{
    "summary": {
        "snap": {
            "added": [],
            "removed": [],
            "diff": []
        },
        "deb": {
            "added": [],
            "removed": [],
            "diff": [
                "ca-certificates",
                "curl",
                "distro-info-data",
                "git",
                "git-man",
                "libcurl3t64-gnutls",
                "libcurl4t64",
                "liblzma5",
                "libnss3",
                "openssh-client",
                "openssh-common",
                "openssh-server",
                "openssh-sftp-server",
                "python3-jwt",
                "sudo-rs",
                "xz-utils",
                "zlib1g"
            ]
        }
    },
    "diff": {
        "deb": [
            {
                "name": "ca-certificates",
                "from_version": {
                    "source_package_name": "ca-certificates",
                    "source_package_version": "20260816",
                    "version": "20260816"
                },
                "to_version": {
                    "source_package_name": "ca-certificates",
                    "source_package_version": "20260816ubuntu0.26.10.1",
                    "version": "20260816ubuntu0.26.10.1"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2171507
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Blacklist the following CA cert due to intermediate cert compromise",
                            "    (LP: #2171507)",
                            "    + \"emSign ECC Root CA - G3\"",
                            ""
                        ],
                        "package": "ca-certificates",
                        "version": "20260816ubuntu0.26.10.1",
                        "urgency": "medium",
                        "distributions": "stonking-security",
                        "launchpad_bugs_fixed": [
                            2171507
                        ],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Tue, 20 Oct 2026 08:44:41 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "curl",
                "from_version": {
                    "source_package_name": "curl",
                    "source_package_version": "8.20.0-2ubuntu11",
                    "version": "8.20.0-2ubuntu11"
                },
                "to_version": {
                    "source_package_name": "curl",
                    "source_package_version": "8.20.0-2ubuntu11.1",
                    "version": "8.20.0-2ubuntu11.1"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-107928",
                        "url": "https://ubuntu.com/security/CVE-2026-107928",
                        "cve_description": "When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent greater than the number of bytes it was given to send. GnuTLS does that after a blocked send.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-107929",
                        "url": "https://ubuntu.com/security/CVE-2026-107929",
                        "cve_description": "When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-86409",
                        "url": "https://ubuntu.com/security/CVE-2026-86409",
                        "cve_description": "Setting `CURLOPT_AWS_SIGV4` to NULL does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL is set next, leaking state information.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-86410",
                        "url": "https://ubuntu.com/security/CVE-2026-86410",
                        "cve_description": "A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect. This means `--knownhosts`, `--hostpubsha256`, and `--hostpubmd5` are never installed when the initial URL is HTTPS. If `--location` and `--proto-redir +sftp` is used and the server returns a `Location: sftp://example.com` redirect, the SFTP connection proceeds without any of the user's requested SSH host verification methods.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-86412",
                        "url": "https://ubuntu.com/security/CVE-2026-86412",
                        "cve_description": "A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-86414",
                        "url": "https://ubuntu.com/security/CVE-2026-86414",
                        "cve_description": "A HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-87862",
                        "url": "https://ubuntu.com/security/CVE-2026-87862",
                        "cve_description": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-87863",
                        "url": "https://ubuntu.com/security/CVE-2026-87863",
                        "cve_description": "An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-87864",
                        "url": "https://ubuntu.com/security/CVE-2026-87864",
                        "cve_description": "Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-87865",
                        "url": "https://ubuntu.com/security/CVE-2026-87865",
                        "cve_description": "When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-92386",
                        "url": "https://ubuntu.com/security/CVE-2026-92386",
                        "cve_description": "When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` will silently abort parsing prematurely upon encountering the oversized line, ignoring all subsequent valid cookies in the file.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-92387",
                        "url": "https://ubuntu.com/security/CVE-2026-92387",
                        "cve_description": "By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-92388",
                        "url": "https://ubuntu.com/security/CVE-2026-92388",
                        "cve_description": "When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while reconfiguring only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-92389",
                        "url": "https://ubuntu.com/security/CVE-2026-92389",
                        "cve_description": "libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-92390",
                        "url": "https://ubuntu.com/security/CVE-2026-92390",
                        "cve_description": "When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-92391",
                        "url": "https://ubuntu.com/security/CVE-2026-92391",
                        "cve_description": "A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-94266",
                        "url": "https://ubuntu.com/security/CVE-2026-94266",
                        "cve_description": "libcurl could accidentally return a URL for curl_easy_getinfo's `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did. The curl tool exposes the same information using the command line option `--write-out '%{url_effective}'`. This credential leak can happen when curl retrieves credentials from a `.netrc` file.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-92392",
                        "url": "https://ubuntu.com/security/CVE-2026-92392",
                        "cve_description": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-10-14 08:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-107928",
                                "url": "https://ubuntu.com/security/CVE-2026-107928",
                                "cve_description": "When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent greater than the number of bytes it was given to send. GnuTLS does that after a blocked send.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-107929",
                                "url": "https://ubuntu.com/security/CVE-2026-107929",
                                "cve_description": "When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-86409",
                                "url": "https://ubuntu.com/security/CVE-2026-86409",
