Cloudsmith - Repositories - Tetrate (tetrate) - getistio-containers (getistio-containers) - pilot

Package Search Help

You can use boolean logic (e.g. AND/OR/NOT) for complex search queries. For more help and examples, see the search documentation.

Search by package name:
my-package _(implicit)
name:my-package _(explicit)

Search by package filename:
filename:my-package.ext

Search by package tag:
tag:latest

Search by package version:
version:1.0.0 prerelease:true _{(prereleases)}
prerelease:false _{(no prereleases)}

Search by package architecture:
architecture:x86_64

Search by package distribution:
distribution:el

Search by package license:
license:MIT

Search by package format:
format:deb

Search by package status:
status:in_progress

Search by package file checksum:
checksum:5afba

Search by package security status:
severity:critical

Search by package vulnerabilities:
vulnerabilities:>1
vulnerabilities:<1000

Search by # of package downloads:
downloads:>8
downloads:<100

Search by package type:
type:binary
type:source

Search by package size (bytes):
size:>50000
size:<10000

Search by dependency name/version:
dependency:log4j
dependency:log4j=1.0.0
dependency:log4j>1.0.0

Search by uploaded date:
uploaded:>"1 day ago"
uploaded:<"August 14, 2022 EST"

Search by entitlement token (identifier):
entitlement:3lKPVJPosCsY

Search by policy violation:
policy_violated:true
deny_policy_violated:true
license_policy_violated:true
vulnerability_policy_violated:true

Search by repository:
repository:repo-name

Search by last download date:
last_downloaded:<"30 days ago"
last_downloaded:>"August 14, 2022 EST"

Search queries for all Debian-specific (and related) package types

Search by component:
deb_component:unstable

Search queries for all Maven-specific (and related) package types

Search by group ID:
maven_group_id:org.apache

Search queries for all Docker-specific (and related) package types

Search by image digest:
docker_image_digest:sha256:7c5..6d4
(full hashref only)

Search by layer digest:
docker_layer_digest:sha256:4c4..ae4
(full hashref only)

Search queries for all Generic-specific package types

Search by file path:
generic_filepath:path/to/file.txt

Search by directory:
generic_directory:path/to

Field type modifiers (depending on the type, you can influence behaviour)

For all queries, you can use:
~foo for negation

For string queries, you can use:
^foo to anchor to start of term
foo$ to anchor to end of term
foo*bar for fuzzy matching

For number/date or version queries, you can use:
>foo for values greater than
>=foo for values greater / equal
<foo for values less than
<=foo for values less / equal

Need a secure and centralised artifact repository to deliver Alpine, Cargo, CocoaPods, Composer, Conan, Conda, CRAN, Dart, Debian, Docker, Generic, Go, Helm, Hex, HuggingFace, LuaRocks, Maven, MCP, npm, NuGet, P2, Python, RedHat, Ruby, Swift, Terraform, Vagrant, VSX, Raw & More packages?

Cloudsmith is the new standard in Package / Artifact Management and Software Distribution.

With support for all major package formats, you can trust us to manage your software supply chain.

Start My Free Trial

Set Me Up

Public — tetrate (Tetrate) / getistio-containers

Tetrate Istio Distro project (formerly GetIstio) container images registry

pilot 6ce794366e728a8f693d61f5eb4…

Download

One-liner (summary)

A certifiably-awesome package curated by Bender Rodriguez, hosted by Cloudsmith.

Description

A certifiably-awesome package curated by Bender Rodriguez, hosted by Cloudsmith.

License

Unknown

Size

71.6 MB

Downloads

Status	Completed
Checksum (MD5)	f41bf4f7e746d0c1fd76c91565571fcc
Checksum (SHA-1)	ea75574ab2ed407a8a633caa913abe5b879201b2
Checksum (SHA-256)	6ce794366e728a8f693d61f5eb474d65a3bc6c76f8ccec1868c67fb174f4b0d6
Checksum (SHA-512)	f3df274529a12e4dccae91a807b6054d466e16d5ebb10f893d078e6da61338fde0…
GPG Signature	Download
GPG Fingerprint	7490c226a7c21a19bb1d09e800b3a57eef287d7b
Storage Region	Dublin, Ireland
Type	Binary (contains binaries and binary artifacts)
Uploaded At	1 month, 2 weeks ago
Uploaded By
Slug Id	pilot-k3x7
Unique Id	osq8RU3zbc8T
Version (Raw)	6ce794366e728a8f693d61f5eb474d65a3bc6c76f8ccec1868c67fb174f4b0d6
Version (Parsed)	Type: Unknown
	docker-specific metadata
Image Digest	sha256:6ce794366e728a8f693d61f5eb474d65a3bc6c76f8ccec1868c67fb174f4b0d6
Config Digest	sha256:dbd4d5fa8f1dbc98da34680f12b52253bcb5f38a5c0d571447dc69c71d8d8cca
V1 OCI Index Digest	sha256:e34ac7221d55a892e666566f23cb0b5c2912858398b09d0d38a172269fbe5a2d
V1 Distribution (Signed) Digest	sha256:94c195cd1f9afb44d4888bbfbae4d199a7d0aa97cb7cd20ad81e55c164358ea0
V1 OCI Digest	sha256:97bb37cf66846f3f7eaa4a5423d10e498cdb7ff397198e0248ceb50422232f67
V2 Distribution List Digest	sha256:51bea6d7e44497eb9263137bae2da74a11be24ef926b9fed25ce184da7b7073b
V1 Distribution Digest	sha256:f160b27150a4c8adda9e3905b6e89ff9f2181d56d9051e0c96eeda1ce7e806bf
V2 Distribution Digest	sha256:6ce794366e728a8f693d61f5eb474d65a3bc6c76f8ccec1868c67fb174f4b0d6
	extended metadata
Manifest Type	V2 Distribution
Architecture	amd64
Config	Entrypoint /usr/local/bin/pilot-discovery Env PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin User 1337:1337 Working Dir /
Created	2026-06-05 08:15:36 UTC
Os	linux

pilot eb83653f5049b8e79f43b5ff134a0d609b2f495…	image amd64 linux 115.6 MB — 1 day, 23 hours ago	0
pilot fff723598e75f8b1fbc97624e6493ded29a0172…	image amd64 linux 76.4 MB — 3 weeks, 5 days ago	1
pilot 894ebe9153911a2a8163deae0af9d8c9b70004f…	image arm64 linux 71.0 MB — 3 weeks, 5 days ago	1
pilot 99a4f0a040a6dc8f21946a3dd7a2ad292bf5e22…	image arm64 linux 33.0 MB — 3 weeks, 5 days ago	1
pilot ebf8c8d5cbe6de81ba8f02fb1de93f276d47e8a…	image amd64 linux 123.4 MB — 3 weeks, 5 days ago	43
pilot a7c06d6750a1b514095affae6c4594490703289…	image arm64 linux 121.9 MB — 3 weeks, 5 days ago	19
pilot d88bda3a2117e6f38875937698beed52a867490…	image amd64 linux 35.9 MB — 3 weeks, 5 days ago	1
pilot 958c656dbb64c426398f724b186405c9c5e3c62…	image arm64 linux 76.1 MB — 3 weeks, 5 days ago	19
pilot 8aaa07b3eb666b6e7b2cea31fdc260b5654cc1e…	image amd64 linux 35.2 MB — 3 weeks, 5 days ago	1
pilot b5a65832aa03a63185b3de16d0614c3b1c3caae…	image arm64 linux 31.4 MB — 3 weeks, 5 days ago	1
pilot 6ce794366e728a8f693d61f5eb474d65a3bc6c7…	image amd64 linux 71.6 MB — 1 month, 2 weeks ago	1
pilot 2f30c795b83eb9bfe4217a2a717446ff7b5a4cf…	image arm64 linux 71.0 MB — 1 day, 16 hours ago	0
pilot 0e8d029d2f0c2308abf6bdea47e71afa601881d…	image arm64 linux 33.0 MB — 1 day, 16 hours ago	0
pilot 39dccaaa99dd1a337822410b2e7bcd07c5f684a…	image amd64 linux 117.6 MB — 1 day, 16 hours ago	0
pilot 6ab5d4136f3a899ccfcf3f4a665a318a38793e5…	image arm64 linux 113.9 MB — 1 day, 16 hours ago	0
pilot 02ec8208980daf4c2b9023e014bd8d1369c430a…	image amd64 linux 35.9 MB — 1 day, 22 hours ago	0
pilot 592f1c913db3633b31739d9703311e63064f5c1…	image arm64 linux 112.9 MB — 1 day, 22 hours ago	1
pilot 679bcddce98fb2b21d6c81a17f796e84f12fec3…	image amd64 linux 35.0 MB — 1 day, 23 hours ago	0
pilot 475ad423c3654450a276a310582f3a392ca25f7…	image amd64 linux 36.9 MB — 3 weeks, 5 days ago	1
pilot 51ce206050b1cff2658adf6557b7f67204526ce…	image arm64 linux 32.1 MB — 3 weeks, 5 days ago	1

