oss-security mailing list - 2026/10

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [year] [list]

oss-security mailing list - 2026/10

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 30	² 8	³	⁴ 2
⁵ 17	⁶ 3	⁷ 33	⁸ 10	⁹ 21	¹⁰ 8	¹¹ 1
¹² 7	¹³ 12	¹⁴	¹⁵	¹⁶	¹⁷	¹⁸
¹⁹	²⁰	²¹	²²	²³	²⁴	²⁵
²⁶	²⁷	²⁸	²⁹	³⁰	³¹

Messages by day:

October 1 (30 messages)

CVE-2026-88789: Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/styles… (James Netherton <jamesnetherton@...che.…)
CVE-2026-78242: Apache APISIX: data-mask may fail to redact request headers in logger output (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-82806: Apache APISIX: cross-request permission pollution via static permission list mutation (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-94212: Apache APISIX: unauthenticated impersonation issue in saml-auth (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-94220: Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-94250: Apache APISIX: Batch response aggregation can exhaust worker memory (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-94269: Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-94276: Apache APISIX: Openid-connect introspection validation issue (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-102504: Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels… (Stig Palmquist <stig@...g.io>)
CVE-2026-102505: Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_g… (Stig Palmquist <stig@...g.io>)
CVE-2026-42356: Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories (Eric Covener <covener@...che.org>)
CVE-2026-42528: Apache HTTP Server: mod_dav shared lock overflow (Eric Covener <covener@...che.org>)
CVE-2026-46729: Apache HTTP Server: mod_heartmonitor denial of service (Eric Covener <covener@...che.org>)
CVE-2026-47360: Apache HTTP Server: mod_session: Session cookie not removed during internal redirect (Eric Covener <covener@...che.org>)
CVE-2026-48005: Apache HTTP Server: mod_auth_digest reauthentication attack (Eric Covener <covener@...che.org>)
CVE-2026-56153: Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char (Eric Covener <covener@...che.org>)
CVE-2026-56154: Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...} (Eric Covener <covener@...che.org>)
CVE-2026-56449: Apache HTTP Server: mod_proxy_html: crash in dump_content (Eric Covener <covener@...che.org>)
CVE-2026-57941: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy (Eric Covener <covener@...che.org>)
CVE-2026-58415: Apache HTTP Server: mod_dav_fs property database read access (Eric Covener <covener@...che.org>)
CVE-2026-59685: Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTE… (Eric Covener <covener@...che.org>)
CVE-2026-59797: Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function (Eric Covener <covener@...che.org>)
CVE-2026-63045: Apache HTTP Server: mod_proxy_ftp PASV address handling (Eric Covener <covener@...che.org>)
CVE-2026-63292: Apache HTTP Server: mod_vhost_alias stack overflow (Eric Covener <covener@...che.org>)
CVE-2026-63686: Apache HTTP Server: mod_xml2enc crash on charset conversion failure (Eric Covener <covener@...che.org>)
CVE-2026-63718: Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling (Eric Covener <covener@...che.org>)
CVE-2026-73636: Apache HTTP Server: mod_auth_digest one-time-nonce replay attack (Eric Covener <covener@...che.org>)
CVE-2026-73637: Apache HTTP Server: mod_auth_digest DoS attack (Eric Covener <covener@...che.org>)
CVE-2026-79768: Apache HTTP Server: mod_userdir information disclosure (Eric Covener <covener@...che.org>)
CVE-2026-93546: Apache HTTP Server: mod_dav_fs namespace overflow (Eric Covener <covener@...che.org>)

October 2 (8 messages)

CVE-2026-102795: Apache Traffic Server: SNI to Host header matching policy is not properly enforced (supersedes CVE-2026-41… (Masakazu Kitajo <maskit@...che.org>)
CVE-2026-59265: Apache OpenOffice: Opening a malicious document can lead to system takeover (Dave Fisher <wave@...che.org>)
CVE-2026-102731: Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode (Emmanuel Lécharny <elecharny@...che.org>)
CVE-2026-103552: Apache Directory LDAP API: A unbound client can send a deeply nested search filter that overflows the … (Emmanuel Lécharny <elecharny@...che.or…)
CVE-2026-103877: Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements (Emmanuel Lécharny <elecharny@...che.org>)
CVE-2026-103878: Apache Directory LDAP API: Injection of plaintext responses during StartTLS (Emmanuel Lécharny <elecharny@...che.org>)
CVE-2026-103880: Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords (Emmanuel Lécharny <elecharny@...che.org>)
CVE-2026-103885: Apache Directory LDAP API: Denial of service via crafted telephone number values (Emmanuel Lécharny <elecharny@...che.org>)

