Snyk test report
- quay.io/argoproj/argocd:v3.5.2/argoproj/argocd/Dockerfile (deb)
- quay.io/argoproj/argocd:v3.5.2/argoproj/argo-cd/v3//usr/local/bin/argocd (gomodules)
- quay.io/argoproj/argocd:v3.5.2//usr/local/bin/git-lfs (gomodules)
- quay.io/argoproj/argocd:v3.5.2//usr/local/bin/kustomize (gomodules)
- quay.io/argoproj/argocd:v3.5.2/helm/v4//usr/local/bin/helm (gomodules)
- quay.io/argoproj/argocd:v3.5.2/canonical/pebble//usr/bin/pebble (gomodules)
Improper Authentication
Detailed paths
Overview
Affected versions of this package are vulnerable to Improper Authentication via the ToASCII and ToUnicode functions. An attacker can bypass hostname validation by submitting Punycode-encoded labels that decode to ASCII-only labels, potentially leading to privilege escalation in applications that rely on these functions for security checks.
Note: The fix depends on the Go toolchain in use having Unicode version 16 or later, which is planned for the 1.27 release.
Remediation
Upgrade golang.org/x/net/idna to version 0.54.0 or higher.
References
Allocation of Resources Without Limits or Throttling
Detailed paths
Overview
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 DATA frame receive buffer handling, where each received fragment incurs per-fragment tracking and queue allocation overhead even while staying within the configured flow-control windows. An attacker can drive the process to an OutOfMemory condition or a runtime panic by opening gRPC streams and fragmenting payloads into millions of tiny HTTP/2 DATA frames, such as 1 byte each, across many concurrent multiplexed streams. This requires only the ability to establish gRPC stream connections to the server.
Remediation
Upgrade google.golang.org/grpc/mem to version 1.83.1 or higher.
References
Incorrect Authorization
Detailed paths
Overview
Affected versions of this package are vulnerable to Incorrect Authorization in the processing of xDS RBAC policies and HTTP/2 transport handling. An attacker can gain unauthorized access to protected services or cause denial of service by exploiting improper handling of unsupported fields in policy matchers, bypassing rapid reset mitigations, or triggering server panics through crafted policy updates.
Note: This advisory refers to several vulnerabilities as aggregated by the maintainer. For an exact breakdown and affected code, see the Maintainer's referenced advisory and commit.
Workaround
This vulnerability can be mitigated by ensuring xDS management servers do not push RBAC policies with unsupported fields or NOT rules wrapping unhandled fields, and by configuring upstream reverse proxies or load balancers with strict HTTP/2 max_concurrent_streams limits and active rate limiting on RST_STREAM frequency per connection.
Remediation
Upgrade google.golang.org/grpc/internal/transport to version 1.82.1 or higher.
References
Allocation of Resources Without Limits or Throttling
Detailed paths
Overview
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 DATA frame receive buffer handling, where each received fragment incurs per-fragment tracking and queue allocation overhead even while staying within the configured flow-control windows. An attacker can drive the process to an OutOfMemory condition or a runtime panic by opening gRPC streams and fragmenting payloads into millions of tiny HTTP/2 DATA frames, such as 1 byte each, across many concurrent multiplexed streams. This requires only the ability to establish gRPC stream connections to the server.
Remediation
Upgrade google.golang.org/grpc/internal/transport to version 1.83.1 or higher.
References
Uncaught Exception
Detailed paths
Overview
Affected versions of this package are vulnerable to Uncaught Exception through the HTTP/2 header processing path in internal/transport/http2_server.go and internal/xds/server/routing.go. An attacker can crash the server by sending a gRPC request that omits both the :authority and Host headers. In xds.NewGRPCServer() deployments, that malformed request reaches the xDS routing interceptor, which expects an authority value and then indexes into an empty header slice. The resulting panic terminates the server process, causing a complete outage for clients connected to that gRPC server.
Remediation
Upgrade google.golang.org/grpc/internal/transport to version 1.82.2, 1.83.2 or higher.
References
- GitHub Commit
- GitHub Commit
- GitHub Commit
- GitHub Issue
- GitHub PR
- GitHub PR
- GitHub PR
- Maintainer's Advisory
Allocation of Resources Without Limits or Throttling
Detailed paths
Overview
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 DATA frame receive buffer handling, where each received fragment incurs per-fragment tracking and queue allocation overhead even while staying within the configured flow-control windows. An attacker can drive the process to an OutOfMemory condition or a runtime panic by opening gRPC streams and fragmenting payloads into millions of tiny HTTP/2 DATA frames, such as 1 byte each, across many concurrent multiplexed streams. This requires only the ability to establish gRPC stream connections to the server.
Remediation
Upgrade google.golang.org/grpc/internal/mem to version 1.83.1 or higher.
References
Allocation of Resources Without Limits or Throttling
Detailed paths
Overview
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 DATA frame receive buffer handling, where each received fragment incurs per-fragment tracking and queue allocation overhead even while staying within the configured flow-control windows. An attacker can drive the process to an OutOfMemory condition or a runtime panic by opening gRPC streams and fragmenting payloads into millions of tiny HTTP/2 DATA frames, such as 1 byte each, across many concurrent multiplexed streams. This requires only the ability to establish gRPC stream connections to the server.
Remediation
Upgrade google.golang.org/grpc/internal/envconfig to version 1.83.1 or higher.
References
Infinite loop
Detailed paths
Overview
golang.org/x/net/http2 is a work-in-progress HTTP/2 implementation for Go.
Affected versions of this package are vulnerable to Infinite loop.
Go Vulnerability Report:
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
Remediation
Upgrade golang.org/x/net/http2 to version 0.53.0 or higher.
References
Allocation of Resources Without Limits or Throttling
Detailed paths
Overview
golang.org/x/crypto/ssh is a SSH client and server
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in its connection multiplexing, reached through Dial, NewClientConn, NewControlClientConn, and NewServerConn, which buffers unhandled messages that fall outside the RFC 4254 channel and global-request handling instead of treating them as protocol errors. A malicious peer can deadlock the entire SSH connection by sending unexpected messages once a channel has been established. This requires a completed handshake and an open SSH channel with the attacker as the peer.
Remediation
Upgrade golang.org/x/crypto/ssh to version 0.56.0 or higher.