Last scanned

1 month, 2 weeks ago

Scan result

Vulnerable

Vulnerability count

Max. severity

High

Target:	osq8RU3zbc8T.sbom-cyclonedx.json (redhat 9.7)
HIGH	CVE-2026-4878: libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation. Package Name: libcap Installed Version: 2.48-10.el9_7.1 Fixed Version: 2.48-10.el9_8.1 References: www.openwall.com www.openwall.com www.openwall.com www.openwall.com www.openwall.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov sites.google.com ubuntu.com www.cve.org
HIGH	CVE-2026-35535: sudo: Sudo: Privilege escalation due to failure in privilege drop calls In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation. Package Name: sudo Installed Version: 1.9.5p2-15.el9_7 Fixed Version: 1.9.17p2-3.el9_8 References: access.redhat.com access.redhat.com bugs.debian.org bugs.launchpad.net bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov ubuntu.com ubuntu.com ubuntu.com www.cve.org www.qualys.com
MEDIUM	CVE-2025-5278: coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data. Package Name: coreutils-single Installed Version: 8.32-39.el9 Fixed Version: References: www.openwall.com www.openwall.com www.openwall.com access.redhat.com bugzilla.redhat.com cgit.git.savannah.gnu.org cgit.git.savannah.gnu.org debbugs.gnu.org nvd.nist.gov security-tracker.debian.org www.cve.org
MEDIUM	CVE-2025-13034: curl: Public key pinning bypass via QUIC and GnuTLS allows server impersonation When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool,curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper check, thus not noticing a possible impostor. To skip this check, the connection had to be done with QUIC with ngtcp2 built to use GnuTLS and the user had to explicitly disable the standard certificate verification. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: access.redhat.com curl.se curl.se github.com nvd.nist.gov ubuntu.com www.cve.org
MEDIUM	CVE-2025-14017: curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se github.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org
MEDIUM	CVE-2026-1965: curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. One underlying reason being that Negotiate sometimes authenticates connections and not requests, contrary to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second request wrongly reused the same connection and since it then sees that the Negotiate negotiation is already made, it just sends the request over that connection thinking it uses the user2 credentials when it is in fact still using the connection authenticated for user1... The set of authentication methods to use is set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus mitigate this problem, by using one of the following libcurl options to alter how connections are or are not reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the curl_multi API). Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: access.redhat.com curl.se curl.se nvd.nist.gov ubuntu.com ubuntu.com www.cve.org
MEDIUM	CVE-2026-3783: curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se github.com hackerone.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org
MEDIUM	CVE-2026-3784: curl: curl: Unauthorized access due to improper HTTP proxy connection reuse curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com cert-portal.siemens.com curl.se curl.se github.com hackerone.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org
MEDIUM	CVE-2026-3805: curl: curl: Arbitrary code execution or Denial of Service via use-after-free in SMB request handling When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se github.com hackerone.com nvd.nist.gov ubuntu.com www.cve.org
MEDIUM	CVE-2026-4873: curl: curl: Information disclosure due to incorrect TLS connection reuse A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com www.cve.org
MEDIUM	CVE-2026-5545: curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1... Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com www.cve.org
MEDIUM	CVE-2026-5773: curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different 'share' than the new subsequent transfer should. This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com www.cve.org
MEDIUM	CVE-2026-6253: curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com www.cve.org
MEDIUM	CVE-2026-6429: curl: libcurl: Credential leak via reused proxy connection during HTTP redirects When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com www.cve.org
MEDIUM	CVE-2026-7168: curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with Digest authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com www.cve.org
MEDIUM	CVE-2026-4046: glibc: glibc: Denial of Service via iconv() function with specific character sets The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them. Package Name: glibc Installed Version: 2.34-231.el9_7.10 Fixed Version: 2.34-270.el9_8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org inbox.sourceware.org linux.oracle.com linux.oracle.com nvd.nist.gov packages.fedoraproject.org sourceware.org sourceware.org sourceware.org www.cve.org
MEDIUM	CVE-2026-4437: glibc: glibc: Incorrect DNS response parsing via crafted DNS server response Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer. Package Name: glibc Installed Version: 2.34-231.el9_7.10 Fixed Version: 2.34-270.el9_8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov sourceware.org www.cve.org www.openwall.com
MEDIUM	CVE-2026-5435: glibc: glibc: Out-of-bounds write via TSIG record processing The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records. Package Name: glibc Installed Version: 2.34-231.el9_7.10 Fixed Version: References: access.redhat.com inbox.sourceware.org inbox.sourceware.org nvd.nist.gov sourceware.org sourceware.org www.cve.org
MEDIUM	CVE-2026-5450: glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow. Package Name: glibc Installed Version: 2.34-231.el9_7.10 Fixed Version: References: access.redhat.com inbox.sourceware.org nvd.nist.gov nvd.nist.gov sourceware.org www.cve.org
MEDIUM	CVE-2026-5928: glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets. Package Name: glibc Installed Version: 2.34-231.el9_7.10 Fixed Version: References: access.redhat.com nvd.nist.gov sourceware.org www.cve.org
MEDIUM	CVE-2026-4046: glibc: glibc: Denial of Service via iconv() function with specific character sets The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them. Package Name: glibc-common Installed Version: 2.34-231.el9_7.10 Fixed Version: 2.34-270.el9_8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org inbox.sourceware.org linux.oracle.com linux.oracle.com nvd.nist.gov packages.fedoraproject.org sourceware.org sourceware.org sourceware.org www.cve.org
MEDIUM	CVE-2026-4437: glibc: glibc: Incorrect DNS response parsing via crafted DNS server response Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer. Package Name: glibc-common Installed Version: 2.34-231.el9_7.10 Fixed Version: 2.34-270.el9_8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov sourceware.org www.cve.org www.openwall.com
MEDIUM	CVE-2026-5435: glibc: glibc: Out-of-bounds write via TSIG record processing The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records. Package Name: glibc-common Installed Version: 2.34-231.el9_7.10 Fixed Version: References: access.redhat.com inbox.sourceware.org inbox.sourceware.org nvd.nist.gov sourceware.org sourceware.org www.cve.org
MEDIUM	CVE-2026-5450: glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow. Package Name: glibc-common Installed Version: 2.34-231.el9_7.10 Fixed Version: References: access.redhat.com inbox.sourceware.org nvd.nist.gov nvd.nist.gov sourceware.org www.cve.org
MEDIUM	CVE-2026-5928: glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets. Package Name: glibc-common Installed Version: 2.34-231.el9_7.10 Fixed Version: References: access.redhat.com nvd.nist.gov sourceware.org www.cve.org
MEDIUM	CVE-2026-4046: glibc: glibc: Denial of Service via iconv() function with specific character sets The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them. Package Name: glibc-minimal-langpack Installed Version: 2.34-231.el9_7.10 Fixed Version: 2.34-270.el9_8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org inbox.sourceware.org linux.oracle.com linux.oracle.com nvd.nist.gov packages.fedoraproject.org sourceware.org sourceware.org sourceware.org www.cve.org
MEDIUM	CVE-2026-4437: glibc: glibc: Incorrect DNS response parsing via crafted DNS server response Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer. Package Name: glibc-minimal-langpack Installed Version: 2.34-231.el9_7.10 Fixed Version: 2.34-270.el9_8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov sourceware.org www.cve.org www.openwall.com
MEDIUM	CVE-2026-5435: glibc: glibc: Out-of-bounds write via TSIG record processing The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records. Package Name: glibc-minimal-langpack Installed Version: 2.34-231.el9_7.10 Fixed Version: References: access.redhat.com inbox.sourceware.org inbox.sourceware.org nvd.nist.gov sourceware.org sourceware.org www.cve.org
MEDIUM	CVE-2026-5450: glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow. Package Name: glibc-minimal-langpack Installed Version: 2.34-231.el9_7.10 Fixed Version: References: access.redhat.com inbox.sourceware.org nvd.nist.gov nvd.nist.gov sourceware.org www.cve.org
MEDIUM	CVE-2026-5928: glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets. Package Name: glibc-minimal-langpack Installed Version: 2.34-231.el9_7.10 Fixed Version: References: access.redhat.com nvd.nist.gov sourceware.org www.cve.org
MEDIUM	CVE-2026-40355: krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message. Package Name: krb5-libs Installed Version: 1.21.1-9.el9_7 Fixed Version: 1.21.1-10.el9_8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cems.fun cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov web.mit.edu www.cve.org
MEDIUM	CVE-2026-40356: krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message. Package Name: krb5-libs Installed Version: 1.21.1-9.el9_7 Fixed Version: 1.21.1-10.el9_8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cems.fun cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com linux.oracle.com linux.oracle.com nvd.nist.gov web.mit.edu www.cve.org
MEDIUM	CVE-2025-13034: curl: Public key pinning bypass via QUIC and GnuTLS allows server impersonation When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool,curl should check the public key of the server certificate to verify the peer. This check was skipped in a certain condition that would then make curl allow the connection without performing the proper check, thus not noticing a possible impostor. To skip this check, the connection had to be done with QUIC with ngtcp2 built to use GnuTLS and the user had to explicitly disable the standard certificate verification. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: access.redhat.com curl.se curl.se github.com nvd.nist.gov ubuntu.com www.cve.org
MEDIUM	CVE-2025-14017: curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se github.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org
