{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [], "removed": [], "diff": [ "bind9-dnsutils", "bind9-host", "bind9-libs", "curl", "git", "git-man", "libarchive13", "libcurl3-gnutls", "libcurl4", "libfreetype6", "libnss-systemd", "libopeniscsiusr", "libpam-systemd", "libpng16-16", "libsgutils2-2", "libsystemd0", "libudev1", "libx11-6", "libx11-data", "libxml2", "open-iscsi", "open-vm-tools", "openssh-client", "openssh-server", "openssh-sftp-server", "python3-jwt", "python3-urllib3", "sg3-utils", "sg3-utils-udev", "snapd", "sudo", "systemd", "systemd-sysv", "systemd-timesyncd", "tzdata", "u-boot-tools", "udev" ] } }, "diff": { "deb": [ { "name": "bind9-dnsutils", "from_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.22.04.6", "version": "1:9.18.39-0ubuntu0.22.04.6" }, "to_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.22.04.7", "version": "1:9.18.39-0ubuntu0.22.04.7" }, "cves": [ { "cve": "CVE-2026-75029", "url": "https://ubuntu.com/security/CVE-2026-75029", "cve_description": "In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19666", "url": "https://ubuntu.com/security/CVE-2026-19666", "cve_description": "On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19662", "url": "https://ubuntu.com/security/CVE-2026-19662", "cve_description": "An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-19941", "url": "https://ubuntu.com/security/CVE-2026-19941", "cve_description": "An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-78301", "url": "https://ubuntu.com/security/CVE-2026-78301", "cve_description": "A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-81563", "url": "https://ubuntu.com/security/CVE-2026-81563", "cve_description": "A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-77119", "url": "https://ubuntu.com/security/CVE-2026-77119", "cve_description": "A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-80274", "url": "https://ubuntu.com/security/CVE-2026-80274", "cve_description": "If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19033", "url": "https://ubuntu.com/security/CVE-2026-19033", "cve_description": "For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-81736", "url": "https://ubuntu.com/security/CVE-2026-81736", "cve_description": "If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-19667", "url": "https://ubuntu.com/security/CVE-2026-19667", "cve_description": "If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-75029", "url": "https://ubuntu.com/security/CVE-2026-75029", "cve_description": "In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19666", "url": "https://ubuntu.com/security/CVE-2026-19666", "cve_description": "On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19662", "url": "https://ubuntu.com/security/CVE-2026-19662", "cve_description": "An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-19941", "url": "https://ubuntu.com/security/CVE-2026-19941", "cve_description": "An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-78301", "url": "https://ubuntu.com/security/CVE-2026-78301", "cve_description": "A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-81563", "url": "https://ubuntu.com/security/CVE-2026-81563", "cve_description": "A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-77119", "url": "https://ubuntu.com/security/CVE-2026-77119", "cve_description": "A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-80274", "url": "https://ubuntu.com/security/CVE-2026-80274", "cve_description": "If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19033", "url": "https://ubuntu.com/security/CVE-2026-19033", "cve_description": "For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-81736", "url": "https://ubuntu.com/security/CVE-2026-81736", "cve_description": "If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-19667", "url": "https://ubuntu.com/security/CVE-2026-19667", "cve_description": "If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Excessive memory usage via repeated SOA, CNAME, or DNAME", " records", " - debian/patches/CVE-2026-75029-1.patch: Skip duplicate singleton records in", " lib/dns/message.c.", " - debian/patches/CVE-2026-75029-2.patch: Add a unit test for repeated", " singleton records in a message in tests/dns/Makefile.am,", " tests/dns/message_test.c.", " - CVE-2026-75029", " * SECURITY UPDATE: Unexpected exit with DNS64 and malformed answers", " - debian/patches/CVE-2026-19666-1.patch: Clear the noqname alias on the", " DNS64 filter64 path in lib/ns/query.c.", " - debian/patches/CVE-2026-19666-2.patch: Test the DNS64 filter64 path", " against a cached NOQNAME proof in bin/tests/system/dns64/ns1/example.db,", " bin/tests/system/dns64/ns2/named.conf.in, bin/tests/system/dns64/tests.sh.", " - CVE-2026-19666", " * SECURITY UPDATE: Unexpected exit via use-after-free with cached DNSSEC", " proofs", " - debian/patches/CVE-2026-19662-pre1.patch: Remove unused closest encloser", " proof caching in lib/dns/dnsrps.c, lib/dns/include/dns/rdataset.h,", " lib/dns/keytable.c, lib/dns/ncache.c, lib/dns/rbtdb.c,", " lib/dns/rdatalist.c, lib/dns/rdatalist_p.h, lib/dns/rdataset.c,", " lib/dns/resolver.c, lib/dns/sdb.c, lib/dns/sdlz.c, lib/ns/query.c.", " - debian/patches/CVE-2026-19662-1.patch: Keep NOQNAME proof slabheaders", " alive in lib/dns/rbtdb.c.", " - debian/patches/CVE-2026-19662-2.patch: Test NOQNAME proof slabheader", " lifetime in tests/dns/rbtdb_test.c.", " - CVE-2026-19662", " * SECURITY UPDATE: Forged NXDOMAIN via inapplicable NSEC wildcard proof", " - debian/patches/CVE-2026-19941-1.patch: Require NSEC wildcard proofs from", " the same zone in lib/dns/include/dns/validator.h, lib/dns/validator.c.", " - debian/patches/CVE-2026-19941-2.patch: Test rejection of cross-zone NSEC", " wildcard proofs in bin/tests/system/Makefile.am,", " bin/tests/system/conf.sh.common,", " bin/tests/system/nsec_wildcard_wrong_zone/ans1/ans.py,", " bin/tests/system/nsec_wildcard_wrong_zone/ns2/named.conf.j2, bin/tests/sys", " tem/nsec_wildcard_wrong_zone/tests_nsec_wildcard_wrong_zone.py.", " - CVE-2026-19941", " * SECURITY UPDATE: Out-of-zone records served as authoritative", " - debian/patches/CVE-2026-78301-1.patch: Test that nodes above the zone apex", " are not zone cuts in bin/tests/system/outofzone_zonecut/ns1/attacker.db,", " bin/tests/system/outofzone_zonecut/ns1/example.db,", " bin/tests/system/outofzone_zonecut/ns1/named.conf.j2,", " bin/tests/system/outofzone_zonecut/ns1/root.db,", " bin/tests/system/outofzone_zonecut/ns2/dnamezone.db,", " bin/tests/system/outofzone_zonecut/ns2/named.conf.j2,", " bin/tests/system/outofzone_zonecut/ns2/nszone.db,", " bin/tests/system/outofzone_zonecut/ns3/dnamezone.db,", " bin/tests/system/outofzone_zonecut/ns3/named.conf.j2,", " bin/tests/system/outofzone_zonecut/ns3/nszone.db,", " bin/tests/system/outofzone_zonecut/tests_outofzone_zonecut.py.", " - debian/patches/CVE-2026-78301-2.patch: Ignore nodes above the zone origin", " in RBT zone database lookups in lib/dns/rbtdb.c, tests/dns/rbtdb_test.c.", " - CVE-2026-78301", " * SECURITY UPDATE: Resource exhaustion via HTTPS/SVCB AliasMode records", " - debian/patches/CVE-2026-81563-1.patch: Add a system test for HTTPS", " AliasMode additional-data errors in", " bin/tests/system/additional/ns1/https.db,", " bin/tests/system/additional/ns1/named1.conf.in,", " bin/tests/system/additional/ns1/named2.conf.in,", " bin/tests/system/additional/ns1/named3.conf.in,", " bin/tests/system/additional/ns1/named4.conf.in,", " bin/tests/system/additional/ns2/root.db,", " bin/tests/system/additional/ns3/named.conf.in,", " bin/tests/system/additional/tests_https_alias.py.", " - debian/patches/CVE-2026-81563-2.patch: Release the rdataset when SVCB", " additional-data lookups fail in lib/dns/rdata/in_1/svcb_64.c.", " - CVE-2026-81563", " * SECURITY UPDATE: DNSSEC downgrade via NSEC3 from an unrelated sibling zone", " - debian/patches/CVE-2026-77119-2.patch: Reject out-of-zone NSEC3 in the", " insecure-referral proof in lib/dns/validator.c.", " - CVE-2026-77119", " * SECURITY UPDATE: Unexpected exit on wildcard answers with NSEC and NSEC3", " proofs", " - debian/patches/CVE-2026-80274-1.patch: Keep NOQNAME proof selection", " consistent in lib/dns/include/dns/rdataset.h,", " lib/dns/include/dns/validator.h, lib/dns/rdatalist.c,", " lib/dns/rdatalist_p.h, lib/dns/rdataset.c, lib/dns/resolver.c,", " lib/dns/validator.c, tests/dns/rbtdb_test.c.", " - debian/patches/CVE-2026-80274-2.patch: Test NOQNAME proof selection in the", " rdataset unit test in tests/dns/rdataset_test.c.", " - debian/patches/CVE-2026-80274-3.patch: Make the findnoqname mismatch", " system test reach the resolver in", " bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py, bin/tests/system", " /dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py.", " - CVE-2026-80274", " * SECURITY UPDATE: Zone transfer data used before TSIG verification", " - debian/patches/CVE-2026-19033.patch: Remove support for sparse TSIG in", " lib/dns/xfrin.c.", " - CVE-2026-19033", " * SECURITY UPDATE: Excessive CPU usage via cached HTTPS/SVCB AliasMode records", " - debian/patches/CVE-2026-81736-1.patch: Bound the total additional", " processing for a single query in lib/ns/client.c,", " lib/ns/include/ns/client.h, lib/ns/query.c.", " - debian/patches/CVE-2026-81736-2.patch: Add a system test for SVCB/HTTPS", " AliasMode additional processing in", " bin/tests/system/additional/ns1/https.db,", " bin/tests/system/additional/tests_https_alias.py,", " bin/tests/system/svcb_alias/ns1/named.conf.j2,", " bin/tests/system/svcb_alias/ns1/root.hint,", " bin/tests/system/svcb_alias/ns2/named.conf.j2,", " bin/tests/system/svcb_alias/ns2/root.db,", " bin/tests/system/svcb_alias/setup.sh,", " bin/tests/system/svcb_alias/tests_svcb_alias.py.", " - CVE-2026-81736", " * SECURITY UPDATE: Unexpected exit via oversized negative cache records", " - debian/patches/CVE-2026-19667-1.patch: Reject negative cache records that", " do not fit in a dns_rdata_t in lib/dns/ncache.c.", " - debian/patches/CVE-2026-19667-2.patch: Test that an oversized negative", " cache record is rejected in tests/dns/Makefile.am,", " tests/dns/ncache_test.c.", " - CVE-2026-19667", "" ], "package": "bind9", "version": "1:9.18.39-0ubuntu0.22.04.7", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Fri, 09 Oct 2026 12:07:28 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "bind9-host", "from_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.22.04.6", "version": "1:9.18.39-0ubuntu0.22.04.6" }, "to_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.22.04.7", "version": "1:9.18.39-0ubuntu0.22.04.7" }, "cves": [ { "cve": "CVE-2026-75029", "url": "https://ubuntu.com/security/CVE-2026-75029", "cve_description": "In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19666", "url": "https://ubuntu.com/security/CVE-2026-19666", "cve_description": "On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19662", "url": "https://ubuntu.com/security/CVE-2026-19662", "cve_description": "An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-19941", "url": "https://ubuntu.com/security/CVE-2026-19941", "cve_description": "An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-78301", "url": "https://ubuntu.com/security/CVE-2026-78301", "cve_description": "A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-81563", "url": "https://ubuntu.com/security/CVE-2026-81563", "cve_description": "A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-77119", "url": "https://ubuntu.com/security/CVE-2026-77119", "cve_description": "A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-80274", "url": "https://ubuntu.com/security/CVE-2026-80274", "cve_description": "If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19033", "url": "https://ubuntu.com/security/CVE-2026-19033", "cve_description": "For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-81736", "url": "https://ubuntu.com/security/CVE-2026-81736", "cve_description": "If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-19667", "url": "https://ubuntu.com/security/CVE-2026-19667", "cve_description": "If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-75029", "url": "https://ubuntu.com/security/CVE-2026-75029", "cve_description": "In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19666", "url": "https://ubuntu.com/security/CVE-2026-19666", "cve_description": "On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19662", "url": "https://ubuntu.com/security/CVE-2026-19662", "cve_description": "An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-19941", "url": "https://ubuntu.com/security/CVE-2026-19941", "cve_description": "An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-78301", "url": "https://ubuntu.com/security/CVE-2026-78301", "cve_description": "A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-81563", "url": "https://ubuntu.com/security/CVE-2026-81563", "cve_description": "A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-77119", "url": "https://ubuntu.com/security/CVE-2026-77119", "cve_description": "A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-80274", "url": "https://ubuntu.com/security/CVE-2026-80274", "cve_description": "If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19033", "url": "https://ubuntu.com/security/CVE-2026-19033", "cve_description": "For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-81736", "url": "https://ubuntu.com/security/CVE-2026-81736", "cve_description": "If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-19667", "url": "https://ubuntu.com/security/CVE-2026-19667", "cve_description": "If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Excessive memory usage via repeated SOA, CNAME, or DNAME", " records", " - debian/patches/CVE-2026-75029-1.patch: Skip duplicate singleton records in", " lib/dns/message.c.", " - debian/patches/CVE-2026-75029-2.patch: Add a