References
Allocation of Resources Without Limits or Throttling
Detailed paths
Overview
golang.org/x/crypto/ssh is a SSH client and server
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the connection multiplexer's channel handling (the mux chanList), reached through Dial, NewClientConn, NewControlClientConn, and NewServerConn, where a channel that is registered but not yet established has its incomingRequests queue flooded without bound. A malicious peer can deadlock the entire SSH connection by flooding channel request packets for a channel before it becomes established. This requires the attacker to participate in an SSH connection with the victim over the library.
Remediation
Upgrade golang.org/x/crypto/ssh to version 0.56.0 or higher.
References
Integer Overflow
Detailed paths
Overview
Affected versions of this package are vulnerable to Integer Overflow leading to an out-of-bounds write in the s2.NewDict() function in s2/dict.go, which reads a uvarint and converts it to int without checking whether it exceeds MaxInt64. An attacker can crash the process with a segmentation fault by supplying S2 dictionary data whose repeat-index uvarint exceeds MaxInt64, which becomes a negative int that bypasses the index validation and drives out-of-bounds arithmetic through unsafe.Pointer in Dict.Encode(). Exploitation requires the application to build an S2 dictionary from attacker-controlled data with s2.NewDict() and then call Dict.Encode() on input of at least 32 bytes.
Remediation
Upgrade github.com/klauspost/compress/s2 to version 1.18.7 or higher.
References
Directory Traversal
Detailed paths
Overview
Affected versions of this package are vulnerable to Directory Traversal via the processing of reference names in dotgit. An attacker can modify or overwrite files outside the intended reference storage by supplying specially crafted reference names containing path traversal sequences. This is only exploitable if the application uses filesystem-backed storage and interacts with a malicious Git server or processes attacker-controlled reference names.
Workaround
This vulnerability can be mitigated by exclusively using in-memory storage or by validating reference names at the application level before passing them to filesystem-backed storage.
Details
A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.
Directory Traversal vulnerabilities can be generally divided into two types:
- Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.
st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.
If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.
curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa
Note %2e is the URL encoded version of . (dot).
- Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as
Zip-Slip.
One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.
The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:
2018-04-15 22:04:29 ..... 19 19 good.txt
2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys
Remediation
Upgrade github.com/go-git/go-git/v5/storage/filesystem/dotgit to version 5.19.2 or higher.
References
Directory Traversal
Detailed paths
Overview
github.com/go-git/go-git/v5/plumbing is a highly extensible git implementation library written in pure Go.
Affected versions of this package are vulnerable to Directory Traversal via the processing of reference names in dotgit. An attacker can modify or overwrite files outside the intended reference storage by supplying specially crafted reference names containing path traversal sequences. This is only exploitable if the application uses filesystem-backed storage and interacts with a malicious Git server or processes attacker-controlled reference names.
Workaround
This vulnerability can be mitigated by exclusively using in-memory storage or by validating reference names at the application level before passing them to filesystem-backed storage.
Details
A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.
Directory Traversal vulnerabilities can be generally divided into two types:
- Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.
st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.
If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.
curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa
Note %2e is the URL encoded version of . (dot).
- Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as
Zip-Slip.
One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.
The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:
2018-04-15 22:04:29 ..... 19 19 good.txt
2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys
Remediation
Upgrade github.com/go-git/go-git/v5/plumbing to version 5.19.2 or higher.
References
Symlink Attack
Detailed paths
Overview
Affected versions of this package are vulnerable to Symlink Attack in worktree_fs.go and worktree.go are vulnerable to symlink traversal in filesystem-backed worktrees. An attacker can modify or overwrite files outside the intended worktree by placing a symlink in the tree and then triggering a worktree operation, such as checkout, create, rename, or remove, against a path that resolves through that link. This can redirect writes into the repository’s .git metadata or another external target, leading to arbitrary file write and corruption of repository state, which can break subsequent Git operations and expose or alter files the application did not intend to touch.
Remediation
Upgrade github.com/go-git/go-git/v5 to version 5.19.2 or higher.
References
Out-of-bounds Write
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream zlib package and not the zlib package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.
Remediation
There is no fixed version for Ubuntu:26.04 zlib.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-85091
- https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490
- https://github.com/madler/zlib
- https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393
- https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate
Time-of-check Time-of-use (TOCTOU)
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.
Remediation
Upgrade Ubuntu:26.04 util-linux to version 2.41.3-3ubuntu2.2 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-27456
- https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4
- https://github.com/util-linux/util-linux/releases/tag/v2.41.4
- https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g
Authentication Bypass
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
A flaw was found in util-linux. Improper hostname canonicalization in the login(1) utility, when invoked with the -h option, can modify the supplied remote hostname before setting PAM_RHOST. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.
Remediation
Upgrade Ubuntu:26.04 util-linux to version 2.41.3-3ubuntu2.2 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-3184
- https://access.redhat.com/errata/RHSA-2026:7180
- https://access.redhat.com/security/cve/CVE-2026-3184
- https://bugzilla.redhat.com/show_bug.cgi?id=2442570
CVE-2026-53612
Detailed paths
NVD Description
This vulnerability has not been analyzed by NVD yet.
Remediation
Upgrade Ubuntu:26.04 util-linux to version 2.41.3-3ubuntu2.2 or higher.
References
CVE-2026-53614
Detailed paths
NVD Description
This vulnerability has not been analyzed by NVD yet.
Remediation
Upgrade Ubuntu:26.04 util-linux to version 2.41.3-3ubuntu2.2 or higher.
References
CVE-2026-53613
Detailed paths
NVD Description
This vulnerability has not been analyzed by NVD yet.
Remediation
Upgrade Ubuntu:26.04 util-linux to version 2.41.3-3ubuntu2.2 or higher.
References
CVE-2026-53615
Detailed paths
NVD Description
This vulnerability has not been analyzed by NVD yet.
Remediation
Upgrade Ubuntu:26.04 util-linux to version 2.41.3-3ubuntu2.2 or higher.
References
Use After Free
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.
Remediation
Upgrade Ubuntu:26.04 util-linux to version 2.41.3-3ubuntu2.2 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-13595
- https://access.redhat.com/errata/RHSA-2026:26573
- https://access.redhat.com/security/cve/CVE-2026-13595
- https://bugzilla.redhat.com/show_bug.cgi?id=2494101
- https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c
Link Following
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream tar package and not the tar package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.