MEDIUM	CVE-2026-1965: curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criterion must first be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. One underlying reason being that Negotiate sometimes authenticates connections and not requests, contrary to how HTTP is designed to work. An application that allows Negotiate authentication to a server (that responds wanting Negotiate) with `user1:password1` and then does another operation to the same server also using Negotiate but with `user2:password2` (while the previous connection is still alive) - the second request wrongly reused the same connection and since it then sees that the Negotiate negotiation is already made, it just sends the request over that connection thinking it uses the user2 credentials when it is in fact still using the connection authenticated for user1... The set of authentication methods to use is set with `CURLOPT_HTTPAUTH`. Applications can disable libcurl's reuse of connections and thus mitigate this problem, by using one of the following libcurl options to alter how connections are or are not reused: `CURLOPT_FRESH_CONNECT`, `CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the curl_multi API). Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: access.redhat.com curl.se curl.se nvd.nist.gov ubuntu.com ubuntu.com www.cve.org
MEDIUM	CVE-2026-3783: curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances. If the hostname that the first request is redirected to has information in the used .netrc file, with either of the `machine` or `default` keywords, curl would pass on the bearer token set for the first host also to the second one. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se github.com hackerone.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org
MEDIUM	CVE-2026-3784: curl: curl: Unauthorized access due to improper HTTP proxy connection reuse curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com cert-portal.siemens.com curl.se curl.se github.com hackerone.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org
MEDIUM	CVE-2026-3805: curl: curl: Arbitrary code execution or Denial of Service via use-after-free in SMB request handling When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se github.com hackerone.com nvd.nist.gov ubuntu.com www.cve.org
MEDIUM	CVE-2026-4873: curl: curl: Information disclosure due to incorrect TLS connection reuse A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com www.cve.org
MEDIUM	CVE-2026-5545: curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different credentials. An application that first uses Negotiate authentication to a server with `user1:password1` and then does another operation to the same server asking for any authentication method but for `user2:password2` (while the previous connection is still alive) - the second request gets confused and wrongly reuses the same connection and sends the new request over that connection thinking it uses a mix of user1's and user2's credentials when it is in fact still using the connection authenticated for user1... Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com www.cve.org
MEDIUM	CVE-2026-5773: curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a network transfer operation that was requested by an application could wrongfully reuse an existing SMB connection to the same server that was using a different 'share' than the new subsequent transfer should. This could in unlucky situations lead to the download of the wrong file or the upload of a file to the wrong place. When this happens, the same credentials are used and the server name is the same. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com www.cve.org
MEDIUM	CVE-2026-6253: curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com www.cve.org
MEDIUM	CVE-2026-6429: curl: libcurl: Credential leak via reused proxy connection during HTTP redirects When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com www.cve.org
MEDIUM	CVE-2026-7168: curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with Digest authentication and then changing the proxy host to a second one (`proxyB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Proxy-Authorization:` header field meant for `proxyA`, to `proxyB`. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com www.cve.org
MEDIUM	CVE-2025-4877: libssh: Write beyond bounds in binary to base64 conversion functions There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to ssh_get_fingerprint_hash() function. In such cases the bin_to_base64() function can experience an integer overflow leading to a memory under allocation, when that happens it's possible that the program perform out of bounds write leading to a heap corruption. This issue affects only 32-bits builds of libssh. Package Name: libssh Installed Version: 0.10.4-17.el9_7 Fixed Version: 0.10.4-18.el9 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org git.libssh.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org
MEDIUM	CVE-2025-5351: libssh: Double Free Vulnerability in libssh Key Export Functions A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed. Package Name: libssh Installed Version: 0.10.4-17.el9_7 Fixed Version: 0.10.4-18.el9 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov ubuntu.com www.cve.org www.libssh.org
MEDIUM	CVE-2025-5372: libssh: Incorrect Return Code Handling in ssh_kdf() in libssh A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability. Package Name: libssh Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov ubuntu.com www.cve.org www.libssh.org
MEDIUM	CVE-2025-8114: libssh: NULL Pointer Dereference in libssh KEX Session ID Calculation A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash. Package Name: libssh Installed Version: 0.10.4-17.el9_7 Fixed Version: 0.10.4-18.el9 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org git.libssh.org git.libssh.org nvd.nist.gov ubuntu.com www.cve.org www.libssh.org
MEDIUM	CVE-2026-0964: libssh: Improper sanitation of paths received from SCP servers A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences. This is the same issue as in OpenSSH, tracked as CVE-2019-6111. Package Name: libssh Installed Version: 0.10.4-17.el9_7 Fixed Version: 0.10.4-18.el9 References: access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org www.libssh.org
MEDIUM	CVE-2026-0966: libssh: libssh: Denial of Service via zero-length input in ssh_get_hexa() A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process. Package Name: libssh Installed Version: 0.10.4-17.el9_7 Fixed Version: 0.10.4-18.el9 References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org www.libssh.org
MEDIUM	CVE-2026-3731: libssh: libssh: Denial of Service via out-of-bounds read in SFTP extension name handler A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component. Package Name: libssh Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com gitlab.com nvd.nist.gov ubuntu.com vuldb.com vuldb.com vuldb.com www.cve.org www.libssh.org www.libssh.org
MEDIUM	CVE-2025-4877: libssh: Write beyond bounds in binary to base64 conversion functions There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to ssh_get_fingerprint_hash() function. In such cases the bin_to_base64() function can experience an integer overflow leading to a memory under allocation, when that happens it's possible that the program perform out of bounds write leading to a heap corruption. This issue affects only 32-bits builds of libssh. Package Name: libssh-config Installed Version: 0.10.4-17.el9_7 Fixed Version: 0.10.4-18.el9 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org git.libssh.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org
MEDIUM	CVE-2025-5351: libssh: Double Free Vulnerability in libssh Key Export Functions A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed. Package Name: libssh-config Installed Version: 0.10.4-17.el9_7 Fixed Version: 0.10.4-18.el9 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov ubuntu.com www.cve.org www.libssh.org
MEDIUM	CVE-2025-5372: libssh: Incorrect Return Code Handling in ssh_kdf() in libssh A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability. Package Name: libssh-config Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org linux.oracle.com linux.oracle.com nvd.nist.gov ubuntu.com www.cve.org www.libssh.org
MEDIUM	CVE-2025-8114: libssh: NULL Pointer Dereference in libssh KEX Session ID Calculation A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash. Package Name: libssh-config Installed Version: 0.10.4-17.el9_7 Fixed Version: 0.10.4-18.el9 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org git.libssh.org git.libssh.org nvd.nist.gov ubuntu.com www.cve.org www.libssh.org
MEDIUM	CVE-2026-0964: libssh: Improper sanitation of paths received from SCP servers A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences. This is the same issue as in OpenSSH, tracked as CVE-2019-6111. Package Name: libssh-config Installed Version: 0.10.4-17.el9_7 Fixed Version: 0.10.4-18.el9 References: access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org www.libssh.org
MEDIUM	CVE-2026-0966: libssh: libssh: Denial of Service via zero-length input in ssh_get_hexa() A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process. Package Name: libssh-config Installed Version: 0.10.4-17.el9_7 Fixed Version: 0.10.4-18.el9 References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org www.libssh.org
MEDIUM	CVE-2026-3731: libssh: libssh: Denial of Service via out-of-bounds read in SFTP extension name handler A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component. Package Name: libssh-config Installed Version: 0.10.4-17.el9_7 Fixed Version: References: access.redhat.com gitlab.com nvd.nist.gov ubuntu.com vuldb.com vuldb.com vuldb.com www.cve.org www.libssh.org www.libssh.org
MEDIUM	CVE-2026-22185: OpenLDAP: OpenLDAP LMDB: Denial of Service and Information Disclosure via Heap Buffer Underflow OpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and including 0.9.14, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition. Package Name: openldap Installed Version: 2.6.8-4.el9 Fixed Version: References: access.redhat.com bugs.openldap.org nvd.nist.gov seclists.org seclists.org www.cve.org www.openldap.org www.vulncheck.com