unit test for repeated", " singleton records in a message in tests/dns/Makefile.am,", " tests/dns/message_test.c.", " - CVE-2026-75029", " * SECURITY UPDATE: Unexpected exit with DNS64 and malformed answers", " - debian/patches/CVE-2026-19666-1.patch: Clear the noqname alias on the", " DNS64 filter64 path in lib/ns/query.c.", " - debian/patches/CVE-2026-19666-2.patch: Test the DNS64 filter64 path", " against a cached NOQNAME proof in bin/tests/system/dns64/ns1/example.db,", " bin/tests/system/dns64/ns2/named.conf.in, bin/tests/system/dns64/tests.sh.", " - CVE-2026-19666", " * SECURITY UPDATE: Unexpected exit via use-after-free with cached DNSSEC", " proofs", " - debian/patches/CVE-2026-19662-pre1.patch: Remove unused closest encloser", " proof caching in lib/dns/dnsrps.c, lib/dns/include/dns/rdataset.h,", " lib/dns/keytable.c, lib/dns/ncache.c, lib/dns/rbtdb.c,", " lib/dns/rdatalist.c, lib/dns/rdatalist_p.h, lib/dns/rdataset.c,", " lib/dns/resolver.c, lib/dns/sdb.c, lib/dns/sdlz.c, lib/ns/query.c.", " - debian/patches/CVE-2026-19662-1.patch: Keep NOQNAME proof slabheaders", " alive in lib/dns/rbtdb.c.", " - debian/patches/CVE-2026-19662-2.patch: Test NOQNAME proof slabheader", " lifetime in tests/dns/rbtdb_test.c.", " - CVE-2026-19662", " * SECURITY UPDATE: Forged NXDOMAIN via inapplicable NSEC wildcard proof", " - debian/patches/CVE-2026-19941-1.patch: Require NSEC wildcard proofs from", " the same zone in lib/dns/include/dns/validator.h, lib/dns/validator.c.", " - debian/patches/CVE-2026-19941-2.patch: Test rejection of cross-zone NSEC", " wildcard proofs in bin/tests/system/Makefile.am,", " bin/tests/system/conf.sh.common,", " bin/tests/system/nsec_wildcard_wrong_zone/ans1/ans.py,", " bin/tests/system/nsec_wildcard_wrong_zone/ns2/named.conf.j2, bin/tests/sys", " tem/nsec_wildcard_wrong_zone/tests_nsec_wildcard_wrong_zone.py.", " - CVE-2026-19941", " * SECURITY UPDATE: Out-of-zone records served as authoritative", " - debian/patches/CVE-2026-78301-1.patch: Test that nodes above the zone apex", " are not zone cuts in bin/tests/system/outofzone_zonecut/ns1/attacker.db,", " bin/tests/system/outofzone_zonecut/ns1/example.db,", " bin/tests/system/outofzone_zonecut/ns1/named.conf.j2,", " bin/tests/system/outofzone_zonecut/ns1/root.db,", " bin/tests/system/outofzone_zonecut/ns2/dnamezone.db,", " bin/tests/system/outofzone_zonecut/ns2/named.conf.j2,", " bin/tests/system/outofzone_zonecut/ns2/nszone.db,", " bin/tests/system/outofzone_zonecut/ns3/dnamezone.db,", " bin/tests/system/outofzone_zonecut/ns3/named.conf.j2,", " bin/tests/system/outofzone_zonecut/ns3/nszone.db,", " bin/tests/system/outofzone_zonecut/tests_outofzone_zonecut.py.", " - debian/patches/CVE-2026-78301-2.patch: Ignore nodes above the zone origin", " in RBT zone database lookups in lib/dns/rbtdb.c, tests/dns/rbtdb_test.c.", " - CVE-2026-78301", " * SECURITY UPDATE: Resource exhaustion via HTTPS/SVCB AliasMode records", " - debian/patches/CVE-2026-81563-1.patch: Add a system test for HTTPS", " AliasMode additional-data errors in", " bin/tests/system/additional/ns1/https.db,", " bin/tests/system/additional/ns1/named1.conf.in,", " bin/tests/system/additional/ns1/named2.conf.in,", " bin/tests/system/additional/ns1/named3.conf.in,", " bin/tests/system/additional/ns1/named4.conf.in,", " bin/tests/system/additional/ns2/root.db,", " bin/tests/system/additional/ns3/named.conf.in,", " bin/tests/system/additional/tests_https_alias.py.", " - debian/patches/CVE-2026-81563-2.patch: Release the rdataset when SVCB", " additional-data lookups fail in lib/dns/rdata/in_1/svcb_64.c.", " - CVE-2026-81563", " * SECURITY UPDATE: DNSSEC downgrade via NSEC3 from an unrelated sibling zone", " - debian/patches/CVE-2026-77119-2.patch: Reject out-of-zone NSEC3 in the", " insecure-referral proof in lib/dns/validator.c.", " - CVE-2026-77119", " * SECURITY UPDATE: Unexpected exit on wildcard answers with NSEC and NSEC3", " proofs", " - debian/patches/CVE-2026-80274-1.patch: Keep NOQNAME proof selection", " consistent in lib/dns/include/dns/rdataset.h,", " lib/dns/include/dns/validator.h, lib/dns/rdatalist.c,", " lib/dns/rdatalist_p.h, lib/dns/rdataset.c, lib/dns/resolver.c,", " lib/dns/validator.c, tests/dns/rbtdb_test.c.", " - debian/patches/CVE-2026-80274-2.patch: Test NOQNAME proof selection in the", " rdataset unit test in tests/dns/rdataset_test.c.", " - debian/patches/CVE-2026-80274-3.patch: Make the findnoqname mismatch", " system test reach the resolver in", " bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py, bin/tests/system", " /dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py.", " - CVE-2026-80274", " * SECURITY UPDATE: Zone transfer data used before TSIG verification", " - debian/patches/CVE-2026-19033.patch: Remove support for sparse TSIG in", " lib/dns/xfrin.c.", " - CVE-2026-19033", " * SECURITY UPDATE: Excessive CPU usage via cached HTTPS/SVCB AliasMode records", " - debian/patches/CVE-2026-81736-1.patch: Bound the total additional", " processing for a single query in lib/ns/client.c,", " lib/ns/include/ns/client.h, lib/ns/query.c.", " - debian/patches/CVE-2026-81736-2.patch: Add a system test for SVCB/HTTPS", " AliasMode additional processing in", " bin/tests/system/additional/ns1/https.db,", " bin/tests/system/additional/tests_https_alias.py,", " bin/tests/system/svcb_alias/ns1/named.conf.j2,", " bin/tests/system/svcb_alias/ns1/root.hint,", " bin/tests/system/svcb_alias/ns2/named.conf.j2,", " bin/tests/system/svcb_alias/ns2/root.db,", " bin/tests/system/svcb_alias/setup.sh,", " bin/tests/system/svcb_alias/tests_svcb_alias.py.", " - CVE-2026-81736", " * SECURITY UPDATE: Unexpected exit via oversized negative cache records", " - debian/patches/CVE-2026-19667-1.patch: Reject negative cache records that", " do not fit in a dns_rdata_t in lib/dns/ncache.c.", " - debian/patches/CVE-2026-19667-2.patch: Test that an oversized negative", " cache record is rejected in tests/dns/Makefile.am,", " tests/dns/ncache_test.c.", " - CVE-2026-19667", "" ], "package": "bind9", "version": "1:9.18.39-0ubuntu0.22.04.7", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Fri, 09 Oct 2026 12:07:28 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "bind9-libs", "from_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.22.04.6", "version": "1:9.18.39-0ubuntu0.22.04.6" }, "to_version": { "source_package_name": "bind9", "source_package_version": "1:9.18.39-0ubuntu0.22.04.7", "version": "1:9.18.39-0ubuntu0.22.04.7" }, "cves": [ { "cve": "CVE-2026-75029", "url": "https://ubuntu.com/security/CVE-2026-75029", "cve_description": "In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19666", "url": "https://ubuntu.com/security/CVE-2026-19666", "cve_description": "On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19662", "url": "https://ubuntu.com/security/CVE-2026-19662", "cve_description": "An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-19941", "url": "https://ubuntu.com/security/CVE-2026-19941", "cve_description": "An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-78301", "url": "https://ubuntu.com/security/CVE-2026-78301", "cve_description": "A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-81563", "url": "https://ubuntu.com/security/CVE-2026-81563", "cve_description": "A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-77119", "url": "https://ubuntu.com/security/CVE-2026-77119", "cve_description": "A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-80274", "url": "https://ubuntu.com/security/CVE-2026-80274", "cve_description": "If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19033", "url": "https://ubuntu.com/security/CVE-2026-19033", "cve_description": "For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-81736", "url": "https://ubuntu.com/security/CVE-2026-81736", "cve_description": "If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-19667", "url": "https://ubuntu.com/security/CVE-2026-19667", "cve_description": "If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-75029", "url": "https://ubuntu.com/security/CVE-2026-75029", "cve_description": "In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19666", "url": "https://ubuntu.com/security/CVE-2026-19666", "cve_description": "On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19662", "url": "https://ubuntu.com/security/CVE-2026-19662", "cve_description": "An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-19941", "url": "https://ubuntu.com/security/CVE-2026-19941", "cve_description": "An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-78301", "url": "https://ubuntu.com/security/CVE-2026-78301", "cve_description": "A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-81563", "url": "https://ubuntu.com/security/CVE-2026-81563", "cve_description": "A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-77119", "url": "https://ubuntu.com/security/CVE-2026-77119", "cve_description": "A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-80274", "url": "https://ubuntu.com/security/CVE-2026-80274", "cve_description": "If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-19033", "url": "https://ubuntu.com/security/CVE-2026-19033", "cve_description": "For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 15:17:00 UTC" }, { "cve": "CVE-2026-81736", "url": "https://ubuntu.com/security/CVE-2026-81736", "cve_description": "If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" }, { "cve": "CVE-2026-19667", "url": "https://ubuntu.com/security/CVE-2026-19667", "cve_description": "If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.", "cve_priority": "medium", "cve_public_date": "2026-09-16 14:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Excessive memory usage via repeated SOA, CNAME, or DNAME", " records", " - debian/patches/CVE-2026-75029-1.patch: Skip duplicate singleton records in", " lib/dns/message.c.", " - debian/patches/CVE-2026-75029-2.patch: Add a unit test for repeated", " singleton records in a message in tests/dns/Makefile.am,", " tests/dns/message_test.c.", " - CVE-2026-75029", " * SECURITY UPDATE: Unexpected exit with DNS64 and malformed answers", " - debian/patches/CVE-2026-19666-1.patch: Clear the noqname alias on the", " DNS64 filter64 path in lib/ns/query.c.", " - debian/patches/CVE-2026-19666-2.patch: Test the DNS64 filter64 path", " against a cached NOQNAME proof in bin/tests/system/dns64/ns1/example.db,", " bin/tests/system/dns64/ns2/named.conf.in, bin/tests/system/dns64/tests.sh.", " - CVE-2026-19666", " * SECURITY UPDATE: Unexpected exit via use-after-free with cached DNSSEC", " proofs", " - debian/patches/CVE-2026-19662-pre1.patch: Remove unused closest encloser", " proof caching in lib/dns/dnsrps.c, lib/dns/include/dns/rdataset.h,", " lib/dns/keytable.c, lib/dns/ncache.c, lib/dns/rbtdb.c,", " lib/dns/rdatalist.c, lib/dns/rdatalist_p.h, lib/dns/rdataset.c,", " lib/dns/resolver.c, lib/dns/sdb.c, lib/dns/sdlz.c, lib/ns/query.c.", " - debian/patches/CVE-2026-19662-1.patch: Keep NOQNAME proof slabheaders", " alive in lib/dns/rbtdb.c.", " - debian/patches/CVE-2026-19662-2.patch: Test NOQNAME proof slabheader", " lifetime in tests/dns/rbtdb_test.c.", " - CVE-2026-19662", " * SECURITY UPDATE: Forged NXDOMAIN via inapplicable NSEC wildcard proof", " - debian/patches/CVE-2026-19941-1.patch: Require NSEC wildcard proofs from", " the same zone in lib/dns/include/dns/validator.h, lib/dns/validator.c.", " - debian/patches/CVE-2026-19941-2.patch: Test rejection of cross-zone NSEC", " wildcard proofs in bin/tests/system/Makefile.am,", " bin/tests/system/conf.sh.common,", " bin/tests/system/nsec_wildcard_wrong_zone/ans1/ans.py,", " bin/tests/system/nsec_wildcard_wrong_zone/ns2/named.conf.j2, bin/tests/sys", " tem/nsec_wildcard_wrong_zone/tests_nsec_wildcard_wrong_zone.py.", " - CVE-2026-19941", " * SECURITY UPDATE: Out-of-zone records served as authoritative", " - debian/patches/CVE-2026-78301-1.patch: Test that nodes above the zone apex", " are not zone cuts in bin/tests/system/outofzone_zonecut/ns1/attacker.db,", " bin/tests/system/outofzone_zonecut/ns1/example.db,", " bin/tests/system/outofzone_zonecut/ns1/named.conf.j2,", " bin/tests/system/outofzone_zonecut/ns1/root.db,", " bin/tests/system/outofzone_zonecut/ns2/dnamezone.db,", " bin/tests/system/outofzone_zonecut/ns2/named.conf.j2,", " bin/tests/system/outofzone_zonecut/ns2/nszone.db,", " bin/tests/system/outofzone_zonecut/ns3/dnamezone.db,", " bin/tests/system/outofzone_zonecut/ns3/named.conf.j2,", " bin/tests/system/outofzone_zonecut/ns3/nszone.db,", " bin/tests/system/outofzone_zonecut/tests_outofzone_zonecut.py.", " - debian/patches/CVE-2026-78301-2.patch: Ignore nodes above the zone origin", " in RBT zone database lookups in lib/dns/rbtdb.c, tests/dns/rbtdb_test.c.", " - CVE-2026-78301", " * SECURITY UPDATE: Resource exhaustion via HTTPS/SVCB AliasMode records", " - debian/patches/CVE-2026-81563-1.patch: Add a system test for HTTPS", " AliasMode additional-data errors in", " bin/tests/system/additional/ns1/https.db,", " bin/tests/system/additional/ns1/named1.conf.in,", " bin/tests/system/additional/ns1/named2.conf.in,", " bin/tests/system/additional/ns1/named3.conf.in,", " bin/tests/system/additional/ns1/named4.conf.in,", " bin/tests/system/additional/ns2/root.db,", " bin/tests/system/additional/ns3/named.conf.in,", " bin/tests/system/additional/tests_https_alias.py.", " - debian/patches/CVE-2026-81563-2.patch: Release the rdataset when SVCB", " additional-data lookups fail in lib/dns/rdata/in_1/svcb_64.c.", " - CVE-2026-81563", " * SECURITY UPDATE: DNSSEC downgrade via NSEC3 from an unrelated sibling zone", " - debian/patches/CVE-2026-77119-2.patch: Reject out-of-zone NSEC3 in the", " insecure-referral proof in lib/dns/validator.c.", " - CVE-2026-77119", " * SECURITY UPDATE: Unexpected exit on wildcard answers with NSEC and NSEC3", " proofs", " - debian/patches/CVE-2026-80274-1.patch: Keep NOQNAME proof selection", " consistent in lib/dns/include/dns/rdataset.h,", " lib/dns/include/dns/validator.h, lib/dns/rdatalist.c,", " lib/dns/rdatalist_p.h, lib/dns/rdataset.c, lib/dns/resolver.c,", " lib/dns/validator.c, tests/dns/rbtdb_test.c.", " - debian/patches/CVE-2026-80274-2.patch: Test NOQNAME proof selection in the", " rdataset unit test in tests/dns/rdataset_test.c.", " - debian/patches/CVE-2026-80274-3.patch: Make the findnoqname mismatch", " system test reach the resolver in", " bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py, bin/tests/system", " /dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py.", " - CVE-2026-80274", " * SECURITY UPDATE: Zone transfer data used before TSIG verification", " - debian/patches/CVE-2026-19033.patch: Remove support for sparse TSIG in", " lib/dns/xfrin.c.", " - CVE-2026-19033", " * SECURITY UPDATE: Excessive CPU usage via cached HTTPS/SVCB AliasMode records", " - debian/patches/CVE-2026-81736-1.patch: Bound the total additional", " processing for a single query in lib/ns/client.c,", " lib/ns/include/ns/client.h, lib/ns/query.c.", " - debian/patches/CVE-2026-81736-2.patch: Add a system test for SVCB/HTTPS", " AliasMode additional processing in", " bin/tests/system/additional/ns1/https.db,", " bin/tests/system/additional/tests_https_alias.py,", " bin/tests/system/svcb_alias/ns1/named.conf.j2,", " bin/tests/system/svcb_alias/ns1/root.hint,", " bin/tests/system/svcb_alias/ns2/named.conf.j2,", " bin/tests/system/svcb_alias/ns2/root.db,", " bin/tests/system/svcb_alias/setup.sh,", " bin/tests/system/svcb_alias/tests_svcb_alias.py.", " - CVE-2026-81736", " * SECURITY UPDATE: Unexpected exit via oversized negative cache records", " - debian/patches/CVE-2026-19667-1.patch: Reject negative cache records that", " do not fit in a dns_rdata_t in lib/dns/ncache.c.", " - debian/patches/CVE-2026-19667-2.patch: Test that an oversized negative", " cache record is rejected in tests/dns/Makefile.am,", " tests/dns/ncache_test.c.", " - CVE-2026-19667", "" ], "package": "bind9", "version": "1:9.18.39-0ubuntu0.22.04.7", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Fri, 09 Oct 2026 12:07:28 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "curl", "from_version": { "source_package_name": "curl", "source_package_version": "7.81.0-1ubuntu1.29", "version": "7.81.0-1ubuntu1.29" }, "to_version": { "source_package_name": "curl", "source_package_version": "7.81.0-1ubuntu1.30", "version": "7.81.0-1ubuntu1.30" }, "cves": [ { "cve": "CVE-2026-86409", "url": "https://ubuntu.com/security/CVE-2026-86409", "cve_description": "Setting `CURLOPT_AWS_SIGV4` to NULL does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL is set next, leaking state information.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86414", "url": "https://ubuntu.com/security/CVE-2026-86414", "cve_description": "A HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87862", "url": "https://ubuntu.com/security/CVE-2026-87862", "cve_description": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87864", "url": "https://ubuntu.com/security/CVE-2026-87864", "cve_description": "Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92388", "url": "https://ubuntu.com/security/CVE-2026-92388", "cve_description": "When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while reconfiguring only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92389", "url": "https://ubuntu.com/security/CVE-2026-92389", "cve_description": "libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92391", "url": "https://ubuntu.com/security/CVE-2026-92391", "cve_description": "A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-94266", "url": "https://ubuntu.com/security/CVE-2026-94266", "cve_description": "libcurl could accidentally return a URL for curl_easy_getinfo's `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did. The curl tool exposes the same information using the command line option `--write-out '%{url_effective}'`. This credential leak can happen when curl retrieves credentials from a `.netrc` file.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-86409", "url": "https://ubuntu.com/security/CVE-2026-86409", "cve_description": "Setting `CURLOPT_AWS_SIGV4` to NULL does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL is set next, leaking state information.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86414", "url": "https://ubuntu.com/security/CVE-2026-86414", "cve_description": "A HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87862", "url": "https://ubuntu.com/security/CVE-2026-87862", "cve_description": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87864", "url": "https://ubuntu.com/security/CVE-2026-87864", "cve_description": "Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92388", "url": "https://ubuntu.com/security/CVE-2026-92388", "cve_description": "When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while reconfiguring only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92389", "url": "https://ubuntu.com/security/CVE-2026-92389", "cve_description": "libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92391", "url": "https://ubuntu.com/security/CVE-2026-92391", "cve_description": "A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-94266", "url": "https://ubuntu.com/security/CVE-2026-94266", "cve_description": "libcurl could accidentally return a URL for curl_easy_getinfo's `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did. The curl tool exposes the same information using the command line option `--write-out '%{url_effective}'`. This credential leak can happen when curl retrieves credentials from a `.netrc` file.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Information exposure from stale AWS SigV4 authentication.", " - debian/patches/CVE-2026-86409.patch: clear CURLAUTH_AWS_SIGV4 when", " CURLOPT_AWS_SIGV4 is set to NULL in lib/setopt.c.", " - CVE-2026-86409", " * SECURITY UPDATE: Credential exposure to an HTTP proxy in CONNECT.", " - debian/patches/CVE-2026-86414.patch: do not react to 401 responses to a", " CONNECT request in lib/http_proxy.c.", " - CVE-2026-86414", " * SECURITY UPDATE: Improper handling of HSTS entries on load.", " - debian/patches/CVE-2026-87862.patch: match only the exact host, not", " parent domains, when removing duplicates while loading an HSTS file in", " lib/hsts.c.", " - CVE-2026-87862", " * SECURITY UPDATE: Command injection in IMAP APPEND with CURLOPT_CRLF.", " - debian/patches/CVE-2026-87864.patch: reject APPEND when CRLF conversion", " is enabled, as it makes the upload size unknown in lib/imap.c.", " - CVE-2026-87864", " * SECURITY UPDATE: Use after free in FTP wildcard matching.", " - debian/patches/CVE-2026-92388-1.patch: stop overwriting set.write_func", " and set.out in lib/sendf.c, lib/ftp.h, lib/ftp.c, lib/ftplistparser.c,", " lib/ftplistparser.h.", " - debian/patches/CVE-2026-92388-2.patch: only use the list parser in the", " CURLWC_MATCHING state in lib/ftplistparser.c.", " - CVE-2026-92388", " * SECURITY UPDATE: Information exposure from TFTP transfer direction", " confusion.", " - debian/patches/CVE-2026-92389.patch: return CURLE_TFTP_ILLEGAL when a", " server response does not match the transfer direction in lib/tftp.c.", " - CVE-2026-92389", " * SECURITY UPDATE: Stack overflow from deeply nested MIME structures.", " - debian/patches/CVE-2026-92391.patch: free MIME handles non-recursively in", " curl_mime_free in lib/mime.c.", " - CVE-2026-92391", " * SECURITY UPDATE: Credential exposure in CURLINFO_EFFECTIVE_URL.", " - debian/patches/CVE-2026-94266.patch: return a copy of the URL without", " credentials for CURLINFO_EFFECTIVE_URL in lib/getinfo.c, lib/transfer.c,", " lib/url.c, lib/urldata.h.", " - CVE-2026-94266", "" ], "package": "curl", "version": "7.81.0-1ubuntu1.30", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Charles Cochran ", "date": "Mon, 12 Oct 2026 18:12:33 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "git", "from_version": { "source_package_name": "git", "source_package_version": "1:2.34.1-1ubuntu1.17", "version": "1:2.34.1-1ubuntu1.17" }, "to_version": { "source_package_name": "git", "source_package_version": "1:2.34.1-1ubuntu1.18", "version": "1:2.34.1-1ubuntu1.18" }, "cves": [], "launchpad_bugs_fixed": [ 2171054 ], "changes": [ { "cves": [], "log": [ "", " * Fix compatibility with curl security update (LP: #2171054)", " - http-handle-curl-stripping-creds-from-effective-url.patch:", " handle curl stripping creds from effective url in git-curl-compat.h,", " http.c.", "" ], "package": "git", "version": "1:2.34.1-1ubuntu1.18", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2171054 ], "author": "Charles Cochran ", "date": "Fri, 16 Oct 2026 10:11:44 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "git-man", "from_version": { "source_package_name": "git", "source_package_version": "1:2.34.1-1ubuntu1.17", "version": "1:2.34.1-1ubuntu1.17" }, "to_version": { "source_package_name": "git", "source_package_version": "1:2.34.1-1ubuntu1.18", "version": "1:2.34.1-1ubuntu1.18" }, "cves": [], "launchpad_bugs_fixed": [ 2171054 ], "changes": [ { "cves": [], "log": [ "", " * Fix compatibility with curl security update (LP: #2171054)", " - http-handle-curl-stripping-creds-from-effective-url.patch:", " handle curl stripping creds from effective url in git-curl-compat.h,", " http.c.", "" ], "package": "git", "version": "1:2.34.1-1ubuntu1.18", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2171054 ], "author": "Charles Cochran ", "date": "Fri, 16 Oct 2026 10:11:44 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libarchive13", "from_version": { "source_package_name": "libarchive", "source_package_version": "3.6.0-1ubuntu1.8", "version": "3.6.0-1ubuntu1.8" }, "to_version": { "source_package_name": "libarchive", "source_package_version": "3.6.0-1ubuntu1.9", "version": "3.6.0-1ubuntu1.9" }, "cves": [ { "cve": "CVE-2026-16517", "url": "https://ubuntu.com/security/CVE-2026-16517", "cve_description": "A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encryption overhead to the entry size overflows int64_t, resulting in undefined behavior. This could lead to incorrect Zip64 extension decisions or potential memory corruption.", "cve_priority": "medium", "cve_public_date": "2026-07-21 23:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-16517", "url": "https://ubuntu.com/security/CVE-2026-16517", "cve_description": "A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encryption overhead to the entry size overflows int64_t, resulting in undefined behavior. This could lead to incorrect Zip64 extension decisions or potential memory corruption.", "cve_priority": "medium", "cve_public_date": "2026-07-21 23:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: integer overflow in ZIP writer", " - debian/patches/CVE-2026-16517.patch: Merge pull request #3228 from", " datauwu/zip-encrypted-int-overflow in", " libarchive/archive_write_set_format_zip.c.", " - CVE-2026-16517", "" ], "package": "libarchive", "version": "3.6.0-1ubuntu1.9", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 07 Oct 2026 09:41:37 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libcurl3-gnutls", "from_version": { "source_package_name": "curl", "source_package_version": "7.81.0-1ubuntu1.29", "version": "7.81.0-1ubuntu1.29" }, "to_version": { "source_package_name": "curl", "source_package_version": "7.81.0-1ubuntu1.30", "version": "7.81.0-1ubuntu1.30" }, "cves": [ { "cve": "CVE-2026-86409", "url": "https://ubuntu.com/security/CVE-2026-86409", "cve_description": "Setting `CURLOPT_AWS_SIGV4` to NULL does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL is set next, leaking state information.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86414", "url": "https://ubuntu.com/security/CVE-2026-86414", "cve_description": "A HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87862", "url": "https://ubuntu.com/security/CVE-2026-87862", "cve_description": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87864", "url": "https://ubuntu.com/security/CVE-2026-87864", "cve_description": "Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92388", "url": "https://ubuntu.com/security/CVE-2026-92388", "cve_description": "When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while reconfiguring only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92389", "url": "https://ubuntu.com/security/CVE-2026-92389", "cve_description": "libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92391", "url": "https://ubuntu.com/security/CVE-2026-92391", "cve_description": "A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-94266", "url": "https://ubuntu.com/security/CVE-2026-94266", "cve_description": "libcurl could accidentally return a URL for curl_easy_getinfo's `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did. The curl tool exposes the same information using the command line option `--write-out '%{url_effective}'`. This credential leak can happen when curl retrieves credentials from a `.netrc` file.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-86409", "url": "https://ubuntu.com/security/CVE-2026-86409", "cve_description": "Setting `CURLOPT_AWS_SIGV4` to NULL does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL is set next, leaking state information.