Remediation
There is no fixed version for Ubuntu:26.04 tar.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-18508
- https://access.redhat.com/errata/RHSA-2026:50807
- https://access.redhat.com/security/cve/CVE-2026-18508
- https://bugzilla.redhat.com/show_bug.cgi?id=2509843
- https://access.redhat.com/errata/RHSA-2026:61581
- https://access.redhat.com/errata/RHSA-2026:61783
- https://access.redhat.com/errata/RHSA-2026:61586
- https://access.redhat.com/errata/RHSA-2026:66018
Time-of-check Time-of-use (TOCTOU)
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream tar package and not the tar package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.
Remediation
There is no fixed version for Ubuntu:26.04 tar.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-18477
- https://access.redhat.com/errata/RHSA-2026:49361
- https://access.redhat.com/security/cve/CVE-2026-18477
- https://bugzilla.redhat.com/show_bug.cgi?id=2509735
- https://access.redhat.com/errata/RHSA-2026:61581
- https://access.redhat.com/errata/RHSA-2026:61783
- https://access.redhat.com/errata/RHSA-2026:61586
- https://access.redhat.com/errata/RHSA-2026:66018
CVE-2026-39113
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream sqlite3 package and not the sqlite3 package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and later snapshots/builds allows an attacker to cause a denial of service via the ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), uncompress() components
Remediation
There is no fixed version for Ubuntu:26.04 sqlite3.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-39113
- https://github.com/20000419/CVE-2026-39113
- https://github.com/sqlite/sqlite/blob/169f68ed88b34cb68f720191c64c058f2ccec508/ext/misc/sqlar.c
- https://github.com/sqlite/sqlite/commit/169f68ed88b34cb68f720191c64c058f2ccec508
- https://www.sqlite.org/
- https://www.sqlite.org/sqlar.html
CVE-2026-35350
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved.
Remediation
There is no fixed version for Ubuntu:26.04 rust-coreutils.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35350
- https://github.com/uutils/coreutils/issues/9750
CVE-2026-35357
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
The cp utility in uutils coreutils is vulnerable to an information disclosure race condition. Destination files are initially created with umask-derived permissions (e.g., 0644) before being restricted to their final mode (e.g., 0600) later in the process. A local attacker can race to open the file during this window; once obtained, the file descriptor remains valid and readable even after the permissions are tightened, exposing sensitive or private file contents.
Remediation
There is no fixed version for Ubuntu:26.04 rust-coreutils.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35357
- https://github.com/uutils/coreutils/issues/10011
CVE-2026-35374
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the split utility of uutils coreutils. The program attempts to prevent data loss by checking for identity between input and output files using their file paths before initiating the split operation. However, the utility subsequently opens the output file with truncation after this path-based validation is complete. A local attacker with write access to the directory can exploit this race window by manipulating mutable path components (e.g., swapping a path with a symbolic link). This can cause split to truncate and write to an unintended target file, potentially including the input file itself or other sensitive files accessible to the process, leading to permanent data loss.
Remediation
There is no fixed version for Ubuntu:26.04 rust-coreutils.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35374
- https://github.com/uutils/coreutils/pull/11401
CVE-2026-35373
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory forms (e.g., ln SOURCE... DIRECTORY). While GNU ln treats filenames as raw bytes and creates the links correctly, the uutils implementation enforces UTF-8 encoding, resulting in a failure to stat the file and a non-zero exit code. In environments where automated scripts or system tasks process valid but non-UTF-8 filenames common on Unix filesystems, this divergence causes the utility to fail, leading to a local denial of service for those specific operations.
Remediation
There is no fixed version for Ubuntu:26.04 rust-coreutils.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35373
- https://github.com/uutils/coreutils/pull/11403
CVE-2026-35370
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of their effective GID to compute the group list, leading to potentially divergent output compared to GNU coreutils. Because many scripts and automated processes rely on the output of id to make security-critical access-control or permission decisions, this discrepancy can lead to unauthorized access or security misconfigurations.
Remediation
There is no fixed version for Ubuntu:26.04 rust-coreutils.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35370
- https://github.com/uutils/coreutils/issues/10006
CVE-2026-35341
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files. When mkfifo fails to create a FIFO because a file already exists at the target path, it fails to terminate the operation for that path and continues to execute a follow-up set_permissions call. This results in the existing file's permissions being changed to the default mode (often 644 after umask), potentially exposing sensitive files such as SSH private keys to other users on the system.
Remediation
There is no fixed version for Ubuntu:26.04 rust-coreutils.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35341
- https://github.com/uutils/coreutils/issues/10020
CVE-2026-35367
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (0644). In multi-user environments, this allows any user on the system to read the captured stdout/stderr output of a command, potentially exposing sensitive information. This behavior diverges from GNU coreutils, which creates nohup.out with owner-only (0600) permissions.
Remediation
There is no fixed version for Ubuntu:26.04 rust-coreutils.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35367
- https://github.com/uutils/coreutils/issues/10021
CVE-2026-35368
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this can trigger the Name Service Switch (NSS) to load shared libraries (e.g., libnss_*.so.2) from the new root directory. If the NEWROOT is writable by an attacker, they can inject a malicious NSS module to execute arbitrary code as root, facilitating a full container escape or privilege escalation.
Remediation
There is no fixed version for Ubuntu:26.04 rust-coreutils.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35368
- https://github.com/uutils/coreutils/issues/10327
CVE-2026-35354
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based system calls that perform fresh path-to-inode lookups for each operation. A local attacker with write access to the directory can exploit this race to swap files between calls, causing the destination file to receive an inconsistent mix of security xattrs, such as SELinux labels or file capabilities.
Remediation
There is no fixed version for Ubuntu:26.04 rust-coreutils.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35354
- https://github.com/uutils/coreutils/issues/10014
CVE-2026-35348
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect(), causing an immediate crash when encountering valid but non-UTF-8 paths. This diverges from GNU sort, which treats filenames as raw bytes. A local attacker can exploit this to crash the utility and disrupt automated pipelines.
Remediation
There is no fixed version for Ubuntu:26.04 rust-coreutils.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35348
- https://github.com/uutils/coreutils/issues/9696
CVE-2026-35371
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control.
Remediation
There is no fixed version for Ubuntu:26.04 rust-coreutils.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35371
- https://github.com/uutils/coreutils/issues/10006
CVE-2026-35364
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the destination path before recreating it through a copy operation. A local attacker with write access to the destination directory can exploit this window to replace the destination with a symbolic link. The subsequent privileged move operation will follow the symlink, allowing the attacker to redirect the write and overwrite an arbitrary target file with contents from the source.