MEDIUM	CVE-2026-2673: openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defer their use until specifically requested by the server. If an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to interpolate the built-in default group list into its own configuration, perhaps adding or removing specific elements, then an implementation defect causes the 'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups were treated as a single sufficiently secure 'tuple', with the server not sending a Hello Retry Request (HRR) even when a group in a more preferred tuple was mutually supported. As a result, the client and server might fail to negotiate a mutually supported post-quantum key agreement group, such as 'X25519MLKEM768', if the client's configuration results in only 'classical' groups (such as 'X25519' being the only ones in the client's initial keyshare prediction). OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS 1.3 key agreement group on TLS servers. The old syntax had a single 'flat' list of groups, and treated all the supported groups as sufficiently secure. If any of the keyshares predicted by the client were supported by the server the most preferred among these was selected, even if other groups supported by the client, but not included in the list of predicted keyshares would have been more preferred, if included. The new syntax partitions the groups into distinct 'tuples' of roughly equivalent security. Within each tuple the most preferred group included among the client's predicted keyshares is chosen, but if the client supports a group from a more preferred tuple, but did not predict any corresponding keyshares, the server will ask the client to retry the ClientHello (by issuing a Hello Retry Request or HRR) with the most preferred mutually supported group. The above works as expected when the server's configuration uses the built-in default group list, or explicitly defines its own list by directly defining the various desired groups and group 'tuples'. No OpenSSL FIPS modules are affected by this issue, the code in question lies outside the FIPS boundary. OpenSSL 3.6 and 3.5 are vulnerable to this issue. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released. OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue. Package Name: openssl Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: www.openwall.com access.redhat.com cert-portal.siemens.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com www.cve.org
MEDIUM	CVE-2026-28390: openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. Package Name: openssl Installed Version: 1:3.5.1-7.el9_7 Fixed Version: 1:3.5.5-3.el9_8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org www.openwall.com
MEDIUM	CVE-2026-31790: openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result, if RSA encryption fails, encapsulation can still return success to the caller, set the output lengths, and leave the caller to use the contents of the ciphertext buffer as if a valid KEM ciphertext had been produced. If applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an attacker-supplied invalid RSA public key without first validating that key, then this may cause stale or uninitialized contents of the caller-provided ciphertext buffer to be disclosed to the attacker in place of the KEM ciphertext. As a workaround calling EVP_PKEY_public_check() or EVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate the issue. The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue. Package Name: openssl Installed Version: 1:3.5.1-7.el9_7 Fixed Version: 1:3.5.5-2.el9_8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com www.cve.org www.openwall.com
MEDIUM	CVE-2026-2673: openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defer their use until specifically requested by the server. If an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to interpolate the built-in default group list into its own configuration, perhaps adding or removing specific elements, then an implementation defect causes the 'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups were treated as a single sufficiently secure 'tuple', with the server not sending a Hello Retry Request (HRR) even when a group in a more preferred tuple was mutually supported. As a result, the client and server might fail to negotiate a mutually supported post-quantum key agreement group, such as 'X25519MLKEM768', if the client's configuration results in only 'classical' groups (such as 'X25519' being the only ones in the client's initial keyshare prediction). OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS 1.3 key agreement group on TLS servers. The old syntax had a single 'flat' list of groups, and treated all the supported groups as sufficiently secure. If any of the keyshares predicted by the client were supported by the server the most preferred among these was selected, even if other groups supported by the client, but not included in the list of predicted keyshares would have been more preferred, if included. The new syntax partitions the groups into distinct 'tuples' of roughly equivalent security. Within each tuple the most preferred group included among the client's predicted keyshares is chosen, but if the client supports a group from a more preferred tuple, but did not predict any corresponding keyshares, the server will ask the client to retry the ClientHello (by issuing a Hello Retry Request or HRR) with the most preferred mutually supported group. The above works as expected when the server's configuration uses the built-in default group list, or explicitly defines its own list by directly defining the various desired groups and group 'tuples'. No OpenSSL FIPS modules are affected by this issue, the code in question lies outside the FIPS boundary. OpenSSL 3.6 and 3.5 are vulnerable to this issue. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released. OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue. Package Name: openssl-fips-provider Installed Version: 3.0.7-8.el9 Fixed Version: References: www.openwall.com access.redhat.com cert-portal.siemens.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com www.cve.org
MEDIUM	CVE-2026-31790: openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result, if RSA encryption fails, encapsulation can still return success to the caller, set the output lengths, and leave the caller to use the contents of the ciphertext buffer as if a valid KEM ciphertext had been produced. If applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an attacker-supplied invalid RSA public key without first validating that key, then this may cause stale or uninitialized contents of the caller-provided ciphertext buffer to be disclosed to the attacker in place of the KEM ciphertext. As a workaround calling EVP_PKEY_public_check() or EVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate the issue. The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue. Package Name: openssl-fips-provider Installed Version: 3.0.7-8.el9 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com www.cve.org www.openwall.com
MEDIUM	CVE-2026-2673: openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defer their use until specifically requested by the server. If an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to interpolate the built-in default group list into its own configuration, perhaps adding or removing specific elements, then an implementation defect causes the 'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups were treated as a single sufficiently secure 'tuple', with the server not sending a Hello Retry Request (HRR) even when a group in a more preferred tuple was mutually supported. As a result, the client and server might fail to negotiate a mutually supported post-quantum key agreement group, such as 'X25519MLKEM768', if the client's configuration results in only 'classical' groups (such as 'X25519' being the only ones in the client's initial keyshare prediction). OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS 1.3 key agreement group on TLS servers. The old syntax had a single 'flat' list of groups, and treated all the supported groups as sufficiently secure. If any of the keyshares predicted by the client were supported by the server the most preferred among these was selected, even if other groups supported by the client, but not included in the list of predicted keyshares would have been more preferred, if included. The new syntax partitions the groups into distinct 'tuples' of roughly equivalent security. Within each tuple the most preferred group included among the client's predicted keyshares is chosen, but if the client supports a group from a more preferred tuple, but did not predict any corresponding keyshares, the server will ask the client to retry the ClientHello (by issuing a Hello Retry Request or HRR) with the most preferred mutually supported group. The above works as expected when the server's configuration uses the built-in default group list, or explicitly defines its own list by directly defining the various desired groups and group 'tuples'. No OpenSSL FIPS modules are affected by this issue, the code in question lies outside the FIPS boundary. OpenSSL 3.6 and 3.5 are vulnerable to this issue. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released. OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue. Package Name: openssl-fips-provider-so Installed Version: 3.0.7-8.el9 Fixed Version: References: www.openwall.com access.redhat.com cert-portal.siemens.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com www.cve.org
MEDIUM	CVE-2026-31790: openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result, if RSA encryption fails, encapsulation can still return success to the caller, set the output lengths, and leave the caller to use the contents of the ciphertext buffer as if a valid KEM ciphertext had been produced. If applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an attacker-supplied invalid RSA public key without first validating that key, then this may cause stale or uninitialized contents of the caller-provided ciphertext buffer to be disclosed to the attacker in place of the KEM ciphertext. As a workaround calling EVP_PKEY_public_check() or EVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate the issue. The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue. Package Name: openssl-fips-provider-so Installed Version: 3.0.7-8.el9 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com www.cve.org www.openwall.com
MEDIUM	CVE-2026-2673: openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defer their use until specifically requested by the server. If an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to interpolate the built-in default group list into its own configuration, perhaps adding or removing specific elements, then an implementation defect causes the 'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups were treated as a single sufficiently secure 'tuple', with the server not sending a Hello Retry Request (HRR) even when a group in a more preferred tuple was mutually supported. As a result, the client and server might fail to negotiate a mutually supported post-quantum key agreement group, such as 'X25519MLKEM768', if the client's configuration results in only 'classical' groups (such as 'X25519' being the only ones in the client's initial keyshare prediction). OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS 1.3 key agreement group on TLS servers. The old syntax had a single 'flat' list of groups, and treated all the supported groups as sufficiently secure. If any of the keyshares predicted by the client were supported by the server the most preferred among these was selected, even if other groups supported by the client, but not included in the list of predicted keyshares would have been more preferred, if included. The new syntax partitions the groups into distinct 'tuples' of roughly equivalent security. Within each tuple the most preferred group included among the client's predicted keyshares is chosen, but if the client supports a group from a more preferred tuple, but did not predict any corresponding keyshares, the server will ask the client to retry the ClientHello (by issuing a Hello Retry Request or HRR) with the most preferred mutually supported group. The above works as expected when the server's configuration uses the built-in default group list, or explicitly defines its own list by directly defining the various desired groups and group 'tuples'. No OpenSSL FIPS modules are affected by this issue, the code in question lies outside the FIPS boundary. OpenSSL 3.6 and 3.5 are vulnerable to this issue. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released. OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue. Package Name: openssl-libs Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: www.openwall.com access.redhat.com cert-portal.siemens.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com www.cve.org