October 4 (2 messages)

Apache Thrift 0.25.0: 61 CVEs fixed (combined announcement) (Jens Geyer <jensg@...che.org>)
cloud computing provider disclosures (Jan Schaumann <jschauma@...meister.org>)

October 5 (17 messages)

Re: cloud computing provider disclosures (Jonathan Wright <jonathan@...alinux.org>)
Re: cloud computing provider disclosures (Demi Marie Obenour <demiobenour@...il.com>)
Re: cloud computing provider disclosures (Aaron Rainbolt <arraybolt3@...il.com>)
Re: cloud computing provider disclosures (Katie <katie@...ricane.ca>)
openjpeg 2.4.0 through 2.5.4 and git master: heap buffer overflow in opj_dwt_encode_and_deinterleave_v() (reversible 5/… ("Security @ Red Eagle Tech" <security@r…)
[cups] Multiple security fixes in incoming new version 2.4.20 (Zdenek Dohnal <zdohnal@...hat.com>)
CVE-2019-25777: YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which c… (Stig Palmquist <stig@...g.io>)
CVE-2017-20285: YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes (Stig Palmquist <stig@...g.io>)
CVE-2026-19954: Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for th… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-104711: Apache Struts: OGNL injection in the legacy RESTful action mapper (Lukasz Lenart <lukaszlenart@...che.org>)
CVE-2026-104712: Apache Struts: Disproportionate response size when rendering BigDecimal request parameters (Lukasz Lenart <lukaszlenart@...che.org>)
CVE-2026-104713: Apache Struts: Unbounded request body read in the REST plugin (Lukasz Lenart <lukaszlenart@...che.org>)
CVE-2026-104714: Apache Struts: Shared message formatter exposes date and time values across concurrent requests (Lukasz Lenart <lukaszlenart@...che.org>)
Re: cloud computing provider disclosures (Jan Schaumann <jschauma@...meister.org>)
Re: cloud computing provider disclosures (Jeremy Stanley <fungi@...goth.org>)
libexpat 2.9.0 fixes two vulnerabilities (Sebastian Pipping <sebastian@...ping.org>)
Fwd: [Freeipmi-announce] FreeIPMI 1.6.20 Released (Chad Dougherty <crd@...rew.cmu.edu>)

October 6 (3 messages)

CVE-2026-104380: Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an … (Timothy Legge <timlegge@...nsec.org>)
Announce: OpenSSH 10.6 released (Damien Miller <djm@....openbsd.org>)
Django CVE-2026-77050, CVE-2026-84429, CVE-2026-87890, and CVE-2026-87975 (Sarah Boyce <sarahboyce@...ngoproject.com>)

October 7 (33 messages)