Remediation
There is no fixed version for Ubuntu:26.04 rust-coreutils.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35364
- https://github.com/uutils/coreutils/issues/10015
CVE-2026-35351
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID rather than the source's metadata. This flaw breaks backups and migrations, causing files moved by a privileged user (e.g., root) to become root-owned unexpectedly, which can lead to information disclosure or restricted access for the intended owners.
Remediation
There is no fixed version for Ubuntu:26.04 rust-coreutils.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35351
- https://github.com/uutils/coreutils/issues/9714
CVE-2026-35345
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting the contents of the link's target. In environments where a privileged user (e.g., root) monitors a log directory, a local attacker with write access to that directory can replace a log file with a symlink to a sensitive system file (such as /etc/shadow), causing tail to disclose the contents of the sensitive file.
Remediation
There is no fixed version for Ubuntu:26.04 rust-coreutils.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35345
- https://github.com/uutils/coreutils/issues/10328
CVE-2026-35360
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
The touch utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file creation. When the utility identifies a missing path, it later attempts creation using File::create(), which internally uses O_TRUNC. An attacker can exploit this window to create a file or swap a symlink at the target path, causing touch to truncate an existing file and leading to permanent data loss.
Remediation
There is no fixed version for Ubuntu:26.04 rust-coreutils.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35360
- https://github.com/uutils/coreutils/issues/10019
CVE-2026-35363
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility correctly refuses to delete . or .., it fails to recognize equivalent paths with trailing slashes, such as ./ or .///. An accidental or malicious execution of rm -rf ./ results in the silent recursive deletion of all contents within the current directory. The command further obscures the data loss by reporting a misleading 'Invalid input' error, which may cause users to miss the critical window for data recovery.
Remediation
There is no fixed version for Ubuntu:26.04 rust-coreutils.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35363
- https://github.com/uutils/coreutils/issues/9749
CVE-2026-35344
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts, as the utility may report a successful operation even when the destination file contains old or garbage data.
Remediation
There is no fixed version for Ubuntu:26.04 rust-coreutils.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35344
- https://github.com/uutils/coreutils/issues/9745
CVE-2026-35352
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mkfifo utility of uutils coreutils. The utility creates a FIFO and then performs a path-based chmod to set permissions. A local attacker with write access to the parent directory can swap the newly created FIFO for a symbolic link between these two operations. This redirects the chmod call to an arbitrary file, potentially enabling privilege escalation if the utility is run with elevated privileges.
Remediation
There is no fixed version for Ubuntu:26.04 rust-coreutils.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35352
- http://www.openwall.com/lists/oss-security/2026/05/04/4
- http://www.openwall.com/lists/oss-security/2026/05/04/5
- http://www.openwall.com/lists/oss-security/2026/05/04/6
- https://github.com/uutils/coreutils/issues/10020
CVE-2026-35359
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag. An attacker with concurrent write access can swap a regular file for a symbolic link during this window, causing a privileged cp process to copy the contents of arbitrary sensitive files into a destination controlled by the attacker.
Remediation
There is no fixed version for Ubuntu:26.04 rust-coreutils.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35359
- https://github.com/uutils/coreutils/issues/10017
CVE-2026-35377
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line arguments when utilizing the -S (split-string) option. In GNU env, backslashes within single quotes are treated literally (with the exceptions of \ and '). However, the uutils implementation incorrectly attempts to validate these sequences, resulting in an "invalid sequence" error and an immediate process termination with an exit status of 125 when encountering valid but unrecognized sequences like \a or \x. This divergence from GNU behavior breaks compatibility for automated scripts and administrative workflows that rely on standard split-string semantics, leading to a local denial of service for those operations.
Remediation
There is no fixed version for Ubuntu:26.04 rust-coreutils.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35377
- https://github.com/uutils/coreutils/pull/11512
CVE-2026-12087
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
Socket versions before 2.041 for Perl have an out-of-bounds heap read.
In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.
Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.
Remediation
Upgrade Ubuntu:26.04 perl to version 5.40.1-7ubuntu0.3 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-12087
- https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch
- https://metacpan.org/release/PEVANS/Socket-2.041/changes
- http://www.openwall.com/lists/oss-security/2026/06/15/10
CVE-2026-13221
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.
When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.
A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.
Remediation
Upgrade Ubuntu:26.04 perl to version 5.40.1-7ubuntu0.3 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-13221
- https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch
- https://github.com/Perl/perl5/issues/23388
- http://www.openwall.com/lists/oss-security/2026/07/13/5
CVE-2026-57432
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.
S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.
A template derived from untrusted input can read heap memory past the buffer and return it to the caller.
Remediation
Upgrade Ubuntu:26.04 perl to version 5.40.1-7ubuntu0.3 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-57432
- https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch
- https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch
- http://www.openwall.com/lists/oss-security/2026/07/13/6
CVE-2026-57433
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.
retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.
A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.
Remediation
Upgrade Ubuntu:26.04 perl to version 5.40.1-7ubuntu0.3 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-57433
- https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch
- http://www.openwall.com/lists/oss-security/2026/07/13/7
CVE-2026-15534
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.
The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.
A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.
Remediation
Upgrade Ubuntu:26.04 perl to version 5.40.1-7ubuntu0.2 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-15534
- https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch
- https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch
- http://www.openwall.com/lists/oss-security/2026/08/09/12
- http://www.openwall.com/lists/oss-security/2026/08/09/13
CVE-2026-19487
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.
The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.
Example:
"ABCDE" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE "ABCDE" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed
An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.
Remediation
Upgrade Ubuntu:26.04 perl to version 5.40.1-7ubuntu0.2 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-19487
- https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch
- http://www.openwall.com/lists/oss-security/2026/08/13/8
- https://github.com/Perl/perl5/issues/22892
Uncontrolled Recursion
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream p11-kit package and not the p11-kit package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.
Remediation
There is no fixed version for Ubuntu:26.04 p11-kit.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-13757
- https://access.redhat.com/errata/RHSA-2026:37469
- https://access.redhat.com/errata/RHSA-2026:38342
- https://access.redhat.com/errata/RHSA-2026:49668
- https://access.redhat.com/security/cve/CVE-2026-13757
- https://bugzilla.redhat.com/show_bug.cgi?id=2494556
- https://github.com/advisories/GHSA-p2wm-69qx-x25w
- https://access.redhat.com/errata/RHSA-2026:49667
- https://access.redhat.com/errata/RHSA-2026:53371
- https://access.redhat.com/errata/RHSA-2026:54387
- https://access.redhat.com/errata/RHSA-2026:54760
- https://access.redhat.com/errata/RHSA-2026:58981
Improper Restriction of Communication Channel to Intended Endpoints
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream openssh package and not the openssh package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may allow some manipulation of the forwarded session.