MEDIUM	CVE-2026-28390: openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. Package Name: openssl-libs Installed Version: 1:3.5.1-7.el9_7 Fixed Version: 1:3.5.5-3.el9_8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org www.openwall.com
MEDIUM	CVE-2026-31790: openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result, if RSA encryption fails, encapsulation can still return success to the caller, set the output lengths, and leave the caller to use the contents of the ciphertext buffer as if a valid KEM ciphertext had been produced. If applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an attacker-supplied invalid RSA public key without first validating that key, then this may cause stale or uninitialized contents of the caller-provided ciphertext buffer to be disclosed to the attacker in place of the KEM ciphertext. As a workaround calling EVP_PKEY_public_check() or EVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate the issue. The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue. Package Name: openssl-libs Installed Version: 1:3.5.1-7.el9_7 Fixed Version: 1:3.5.5-2.el9_8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cert-portal.siemens.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com www.cve.org www.openwall.com
MEDIUM	CVE-2026-2100: p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states. Package Name: p11-kit Installed Version: 0.25.3-3.el9_5 Fixed Version: 0.26.2-1.el9 References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com nvd.nist.gov www.cve.org
MEDIUM	CVE-2026-2100: p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states. Package Name: p11-kit-trust Installed Version: 0.25.3-3.el9_5 Fixed Version: 0.26.2-1.el9 References: access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com nvd.nist.gov www.cve.org
MEDIUM	CVE-2026-5958: sed: GNU sed TOCTOU race condition When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations on the same path: 1. resolves symlink to its target and stores the resolved path for determining when output is written, 2. opens the original symlink path (not the resolved one) to read the file. Between these two calls there is a race window. If an attacker atomically replaces the symlink with a different target during that window, sed will: read content from the new (attacker-chosen) symlink target and write the processed result to the path recorded in step 1. This can lead to arbitrary file overwrite with attacker-controlled content in the context of the sed process. This issue was fixed in version 4.10. Package Name: sed Installed Version: 4.8-9.el9 Fixed Version: References: www.openwall.com access.redhat.com cert.pl github.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.gnu.org www.gnu.org
LOW	CVE-2024-11053: curl: curl netrc password leak When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com curl.se curl.se cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com hackerone.com linux.oracle.com linux.oracle.com nvd.nist.gov security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com ubuntu.com www.cve.org www.oracle.com
LOW	CVE-2024-7264: curl: libcurl: ASN.1 date parser overread libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the time fraction, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com curl.se curl.se cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com hackerone.com linux.oracle.com linux.oracle.com nvd.nist.gov security.netapp.com security.netapp.com security.netapp.com ubuntu.com ubuntu.com www.cve.org www.oracle.com
LOW	CVE-2024-9681: curl: HSTS subdomain overwrites parent cache entry When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is a subdomain of the second host. (The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS accesses done as the cache needs to have entries for the domains involved to trigger this problem.) When `x.example.com` responds with `Strict-Transport-Security:` headers, this bug can make the subdomain's expiry timeout bleed over and get set for the parent domain `example.com` in curl's HSTS cache. The result of a triggered bug is that HTTP accesses to `example.com` get converted to HTTPS for a different period of time than what was asked for by the origin server. If `example.com` for example stops supporting HTTPS at its expiry time, curl might then fail to access `http://example.com` until the (wrongly set) timeout expires. This bug can also expire the parent's entry earlier, thus making curl inadvertently switch back to insecure HTTP earlier than otherwise intended. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: seclists.org seclists.org seclists.org seclists.org seclists.org seclists.org seclists.org seclists.org www.openwall.com access.redhat.com curl.se curl.se github.com hackerone.com nvd.nist.gov security.netapp.com security.netapp.com ubuntu.com www.cve.org
LOW	CVE-2025-14524: curl: Information disclosure via cross-protocol redirect with OAuth2 bearer token When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se github.com hackerone.com nvd.nist.gov ubuntu.com www.cve.org
LOW	CVE-2025-15079: curl: Host verification bypass during SSH transfers When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se github.com hackerone.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org
LOW	CVE-2025-15224: curl: libssh key passphrase bypass without agent set When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se github.com hackerone.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org
LOW	CVE-2026-6276: curl: libcurl: Information disclosure due to cookie leak when reusing connections with custom Host headers Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same easy handle but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them. Package Name: curl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com www.cve.org
LOW	CVE-2024-25260: elfutils: global-buffer-overflow exists in the function ebl_machine_flag_name in eblmachineflagname.c elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c. Package Name: elfutils-libelf Installed Version: 0.193-1.el9 Fixed Version: References: access.redhat.com github.com nvd.nist.gov sourceware.org sourceware.org ubuntu.com www.cve.org
LOW	CVE-2025-1371: elfutils: GNU elfutils eu-read readelf.c handle_dynamic_symtab null pointer dereference A vulnerability has been found in GNU elfutils 0.192 and classified as problematic. This vulnerability affects the function handle_dynamic_symtab of the file readelf.c of the component eu-read. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is identified as b38e562a4c907e08171c76b8b2def8464d5a104a. It is recommended to apply a patch to fix this issue. Package Name: elfutils-libelf Installed Version: 0.193-1.el9 Fixed Version: References: access.redhat.com nvd.nist.gov sourceware.org sourceware.org sourceware.org ubuntu.com vuldb.com vuldb.com vuldb.com www.cve.org www.gnu.org
LOW	CVE-2025-1376: elfutils: GNU elfutils eu-strip elf_strptr.c elf_strptr denial of service A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue. Package Name: elfutils-libelf Installed Version: 0.193-1.el9 Fixed Version: References: access.redhat.com cert-portal.siemens.com nvd.nist.gov sourceware.org sourceware.org sourceware.org vuldb.com vuldb.com vuldb.com www.cve.org www.gnu.org
LOW	CVE-2025-1377: elfutils: GNU elfutils eu-strip strip.c gelf_getsymshndx denial of service A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is recommended to apply a patch to fix this issue. Package Name: elfutils-libelf Installed Version: 0.193-1.el9 Fixed Version: References: access.redhat.com nvd.nist.gov sourceware.org sourceware.org sourceware.org ubuntu.com vuldb.com vuldb.com vuldb.com www.cve.org www.gnu.org
LOW	CVE-2023-4156: gawk: heap out of bound read in builtin.c A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information. Package Name: gawk Installed Version: 5.1.0-6.el9 Fixed Version: References: access.redhat.com bugzilla.redhat.com git.savannah.gnu.org mail.gnu.org mail.gnu.org nvd.nist.gov ubuntu.com www.cve.org
LOW	CVE-2026-4438: glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification. Package Name: glibc Installed Version: 2.34-231.el9_7.10 Fixed Version: 2.34-270.el9_8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov sourceware.org www.cve.org www.openwall.com
LOW	CVE-2026-4438: glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification. Package Name: glibc-common Installed Version: 2.34-231.el9_7.10 Fixed Version: 2.34-270.el9_8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov sourceware.org www.cve.org www.openwall.com
LOW	CVE-2026-4438: glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification. Package Name: glibc-minimal-langpack Installed Version: 2.34-231.el9_7.10 Fixed Version: 2.34-270.el9_8 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov sourceware.org www.cve.org www.openwall.com
LOW	CVE-2024-11053: curl: curl netrc password leak When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com curl.se curl.se cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com hackerone.com linux.oracle.com linux.oracle.com nvd.nist.gov security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com ubuntu.com www.cve.org www.oracle.com
LOW	CVE-2024-7264: curl: libcurl: ASN.1 date parser overread libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the time fraction, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com curl.se curl.se cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com hackerone.com linux.oracle.com linux.oracle.com nvd.nist.gov security.netapp.com security.netapp.com security.netapp.com ubuntu.com ubuntu.com www.cve.org www.oracle.com
LOW	CVE-2024-9681: curl: HSTS subdomain overwrites parent cache entry When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is a subdomain of the second host. (The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS accesses done as the cache needs to have entries for the domains involved to trigger this problem.) When `x.example.com` responds with `Strict-Transport-Security:` headers, this bug can make the subdomain's expiry timeout bleed over and get set for the parent domain `example.com` in curl's HSTS cache. The result of a triggered bug is that HTTP accesses to `example.com` get converted to HTTPS for a different period of time than what was asked for by the origin server. If `example.com` for example stops supporting HTTPS at its expiry time, curl might then fail to access `http://example.com` until the (wrongly set) timeout expires. This bug can also expire the parent's entry earlier, thus making curl inadvertently switch back to insecure HTTP earlier than otherwise intended. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: seclists.org seclists.org seclists.org seclists.org seclists.org seclists.org seclists.org seclists.org www.openwall.com access.redhat.com curl.se curl.se github.com hackerone.com nvd.nist.gov security.netapp.com security.netapp.com ubuntu.com www.cve.org