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86414", "url": "https://ubuntu.com/security/CVE-2026-86414", "cve_description": "A HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87862", "url": "https://ubuntu.com/security/CVE-2026-87862", "cve_description": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87864", "url": "https://ubuntu.com/security/CVE-2026-87864", "cve_description": "Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92388", "url": "https://ubuntu.com/security/CVE-2026-92388", "cve_description": "When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while reconfiguring only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92389", "url": "https://ubuntu.com/security/CVE-2026-92389", "cve_description": "libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92391", "url": "https://ubuntu.com/security/CVE-2026-92391", "cve_description": "A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-94266", "url": "https://ubuntu.com/security/CVE-2026-94266", "cve_description": "libcurl could accidentally return a URL for curl_easy_getinfo's `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did. The curl tool exposes the same information using the command line option `--write-out '%{url_effective}'`. This credential leak can happen when curl retrieves credentials from a `.netrc` file.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Information exposure from stale AWS SigV4 authentication.", " - debian/patches/CVE-2026-86409.patch: clear CURLAUTH_AWS_SIGV4 when", " CURLOPT_AWS_SIGV4 is set to NULL in lib/setopt.c.", " - CVE-2026-86409", " * SECURITY UPDATE: Credential exposure to an HTTP proxy in CONNECT.", " - debian/patches/CVE-2026-86414.patch: do not react to 401 responses to a", " CONNECT request in lib/http_proxy.c.", " - CVE-2026-86414", " * SECURITY UPDATE: Improper handling of HSTS entries on load.", " - debian/patches/CVE-2026-87862.patch: match only the exact host, not", " parent domains, when removing duplicates while loading an HSTS file in", " lib/hsts.c.", " - CVE-2026-87862", " * SECURITY UPDATE: Command injection in IMAP APPEND with CURLOPT_CRLF.", " - debian/patches/CVE-2026-87864.patch: reject APPEND when CRLF conversion", " is enabled, as it makes the upload size unknown in lib/imap.c.", " - CVE-2026-87864", " * SECURITY UPDATE: Use after free in FTP wildcard matching.", " - debian/patches/CVE-2026-92388-1.patch: stop overwriting set.write_func", " and set.out in lib/sendf.c, lib/ftp.h, lib/ftp.c, lib/ftplistparser.c,", " lib/ftplistparser.h.", " - debian/patches/CVE-2026-92388-2.patch: only use the list parser in the", " CURLWC_MATCHING state in lib/ftplistparser.c.", " - CVE-2026-92388", " * SECURITY UPDATE: Information exposure from TFTP transfer direction", " confusion.", " - debian/patches/CVE-2026-92389.patch: return CURLE_TFTP_ILLEGAL when a", " server response does not match the transfer direction in lib/tftp.c.", " - CVE-2026-92389", " * SECURITY UPDATE: Stack overflow from deeply nested MIME structures.", " - debian/patches/CVE-2026-92391.patch: free MIME handles non-recursively in", " curl_mime_free in lib/mime.c.", " - CVE-2026-92391", " * SECURITY UPDATE: Credential exposure in CURLINFO_EFFECTIVE_URL.", " - debian/patches/CVE-2026-94266.patch: return a copy of the URL without", " credentials for CURLINFO_EFFECTIVE_URL in lib/getinfo.c, lib/transfer.c,", " lib/url.c, lib/urldata.h.", " - CVE-2026-94266", "" ], "package": "curl", "version": "7.81.0-1ubuntu1.30", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Charles Cochran ", "date": "Mon, 12 Oct 2026 18:12:33 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libcurl4", "from_version": { "source_package_name": "curl", "source_package_version": "7.81.0-1ubuntu1.29", "version": "7.81.0-1ubuntu1.29" }, "to_version": { "source_package_name": "curl", "source_package_version": "7.81.0-1ubuntu1.30", "version": "7.81.0-1ubuntu1.30" }, "cves": [ { "cve": "CVE-2026-86409", "url": "https://ubuntu.com/security/CVE-2026-86409", "cve_description": "Setting `CURLOPT_AWS_SIGV4` to NULL does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL is set next, leaking state information.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86414", "url": "https://ubuntu.com/security/CVE-2026-86414", "cve_description": "A HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87862", "url": "https://ubuntu.com/security/CVE-2026-87862", "cve_description": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87864", "url": "https://ubuntu.com/security/CVE-2026-87864", "cve_description": "Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92388", "url": "https://ubuntu.com/security/CVE-2026-92388", "cve_description": "When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while reconfiguring only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92389", "url": "https://ubuntu.com/security/CVE-2026-92389", "cve_description": "libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92391", "url": "https://ubuntu.com/security/CVE-2026-92391", "cve_description": "A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-94266", "url": "https://ubuntu.com/security/CVE-2026-94266", "cve_description": "libcurl could accidentally return a URL for curl_easy_getinfo's `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did. The curl tool exposes the same information using the command line option `--write-out '%{url_effective}'`. This credential leak can happen when curl retrieves credentials from a `.netrc` file.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-86409", "url": "https://ubuntu.com/security/CVE-2026-86409", "cve_description": "Setting `CURLOPT_AWS_SIGV4` to NULL does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL is set next, leaking state information.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86414", "url": "https://ubuntu.com/security/CVE-2026-86414", "cve_description": "A HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87862", "url": "https://ubuntu.com/security/CVE-2026-87862", "cve_description": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87864", "url": "https://ubuntu.com/security/CVE-2026-87864", "cve_description": "Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92388", "url": "https://ubuntu.com/security/CVE-2026-92388", "cve_description": "When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while reconfiguring only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92389", "url": "https://ubuntu.com/security/CVE-2026-92389", "cve_description": "libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92391", "url": "https://ubuntu.com/security/CVE-2026-92391", "cve_description": "A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-94266", "url": "https://ubuntu.com/security/CVE-2026-94266", "cve_description": "libcurl could accidentally return a URL for curl_easy_getinfo's `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did. The curl tool exposes the same information using the command line option `--write-out '%{url_effective}'`. This credential leak can happen when curl retrieves credentials from a `.netrc` file.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Information exposure from stale AWS SigV4 authentication.", " - debian/patches/CVE-2026-86409.patch: clear CURLAUTH_AWS_SIGV4 when", " CURLOPT_AWS_SIGV4 is set to NULL in lib/setopt.c.", " - CVE-2026-86409", " * SECURITY UPDATE: Credential exposure to an HTTP proxy in CONNECT.", " - debian/patches/CVE-2026-86414.patch: do not react to 401 responses to a", " CONNECT request in lib/http_proxy.c.", " - CVE-2026-86414", " * SECURITY UPDATE: Improper handling of HSTS entries on load.", " - debian/patches/CVE-2026-87862.patch: match only the exact host, not", " parent domains, when removing duplicates while loading an HSTS file in", " lib/hsts.c.", " - CVE-2026-87862", " * SECURITY UPDATE: Command injection in IMAP APPEND with CURLOPT_CRLF.", " - debian/patches/CVE-2026-87864.patch: reject APPEND when CRLF conversion", " is enabled, as it makes the upload size unknown in lib/imap.c.", " - CVE-2026-87864", " * SECURITY UPDATE: Use after free in FTP wildcard matching.", " - debian/patches/CVE-2026-92388-1.patch: stop overwriting set.write_func", " and set.out in lib/sendf.c, lib/ftp.h, lib/ftp.c, lib/ftplistparser.c,", " lib/ftplistparser.h.", " - debian/patches/CVE-2026-92388-2.patch: only use the list parser in the", " CURLWC_MATCHING state in lib/ftplistparser.c.", " - CVE-2026-92388", " * SECURITY UPDATE: Information exposure from TFTP transfer direction", " confusion.", " - debian/patches/CVE-2026-92389.patch: return CURLE_TFTP_ILLEGAL when a", " server response does not match the transfer direction in lib/tftp.c.", " - CVE-2026-92389", " * SECURITY UPDATE: Stack overflow from deeply nested MIME structures.", " - debian/patches/CVE-2026-92391.patch: free MIME handles non-recursively in", " curl_mime_free in lib/mime.c.", " - CVE-2026-92391", " * SECURITY UPDATE: Credential exposure in CURLINFO_EFFECTIVE_URL.", " - debian/patches/CVE-2026-94266.patch: return a copy of the URL without", " credentials for CURLINFO_EFFECTIVE_URL in lib/getinfo.c, lib/transfer.c,", " lib/url.c, lib/urldata.h.", " - CVE-2026-94266", "" ], "package": "curl", "version": "7.81.0-1ubuntu1.30", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Charles Cochran ", "date": "Mon, 12 Oct 2026 18:12:33 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libfreetype6", "from_version": { "source_package_name": "freetype", "source_package_version": "2.11.1+dfsg-1ubuntu0.3", "version": "2.11.1+dfsg-1ubuntu0.3" }, "to_version": { "source_package_name": "freetype", "source_package_version": "2.11.1+dfsg-1ubuntu0.4", "version": "2.11.1+dfsg-1ubuntu0.4" }, "cves": [ { "cve": "CVE-2026-95512", "url": "https://ubuntu.com/security/CVE-2026-95512", "cve_description": "A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate.", "cve_priority": "medium", "cve_public_date": "2026-10-02 09:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-95512", "url": "https://ubuntu.com/security/CVE-2026-95512", "cve_description": "A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate.", "cve_priority": "medium", "cve_public_date": "2026-10-02 09:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: DoS in CID font loader", " - debian/patches/CVE-2026-95512.patch: * src/cid/cidload.c (cid_read_subrs):", " Limit overlaps. in src/cid/cidload.c.", " - CVE-2026-95512", "" ], "package": "freetype", "version": "2.11.1+dfsg-1ubuntu0.4", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 05 Oct 2026 10:43:41 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libnss-systemd", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.23", "version": "249.11-0ubuntu3.23" }, "cves": [], "launchpad_bugs_fixed": [ 2170538 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp2170538-resolved-pick-up-new-DNSSEC-KSK-from-2024.patch: add", " the root zone KSK-2024 (key tag 38696) to the built-in DNSSEC trust", " anchor. Since 2026-10-11 the root DNSKEY RRset is signed only by", " this key, so with DNSSEC enabled and no local trust anchor file", " every lookup failed with \"missing-key\" (LP: #2170538)", "" ], "package": "systemd", "version": "249.11-0ubuntu3.23", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2170538 ], "author": "CyberNative AI LLC ", "date": "Mon, 12 Oct 2026 07:44:55 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "libopeniscsiusr", "from_version": { "source_package_name": "open-iscsi", "source_package_version": "2.1.5-1ubuntu1.1", "version": "2.1.5-1ubuntu1.1" }, "to_version": { "source_package_name": "open-iscsi", "source_package_version": "2.1.5-1ubuntu1.3", "version": "2.1.5-1ubuntu1.3" }, "cves": [], "launchpad_bugs_fixed": [ 2147499 ], "changes": [ { "cves": [], "log": [ "", " * d/extra/initramfs/local-top/iscsi: normalize static bootproto for", " initramfs netplan conversion. In iscsi_auto flow, firmware reports", " bootproto as STATIC, but netinfo_to_netplan handles static IPv4", " through PROTO=none with address fields. Map STATIC to PROTO=none", " and record IPV4PROTO=static in net-*.conf. (LP: #2147499)", "" ], "package": "open-iscsi", "version": "2.1.5-1ubuntu1.3", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2147499 ], "author": "Zhang Hua ", "date": "Fri, 03 Jul 2026 17:04:18 +0800" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-systemd", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.23", "version": "249.11-0ubuntu3.23" }, "cves": [], "launchpad_bugs_fixed": [ 2170538 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp2170538-resolved-pick-up-new-DNSSEC-KSK-from-2024.patch: add", " the root zone KSK-2024 (key tag 38696) to the built-in DNSSEC trust", " anchor. Since 2026-10-11 the root DNSKEY RRset is signed only by", " this key, so with DNSSEC enabled and no local trust anchor file", " every lookup failed with \"missing-key\" (LP: #2170538)", "" ], "package": "systemd", "version": "249.11-0ubuntu3.23", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2170538 ], "author": "CyberNative AI LLC ", "date": "Mon, 12 Oct 2026 07:44:55 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpng16-16", "from_version": { "source_package_name": "libpng1.6", "source_package_version": "1.6.37-3ubuntu0.6", "version": "1.6.37-3ubuntu0.6" }, "to_version": { "source_package_name": "libpng1.6", "source_package_version": "1.6.37-3ubuntu0.7", "version": "1.6.37-3ubuntu0.7" }, "cves": [ { "cve": "CVE-2026-46675", "url": "https://ubuntu.com/security/CVE-2026-46675", "cve_description": "[Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression]", "cve_priority": "medium", "cve_public_date": "2026-09-29" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-46675", "url": "https://ubuntu.com/security/CVE-2026-46675", "cve_description": "[Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression]", "cve_priority": "medium", "cve_public_date": "2026-09-29" } ], "log": [ "", " * SECURITY UPDATE: Use-after-free in png_read_end", " - debian/patches/CVE-2026-46675.patch: Clear stale zstream pointers when", " releasing the inflate stream in pngrutil.c", " - CVE-2026-46675", "" ], "package": "libpng1.6", "version": "1.6.37-3ubuntu0.7", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Mon, 05 Oct 2026 15:37:39 