Remediation
There is no fixed version for Ubuntu:26.04 openssh.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-55655
- https://access.redhat.com/errata/RHSA-2026:36759
- https://access.redhat.com/errata/RHSA-2026:47755
- https://access.redhat.com/security/cve/CVE-2026-55655
- https://bugzilla.redhat.com/show_bug.cgi?id=2462250
- https://access.redhat.com/errata/RHSA-2026:47756
- https://access.redhat.com/errata/RHSA-2026:47757
- https://access.redhat.com/errata/RHSA-2026:54387
- https://access.redhat.com/errata/RHSA-2026:58981
Incorrect Resource Transfer Between Spheres
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream openssh package and not the openssh package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.
Remediation
Upgrade Ubuntu:26.04 openssh to version 1:10.2p1-2ubuntu3.6 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-73281
- https://www.openssh.org/releasenotes.html#10.5
Use After Free
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream openssh package and not the openssh package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
Remediation
Upgrade Ubuntu:26.04 openssh to version 1:10.2p1-2ubuntu3.6 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-73282
- https://www.openssh.org/releasenotes.html#10.5
Always-Incorrect Control Flow Implementation
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream openssh package and not the openssh package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.
Remediation
Upgrade Ubuntu:26.04 openssh to version 1:10.2p1-2ubuntu3.6 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-73283
- https://www.openssh.org/releasenotes.html#10.5
Heap-based Buffer Overflow
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size during Encrypt-then-MAC cipher negotiation. In the fullpacket() function in src/transport.c, the ETM path allocates a buffer of packet_length bytes but copies blocksize minus one bytes via memcpy, causing an overflow that on 32-bit glibc writes attacker-controlled bytes into an adjacent chunk's SIZE field, enabling tcache bin confusion, overlapping live objects, and function pointer overwrite during the session handshake before authentication.
Remediation
Upgrade Ubuntu:26.04 libssh2 to version 1.11.1-1ubuntu0.26.04.4 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-66035
- https://github.com/libssh2/libssh2/commit/42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4
- https://github.com/libssh2/libssh2/pull/2198
- https://www.vulncheck.com/advisories/libssh2-heap-buffer-overflow-via-etm-cipher-negotiation
Out-of-bounds Read
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit the underflow in the expression computing blocksize minus aadlen minus authentication tag length to trigger an out-of-bounds read and a memcpy call with a near-SIZE_MAX length argument, causing immediate process crash before any authentication occurs.
Remediation
Upgrade Ubuntu:26.04 libssh2 to version 1.11.1-1ubuntu0.26.04.4 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-66033
- https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6
- https://github.com/libssh2/libssh2/pull/2401
- https://www.vulncheck.com/advisories/libssh2-integer-underflow-dos-via-aes-gcm-cipher-negotiation
Double Free
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.
Remediation
Upgrade Ubuntu:26.04 libssh2 to version 1.11.1-1ubuntu0.26.04.4 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-66032
- https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0
- https://github.com/libssh2/libssh2/pull/2180
- https://www.vulncheck.com/advisories/libssh2-double-free-heap-corruption-via-sftp-open
Incorrect Authorization
Detailed paths
Overview
golang.org/x/crypto/ssh is a SSH client and server
Affected versions of this package are vulnerable to Incorrect Authorization in NewServerConn, which applied the critical option from the Permissions returned by an authentication callback only on the PublicKeyCallback and VerifiedPublicKeyCallback paths and silently ignored it for PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin. An attacker can connect from an address the restriction was meant to exclude by authenticating through one of those unenforced callback paths. This affects only servers that set a source-address restriction from a password, keyboard-interactive, no-client-auth, or GSSAPI authentication callback and rely on it being enforced.
Note: This is a bypass of the fix for the vulnerability described in CVE-2026-46595.
Remediation
Upgrade golang.org/x/crypto/ssh to version 0.55.0 or higher.
References
CVE-2026-6368
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.
Remediation
Upgrade Ubuntu:26.04 glibc to version 2.43-2ubuntu2.4 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-6368
- https://sourceware.org/bugzilla/show_bug.cgi?id=34090
- https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0014;h=1e9a0039f07471ddfe6816e5df04875bec409f92;hb=HEAD
CVE-2026-6791
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.
Remediation
Upgrade Ubuntu:26.04 glibc to version 2.43-2ubuntu2.4 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-6791
- https://sourceware.org/bugzilla/show_bug.cgi?id=34091
CVE-2026-19499
Detailed paths
NVD Description
This vulnerability has not been analyzed by NVD yet.
Remediation
Upgrade Ubuntu:26.04 glibc to version 2.43-2ubuntu2.4 or higher.
References
CVE-2026-19542
Detailed paths
NVD Description
This vulnerability has not been analyzed by NVD yet.
Remediation
Upgrade Ubuntu:26.04 glibc to version 2.43-2ubuntu2.4 or higher.
References
CVE-2026-77117
Detailed paths
NVD Description
This vulnerability has not been analyzed by NVD yet.
Remediation
Upgrade Ubuntu:26.04 glibc to version 2.43-2ubuntu2.4 or higher.
References
CVE-2026-18374
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.
This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for ccs should not pass them through without validation.
Remediation
There is no fixed version for Ubuntu:26.04 glibc.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-18374
- https://sourceware.org/bugzilla/show_bug.cgi?id=34574
- https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015
- http://www.openwall.com/lists/oss-security/2026/08/27/6
CVE-2026-80489
Detailed paths
NVD Description
This vulnerability has not been analyzed by NVD yet.
Remediation
Upgrade Ubuntu:26.04 glibc to version 2.43-2ubuntu2.4 or higher.
References
Improper Validation of Specified Type of Input
Detailed paths
Overview
Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in the calls plugin when handling websocket messages containing malformed msgpack frames. An attacker can cause the server to consume excessive memory and crash by sending specially crafted websocket requests.
Remediation
There is no fixed version for github.com/vmihailenco/msgpack/v5.