CVE-2026-96659: Foreman: excessive Viewer permissions on preview (fixed in 3.19.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-96658: Foreman: Safemode bypass leading to RCE (fixed in 3.19.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-56098: Katello: Registry Proxy authorization bypass (fixed in 4.21.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-56097: Katello: SQL injection in Registry Proxy labels (fixed in 4.21.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-12545: Hammer CLI: editor command injection (fixed in 3.19.1, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-12544: Foreman: SSTI and unsafe deserialization in configuration (fixed in 3.19.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-12542: Foreman: command injection in foreman-tail (fixed in 3.19.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-12541: Foreman: command injection in foreman-rake database tasks (fixed in 3.19.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-12540: Foreman: command injection in foreman-rake errors:fetch_log (fixed in 3.19.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-12423: Foreman: provisioning token validation flaw (fixed in 3.19.2, 5.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-12405: Foreman Remote Execution: command injection via effective_user (fixed in 16.6.6, 17.2.2, 18.0.1) (Ondrej Gajdusek <ogajduse@...hat.com>)
CVE-2026-94114: Apache Commons BCEL: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser ("Gary D. Gregory" <ggregory@...che.org>)
CVE-2026-105111: Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS ("Gary D. Gregory" <ggregory@...che.org>)
CVE-2026-105239: Apache log4net: NUL character truncates EventLogAppender records (Jan Friedrich <freeandnil@...che.org>)
CVE-2026-105241: Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch (Jan Friedrich <freeandnil@...che.org>)
CVE-2026-105242: Apache log4net: Request validation failure drops the event in the aspnet-request converter (Jan Friedrich <freeandnil@...che.org>)
CVE-2026-105243: Apache log4net: Oversize EventLogAppender record silently discarded (Jan Friedrich <freeandnil@...che.org>)
CVE-2026-105240: Apache log4net: NUL character truncates OutputDebugStringAppender records (Jan Friedrich <freeandnil@...che.org>)
CVE-2026-105244: Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content (Jan Friedrich <freeandnil@...che.org>)
CVE-2026-90466: Apache Impala: Path traversal executes JARs outside trusted paths (Michael Smith <michaelsmith@...che.org>)
CVE-2026-93684: Apache Impala: Stored XSS in Impala query plans (Michael Smith <michaelsmith@...che.org>)
CVE-2026-97720: Apache Impala: Impala Executor Webserver Auth Bypass (Michael Smith <michaelsmith@...che.org>)
FW: X.Org Security Advisory: multiple security issues in X.Org X server (Peter Hutterer <peter.hutterer@...-t.net>)
CVE-2026-78243: Apache YuniKorn: LDAP Group provider panics on lowercase attribute name (Wilfred Spiegelenburg <wilfreds@...che.org>)
CVE-2026-92393: Apache YuniKorn: Admission control bypass via workload UPDATE operation (Wilfred Spiegelenburg <wilfreds@...che.org>)
CVE-2026-97146: Apache YuniKorn: Admission control bypass via system label forgery (Wilfred Spiegelenburg <wilfreds@...che.org>)
CVE-2026-92414: Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens (Julian Reschke <reschke@...che.org>)
CVE-2026-92415: Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies… (Julian Reschke <reschke@...che.org>)
CVE-2026-103371: Apache Geode: Management REST API: Insertion of Sensitive Information into Log File (Jinwoo Hwang <jinwoo@...che.org>)
[OSSA-2026-043] OpenStack Zaqar: Zaqar WebSocket project substitution allows cross-project queue access (CVE-2026-pendi… (Goutham Pacha Ravi <gouthampravi@...il.…)
Re: [OSSA-2026-043] OpenStack Zaqar: Zaqar WebSocket project substitution allows cross-project queue access (CVE-2026-1… (Goutham Pacha Ravi <gouthampravi@...il.…)
[OSSN-0109] Cross-project metric association bypass in Gnocchi (Goutham Pacha Ravi <gouthampravi@...il.com>)
tor-0.4.9.14 released (Sam James <sam@...too.org>)

October 8 (10 messages)

CVE-2026-66082: Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow） (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-66084: Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-66087: Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-71183: Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords… (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-71895: Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-71896: Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information… (Wenjun Ruan <wenjun@...che.org>)
Re: CVE-2026-59265: Apache OpenOffice: Opening a malicious document can lead to system takeover (Demi Marie Obenour <demiobenour@...il.com>)
OpenJPEG: heap-buffer-overflow write fixed on master since Feb 2026, still present in every release (2.5.3, 2.5.4) (TheSecguy <thesecguy45@...il.com>)
Fwd: Go 1.27.2 and Go 1.26.9 are released (Alan Coopersmith <alan.coopersmith@...cle.com>)
Fwd: Vulnerabilities in golang.org/x/net (Alan Coopersmith <alan.coopersmith@...cle.com>)

October 9 (21 messages)

[OSSA-2026-044] OpenStack Mistral: Four authorization and privilege vulnerabilities in Mistral (CVE-2026-93858, CVE-2026-938… (Jeremy Stanley <fungi@...goth.org>)
[OSSN-0110] Ironic can leak basic auth credentials to image server (Jay Faulkner <jay@....cc>)
Xen Security Advisory 522 v1 (CVE-2026-98375) - Linux xen-netfront: backend can crash guest via malformed RX packets (Xen.org security team <security@....org>)
CVE-2026-71575: Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-73179: Apache CXF: JPA authorization-code consume is non-atomic (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-78384: Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb) (Colm O hEigeartaigh <coheigea@...che.org…)
CVE-2026-79650: Apache CXF: OIDC RP Open Redirect (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-86463: Apache CXF: FIQL Query Parser Denial of Service (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-97468: Apache CXF: Authentication bypass via weak cache keys for validated STS tokens (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-97791: Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state b… (Colm O hEigeartaigh <coheigea@...che.or…)
CVE-2026-100227: Apache CXF: XML Signature wrapping in JAX-RS XML Security (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-107937: Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of servic… (Colm O hEigeartaigh <coheigea@...che.or…)
CVE-2026-107938: Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification. (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-108039: Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character l… (Colm O hEigeartaigh <coheigea@...che.or…)
Re: OpenJPEG: heap-buffer-overflow write fixed on master since Feb 2026, still present in every release (2.5.3, 2.5.4) (Stuart Henderson <stu@...cehopper.org>)
CVE-2026-103412: Apache Camel Karavan: project file name path traversal when committing a project to Git (Andrea Cosentino <acosentino@...che.org>)
CVE-2026-103413: Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml (Andrea Cosentino <acosentino@...che.org>)
Multiple CVEs for illumos and distros: door server processes (Dan McDonald <danmcd@...decomputer.com>)
CVE for illumos and distros: VMM/BHYVE (Dan McDonald <danmcd@...decomputer.com>)
Unfixed vulnerabilities in Cyrus SASL (Alan Coopersmith <alan.coopersmith@...cle.com>)
mutt 2.4.3 released, fixes CVE-2026-107570 (Alan Coopersmith <alan.coopersmith@...cle.com>)

