic_symtab null pointer dereference

CVE-2025-1376: elfutils: GNU elfutils eu-strip elf_strptr.c elf_strptr denial of service

CVE-2025-1377: elfutils: GNU elfutils eu-strip strip.c gelf_getsymshndx denial of service

CVE-2023-4156: gawk: heap out of bound read in builtin.c

CVE-2026-4438: glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions

CVE-2026-4438: glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions

CVE-2026-4438: glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions

CVE-2024-11053: curl: curl netrc password leak

CVE-2024-7264: curl: libcurl: ASN.1 date parser overread

CVE-2024-9681: curl: HSTS subdomain overwrites parent cache entry

CVE-2025-14524: curl: Information disclosure via cross-protocol redirect with OAuth2 bearer token

CVE-2025-14819: curl: libcurl: Improper certificate validation due to cached TLS settings reuse

CVE-2025-15079: curl: Host verification bypass during SSH transfers

CVE-2025-15224: curl: libssh key passphrase bypass without agent set

CVE-2022-27943: binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const

CVE-2025-11961: libpcap: libpcap: Memory corruption via malformed MAC-48 address input

CVE-2025-4878: libssh: Use of uninitialized variable in privatekey_from_file()

CVE-2025-8277: libssh: Memory Exhaustion via Repeated Key Exchange in libssh

CVE-2026-0965: libssh: libssh: Denial of Service via improper configuration file handling

CVE-2026-0967: libssh: libssh: Denial of Service via inefficient regular expression processing

CVE-2026-0968: libssh: libssh: Denial of Service due to malformed SFTP message