References
Incorrect Authorization
Detailed paths
Overview
Affected versions of this package are vulnerable to Incorrect Authorization in the ServeHTTP method of ServeMux (runtime/mux.go), which rewrites r.Method from the client-supplied X-HTTP-Method-Override header on form-urlencoded POST requests without restricting the allowed methods. An attacker can reach handlers for restricted verbs such as DELETE, PUT, or PATCH, bypassing method-based access controls enforced at an upstream proxy or WAF, by sending a POST request with Content-Type: application/x-www-form-urlencoded and the override header set to the target method. This requires a deployment where a perimeter proxy or WAF filters on the wire method while trusting the gateway downstream, and a handler must exist for the overridden method.
Note: The WithDisablePathLengthFallback is added in version 2.29.0 but it is disabled by default.
Workaround
This vulnerability can be avoided by stripping the X-HTTP-Method-Override header at the perimeter proxy or WAF, so the enforced wire method is the one the gateway routes on.
Remediation
There is no fixed version for github.com/grpc-ecosystem/grpc-gateway/v2/runtime.
References
Incorrect Authorization
Detailed paths
Overview
Affected versions of this package are vulnerable to Incorrect Authorization in the ServeHTTP method of ServeMux (runtime/mux.go), which rewrites r.Method from the client-supplied X-HTTP-Method-Override header on form-urlencoded POST requests without restricting the allowed methods. An attacker can reach handlers for restricted verbs such as DELETE, PUT, or PATCH, bypassing method-based access controls enforced at an upstream proxy or WAF, by sending a POST request with Content-Type: application/x-www-form-urlencoded and the override header set to the target method. This requires a deployment where a perimeter proxy or WAF filters on the wire method while trusting the gateway downstream, and a handler must exist for the overridden method.
Note: The WithDisablePathLengthFallback is added in version 2.29.0 but it is disabled by default.
Workaround
This vulnerability can be avoided by stripping the X-HTTP-Method-Override header at the perimeter proxy or WAF, so the enforced wire method is the one the gateway routes on.
Remediation
There is no fixed version for github.com/grpc-ecosystem/grpc-gateway/runtime.
References
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Detailed paths
Overview
github.com/gorilla/websocket is a Go implementation of the WebSocket protocol.
Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) via the newMaskKey function in conn.go. An attacker can predict or recover WebSocket frame mask keys by causing the client side to generate masking values with math/rand, then use that predictability to inject content into WebSocket connections. The flaw affects WebSocket masking key generation for client frames, where unpredictable 32-bit keys are required. When the mask key can be guessed, an attacker can tamper with masked frame contents and disrupt or alter the data a user’s WebSocket connection sends or receives.
Remediation
Upgrade github.com/gorilla/websocket to version 1.5.3 or higher.
References
Improper Encoding or Escaping of Output
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream git package and not the git package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called "sideband channel". These messages will be prefixed with "remote:" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information, or to mislead the user into executing untrusted scripts. As requested on the git-security mailing list, the patches are under discussion on the public mailing list. Users are advised to update as soon as possible. Users unable to upgrade should avoid recursive clones unless they are from trusted sources.
Remediation
There is no fixed version for Ubuntu:26.04 git.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2024-52005
- https://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329
- https://lore.kernel.org/git/1M9FnZ-1taoNo1wwh-00ESSd@mail.gmx.net
Algorithmic Complexity
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.
Remediation
There is no fixed version for Ubuntu:26.04 expat.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-66382
- https://github.com/libexpat/libexpat/issues/1076
- http://www.openwall.com/lists/oss-security/2025/12/02/1
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://cert-portal.siemens.com/productcert/html/ssa-253495.html
NULL Pointer Dereference
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.
Remediation
There is no fixed version for Ubuntu:26.04 expat.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-32776
- https://github.com/libexpat/libexpat/pull/1158
- https://github.com/libexpat/libexpat/pull/1159
Loop with Unreachable Exit Condition ('Infinite Loop')
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
libexpat before 2.7.5 allows an infinite loop while parsing DTD content.
Remediation
There is no fixed version for Ubuntu:26.04 expat.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-32777
- https://github.com/libexpat/libexpat/issues/1161
- https://github.com/libexpat/libexpat/pull/1159
- https://github.com/libexpat/libexpat/pull/1162
- https://issues.oss-fuzz.com/issues/486993411
NULL Pointer Dereference
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.
Remediation
There is no fixed version for Ubuntu:26.04 expat.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-32778
- https://github.com/libexpat/libexpat/pull/1159
- https://github.com/libexpat/libexpat/pull/1163
Insufficient Entropy
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
Remediation
There is no fixed version for Ubuntu:26.04 expat.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-41080
- https://github.com/libexpat/libexpat/issues/47
- https://github.com/libexpat/libexpat/pull/1183
- https://blog.hartwork.org/posts/expat-2-8-0-released/
- https://www.openwall.com/lists/oss-security/2026/04/26/1
- http://www.openwall.com/lists/oss-security/2026/04/26/1
Algorithmic Complexity
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.
Remediation
There is no fixed version for Ubuntu:26.04 expat.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45186
- https://github.com/libexpat/libexpat/pull/1216
- http://www.openwall.com/lists/oss-security/2026/05/11/16
- https://access.redhat.com/errata/RHSA-2026:22715
- https://access.redhat.com/errata/RHSA-2026:22721
- https://access.redhat.com/errata/RHSA-2026:23230
- https://access.redhat.com/errata/RHSA-2026:26319
- https://access.redhat.com/errata/RHSA-2026:27201
- https://access.redhat.com/errata/RHSA-2026:29197
- https://access.redhat.com/security/cve/CVE-2026-45186
- https://bugzilla.redhat.com/show_bug.cgi?id=2468575
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45186.json
- https://access.redhat.com/errata/RHSA-2026:58981
Use After Free
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,
Remediation
There is no fixed version for Ubuntu:26.04 expat.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-50219
- https://github.com/libexpat/libexpat/pull/1246
Integer Overflow or Wraparound
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
libexpat before 2.8.2 has an integer overflow in addBinding.
Remediation
There is no fixed version for Ubuntu:26.04 expat.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-56404
- https://github.com/libexpat/libexpat/pull/1249
Integer Overflow or Wraparound
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
Remediation
There is no fixed version for Ubuntu:26.04 expat.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-56411
- https://github.com/libexpat/libexpat/pull/1263
Integer Overflow or Wraparound
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
libexpat before 2.8.2 has an integer overflow in copyString.
Remediation
There is no fixed version for Ubuntu:26.04 expat.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-56408
- https://github.com/libexpat/libexpat/commit/16e2efd867ea8567ffa012210b52ef5918e20817
Integer Overflow or Wraparound
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
Remediation
There is no fixed version for Ubuntu:26.04 expat.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-56410
- https://github.com/libexpat/libexpat/pull/1252
Integer Overflow or Wraparound
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
libexpat before 2.8.2 has an integer overflow in getAttributeId.