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "libsgutils2-2", "from_version": { "source_package_name": "sg3-utils", "source_package_version": "1.46-1ubuntu0.22.04.1", "version": "1.46-1ubuntu0.22.04.1" }, "to_version": { "source_package_name": "sg3-utils", "source_package_version": "1.46-1ubuntu0.22.04.2", "version": "1.46-1ubuntu0.22.04.2" }, "cves": [ { "cve": "CVE-2026-16313", "url": "https://ubuntu.com/security/CVE-2026-16313", "cve_description": "A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.", "cve_priority": "medium", "cve_public_date": "2026-07-28 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-16313", "url": "https://ubuntu.com/security/CVE-2026-16313", "cve_description": "A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.", "cve_priority": "medium", "cve_public_date": "2026-07-28 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: command injection via udev property injection", " - debian/patches/CVE-2026-16313.patch: apply udev-conforming character", " encoding to the VPD 0x83 SCSI name string and T10 vendor ID ATA", " subfield output of sg_inq --export, so a crafted SCSI device cannot", " inject udev properties and execute commands as root (fix released", " upstream in sg3_utils 1.49).", " - debian/patches/CVE-2026-16313_2.patch: avoid including 0-bytes in SCSI", " name strings (upstream follow-up fix).", " - CVE-2026-16313", "" ], "package": "sg3-utils", "version": "1.46-1ubuntu0.22.04.2", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Thu, 01 Oct 2026 14:12:16 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libsystemd0", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.23", "version": "249.11-0ubuntu3.23" }, "cves": [], "launchpad_bugs_fixed": [ 2170538 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp2170538-resolved-pick-up-new-DNSSEC-KSK-from-2024.patch: add", " the root zone KSK-2024 (key tag 38696) to the built-in DNSSEC trust", " anchor. Since 2026-10-11 the root DNSKEY RRset is signed only by", " this key, so with DNSSEC enabled and no local trust anchor file", " every lookup failed with \"missing-key\" (LP: #2170538)", "" ], "package": "systemd", "version": "249.11-0ubuntu3.23", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2170538 ], "author": "CyberNative AI LLC ", "date": "Mon, 12 Oct 2026 07:44:55 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "libudev1", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.23", "version": "249.11-0ubuntu3.23" }, "cves": [], "launchpad_bugs_fixed": [ 2170538 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp2170538-resolved-pick-up-new-DNSSEC-KSK-from-2024.patch: add", " the root zone KSK-2024 (key tag 38696) to the built-in DNSSEC trust", " anchor. Since 2026-10-11 the root DNSKEY RRset is signed only by", " this key, so with DNSSEC enabled and no local trust anchor file", " every lookup failed with \"missing-key\" (LP: #2170538)", "" ], "package": "systemd", "version": "249.11-0ubuntu3.23", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2170538 ], "author": "CyberNative AI LLC ", "date": "Mon, 12 Oct 2026 07:44:55 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "libx11-6", "from_version": { "source_package_name": "libx11", "source_package_version": "2:1.7.5-1ubuntu0.3", "version": "2:1.7.5-1ubuntu0.3" }, "to_version": { "source_package_name": "libx11", "source_package_version": "2:1.7.5-1ubuntu0.4", "version": "2:1.7.5-1ubuntu0.4" }, "cves": [ { "cve": "CVE-2026-88806", "url": "https://ubuntu.com/security/CVE-2026-88806", "cve_description": "A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.", "cve_priority": "medium", "cve_public_date": "2026-09-21 14:17:00 UTC" }, { "cve": "CVE-2026-94283", "url": "https://ubuntu.com/security/CVE-2026-94283", "cve_description": "An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.", "cve_priority": "medium", "cve_public_date": "2026-09-28 09:17:00 UTC" }, { "cve": "CVE-2026-94284", "url": "https://ubuntu.com/security/CVE-2026-94284", "cve_description": "An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.", "cve_priority": "medium", "cve_public_date": "2026-09-28 09:17:00 UTC" }, { "cve": "CVE-2026-94285", "url": "https://ubuntu.com/security/CVE-2026-94285", "cve_description": "An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.", "cve_priority": "medium", "cve_public_date": "2026-09-28 09:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-88806", "url": "https://ubuntu.com/security/CVE-2026-88806", "cve_description": "A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.", "cve_priority": "medium", "cve_public_date": "2026-09-21 14:17:00 UTC" }, { "cve": "CVE-2026-94283", "url": "https://ubuntu.com/security/CVE-2026-94283", "cve_description": "An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.", "cve_priority": "medium", "cve_public_date": "2026-09-28 09:17:00 UTC" }, { "cve": "CVE-2026-94284", "url": "https://ubuntu.com/security/CVE-2026-94284", "cve_description": "An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.", "cve_priority": "medium", "cve_public_date": "2026-09-28 09:17:00 UTC" }, { "cve": "CVE-2026-94285", "url": "https://ubuntu.com/security/CVE-2026-94285", "cve_description": "An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.", "cve_priority": "medium", "cve_public_date": "2026-09-28 09:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: heap buffer overflow in _XkbReadKeyActions()", " - debian/patches/CVE-2026-88806.patch: check the keysym range in", " _XkbReadKeyActions() in src/xkb/XKBGetMap.c.", " - CVE-2026-88806", " * SECURITY UPDATE: out-of-bounds read in XIM attribute parser", " - debian/patches/CVE-2026-94283.patch: bound XIM_OPEN_REPLY attribute", " lengths to the received packet in modules/im/ximcp/imDefIm.c,", " modules/im/ximcp/imRmAttr.c and src/xlibi18n/XimintP.h.", " - CVE-2026-94283", " * SECURITY UPDATE: out-of-bounds read in XIM trigger-key registration", " - debian/patches/CVE-2026-94284.patch: bound XIM_REGISTER_TRIGGERKEYS", " keylist lengths to the packet in modules/im/ximcp/imDefLkup.c.", " - CVE-2026-94284", " * SECURITY UPDATE: out-of-bounds read in byte-oriented codeset parser", " - debian/patches/CVE-2026-94285.patch: bound byteM_parse_codeset() reads", " to the remaining input length in modules/lc/gen/lcGenConv.c.", " - CVE-2026-94285", "" ], "package": "libx11", "version": "2:1.7.5-1ubuntu0.4", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Nick Galanis ", "date": "Thu, 08 Oct 2026 14:13:21 +0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "libx11-data", "from_version": { "source_package_name": "libx11", "source_package_version": "2:1.7.5-1ubuntu0.3", "version": "2:1.7.5-1ubuntu0.3" }, "to_version": { "source_package_name": "libx11", "source_package_version": "2:1.7.5-1ubuntu0.4", "version": "2:1.7.5-1ubuntu0.4" }, "cves": [ { "cve": "CVE-2026-88806", "url": "https://ubuntu.com/security/CVE-2026-88806", "cve_description": "A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.", "cve_priority": "medium", "cve_public_date": "2026-09-21 14:17:00 UTC" }, { "cve": "CVE-2026-94283", "url": "https://ubuntu.com/security/CVE-2026-94283", "cve_description": "An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.", "cve_priority": "medium", "cve_public_date": "2026-09-28 09:17:00 UTC" }, { "cve": "CVE-2026-94284", "url": "https://ubuntu.com/security/CVE-2026-94284", "cve_description": "An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.", "cve_priority": "medium", "cve_public_date": "2026-09-28 09:17:00 UTC" }, { "cve": "CVE-2026-94285", "url": "https://ubuntu.com/security/CVE-2026-94285", "cve_description": "An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.", "cve_priority": "medium", "cve_public_date": "2026-09-28 09:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-88806", "url": "https://ubuntu.com/security/CVE-2026-88806", "cve_description": "A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.", "cve_priority": "medium", "cve_public_date": "2026-09-21 14:17:00 UTC" }, { "cve": "CVE-2026-94283", "url": "https://ubuntu.com/security/CVE-2026-94283", "cve_description": "An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.", "cve_priority": "medium", "cve_public_date": "2026-09-28 09:17:00 UTC" }, { "cve": "CVE-2026-94284", "url": "https://ubuntu.com/security/CVE-2026-94284", "cve_description": "An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.", "cve_priority": "medium", "cve_public_date": "2026-09-28 09:17:00 UTC" }, { "cve": "CVE-2026-94285", "url": "https://ubuntu.com/security/CVE-2026-94285", "cve_description": "An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.", "cve_priority": "medium", "cve_public_date": "2026-09-28 09:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: heap buffer overflow in _XkbReadKeyActions()", " - debian/patches/CVE-2026-88806.patch: check the keysym range in", " _XkbReadKeyActions() in src/xkb/XKBGetMap.c.", " - CVE-2026-88806", " * SECURITY UPDATE: out-of-bounds read in XIM attribute parser", " - debian/patches/CVE-2026-94283.patch: bound XIM_OPEN_REPLY attribute", " lengths to the received packet in modules/im/ximcp/imDefIm.c,", " modules/im/ximcp/imRmAttr.c and src/xlibi18n/XimintP.h.", " - CVE-2026-94283", " * SECURITY UPDATE: out-of-bounds read in XIM trigger-key registration", " - debian/patches/CVE-2026-94284.patch: bound XIM_REGISTER_TRIGGERKEYS", " keylist lengths to the packet in modules/im/ximcp/imDefLkup.c.", " - CVE-2026-94284", " * SECURITY UPDATE: out-of-bounds read in byte-oriented codeset parser", " - debian/patches/CVE-2026-94285.patch: bound byteM_parse_codeset() reads", " to the remaining input length in modules/lc/gen/lcGenConv.c.", " - CVE-2026-94285", "" ], "package": "libx11", "version": "2:1.7.5-1ubuntu0.4", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Nick Galanis ", "date": "Thu, 08 Oct 2026 14:13:21 +0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "libxml2", "from_version": { "source_package_name": "libxml2", "source_package_version": "2.9.13+dfsg-1ubuntu0.13", "version": "2.9.13+dfsg-1ubuntu0.13" }, "to_version": { "source_package_name": "libxml2", "source_package_version": "2.9.13+dfsg-1ubuntu0.14", "version": "2.9.13+dfsg-1ubuntu0.14" }, "cves": [ { "cve": "CVE-2026-76781", "url": "https://ubuntu.com/security/CVE-2026-76781", "cve_description": "A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to the application crashing and causing a Denial of Service (DoS).", "cve_priority": "medium", "cve_public_date": "2026-09-17 16:17:00 UTC" }, { "cve": "CVE-2026-86138", "url": "https://ubuntu.com/security/CVE-2026-86138", "cve_description": "In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.", "cve_priority": "medium", "cve_public_date": "2026-09-05 05:17:00 UTC" }, { "cve": "CVE-2026-86142", "url": "https://ubuntu.com/security/CVE-2026-86142", "cve_description": "In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.", "cve_priority": "medium", "cve_public_date": "2026-09-05 05:17:00 UTC" }, { "cve": "CVE-2026-86143", "url": "https://ubuntu.com/security/CVE-2026-86143", "cve_description": "In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.", "cve_priority": "medium", "cve_public_date": "2026-09-05 05:17:00 UTC" }, { "cve": "CVE-2026-86144", "url": "https://ubuntu.com/security/CVE-2026-86144", "cve_description": "In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).", "cve_priority": "medium", "cve_public_date": "2026-09-05 05:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-76781", "url": "https://ubuntu.com/security/CVE-2026-76781", "cve_description": "A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to the application crashing and causing a Denial of Service (DoS).", "cve_priority": "medium", "cve_public_date": "2026-09-17 16:17:00 UTC" }, { "cve": "CVE-2026-86138", "url": "https://ubuntu.com/security/CVE-2026-86138", "cve_description": "In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.", "cve_priority": "medium", "cve_public_date": "2026-09-05 05:17:00 UTC" }, { "cve": "CVE-2026-86142", "url": "https://ubuntu.com/security/CVE-2026-86142", "cve_description": "In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.", "cve_priority": "medium", "cve_public_date": "2026-09-05 05:17:00 UTC" }, { "cve": "CVE-2026-86143", "url": "https://ubuntu.com/security/CVE-2026-86143", "cve_description": "In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.", "cve_priority": "medium", "cve_public_date": "2026-09-05 05:17:00 UTC" }, { "cve": "CVE-2026-86144", "url": "https://ubuntu.com/security/CVE-2026-86144", "cve_description": "In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).", "cve_priority": "medium", "cve_public_date": "2026-09-05 05:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: NULL pointer dereference when parsing XML catalogs", " - debian/patches/CVE-2026-76781.patch: Skip the duplicate nextCatalog", " check when the catalog attribute is missing in catalog.c.", " - CVE-2026-76781", " * SECURITY UPDATE: integer overflow leading to heap-based buffer overflow", " in xmlDictAddQString", " - debian/patches/CVE-2026-86138.patch: Add overflow checks to the pool", " size calculations in xmlDictAddQString in dict.c.", " - CVE-2026-86138", " * SECURITY UPDATE: heap-based buffer overflow in XPointer evaluation", " - debian/patches/CVE-2026-86142.patch: Return an error when xmlStrlen", " reports an overflowed expression in xmlXPtrEvalXPtrPart in xpointer.c.", " - CVE-2026-86142", " * SECURITY UPDATE: integer overflow in length passed to output callbacks", " - debian/patches/CVE-2026-86143.patch: Fail when the output buffer holds", " >= INT_MAX bytes in xmlIO.c.", " - CVE-2026-86143", " * SECURITY UPDATE: XInclude processing ignores parse flags", " - debian/patches/CVE-2026-86144.patch: Pass the document parseFlags to", " xmlXIncludeProcess and xmlXIncludeProcessTree and apply parse flags", " to text includes in