LOW	CVE-2025-14524: curl: Information disclosure via cross-protocol redirect with OAuth2 bearer token When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se github.com hackerone.com nvd.nist.gov ubuntu.com www.cve.org
LOW	CVE-2025-15079: curl: Host verification bypass during SSH transfers When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se github.com hackerone.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org
LOW	CVE-2025-15224: curl: libssh key passphrase bypass without agent set When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se github.com hackerone.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org
LOW	CVE-2026-6276: curl: libcurl: Information disclosure due to cookie leak when reusing connections with custom Host headers Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same easy handle but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them. Package Name: libcurl Installed Version: 7.76.1-35.el9_7.3 Fixed Version: References: www.openwall.com access.redhat.com curl.se curl.se hackerone.com nvd.nist.gov ubuntu.com www.cve.org
LOW	CVE-2021-46195: gcc: uncontrolled recursion in libiberty/rust-demangle.c GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources. Package Name: libgcc Installed Version: 11.5.0-11.el9 Fixed Version: References: access.redhat.com access.redhat.com bugzilla.redhat.com errata.almalinux.org gcc.gnu.org gcc.gnu.org linux.oracle.com linux.oracle.com nvd.nist.gov www.cve.org
LOW	CVE-2022-27943: binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new. Package Name: libgcc Installed Version: 11.5.0-11.el9 Fixed Version: References: access.redhat.com gcc.gnu.org gcc.gnu.org gcc.gnu.org gcc.gnu.org gcc.gnu.org lists.fedoraproject.org nvd.nist.gov sourceware.org www.cve.org
LOW	CVE-2025-11961: libpcap: libpcap: Memory corruption via malformed MAC-48 address input pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer. Package Name: libpcap Installed Version: 14:1.10.0-4.el9 Fixed Version: References: access.redhat.com github.com nvd.nist.gov www.cve.org
LOW	CVE-2025-4878: libssh: Use of uninitialized variable in privatekey_from_file() A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption. Package Name: libssh Installed Version: 0.10.4-17.el9_7 Fixed Version: 0.10.4-18.el9 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org git.libssh.org git.libssh.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org
LOW	CVE-2025-8277: libssh: Memory Exhaustion via Repeated Key Exchange in libssh A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability. Package Name: libssh Installed Version: 0.10.4-17.el9_7 Fixed Version: 0.10.4-18.el9 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org
LOW	CVE-2026-0965: libssh: libssh: Denial of Service via improper configuration file handling A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations. Package Name: libssh Installed Version: 0.10.4-17.el9_7 Fixed Version: 0.10.4-18.el9 References: access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org
LOW	CVE-2026-0967: libssh: libssh: Denial of Service via inefficient regular expression processing A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the `match_pattern()` function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client. Package Name: libssh Installed Version: 0.10.4-17.el9_7 Fixed Version: 0.10.4-18.el9 References: access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org www.libssh.org
LOW	CVE-2026-0968: libssh: libssh: Denial of Service due to malformed SFTP message A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes. Package Name: libssh Installed Version: 0.10.4-17.el9_7 Fixed Version: 0.10.4-18.el9 References: access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org www.libssh.org
LOW	CVE-2025-4878: libssh: Use of uninitialized variable in privatekey_from_file() A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption. Package Name: libssh-config Installed Version: 0.10.4-17.el9_7 Fixed Version: 0.10.4-18.el9 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org git.libssh.org git.libssh.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org
LOW	CVE-2025-8277: libssh: Memory Exhaustion via Repeated Key Exchange in libssh A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability. Package Name: libssh-config Installed Version: 0.10.4-17.el9_7 Fixed Version: 0.10.4-18.el9 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org
LOW	CVE-2026-0965: libssh: libssh: Denial of Service via improper configuration file handling A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations. Package Name: libssh-config Installed Version: 0.10.4-17.el9_7 Fixed Version: 0.10.4-18.el9 References: access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org
LOW	CVE-2026-0967: libssh: libssh: Denial of Service via inefficient regular expression processing A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the `match_pattern()` function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client. Package Name: libssh-config Installed Version: 0.10.4-17.el9_7 Fixed Version: 0.10.4-18.el9 References: access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org www.libssh.org
LOW	CVE-2026-0968: libssh: libssh: Denial of Service due to malformed SFTP message A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes. Package Name: libssh-config Installed Version: 0.10.4-17.el9_7 Fixed Version: 0.10.4-18.el9 References: access.redhat.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.libssh.org www.libssh.org
LOW	CVE-2025-13151: libtasn1: libtasn1: Denial of Service via stack-based buffer overflow in asn1_expend_octet_string Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string. Package Name: libtasn1 Installed Version: 4.16.0-9.el9 Fixed Version: References: www.openwall.com access.redhat.com gitlab.com gitlab.com nvd.nist.gov ubuntu.com ubuntu.com www.cve.org www.kb.cert.org
LOW	CVE-2023-50495: ncurses: segmentation fault via _nc_wrap_entry() NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry(). Package Name: ncurses-base Installed Version: 6.2-12.20210508.el9 Fixed Version: References: access.redhat.com lists.fedoraproject.org lists.fedoraproject.org lists.gnu.org lists.gnu.org nvd.nist.gov security.netapp.com ubuntu.com www.cve.org
LOW	CVE-2023-50495: ncurses: segmentation fault via _nc_wrap_entry() NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry(). Package Name: ncurses-libs Installed Version: 6.2-12.20210508.el9 Fixed Version: References: access.redhat.com lists.fedoraproject.org lists.fedoraproject.org lists.gnu.org lists.gnu.org nvd.nist.gov security.netapp.com ubuntu.com www.cve.org
LOW	CVE-2024-13176: openssl: Timing side-channel in ECDSA signature computation Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low. The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue. Package Name: openssl Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com github.openssl.org github.openssl.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov openssl-library.org security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com ubuntu.com ubuntu.com ubuntu.com www.cve.org www.oracle.com
LOW	CVE-2024-41996: openssl: remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key. Package Name: openssl Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: access.redhat.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com dheatattack.gitlab.io dheatattack.gitlab.io gist.github.com github.com nvd.nist.gov openssl-library.org www.cve.org
LOW	CVE-2025-9232: openssl: Out-of-bounds read in HTTP client no_proxy handling Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary. Package Name: openssl Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: www.openwall.com access.redhat.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com github.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org
LOW	CVE-2026-28387: openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLSA authentication Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate usage. By far the most common deployment of DANE is in SMTP MTAs for which RFC7672 recommends that clients treat as 'unusable' any TLSA records that have the PKIX certificate usages. These SMTP (or other similar) clients are not vulnerable to this issue. Conversely, any clients that support only the PKIX usages, and ignore the DANE-TA(2) usage are also not vulnerable. The client would also need to be communicating with a server that publishes a TLSA RRset with both types of TLSA records. No FIPS modules are affected by this issue, the problem code is outside the FIPS module boundary. Package Name: openssl Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: access.redhat.com cert-portal.siemens.com cert-portal.siemens.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org www.openwall.com
LOW	CVE-2026-28388: openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference. Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. Package Name: openssl Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: access.redhat.com cert-portal.siemens.com cert-portal.siemens.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org www.openwall.com
LOW	CVE-2026-28389: openssl: OpenSSL: Denial of Service vulnerability in CMS processing Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. Package Name: openssl Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: access.redhat.com cert-portal.siemens.com cert-portal.siemens.com github.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org www.openwall.com
LOW	CVE-2026-31789: openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior. If an attacker can supply a crafted X.509 certificate with an excessively large OCTET STRING value in extensions such as the Subject Key Identifier (SKID) or Authority Key Identifier (AKID) which are being converted to hex, the size of the buffer needed for the result is calculated as multiplication of the input length by 3. On 32 bit platforms, this multiplication may overflow resulting in the allocation of a smaller buffer and a heap buffer overflow. Applications and services that print or log contents of untrusted X.509 certificates are vulnerable to this issue. As the certificates would have to have sizes of over 1 Gigabyte, printing or logging such certificates is a fairly unlikely operation and only 32 bit platforms are affected, this issue was assigned Low severity. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. Package Name: openssl Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: access.redhat.com cert-portal.siemens.com github.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com www.cve.org www.openwall.com
LOW	CVE-2024-13176: openssl: Timing side-channel in ECDSA signature computation Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low. The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue. Package Name: openssl-libs Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: www.openwall.com access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com github.com github.com github.com github.com github.openssl.org github.openssl.org linux.oracle.com linux.oracle.com lists.debian.org nvd.nist.gov openssl-library.org security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com security.netapp.com ubuntu.com ubuntu.com ubuntu.com www.cve.org www.oracle.com