Remediation
There is no fixed version for Ubuntu:26.04 expat.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-56405
- https://github.com/libexpat/libexpat/pull/1251
Use After Free
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).
Remediation
There is no fixed version for Ubuntu:26.04 expat.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-56131
- https://github.com/libexpat/libexpat/pull/1267
Use After Free
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.
Remediation
There is no fixed version for Ubuntu:26.04 expat.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-56412
- https://github.com/libexpat/libexpat/pull/1278
Incorrect Synchronization
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.
Remediation
There is no fixed version for Ubuntu:26.04 expat.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-56132
- https://github.com/libexpat/libexpat/pull/1272
Integer Overflow or Wraparound
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.
Remediation
There is no fixed version for Ubuntu:26.04 expat.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-56407
- https://github.com/libexpat/libexpat/pull/1262
Integer Overflow or Wraparound
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.
Remediation
There is no fixed version for Ubuntu:26.04 expat.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-56406
- https://github.com/libexpat/libexpat/pull/1255
Integer Overflow or Wraparound
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.
Remediation
There is no fixed version for Ubuntu:26.04 expat.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-56409
- https://github.com/libexpat/libexpat/pull/1259
Integer Overflow or Wraparound
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
libexpat before 2.8.2 has an integer overflow in storeAtts.
Remediation
There is no fixed version for Ubuntu:26.04 expat.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-56403
- https://github.com/libexpat/libexpat/pull/1232
Out-of-bounds Read
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.
Remediation
There is no fixed version for Ubuntu:26.04 expat.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-72522
- https://bugzilla.mozilla.org/show_bug.cgi?id=2053153
- https://github.com/libexpat/libexpat/pull/1296
- http://www.openwall.com/lists/oss-security/2026/08/11/5
Algorithmic Complexity
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.
Remediation
There is no fixed version for Ubuntu:26.04 expat.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-66046
- https://github.com/libexpat/libexpat/pull/1321
- https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity
Use After Free
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
Remediation
There is no fixed version for Ubuntu:26.04 expat.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-76957
- https://github.com/libexpat/libexpat/pull/1322
- https://github.com/libexpat/libexpat/pull/1329
Out-of-bounds Read
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.
Remediation
There is no fixed version for Ubuntu:26.04 expat.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-76641
- https://github.com/libexpat/libexpat/commit/98599f6dcc2b460410881fe420f5f55d6bec63bf
- https://github.com/libexpat/libexpat/pull/1331
- https://www.vulncheck.com/advisories/expat-out-of-bounds-read-via-dtdcopy
Integer Overflow or Wraparound
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream diffutils package and not the diffutils package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing. An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment.
This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815
NOTE: The project maintainers claim that this is not a security issue. They state that the worst outcome this issue can cause is a crash of diff and that it cannot be used to escalate privileges.
Remediation
Upgrade Ubuntu:26.04 diffutils to version 1:3.12-1ubuntu0.1 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-53910
- https://cert.pl/en/posts/2026/07/CVE-2026-53910
- https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=73ed7ce85cc78effb94daf028c9af6b4e5252e50
- https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=9ff04d5b84743e331e80b589335a52c5480d1815
- https://git.savannah.gnu.org/cgit/diffutils.git/
CVE-2026-13608
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.
Remediation
There is no fixed version for Ubuntu:26.04 curl.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-13608
- https://curl.se/docs/CVE-2026-13608.html
- https://curl.se/docs/CVE-2026-13608.json
- https://hackerone.com/reports/3822248
CVE-2026-18924
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.
Remediation
There is no fixed version for Ubuntu:26.04 curl.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-18924
- https://curl.se/docs/CVE-2026-18924.html
- https://curl.se/docs/CVE-2026-18924.json
- https://hackerone.com/reports/3916059
CVE-2026-19931
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
Remediation
There is no fixed version for Ubuntu:26.04 curl.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-19931
- https://curl.se/docs/CVE-2026-19931.html
- https://curl.se/docs/CVE-2026-19931.json
- https://hackerone.com/reports/3923520
CVE-2026-80255
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
A Set-Cookie: header using tab (horizontal tab, ASCII code 9) instead of
space (ascii code 32) immediately before the Secure attribute causes curl to
store the cookie without its Secure flag. The cookie might then wrongfully be
sent over plaintext HTTP on subsequent requests to the same host.
Remediation
There is no fixed version for Ubuntu:26.04 curl.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-80255
- https://curl.se/docs/CVE-2026-80255.html
- https://curl.se/docs/CVE-2026-80255.json
- https://hackerone.com/reports/3972395
CVE-2026-80230
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable
standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and
CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on
connections established without a presented server certificate. Bypassing the
pinning check under these disabled-verification conditions allows
unauthenticated connections to succeed when they should be rejected.
Remediation
There is no fixed version for Ubuntu:26.04 curl.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-80230
- https://curl.se/docs/CVE-2026-80230.html
- https://curl.se/docs/CVE-2026-80230.json
- https://hackerone.com/reports/3969300
CVE-2026-82209
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
When libpsl support is enabled, libcurl fails to enforce the Public Suffix
List boundary check when processing a Set-Cookie header where the Domain
attribute explicitly matches an origin host that is itself a public suffix
(e.g., Domain=co.uk set by co.uk).
Instead of coercing it into a strict host-only cookie, libcurl saves the
cookie with wildcard domain scope (.co.uk). Consequently, the cookie is
inappropriately included in subsequent outbound requests or HTTP redirects to
arbitrary sibling subdomains under the same public suffix (e.g.,
attacker.co.uk).
Remediation
There is no fixed version for Ubuntu:26.04 curl.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-82209
- https://curl.se/docs/CVE-2026-82209.html
- https://curl.se/docs/CVE-2026-82209.json
- https://hackerone.com/reports/3972385
CVE-2026-80229
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.
Remediation
There is no fixed version for Ubuntu:26.04 curl.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-80229
- https://curl.se/docs/CVE-2026-80229.html
- https://curl.se/docs/CVE-2026-80229.json
- https://hackerone.com/reports/3969255
Out-of-bounds Read
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream coreutils package and not the coreutils package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.
When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.
This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.