xinclude.c.", " - CVE-2026-86144", "" ], "package": "libxml2", "version": "2.9.13+dfsg-1ubuntu0.14", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Charles Cochran ", "date": "Tue, 06 Oct 2026 12:46:29 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "open-iscsi", "from_version": { "source_package_name": "open-iscsi", "source_package_version": "2.1.5-1ubuntu1.1", "version": "2.1.5-1ubuntu1.1" }, "to_version": { "source_package_name": "open-iscsi", "source_package_version": "2.1.5-1ubuntu1.3", "version": "2.1.5-1ubuntu1.3" }, "cves": [], "launchpad_bugs_fixed": [ 2147499 ], "changes": [ { "cves": [], "log": [ "", " * d/extra/initramfs/local-top/iscsi: normalize static bootproto for", " initramfs netplan conversion. In iscsi_auto flow, firmware reports", " bootproto as STATIC, but netinfo_to_netplan handles static IPv4", " through PROTO=none with address fields. Map STATIC to PROTO=none", " and record IPV4PROTO=static in net-*.conf. (LP: #2147499)", "" ], "package": "open-iscsi", "version": "2.1.5-1ubuntu1.3", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2147499 ], "author": "Zhang Hua ", "date": "Fri, 03 Jul 2026 17:04:18 +0800" } ], "notes": null, "is_version_downgrade": false }, { "name": "open-vm-tools", "from_version": { "source_package_name": "open-vm-tools", "source_package_version": "2:12.3.5-3~ubuntu0.22.04.3", "version": "2:12.3.5-3~ubuntu0.22.04.3" }, "to_version": { "source_package_name": "open-vm-tools", "source_package_version": "2:12.3.5-3~ubuntu0.22.04.4", "version": "2:12.3.5-3~ubuntu0.22.04.4" }, "cves": [], "launchpad_bugs_fixed": [ 2166910 ], "changes": [ { "cves": [], "log": [ "", " * Avoid ordering implications to other services on non-vmware systems", " (LP: #2166910)", "" ], "package": "open-vm-tools", "version": "2:12.3.5-3~ubuntu0.22.04.4", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2166910 ], "author": "Christian Ehrhardt ", "date": "Wed, 16 Sep 2026 10:57:02 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-client", "from_version": { "source_package_name": "openssh", "source_package_version": "1:8.9p1-3ubuntu0.17", "version": "1:8.9p1-3ubuntu0.17" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:8.9p1-3ubuntu0.18", "version": "1:8.9p1-3ubuntu0.18" }, "cves": [ { "cve": "CVE-2026-106552", "url": "https://ubuntu.com/security/CVE-2026-106552", "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106553", "url": "https://ubuntu.com/security/CVE-2026-106553", "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106555", "url": "https://ubuntu.com/security/CVE-2026-106555", "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106582", "url": "https://ubuntu.com/security/CVE-2026-106582", "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106583", "url": "https://ubuntu.com/security/CVE-2026-106583", "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.", "cve_priority": "medium", "cve_public_date": "2026-10-07 00:17:00 UTC" }, { "cve": "CVE-2026-106584", "url": "https://ubuntu.com/security/CVE-2026-106584", "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106585", "url": "https://ubuntu.com/security/CVE-2026-106585", "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106586", "url": "https://ubuntu.com/security/CVE-2026-106586", "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106587", "url": "https://ubuntu.com/security/CVE-2026-106587", "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.", "cve_priority": "medium", "cve_public_date": "2026-10-06 22:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-106552", "url": "https://ubuntu.com/security/CVE-2026-106552", "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106553", "url": "https://ubuntu.com/security/CVE-2026-106553", "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106555", "url": "https://ubuntu.com/security/CVE-2026-106555", "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106582", "url": "https://ubuntu.com/security/CVE-2026-106582", "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106583", "url": "https://ubuntu.com/security/CVE-2026-106583", "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.", "cve_priority": "medium", "cve_public_date": "2026-10-07 00:17:00 UTC" }, { "cve": "CVE-2026-106584", "url": "https://ubuntu.com/security/CVE-2026-106584", "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106585", "url": "https://ubuntu.com/security/CVE-2026-106585", "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106586", "url": "https://ubuntu.com/security/CVE-2026-106586", "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106587", "url": "https://ubuntu.com/security/CVE-2026-106587", "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.", "cve_priority": "medium", "cve_public_date": "2026-10-06 22:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: sftp directory traversal", " - debian/patches/CVE-2026-106552-pre1.patch: upstream: similar to scp, fix", " implicit destination path selection in sftp.c.", " - debian/patches/CVE-2026-106552.patch: upstream: sftp: be stricter in", " accepting paths returned by the in sftp-client.c, sftp.c.", " - CVE-2026-106552", " * SECURITY UPDATE: incorrect GSSAPIAuthentication auth persistence", " - debian/patches/CVE-2026-106553-1.patch: upstream: Reset GSSAPI client", " state before authentication in auth2.c, gss-serv.c, monitor.c, ssh-gss.h.", " - debian/patches/CVE-2026-106553-2.patch: upstream: Only store GSSAPI creds", " when authn succeeds in gss-serv.c, ssh-gss.h.", " - debian/patches/CVE-2026-106553-3.patch: upstream:", " ssh_gssapi_cleanup_global_client() needs a prototype in gss-serv.c, ssh-", " gss.h.", " - CVE-2026-106553", " - CVE-2026-106555", " * SECURITY UPDATE: incorrect use of LZ77 dictionary coder", " - debian/patches/CVE-2026-106582.patch: upstream: Disable LZ77 dictionary", " coder to avoid a potential in packet.c.", " - CVE-2026-106582", " * SECURITY UPDATE: invalid chars in command-line username", " - debian/patches/CVE-2026-106583-1.patch: upstream: Further restrict the", " characters allowed in a command-line in readconf.c.", " - debian/patches/CVE-2026-106583-2.patch: upstream: Add test for", " proxycommand percent expansions. in regress/percent.sh.", " - debian/patches/CVE-2026-106583-3.patch: avoid ksh-ism in regress test in", " regress/percent.sh.", " - CVE-2026-106583", " * SECURITY UPDATE: incorrect cert expiry in ssh-keygen", " - debian/patches/CVE-2026-106584.patch: upstream: Correct handling of DST", " when converting dates in misc.c.", " - CVE-2026-106584", " * SECURITY UPDATE: missing maximum packet length check", " - debian/patches/CVE-2026-106585.patch: upstream: Check that compressed", " payloads don't inflate beyond the in packet.c.", " - CVE-2026-106585", " * SECURITY UPDATE: incorrect restrict keyword usage in tunnel forwarding", " - debian/patches/CVE-2026-106586-1.patch: upstream: Propagate", " authorized_keys \"resrict\" keyword in auth-options.c.", " - debian/patches/CVE-2026-106586-2.patch: upstream: correctly check", " sshauthopt->restricted merging in regress/unittests/authopt/tests.c.", " - debian/patches/CVE-2026-106586-3.patch: upstream: simpler in", " regress/unittests/authopt/tests.c.", " - CVE-2026-106586", " * SECURITY UPDATE: \"none\" value confusion in options", " - debian/patches/CVE-2026-106587.patch: upstream: Correctly handle some", " options that accept \"none\" in servconf.c.", " - CVE-2026-106587", "" ], "package": "openssh", "version": "1:8.9p1-3ubuntu0.18", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 08 Oct 2026 13:31:33 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-server", "from_version": { "source_package_name": "openssh", "source_package_version": "1:8.9p1-3ubuntu0.17", "version": "1:8.9p1-3ubuntu0.17" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:8.9p1-3ubuntu0.18", "version": "1:8.9p1-3ubuntu0.18" }, "cves": [ { "cve": "CVE-2026-106552", "url": "https://ubuntu.com/security/CVE-2026-106552", "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106553", "url": "https://ubuntu.com/security/CVE-2026-106553", "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106555", "url": "https://ubuntu.com/security/CVE-2026-106555", "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106582", "url": "https://ubuntu.com/security/CVE-2026-106582", "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106583", "url": "https://ubuntu.com/security/CVE-2026-106583", "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.", "cve_priority": "medium", "cve_public_date": "2026-10-07 00:17:00 UTC" }, { "cve": "CVE-2026-106584", "url": "https://ubuntu.com/security/CVE-2026-106584", "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106585", "url": "https://ubuntu.com/security/CVE-2026-106585", "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106586", "url": "https://ubuntu.com/security/CVE-2026-106586", "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106587", "url": "https://ubuntu.com/security/CVE-2026-106587", "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.", "cve_priority": "medium", "cve_public_date": "2026-10-06 22:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-106552", "url": "https://ubuntu.com/security/CVE-2026-106552", "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106553", "url": "https://ubuntu.com/security/CVE-2026-106553", "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106555", "url": "https://ubuntu.com/security/CVE-2026-106555", "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106582", "url": "https://ubuntu.com/security/CVE-2026-106582", "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106583", "url": "https://ubuntu.com/security/CVE-2026-106583", "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.", "cve_priority": "medium", "cve_public_date": "2026-10-07 00:17:00 UTC" }, { "cve": "CVE-2026-106584", "url": "https://ubuntu.com/security/CVE-2026-106584", "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106585", "url": "https://ubuntu.com/security/CVE-2026-106585", "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106586", "url": "https://ubuntu.com/security/CVE-2026-106586", "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106587", "url": "https://ubuntu.com/security/CVE-2026-106587", "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.", "cve_priority": "medium", "cve_public_date": "2026-10-06 22:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: sftp directory traversal", " - debian/patches/CVE-2026-106552-pre1.patch: upstream: similar to scp, fix", " implicit destination path selection in sftp.c.", " - debian/patches/CVE-2026-106552.patch: upstream: sftp: be stricter in", " accepting paths returned by the in sftp-client.c, sftp.c.", " - CVE-2026-106552", " * SECURITY UPDATE: incorrect GSSAPIAuthentication auth persistence", " - debian/patches/CVE-2026-106553-1.patch: upstream: Reset GSSAPI client", " state before authentication in auth2.c, gss-serv.c, monitor.c, ssh-gss.h.", " - debian/patches/CVE-2026-106553-2.patch: upstream: Only store GSSAPI creds", " when authn succeeds in gss-serv.c, ssh-gss.h.", " - debian/patches/CVE-2026-106553-3.patch: upstream:", " ssh_gssapi_cleanup_global_client() needs a prototype in gss-serv.c, ssh-", " gss.h.", " - CVE-2026-106553", " - CVE-2026-106555", " * SECURITY UPDATE: incorrect use of LZ77 dictionary coder", " - debian/patches/CVE-2026-106582.patch: upstream: Disable LZ77 dictionary", " coder to avoid a potential in packet.c.", " - CVE-2026-106582", " * SECURITY UPDATE: invalid chars in command-line username", " - debian/patches/CVE-2026-106583-1.patch: upstream: Further restrict the", " characters allowed in a command-line in readconf.c.", " - debian/patches/CVE-2026-106583-2.patch: upstream: Add test for", " proxycommand percent expansions. in regress/percent.sh.", " - debian/patches/CVE-2026-106583-3.patch: avoid ksh-ism in regress test in", " regress/percent.sh.", " - CVE-2026-106583", " * SECURITY UPDATE: incorrect cert expiry in ssh-keygen", " - debian/patches/CVE-2026-106584.patch: upstream: Correct handling of DST", " when converting dates in misc.c.", " - CVE-2026-106584", " * SECURITY UPDATE: missing maximum packet length check", " - debian/patches/CVE-2026-106585.patch: upstream: Check that compressed", " payloads don't inflate beyond the in packet.c.", " - CVE-2026-106585", " * SECURITY UPDATE: incorrect restrict keyword usage in tunnel forwarding", " - debian/patches/CVE-2026-106586-1.patch: upstream: Propagate", " authorized_keys \"resrict\" keyword in auth-options.c.", " - debian/patches/CVE-2026-106586-2.patch: upstream: correctly check", " sshauthopt->restricted merging in regress/unittests/authopt/tests.c.", " - debian/patches/CVE-2026-106586-3.patch: upstream: simpler in", " regress/unittests/authopt/tests.c.", " - CVE-2026-106586", " * SECURITY UPDATE: \"none\" value confusion in options", " - debian/patches/CVE-2026-106587.patch: upstream: Correctly handle some", " options that accept \"none\" in servconf.c.", " - CVE-2026-106587", "" ], "package": "openssh", "version": "1:8.9p1-3ubuntu0.18", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 08 Oct 2026 13:31:33 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-sftp-server", "from_version": { "source_package_name": "openssh", "source_package_version": "1:8.9p1-3ubuntu0.17", "version": "1:8.9p1-3ubuntu0.17" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:8.9p1-3ubuntu0.18", "version": "1:8.9p1-3ubuntu0.18" }, "cves": [ { "cve": "CVE-2026-106552", "url": "https://ubuntu.com/security/CVE-2026-106552", "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106553", "url": "https://ubuntu.com/security/CVE-2026-106553", "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106555", "url": "https://ubuntu.com/security/CVE-2026-106555", "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106582", "url": "https://ubuntu.com/security/CVE-2026-106582", "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106583", "url": "https://ubuntu.com/security/CVE-2026-106583", "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.", "cve_priority": "medium", "cve_public_date": "2026-10-07 