LOW	CVE-2024-41996: openssl: remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key. Package Name: openssl-libs Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: access.redhat.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com dheatattack.gitlab.io dheatattack.gitlab.io gist.github.com github.com nvd.nist.gov openssl-library.org www.cve.org
LOW	CVE-2025-9232: openssl: Out-of-bounds read in HTTP client no_proxy handling Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary. Package Name: openssl-libs Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: www.openwall.com access.redhat.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com cert-portal.siemens.com github.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org
LOW	CVE-2026-28387: openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLSA authentication Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate usage. By far the most common deployment of DANE is in SMTP MTAs for which RFC7672 recommends that clients treat as 'unusable' any TLSA records that have the PKIX certificate usages. These SMTP (or other similar) clients are not vulnerable to this issue. Conversely, any clients that support only the PKIX usages, and ignore the DANE-TA(2) usage are also not vulnerable. The client would also need to be communicating with a server that publishes a TLSA RRset with both types of TLSA records. No FIPS modules are affected by this issue, the problem code is outside the FIPS module boundary. Package Name: openssl-libs Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: access.redhat.com cert-portal.siemens.com cert-portal.siemens.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org www.openwall.com
LOW	CVE-2026-28388: openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference. Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. Package Name: openssl-libs Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: access.redhat.com cert-portal.siemens.com cert-portal.siemens.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org www.openwall.com
LOW	CVE-2026-28389: openssl: OpenSSL: Denial of Service vulnerability in CMS processing Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. Package Name: openssl-libs Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: access.redhat.com cert-portal.siemens.com cert-portal.siemens.com github.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com ubuntu.com www.cve.org www.openwall.com
LOW	CVE-2026-31789: openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior. If an attacker can supply a crafted X.509 certificate with an excessively large OCTET STRING value in extensions such as the Subject Key Identifier (SKID) or Authority Key Identifier (AKID) which are being converted to hex, the size of the buffer needed for the result is calculated as multiplication of the input length by 3. On 32 bit platforms, this multiplication may overflow resulting in the allocation of a smaller buffer and a heap buffer overflow. Applications and services that print or log contents of untrusted X.509 certificates are vulnerable to this issue. As the certificates would have to have sizes of over 1 Gigabyte, printing or logging such certificates is a fairly unlikely operation and only 32 bit platforms are affected, this issue was assigned Low severity. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. Package Name: openssl-libs Installed Version: 1:3.5.1-7.el9_7 Fixed Version: References: access.redhat.com cert-portal.siemens.com github.com github.com github.com github.com github.com github.com nvd.nist.gov openssl-library.org ubuntu.com www.cve.org www.openwall.com
LOW	CVE-2022-41409: pcre2: negative repeat value in a pcre2test subject line leads to inifinite loop Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input. Package Name: pcre2 Installed Version: 10.40-6.el9 Fixed Version: References: access.redhat.com github.com github.com github.com nvd.nist.gov www.cve.org
LOW	CVE-2022-41409: pcre2: negative repeat value in a pcre2test subject line leads to inifinite loop Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input. Package Name: pcre2-syntax Installed Version: 10.40-6.el9 Fixed Version: References: access.redhat.com github.com github.com github.com nvd.nist.gov www.cve.org
LOW	CVE-2026-27171: zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition. Package Name: zlib Installed Version: 1.2.11-40.el9 Fixed Version: References: 7asecurity.com 7asecurity.com 7asecurity.com access.redhat.com github.com github.com github.com nvd.nist.gov ostif.org ostif.org www.cve.org
Target:	usr/local/bin/pilot-discovery
HIGH	CVE-2026-42151: github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3. Package Name: github.com/prometheus/prometheus Installed Version: v0.302.1 Fixed Version: 0.311.3 References: access.redhat.com github.com github.com github.com github.com github.com github.com nvd.nist.gov www.cve.org
HIGH	CVE-2026-42154: github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An unauthenticated attacker can send a small payload that causes a huge heap allocation per request. Under concurrent load this can exhaust available memory and crash the Prometheus process. This issue has been patched in versions 3.5.3 and 3.11.3. Package Name: github.com/prometheus/prometheus Installed Version: v0.302.1 Fixed Version: 0.311.3 References: access.redhat.com github.com github.com github.com github.com github.com github.com nvd.nist.gov www.cve.org
HIGH	CVE-2026-33811: net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. Package Name: stdlib Installed Version: v1.25.9 Fixed Version: 1.25.10, 1.26.3 References: access.redhat.com go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev www.cve.org
HIGH	CVE-2026-33814: When processing HTTP/2 SETTINGS frames, transport will enter an infini ... When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. Package Name: stdlib Installed Version: v1.25.9 Fixed Version: 1.25.10, 1.26.3 References: github.com go-review.googlesource.com go-review.googlesource.com go.dev go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev www.cve.org
HIGH	CVE-2026-39820: Well-crafted inputs reaching ParseAddress, ParseAddressList, and Parse ... Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations. Package Name: stdlib Installed Version: v1.25.9 Fixed Version: 1.25.10, 1.26.3 References: go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev
HIGH	CVE-2026-39823: CVE-2026-27142 fixed a vulnerability in which URLs were not correctly ... CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS. Package Name: stdlib Installed Version: v1.25.9 Fixed Version: 1.25.10, 1.26.3 References: go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev
HIGH	CVE-2026-39825: ReverseProxy can forward queries containing parameters not visible to ... ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function. Package Name: stdlib Installed Version: v1.25.9 Fixed Version: 1.25.10, 1.26.3 References: go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev
HIGH	CVE-2026-39826: If a trusted template author were to write a <script> tag containing a ... If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block. Package Name: stdlib Installed Version: v1.25.9 Fixed Version: 1.25.10, 1.26.3 References: go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev
HIGH	CVE-2026-39836: ELSA-2026-22112: go-toolset:ol8 security update (IMPORTANT) The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0). Package Name: stdlib Installed Version: v1.25.9 Fixed Version: 1.25.10, 1.26.3 References: go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev
HIGH	CVE-2026-42499: Pathological inputs could cause DoS through consumePhrase when parsing ... Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. Package Name: stdlib Installed Version: v1.25.9 Fixed Version: 1.25.10, 1.26.3 References: go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev
HIGH	CVE-2026-42504: Decoding a maliciously-crafted MIME header containing many invalid enc ... Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. Package Name: stdlib Installed Version: v1.25.9 Fixed Version: 1.25.11, 1.26.4 References: go.dev go.dev groups.google.com nvd.nist.gov pkg.go.dev
MEDIUM	CVE-2026-40179: Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values are injected into innerHTML without escaping. In both the Mantine UI and old React UI, chart tooltips on the Graph page render metric names containing HTML/JavaScript without sanitization. In the old React UI, the Metric Explorer fuzzy search results use dangerouslySetInnerHTML without escaping, and heatmap cell tooltips interpolate le label values without sanitization. With Prometheus v3.x defaulting to UTF-8 metric and label name validation, characters like <, >, and " are now valid in metric names and labels. An attacker who can inject metrics via a compromised scrape target, remote write, or OTLP receiver endpoint can execute arbitrary JavaScript in the browser of any Prometheus user who views the metric in the Graph UI, potentially enabling configuration exfiltration, data deletion, or Prometheus shutdown depending on enabled flags. This issue has been fixed in versions 3.5.2 and 3.11.2. If developers are unable to immediately update, the following workarounds are recommended: ensure that the remote write receiver (--web.enable-remote-write-receiver) and the OTLP receiver (--web.enable-otlp-receiver) are not exposed to untrusted sources; verify that all scrape targets are trusted and not under attacker control; avoid enabling admin or mutating API endpoints (e.g., --web.enable-admin-api or --web.enable-lifecycle) in environments where untrusted data may be ingested; and refrain from clicking untrusted links, particularly those containing functions such as label_replace, as they may generate poisoned label names and values. Package Name: github.com/prometheus/prometheus Installed Version: v0.302.1 Fixed Version: 0.311.2-0.20260410083055-07c6232d159b References: github.com github.com github.com github.com nvd.nist.gov
MEDIUM	CVE-2026-44903: Prometheus is an open-source monitoring system and time series databas ... Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the histogram heatmap chart view does not escape le label values when inserting them into the HTML for use as axis tick mark labels. An attacker who can inject crafted metrics can execute JavaScript in the browser of any Prometheus user who views the metric in the heatmap chart UI. This vulnerability is fixed in 3.5.3 and 3.11.3. Package Name: github.com/prometheus/prometheus Installed Version: v0.302.1 Fixed Version: 0.311.3 References: github.com github.com github.com nvd.nist.gov
MEDIUM	CVE-2026-27145: x509.Certificate).VerifyHostname previously called matchHostnames in ... (x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates. Package Name: stdlib Installed Version: v1.25.9 Fixed Version: 1.25.11, 1.26.4 References: go.dev go.dev groups.google.com nvd.nist.gov pkg.go.dev
MEDIUM	CVE-2026-42507: When returning errors, functions in the net/textproto package would in ... When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged. Package Name: stdlib Installed Version: v1.25.9 Fixed Version: 1.25.11, 1.26.4 References: go.dev go.dev groups.google.com nvd.nist.gov pkg.go.dev