October 10 (8 messages)

3 Vulnerabilities in GNU Aspell before 0.60.8.3 (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-103501: Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption … (Lee Rhodes <leerho@...che.org>)
CVE-2026-103513: Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows m… (Lee Rhodes <leerho@...che.org>)
CVE-2026-103634: Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch deserialization allows … (Lee Rhodes <leerho@...che.org>)
CVE-2026-103635: Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial… (Lee Rhodes <leerho@...che.org>)
CVE-2026-103636: Apache DataSketches: datasketches-cpp: Out-of-bounds read in VarOpt union deserialization allows denial of ser… (Lee Rhodes <leerho@...che.org>)
CVE-2026-107373: ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-107794: ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list (Robert Rothenberg <rrwo@...nsec.org>)

October 11 (1 message)

Incomplete fix for Emacs CVE-2026-79992 (Sean Whitton <spwhitton@...hitton.name>)

October 12 (7 messages)

Unpatched credential leak in kubernetes/cloud-provider-gcp (auth-provider-gcp) - CVE requested (CAN-2026-2039459) (Nebojša Jaćović <nebojsa.jacovic@...il.co…)
Unpatched cross-namespace secret exfiltration in GoogleCloudPlatform/k8s-config-connector - CVE requested (CAN-2026-203… (Nebojša Jaćović <nebojsa.jacovic@gma…)
CVE-2026-92116: Apache Allura: OAuth1 missing callback validation (Dave Brondsema <dave@...ndsema.net>)
CVE-2026-92119: Apache Allura: REST API Mass Assignment (Dave Brondsema <dave@...ndsema.net>)
CVE-2026-92120: Apache Allura: Oauth1 Replay Attack (Dave Brondsema <dave@...ndsema.net>)
[vim-security] Arbitrary Code Execution via Ruby Omni-Completion in Vim < 9.2.1177 (Christian Brabandt <cb@...bit.org>)
[vim-security] Command Execution via Rmd Syntax Highlighting in Vim < 9.2.1178 (Christian Brabandt <cb@...bit.org>)

October 13 (12 messages)

Fwd: Announcing FreeType version 2.15.0 (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-107460: Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding (Shuxin Pan <psxjoy@...che.org>)
Xen Security Advisory 514 v2 (CVE-2026-79607) - Xenstore: Guests can crash xenstored during Live Update (Xen.org security team <security@....org>)
Xen Security Advisory 515 v2 (CVE-2026-79608) - x86/AMD: ineffectual Zenbleed workaround (Xen.org security team <security@....org>)
Xen Security Advisory 516 v2 (CVE-2026-79609) - x86: XPTI may break on huge-memory systems (Xen.org security team <security@....org>)
Xen Security Advisory 517 v2 (CVE-2026-79610) - grant-table: double version change race (Xen.org security team <security@....org>)
Xen Security Advisory 518 v2 (CVE-2026-79611) - VMX: VMentry failure with branch tracing and blocked states (Xen.org security team <security@....org>)
Xen Security Advisory 519 v2 (CVE-2026-102699,CVE-2026-102702) - Arm: multiple issues with GNTTABOP_cache_flush (Xen.org security team <security@....org>)
Xen Security Advisory 520 v2 (CVE-2026-102700) - gnttab: cache-flush handling may cause page reference leak (Xen.org security team <security@....org>)
Xen Security Advisory 521 v2 (CVE-2026-102701) - tapdisk: Out-of-bounds access in tap_ctl_connect_xenblkif() (Xen.org security team <security@....org>)
Nix and Lix: multiple vulnerabilities leading to local root privilege escalation - October 2026 (Thomas GERBET <thomas@...bet.me>)
rsyslog RainerScript replace() output length overflow (GHSA-48f2-29wv-5jgc) (Rainer Gerhards <rgerhards@...adiscon.com>)

152 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.