00:17:00 UTC" }, { "cve": "CVE-2026-106584", "url": "https://ubuntu.com/security/CVE-2026-106584", "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106585", "url": "https://ubuntu.com/security/CVE-2026-106585", "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106586", "url": "https://ubuntu.com/security/CVE-2026-106586", "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106587", "url": "https://ubuntu.com/security/CVE-2026-106587", "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.", "cve_priority": "medium", "cve_public_date": "2026-10-06 22:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-106552", "url": "https://ubuntu.com/security/CVE-2026-106552", "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106553", "url": "https://ubuntu.com/security/CVE-2026-106553", "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106555", "url": "https://ubuntu.com/security/CVE-2026-106555", "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106582", "url": "https://ubuntu.com/security/CVE-2026-106582", "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106583", "url": "https://ubuntu.com/security/CVE-2026-106583", "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.", "cve_priority": "medium", "cve_public_date": "2026-10-07 00:17:00 UTC" }, { "cve": "CVE-2026-106584", "url": "https://ubuntu.com/security/CVE-2026-106584", "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106585", "url": "https://ubuntu.com/security/CVE-2026-106585", "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106586", "url": "https://ubuntu.com/security/CVE-2026-106586", "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106587", "url": "https://ubuntu.com/security/CVE-2026-106587", "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.", "cve_priority": "medium", "cve_public_date": "2026-10-06 22:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: sftp directory traversal", " - debian/patches/CVE-2026-106552-pre1.patch: upstream: similar to scp, fix", " implicit destination path selection in sftp.c.", " - debian/patches/CVE-2026-106552.patch: upstream: sftp: be stricter in", " accepting paths returned by the in sftp-client.c, sftp.c.", " - CVE-2026-106552", " * SECURITY UPDATE: incorrect GSSAPIAuthentication auth persistence", " - debian/patches/CVE-2026-106553-1.patch: upstream: Reset GSSAPI client", " state before authentication in auth2.c, gss-serv.c, monitor.c, ssh-gss.h.", " - debian/patches/CVE-2026-106553-2.patch: upstream: Only store GSSAPI creds", " when authn succeeds in gss-serv.c, ssh-gss.h.", " - debian/patches/CVE-2026-106553-3.patch: upstream:", " ssh_gssapi_cleanup_global_client() needs a prototype in gss-serv.c, ssh-", " gss.h.", " - CVE-2026-106553", " - CVE-2026-106555", " * SECURITY UPDATE: incorrect use of LZ77 dictionary coder", " - debian/patches/CVE-2026-106582.patch: upstream: Disable LZ77 dictionary", " coder to avoid a potential in packet.c.", " - CVE-2026-106582", " * SECURITY UPDATE: invalid chars in command-line username", " - debian/patches/CVE-2026-106583-1.patch: upstream: Further restrict the", " characters allowed in a command-line in readconf.c.", " - debian/patches/CVE-2026-106583-2.patch: upstream: Add test for", " proxycommand percent expansions. in regress/percent.sh.", " - debian/patches/CVE-2026-106583-3.patch: avoid ksh-ism in regress test in", " regress/percent.sh.", " - CVE-2026-106583", " * SECURITY UPDATE: incorrect cert expiry in ssh-keygen", " - debian/patches/CVE-2026-106584.patch: upstream: Correct handling of DST", " when converting dates in misc.c.", " - CVE-2026-106584", " * SECURITY UPDATE: missing maximum packet length check", " - debian/patches/CVE-2026-106585.patch: upstream: Check that compressed", " payloads don't inflate beyond the in packet.c.", " - CVE-2026-106585", " * SECURITY UPDATE: incorrect restrict keyword usage in tunnel forwarding", " - debian/patches/CVE-2026-106586-1.patch: upstream: Propagate", " authorized_keys \"resrict\" keyword in auth-options.c.", " - debian/patches/CVE-2026-106586-2.patch: upstream: correctly check", " sshauthopt->restricted merging in regress/unittests/authopt/tests.c.", " - debian/patches/CVE-2026-106586-3.patch: upstream: simpler in", " regress/unittests/authopt/tests.c.", " - CVE-2026-106586", " * SECURITY UPDATE: \"none\" value confusion in options", " - debian/patches/CVE-2026-106587.patch: upstream: Correctly handle some", " options that accept \"none\" in servconf.c.", " - CVE-2026-106587", "" ], "package": "openssh", "version": "1:8.9p1-3ubuntu0.18", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 08 Oct 2026 13:31:33 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-jwt", "from_version": { "source_package_name": "pyjwt", "source_package_version": "2.3.0-1ubuntu0.4", "version": "2.3.0-1ubuntu0.4" }, "to_version": { "source_package_name": "pyjwt", "source_package_version": "2.3.0-1ubuntu0.6", "version": "2.3.0-1ubuntu0.6" }, "cves": [ { "cve": "CVE-2026-101917", "url": "https://ubuntu.com/security/CVE-2026-101917", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-101918", "url": "https://ubuntu.com/security/CVE-2026-101918", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102274", "url": "https://ubuntu.com/security/CVE-2026-102274", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102275", "url": "https://ubuntu.com/security/CVE-2026-102275", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102267", "url": "https://ubuntu.com/security/CVE-2026-102267", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102268", "url": "https://ubuntu.com/security/CVE-2026-102268", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102271", "url": "https://ubuntu.com/security/CVE-2026-102271", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102272", "url": "https://ubuntu.com/security/CVE-2026-102272", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102273", "url": "https://ubuntu.com/security/CVE-2026-102273", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-101917", "url": "https://ubuntu.com/security/CVE-2026-101917", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-101918", "url": "https://ubuntu.com/security/CVE-2026-101918", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102274", "url": "https://ubuntu.com/security/CVE-2026-102274", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102275", "url": "https://ubuntu.com/security/CVE-2026-102275", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Unauthenticated Denial of Service via unbounded thread", " lock waiting during JWKS cache refreshes", " - debian/patches/CVE-2026-101917.patch: Throttle repeated PyJWKClient", " refreshes in jwt/jwks_client.py, tests/test_jwks_client.py.", " - CVE-2026-101917", " * SECURITY UPDATE: Uncaught recursion exception in get_signing_key_from_jwt", " - debian/patches/CVE-2026-101918.patch: fix: normalize recursive JWT ", " payload errors in jwt/api_jwt.py, tests/test_api_jwt.py,", " tests/test_jwks_client.py.", " - CVE-2026-101918", " * SECURITY UPDATE: Uncaught exception in RSAAlgorithm.from_jwk when ", " processing malformed RSA key.", " - debian/patches/CVE-2026-102274.patch: Skip malformed JWKs in JWK sets in", " jwt/api_jwk.py, tests/test_api_jwk.py.", " - CVE-2026-102274", " * SECURITY UPDATE: Public/private key identity confusion via mismatched x ", " and d parameters in OKPAlgorithm.from_jwk", " - debian/patches/CVE-2026-102275.patch: fix: reject inconsistent OKP ", " private keys in jwt/algorithms.py, tests/test_algorithms.py.", " - CVE-2026-102275", "" ], "package": "pyjwt", "version": "2.3.0-1ubuntu0.6", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Hurman ", "date": "Thu, 15 Oct 2026 12:31:23 +0800" }, { "cves": [ { "cve": "CVE-2026-102267", "url": "https://ubuntu.com/security/CVE-2026-102267", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102268", "url": "https://ubuntu.com/security/CVE-2026-102268", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102271", "url": "https://ubuntu.com/security/CVE-2026-102271", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102272", "url": "https://ubuntu.com/security/CVE-2026-102272", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102273", "url": "https://ubuntu.com/security/CVE-2026-102273", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Unvalidated HTTP redirect traversal in PyJWKClient", " - debian/patches/CVE-2026-102267.patch: Reject redirects in PyJWKClient", " fetches in jwt/jwks_client.py, tests/test_jwks_client.py,", " jwt/exceptions.py, jwt/__init__.py.", " - CVE-2026-102267", " * SECURITY UPDATE: Algorithm confusion via whitespace and line-break evasion", " in is_pem_format", " - debian/patches/CVE-2026-102268.patch: fix: reject loader-accepted PEM", " variants in jwt/utils.py, tests/test_algorithms.py.", " - CVE-2026-102268", " * SECURITY UPDATE: Algorithm confusion via DER-encoded public key bytes in ", " HMACAlgorithm.prepare_key", " - debian/patches/CVE-2026-102271.patch: fix: reject DER public keys as ", " HMAC secrets in jwt/algorithms.py, tests/test_algorithms.py.", " - CVE-2026-102271", " * SECURITY UPDATE: Key inspection bypass via UTF-8 Byte Order Mark (BOM) in", " HMACAlgorithm.prepare_key", " - debian/patches/CVE-2026-102272.patch: Reject encoded JWKs as HMAC keys", " in jwt/algorithms.py, tests/test_algorithms.py.", " - CVE-2026-102272", " * SECURITY UPDATE: Key-type spoofing via nested JWK container structures in ", " HMACAlgorithm.prepare_key", " - debian/patches/CVE-2026-102273.patch: fix: reject public JWK container", " HMAC keys in jwt/algorithms.py, tests/test_algorithms.py.", " - CVE-2026-102273", "" ], "package": "pyjwt", "version": "2.3.0-1ubuntu0.5", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Hurman ", "date": "Mon, 12 Oct 2026 11:05:30 +0800" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-urllib3", "from_version": { "source_package_name": "python-urllib3", "source_package_version": "1.26.5-1~exp1ubuntu0.7", "version": "1.26.5-1~exp1ubuntu0.7" }, "to_version": { "source_package_name": "python-urllib3", "source_package_version": "1.26.5-1~exp1ubuntu0.8", "version": "1.26.5-1~exp1ubuntu0.8" }, "cves": [ { "cve": "CVE-2026-97689", "url": "https://ubuntu.com/security/CVE-2026-97689", "cve_description": "urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.", "cve_priority": "medium", "cve_public_date": "2026-09-29 16:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-97689", "url": "https://ubuntu.com/security/CVE-2026-97689", "cve_description": "urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.", "cve_priority": "medium", "cve_public_date": "2026-09-29 16:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Denial of Service", " - debian/patches/CVE-2026-97689.patch: Bound chunk-size line reads", " to prevent memory exhaustion DoS", " - CVE-2026-97689", "" ], "package": "python-urllib3", "version": "1.26.5-1~exp1ubuntu0.8", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Bruce Cable ", "date": "Tue, 13 Oct 2026 14:01:23 +1100" } ], "notes": null, "is_version_downgrade": false }, { "name": "sg3-utils", "from_version": { "source_package_name": "sg3-utils", "source_package_version": "1.46-1ubuntu0.22.04.1", "version": "1.46-1ubuntu0.22.04.1" }, "to_version": { "source_package_name": "sg3-utils", "source_package_version": "1.46-1ubuntu0.22.04.2", "version": "1.46-1ubuntu0.22.04.2" }, "cves": [ { "cve": "CVE-2026-16313", "url": "https://ubuntu.com/security/CVE-2026-16313", "cve_description": "A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.", "cve_priority": "medium", "cve_public_date": "2026-07-28 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-16313", "url": "https://ubuntu.com/security/CVE-2026-16313", "cve_description": "A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.", "cve_priority": "medium", "cve_public_date": "2026-07-28 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: command injection via udev property injection", " - debian/patches/CVE-2026-16313.patch: apply udev-conforming character", " encoding to the VPD 0x83 SCSI name string and T10 vendor ID ATA", " subfield output of sg_inq --export, so a crafted SCSI device cannot", " inject udev properties and execute commands as root (fix released", " upstream in sg3_utils 1.49).", " - debian/patches/CVE-2026-16313_2.patch: avoid including 0-bytes in SCSI", " name strings (upstream follow-up fix).", " - CVE-2026-16313", "" ], "package": "sg3-utils", "version": "1.46-1ubuntu0.22.04.2", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Thu, 01 Oct 2026 14:12:16 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "sg3-utils-udev", "from_version": { "source_package_name": "sg3-utils", "source_package_version": "1.46-1ubuntu0.22.04.1", "version": "1.46-1ubuntu0.22.04.1" }, "to_version": { "source_package_name": "sg3-utils", "source_package_version": "1.46-1ubuntu0.22.04.2", "version": "1.46-1ubuntu0.22.04.2" }, "cves": [ { "cve": "CVE-2026-16313", "url": "https://ubuntu.com/security/CVE-2026-16313", "cve_description": "A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.", "cve_priority": "medium", "cve_public_date": "2026-07-28 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-16313", "url": "https://ubuntu.com/security/CVE-2026-16313", "cve_description": "A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.", "cve_priority": "medium", "cve_public_date": "2026-07-28 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: command injection via udev property injection", " - debian/patches/CVE-2026-16313.patch: apply udev-conforming character", " encoding to the VPD 0x83 SCSI name