Remediation
Upgrade Ubuntu:26.04 coreutils to version 9.7-3ubuntu2.1 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-56391
- https://cert.pl/en/posts/2026/07/CVE-2026-56391
- https://git.savannah.gnu.org/cgit/coreutils.git/
- https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371
Link Following
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream attr package and not the attr package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.
Remediation
Upgrade Ubuntu:26.04 attr to version 1:2.5.2-4ubuntu0.1 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-54371
- https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f
- https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b
- https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr
- https://access.redhat.com/security/cve/CVE-2026-54371
- https://bugzilla.redhat.com/show_bug.cgi?id=2490283
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json
- https://access.redhat.com/errata/RHSA-2026:34889
- https://access.redhat.com/errata/RHSA-2026:56133
- https://access.redhat.com/errata/RHSA-2026:59380
- https://access.redhat.com/errata/RHSA-2026:60226
- https://access.redhat.com/errata/RHSA-2026:61783
- https://access.redhat.com/errata/RHSA-2026:63135
- https://access.redhat.com/errata/RHSA-2026:63138
- https://access.redhat.com/errata/RHSA-2026:66018
Improper Validation of Specified Quantity in Input
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream zlib package and not the zlib package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.
Remediation
Upgrade Ubuntu:26.04 zlib to version 1:1.3.dfsg+really1.3.1-1ubuntu3.1 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-27171
- https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit/
- https://github.com/madler/zlib/releases/tag/v1.3.2
- https://ostif.org/zlib-audit-complete/
- https://github.com/madler/zlib/issues/904
- https://7asecurity.com/reports/pentest-report-zlib-RC1.1.pdf
Incorrect Resource Transfer Between Spheres
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToWall=yes is set.
Remediation
There is no fixed version for Ubuntu:26.04 systemd.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-40228
- https://www.openwall.com/lists/oss-security/2026/04/08/1
- http://www.openwall.com/lists/oss-security/2026/05/05/1
CVE-2024-56433
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream shadow package and not the shadow package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.
Remediation
There is no fixed version for Ubuntu:26.04 shadow.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2024-56433
- https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241
- https://github.com/shadow-maint/shadow/issues/1157
- https://github.com/shadow-maint/shadow/releases/tag/4.4
CVE-2026-75803
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function.
Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages.
CWE: CWE-354 (Improper Validation of Integrity Check Value)
Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case.
FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module.
Remediation
Upgrade Ubuntu:26.04 openssl to version 3.5.5-1ubuntu3.5 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-75803
- https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42
- https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e05b
- https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a
- https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34
- https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9
- https://openssl-library.org/news/secadv/20260825.txt
Out-of-bounds Read
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream openssh package and not the openssh package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.
Remediation
There is no fixed version for Ubuntu:26.04 openssh.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-55654
- https://access.redhat.com/errata/RHSA-2026:36759
- https://access.redhat.com/errata/RHSA-2026:47756
- https://access.redhat.com/errata/RHSA-2026:47757
- https://access.redhat.com/security/cve/CVE-2026-55654
- https://bugzilla.redhat.com/show_bug.cgi?id=2462493
- https://access.redhat.com/errata/RHSA-2026:54387
- https://access.redhat.com/errata/RHSA-2026:58981
Covert Timing Channel
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream libgcrypt20 package and not the libgcrypt20 package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.
Remediation
Upgrade Ubuntu:26.04 libgcrypt20 to version 1.12.0-2ubuntu1.1 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2024-2236
- https://access.redhat.com/errata/RHSA-2024:9404
- https://bugzilla.redhat.com/show_bug.cgi?id=2268268
- https://access.redhat.com/errata/RHSA-2025:3534
- https://access.redhat.com/errata/RHSA-2025:3530
- https://access.redhat.com/security/cve/CVE-2024-2236
- https://bugzilla.redhat.com/show_bug.cgi?id=2245218
CVE-2026-57062
Detailed paths
NVD Description
This vulnerability has not been analyzed by NVD yet.
Remediation
Upgrade Ubuntu:26.04 gnupg2 to version 2.4.8-4ubuntu3.1 or higher.
References
CVE-2026-8932
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.
libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.
Remediation
Upgrade Ubuntu:26.04 curl to version 8.18.0-1ubuntu2.5 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-8932
- https://curl.se/docs/CVE-2026-8932.html
- https://curl.se/docs/CVE-2026-8932.json
- https://hackerone.com/reports/3733910
Stack-based Buffer Overflow
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream coreutils package and not the coreutils package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.
Remediation
Upgrade Ubuntu:26.04 coreutils to version 9.7-3ubuntu2.1 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-5278
- https://access.redhat.com/security/cve/CVE-2025-5278
- https://bugzilla.redhat.com/show_bug.cgi?id=2368764
- http://www.openwall.com/lists/oss-security/2025/05/27/2
- http://www.openwall.com/lists/oss-security/2025/05/29/1
- https://cgit.git.savannah.gnu.org/cgit/coreutils.git/tree/NEWS?id=8c9602e3a145e9596dc1a63c6ed67865814b6633#n14
- https://security-tracker.debian.org/tracker/CVE-2025-5278
- http://www.openwall.com/lists/oss-security/2025/05/29/2
- https://debbugs.gnu.org/cgi/bugreport.cgi?bug=78507
- https://access.redhat.com/errata/RHSA-2026:28911
- https://access.redhat.com/errata/RHSA-2026:33124
- https://access.redhat.com/errata/RHSA-2026:33313
- https://access.redhat.com/errata/RHSA-2026:33612
- https://access.redhat.com/errata/RHSA-2026:34102
- https://access.redhat.com/errata/RHSA-2026:39981
- https://access.redhat.com/errata/RHSA-2026:44481
- https://access.redhat.com/errata/RHSA-2026:46836
- https://access.redhat.com/errata/RHSA-2026:50205
- https://access.redhat.com/errata/RHSA-2026:58981
- https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633
Out-of-bounds Write
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream bzip2 package and not the bzip2 package as distributed by Ubuntu.
See How to fix? for Ubuntu:26.04 relevant fixed versions and status.
bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).
This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67
Remediation
Upgrade Ubuntu:26.04 bzip2 to version 1.0.8-6ubuntu0.1 or higher.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-42250
- https://cert.pl/en/posts/2026/05/CVE-2026-42250/
- https://sourceware.org/bzip2/
- https://inbox.sourceware.org/bzip2-devel/20260528145407.293768-1-mark@klomp.org/
- https://sourceware.org/cgit/bzip2/commit/?id=35d122a3df8b0cc4082a4d89fdc6ee99f375fe67