Package statistics are no longer available on cloudsmith.io. Please visit our new web app to access this feature.

These instructions assume you have setup the repository first (or read it).

To pull pilot @ reference/tag sha256:6ce794366e728a8f693d61f5eb474d65a3bc6c76f8ccec1868c67fb174f4b0d6:

docker pull containers.istio.tetratelabs.com/pilot@sha256:6ce794366e728a8f693d61f5eb474d65a3bc6c76f8ccec1868c67fb174f4b0d6

You can also pull the latest version of this image (if it exists):

docker pull containers.istio.tetratelabs.com/pilot:latest

To refer to this image after pulling in a Dockerfile, specify the following:

FROM containers.istio.tetratelabs.com/pilot@sha256:6ce794366e728a8f693d61f5eb474d65a3bc6c76f8ccec1868c67fb174f4b0d6

Still stuck? Need help? Don't panic. Just contact us for help (even if you're not a customer).

Previous Version: 2f30c795b83eb9bfe42…

Next Version: b5a65832aa03a63185b…

	Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4 Command: ARG MICRO	32 bytes
	Digest: sha256:96902f2973287ebed3e4dd8ff6cf9de3d3c9d59091a6506aa201fbce384eed55 Command: COPY /micro . # buildkit	39.7 MB
	Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4 Command: ARG TARGETARCH	32 bytes
	Digest: sha256:00c86178b3d5f96eb2e67d53483bf0c6ec91df566611416f06f963e450b266f1 Command: COPY amd64/pilot-discovery /usr/local/bin/pilot-discovery # buildkit	31.9 MB
	Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4 Command: USER 1337:1337	32 bytes
	Digest: sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4 Command: ENTRYPOINT ["/usr/local/bin/pilot-discovery"]	32 bytes

pilot 6ce794366e728a8f693d61f5eb4…

One-liner (summary)

Description

License

Size

Downloads

Tags

Last scanned

Scan result

Vulnerability count

Max. severity

CVE-2026-4878: libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()

CVE-2026-35535: sudo: Sudo: Privilege escalation due to failure in privilege drop calls

CVE-2025-5278: coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification

CVE-2025-13034: curl: Public key pinning bypass via QUIC and GnuTLS allows server impersonation

CVE-2025-14017: curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers

CVE-2026-1965: curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication

CVE-2026-3783: curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect

CVE-2026-3784: curl: curl: Unauthorized access due to improper HTTP proxy connection reuse

CVE-2026-3805: curl: curl: Arbitrary code execution or Denial of Service via use-after-free in SMB request handling

CVE-2026-4873: curl: curl: Information disclosure due to incorrect TLS connection reuse

CVE-2026-5545: curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse

CVE-2026-5773: curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse

CVE-2026-6253: curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies

CVE-2026-6429: curl: libcurl: Credential leak via reused proxy connection during HTTP redirects

CVE-2026-7168: curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse

CVE-2026-4046: glibc: glibc: Denial of Service via iconv() function with specific character sets

CVE-2026-4437: glibc: glibc: Incorrect DNS response parsing via crafted DNS server response

CVE-2026-5435: glibc: glibc: Out-of-bounds write via TSIG record processing

CVE-2026-5450: glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width

CVE-2026-5928: glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings

CVE-2026-4046: glibc: glibc: Denial of Service via iconv() function with specific character sets

CVE-2026-4437: glibc: glibc: Incorrect DNS response parsing via crafted DNS server response

CVE-2026-5435: glibc: glibc: Out-of-bounds write via TSIG record processing

CVE-2026-5450: glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width

CVE-2026-5928: glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings

CVE-2026-4046: glibc: glibc: Denial of Service via iconv() function with specific character sets

CVE-2026-4437: glibc: glibc: Incorrect DNS response parsing via crafted DNS server response

CVE-2026-5435: glibc: glibc: Out-of-bounds write via TSIG record processing

CVE-2026-5450: glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width

CVE-2026-5928: glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings

CVE-2026-40355: krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism

CVE-2026-40356: krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read

CVE-2025-13034: curl: Public key pinning bypass via QUIC and GnuTLS allows server impersonation

CVE-2025-14017: curl: curl: Security bypass due to global TLS option changes in multi-threaded LDAPS transfers

CVE-2026-1965: curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication

CVE-2026-3783: curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect

CVE-2026-3784: curl: curl: Unauthorized access due to improper HTTP proxy connection reuse

CVE-2026-3805: curl: curl: Arbitrary code execution or Denial of Service via use-after-free in SMB request handling

CVE-2026-4873: curl: curl: Information disclosure due to incorrect TLS connection reuse

CVE-2026-5545: curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse

CVE-2026-5773: curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse

CVE-2026-6253: curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies

CVE-2026-6429: curl: libcurl: Credential leak via reused proxy connection during HTTP redirects

CVE-2026-7168: curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse

CVE-2025-4877: libssh: Write beyond bounds in binary to base64 conversion functions

CVE-2025-5351: libssh: Double Free Vulnerability in libssh Key Export Functions

CVE-2025-5372: libssh: Incorrect Return Code Handling in ssh_kdf() in libssh

CVE-2025-8114: libssh: NULL Pointer Dereference in libssh KEX Session ID Calculation

CVE-2026-0964: libssh: Improper sanitation of paths received from SCP servers

CVE-2026-0966: libssh: libssh: Denial of Service via zero-length input in ssh_get_hexa()

CVE-2026-3731: libssh: libssh: Denial of Service via out-of-bounds read in SFTP extension name handler

CVE-2025-4877: libssh: Write beyond bounds in binary to base64 conversion functions

CVE-2025-5351: libssh: Double Free Vulnerability in libssh Key Export Functions

CVE-2025-5372: libssh: Incorrect Return Code Handling in ssh_kdf() in libssh

CVE-2025-8114: libssh: NULL Pointer Dereference in libssh KEX Session ID Calculation

CVE-2026-0964: libssh: Improper sanitation of paths received from SCP servers

CVE-2026-0966: libssh: libssh: Denial of Service via zero-length input in ssh_get_hexa()

CVE-2026-3731: libssh: libssh: Denial of Service via out-of-bounds read in SFTP extension name handler

CVE-2026-22185: OpenLDAP: OpenLDAP LMDB: Denial of Service and Information Disclosure via Heap Buffer Underflow

CVE-2026-2673: openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group

CVE-2026-28390: openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing

CVE-2026-31790: openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key

CVE-2026-2673: openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group

CVE-2026-31790: openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key

CVE-2026-2673: openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group

CVE-2026-31790: openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key

CVE-2026-2673: openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group

CVE-2026-28390: openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing

CVE-2026-31790: openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key