string and T10 vendor ID ATA", " subfield output of sg_inq --export, so a crafted SCSI device cannot", " inject udev properties and execute commands as root (fix released", " upstream in sg3_utils 1.49).", " - debian/patches/CVE-2026-16313_2.patch: avoid including 0-bytes in SCSI", " name strings (upstream follow-up fix).", " - CVE-2026-16313", "" ], "package": "sg3-utils", "version": "1.46-1ubuntu0.22.04.2", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Thu, 01 Oct 2026 14:12:16 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "snapd", "from_version": { "source_package_name": "snapd", "source_package_version": "2.76.3+ubuntu22.04", "version": "2.76.3+ubuntu22.04" }, "to_version": { "source_package_name": "snapd", "source_package_version": "2.76.3+ubuntu22.04.1", "version": "2.76.3+ubuntu22.04.1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * No change rebuild due to golang-1.18 update", "" ], "package": "snapd", "version": "2.76.3+ubuntu22.04.1", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Jorge Sancho Larraz ", "date": "Tue, 06 Oct 2026 10:21:48 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "sudo", "from_version": { "source_package_name": "sudo", "source_package_version": "1.9.9-1ubuntu2.6", "version": "1.9.9-1ubuntu2.6" }, "to_version": { "source_package_name": "sudo", "source_package_version": "1.9.9-1ubuntu2.7", "version": "1.9.9-1ubuntu2.7" }, "cves": [ { "cve": "CVE-2026-96512", "url": "https://ubuntu.com/security/CVE-2026-96512", "cve_description": "A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.", "cve_priority": "medium", "cve_public_date": "2026-09-23 14:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-96512", "url": "https://ubuntu.com/security/CVE-2026-96512", "cve_description": "A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.", "cve_priority": "medium", "cve_public_date": "2026-09-23 14:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: NOTBEFORE or NOTAFTER restrictions bypass via TZ", " - debian/patches/CVE-2026-96512-pre1.patch: sudo: ignore user-specified TZ", " environment variable in src/sudo.c.", " - debian/patches/CVE-2026-96512.patch: Remove TZ from sudo's working", " environment without modifying envp. in src/sudo.c.", " - CVE-2026-96512", "" ], "package": "sudo", "version": "1.9.9-1ubuntu2.7", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Tue, 06 Oct 2026 10:05:40 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "systemd", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.23", "version": "249.11-0ubuntu3.23" }, "cves": [], "launchpad_bugs_fixed": [ 2170538 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp2170538-resolved-pick-up-new-DNSSEC-KSK-from-2024.patch: add", " the root zone KSK-2024 (key tag 38696) to the built-in DNSSEC trust", " anchor. Since 2026-10-11 the root DNSKEY RRset is signed only by", " this key, so with DNSSEC enabled and no local trust anchor file", " every lookup failed with \"missing-key\" (LP: #2170538)", "" ], "package": "systemd", "version": "249.11-0ubuntu3.23", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2170538 ], "author": "CyberNative AI LLC ", "date": "Mon, 12 Oct 2026 07:44:55 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "systemd-sysv", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.23", "version": "249.11-0ubuntu3.23" }, "cves": [], "launchpad_bugs_fixed": [ 2170538 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp2170538-resolved-pick-up-new-DNSSEC-KSK-from-2024.patch: add", " the root zone KSK-2024 (key tag 38696) to the built-in DNSSEC trust", " anchor. Since 2026-10-11 the root DNSKEY RRset is signed only by", " this key, so with DNSSEC enabled and no local trust anchor file", " every lookup failed with \"missing-key\" (LP: #2170538)", "" ], "package": "systemd", "version": "249.11-0ubuntu3.23", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2170538 ], "author": "CyberNative AI LLC ", "date": "Mon, 12 Oct 2026 07:44:55 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "systemd-timesyncd", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.23", "version": "249.11-0ubuntu3.23" }, "cves": [], "launchpad_bugs_fixed": [ 2170538 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp2170538-resolved-pick-up-new-DNSSEC-KSK-from-2024.patch: add", " the root zone KSK-2024 (key tag 38696) to the built-in DNSSEC trust", " anchor. Since 2026-10-11 the root DNSKEY RRset is signed only by", " this key, so with DNSSEC enabled and no local trust anchor file", " every lookup failed with \"missing-key\" (LP: #2170538)", "" ], "package": "systemd", "version": "249.11-0ubuntu3.23", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2170538 ], "author": "CyberNative AI LLC ", "date": "Mon, 12 Oct 2026 07:44:55 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "tzdata", "from_version": { "source_package_name": "tzdata", "source_package_version": "2026c-0ubuntu0.22.04.1", "version": "2026c-0ubuntu0.22.04.1" }, "to_version": { "source_package_name": "tzdata", "source_package_version": "2026e-0ubuntu0.22.04.1", "version": "2026e-0ubuntu0.22.04.1" }, "cves": [], "launchpad_bugs_fixed": [ 2169125 ], "changes": [ { "cves": [], "log": [ "", " * New upstream release (LP: #2169125):", " - Canada’s Northwest Territories moved to permanent -06 on 2026-08-21 and", " will not fall back from -06 to -07 on 2026-11-01", " - Manitoba moves to permanent -05 on 2026-10-31 and will not fall back", " from -05 to -06 on 2026-11-01", " * Add autopkgtest test cases for 2026d and 2026e releases", " * Revert POSIX conformance of old SysV names EST5EDT, CST6CDT, MST7MDT and", " PST8PDT", " * Update the ICU timezone data to 2026e", " * Add autopkgtest test case for ICU timezone data 2026d and 2026e", "" ], "package": "tzdata", "version": "2026e-0ubuntu0.22.04.1", "urgency": "medium", "distributions": "jammy", "launchpad_bugs_fixed": [ 2169125 ], "author": "Benjamin Drung ", "date": "Mon, 05 Oct 2026 11:21:00 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "u-boot-tools", "from_version": { "source_package_name": "u-boot", "source_package_version": "2022.01+dfsg-2ubuntu2.7", "version": "2022.01+dfsg-2ubuntu2.7" }, "to_version": { "source_package_name": "u-boot", "source_package_version": "2022.01+dfsg-2ubuntu2.9", "version": "2022.01+dfsg-2ubuntu2.9" }, "cves": [ { "cve": "CVE-2026-74220", "url": "https://ubuntu.com/security/CVE-2026-74220", "cve_description": "U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the destination buffer, crashing the bootloader or corrupting memory.", "cve_priority": "medium", "cve_public_date": "2026-09-29 22:18:00 UTC" }, { "cve": "CVE-2026-74221", "url": "https://ubuntu.com/security/CVE-2026-74221", "cve_description": "U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.", "cve_priority": "medium", "cve_public_date": "2026-09-29 22:18:00 UTC" }, { "cve": "CVE-2025-70290", "url": "https://ubuntu.com/security/CVE-2025-70290", "cve_description": "An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed on-disk metadata. The issue may result in incorrect memory allocation followed by out-of-bounds memory access, potentially leading to a crash or arbitrary code execution during the boot process.", "cve_priority": "medium", "cve_public_date": "2026-08-26 20:16:00 UTC" }, { "cve": "CVE-2025-70293", "url": "https://ubuntu.com/security/CVE-2025-70293", "cve_description": "An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ext4fs_get_bgdtable, the size calculation can lead to under allocation and this underallocated buffer will be used in memcpy() which could lead to arbitrary code execution, a denial of service, or other unspecified impacts.", "cve_priority": "medium", "cve_public_date": "2026-08-26 20:16:00 UTC" }, { "cve": "CVE-2026-15390", "url": "https://ubuntu.com/security/CVE-2026-15390", "cve_description": "Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.", "cve_priority": "medium", "cve_public_date": "2026-09-29 10:17:00 UTC" }, { "cve": "CVE-2026-71971", "url": "https://ubuntu.com/security/CVE-2026-71971", "cve_description": "U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bounds write vulnerability in the __net_defragment() function in net/net.c. Remote attackers can send a crafted IP fragment with non-zero offset and More-Fragments flag set during netboot to corrupt adjacent memory and crash the bootloader.", "cve_priority": "medium", "cve_public_date": "2026-09-29 22:18:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-74220", "url": "https://ubuntu.com/security/CVE-2026-74220", "cve_description": "U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the destination buffer, crashing the bootloader or corrupting memory.", "cve_priority": "medium", "cve_public_date": "2026-09-29 22:18:00 UTC" }, { "cve": "CVE-2026-74221", "url": "https://ubuntu.com/security/CVE-2026-74221", "cve_description": "U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.", "cve_priority": "medium", "cve_public_date": "2026-09-29 22:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Buffer overflow during NFS read reply processing", " - debian/patches/CVE-2026-74220.patch: Bound the length of an NFS read", " reply in net/nfs.c.", " - CVE-2026-74220", " * SECURITY UPDATE: Buffer overflow during NFS readlink reply processing", " - debian/patches/CVE-2026-74221.patch: Bound the length of an NFS", " readlink reply in net/nfs.c.", " - CVE-2026-74221", "" ], "package": "u-boot", "version": "2022.01+dfsg-2ubuntu2.9", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Wed, 07 Oct 2026 16:58:55 -0400" }, { "cves": [ { "cve": "CVE-2025-70290", "url": "https://ubuntu.com/security/CVE-2025-70290", "cve_description": "An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed on-disk metadata. The issue may result in incorrect memory allocation followed by out-of-bounds memory access, potentially leading to a crash or arbitrary code execution during the boot process.", "cve_priority": "medium", "cve_public_date": "2026-08-26 20:16:00 UTC" }, { "cve": "CVE-2025-70293", "url": "https://ubuntu.com/security/CVE-2025-70293", "cve_description": "An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ext4fs_get_bgdtable, the size calculation can lead to under allocation and this underallocated buffer will be used in memcpy() which could lead to arbitrary code execution, a denial of service, or other unspecified impacts.", "cve_priority": "medium", "cve_public_date": "2026-08-26 20:16:00 UTC" }, { "cve": "CVE-2026-15390", "url": "https://ubuntu.com/security/CVE-2026-15390", "cve_description": "Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.", "cve_priority": "medium", "cve_public_date": "2026-09-29 10:17:00 UTC" }, { "cve": "CVE-2026-71971", "url": "https://ubuntu.com/security/CVE-2026-71971", "cve_description": "U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bounds write vulnerability in the __net_defragment() function in net/net.c. Remote attackers can send a crafted IP fragment with non-zero offset and More-Fragments flag set during netboot to corrupt adjacent memory and crash the bootloader.", "cve_priority": "medium", "cve_public_date": "2026-09-29 22:18:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Integer overflow in ZFS filesystem metadata parsing", " - debian/patches/CVE-2025-70290.patch: Prevent integer overflow in", " zfs_nvlist_lookup in fs/zfs/zfs.c.", " - CVE-2025-70290", " * SECURITY UPDATE: Integer overflow in ext4 block group descriptor sizing", " - debian/patches/CVE-2025-70293.patch: Prevent integer overflow in", " ext4fs_get_bgdtable in fs/ext4/ext4_write.c.", " - CVE-2025-70293", " * SECURITY UPDATE: Stale IP defragmentation state after datagram reassembly", " - debian/patches/CVE-2026-15390_1.patch: Clear IP defragmentation state", " after returning a complete packet in net/net.c.", " - debian/patches/CVE-2026-15390_2.patch: Add IP defragmentation", " duplicate-fragment regression test in test/dm/Makefile,", " test/dm/net_defrag.c.", " - CVE-2026-15390", " * SECURITY UPDATE: Out-of-bounds write in IP fragment reassembly", " - debian/patches/CVE-2026-71971_1.patch: Fix out-of-bounds write in IP", " fragment reassembly in net/net.c.", " - debian/patches/CVE-2026-71971_2.patch: Add regression test for IP", " reassembly overflow in test/dm/net_defrag.c.", " - CVE-2026-71971", "" ], "package": "u-boot", "version": "2022.01+dfsg-2ubuntu2.8", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [], "author": "Shafayat Hossain Majumder ", "date": "Thu, 01 Oct 2026 16:02:44 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "udev", "from_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.22", "version": "249.11-0ubuntu3.22" }, "to_version": { "source_package_name": "systemd", "source_package_version": "249.11-0ubuntu3.23", "version": "249.11-0ubuntu3.23" }, "cves": [], "launchpad_bugs_fixed": [ 2170538 ], "changes": [ { "cves": [], "log": [ "", " * d/p/lp2170538-resolved-pick-up-new-DNSSEC-KSK-from-2024.patch: add", " the root zone KSK-2024 (key tag 38696) to the built-in DNSSEC trust", " anchor. Since 2026-10-11 the root DNSKEY RRset is signed only by", " this key, so with DNSSEC enabled and no local trust anchor file", " every lookup failed with \"missing-key\" (LP: #2170538)", "" ], "package": "systemd", "version": "249.11-0ubuntu3.23", "urgency": "medium", "distributions": "jammy-security", "launchpad_bugs_fixed": [ 2170538 ], "author": "CyberNative AI LLC ", "date": "Mon, 12 Oct 2026 07:44:55 +0000" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [], "snap": [] }, "removed": { "deb": [], "snap": [] }, "notes": "Changelog diff for Ubuntu 22.04 jammy image from release image serial 20261004 to 20261020", "from_series": "jammy", "to_series": "jammy", "from_serial": "20261004", "to_serial": "20261020", "from_manifest_filename": "release_manifest.previous", "to_manifest_filename": "manifest.current" }