                                "cve_description": "Setting `CURLOPT_AWS_SIGV4` to NULL does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL is set next, leaking state information.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-86410",
                                "url": "https://ubuntu.com/security/CVE-2026-86410",
                                "cve_description": "A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect. This means `--knownhosts`, `--hostpubsha256`, and `--hostpubmd5` are never installed when the initial URL is HTTPS. If `--location` and `--proto-redir +sftp` is used and the server returns a `Location: sftp://example.com` redirect, the SFTP connection proceeds without any of the user's requested SSH host verification methods.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-86412",
                                "url": "https://ubuntu.com/security/CVE-2026-86412",
                                "cve_description": "A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-86414",
                                "url": "https://ubuntu.com/security/CVE-2026-86414",
                                "cve_description": "A HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-87862",
                                "url": "https://ubuntu.com/security/CVE-2026-87862",
                                "cve_description": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-87863",
                                "url": "https://ubuntu.com/security/CVE-2026-87863",
                                "cve_description": "An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-87864",
                                "url": "https://ubuntu.com/security/CVE-2026-87864",
                                "cve_description": "Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-87865",
                                "url": "https://ubuntu.com/security/CVE-2026-87865",
                                "cve_description": "When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-92386",
                                "url": "https://ubuntu.com/security/CVE-2026-92386",
                                "cve_description": "When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` will silently abort parsing prematurely upon encountering the oversized line, ignoring all subsequent valid cookies in the file.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-92387",
                                "url": "https://ubuntu.com/security/CVE-2026-92387",
                                "cve_description": "By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-92388",
                                "url": "https://ubuntu.com/security/CVE-2026-92388",
                                "cve_description": "When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while reconfiguring only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-92389",
                                "url": "https://ubuntu.com/security/CVE-2026-92389",
                                "cve_description": "libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-92390",
                                "url": "https://ubuntu.com/security/CVE-2026-92390",
                                "cve_description": "When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-92391",
                                "url": "https://ubuntu.com/security/CVE-2026-92391",
                                "cve_description": "A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-94266",
                                "url": "https://ubuntu.com/security/CVE-2026-94266",
                                "cve_description": "libcurl could accidentally return a URL for curl_easy_getinfo's `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did. The curl tool exposes the same information using the command line option `--write-out '%{url_effective}'`. This credential leak can happen when curl retrieves credentials from a `.netrc` file.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-92392",
                                "url": "https://ubuntu.com/security/CVE-2026-92392",
                                "cve_description": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-10-14 08:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  [ Charles Cochran ]",
                            "  * SECURITY UPDATE: Out-of-bounds read in GnuTLS send path.",
                            "    - debian/patches/CVE-2026-107928.patch: reject a gnutls_record_send()",
                            "      return value larger than the length given in lib/vtls/gtls.c.",
                            "    - CVE-2026-107928",
                            "  * SECURITY UPDATE: Improper connection reuse with CURLOPT_INTERFACE.",
                            "    - debian/patches/CVE-2026-107929.patch: include the CURLOPT_INTERFACE",
                            "      binding in the connection reuse match in lib/cf-socket.c, lib/setopt.c,",
                            "      lib/url.c, lib/urldata.h.",
                            "    - CVE-2026-107929",
                            "  * SECURITY UPDATE: Information exposure from stale AWS SigV4 authentication.",
                            "    - debian/patches/CVE-2026-86409.patch: clear CURLAUTH_AWS_SIGV4 when",
                            "      CURLOPT_AWS_SIGV4 is set to NULL in lib/setopt.c, tests/data/test1978,",
                            "      tests/libtest/lib1978.c.",
                            "    - CVE-2026-86409",
                            "  * SECURITY UPDATE: Missing SSH host verification when redirected to SFTP/SCP.",
                            "    - debian/patches/CVE-2026-86410.patch: always set the SSH host verification",
                            "      options, falling back to ~/.ssh/known_hosts in src/config2setopts.c.",
                            "    - CVE-2026-86410",
                            "  * SECURITY UPDATE: Cookie jar data loss from an unloadable cookie.",
                            "    - debian/patches/CVE-2026-86412.patch: ignore individual cookie errors,",
                            "      except out of memory, when loading a cookie jar in lib/cookie.c.",
                            "    - CVE-2026-86412",
                            "  * SECURITY UPDATE: Credential exposure to an HTTP proxy in CONNECT.",
                            "    - debian/patches/CVE-2026-86414.patch: do not react to 401 responses to a",
                            "      CONNECT request in lib/cf-h1-proxy.c, lib/cf-h2-proxy.c,",
                            "      tests/data/Makefile.am, tests/data/test2173.",
                            "    - CVE-2026-86414",
                            "  * SECURITY UPDATE: Improper handling of HSTS entries on load.",
                            "    - debian/patches/CVE-2026-87862.patch: match only the exact host, not",
                            "      parent domains, when removing duplicates while loading an HSTS file in",
                            "      lib/hsts.c, tests/data/Makefile.am, tests/data/test3109.",
                            "    - CVE-2026-87862",
                            "  * SECURITY UPDATE: Data loss from out-of-range HSTS max-age.",
                            "    - debian/patches/CVE-2026-87863.patch: cap max-age to two years and skip",
                            "      entries whose expiry cannot be formatted in lib/hsts.c,",
                            "      tests/data/Makefile.am, tests/data/test1862.",
                            "    - CVE-2026-87863",
                            "  * SECURITY UPDATE: Command injection in IMAP APPEND with CURLOPT_CRLF.",
                            "    - debian/patches/CVE-2026-87864.patch: reject APPEND when CRLF conversion",
                            "      makes the upload size unknown in lib/imap.c.",
                            "    - CVE-2026-87864",
                            "  * SECURITY UPDATE: Improper host key verification with libssh2 hashed",
                            "    known_hosts.",
                            "    - debian/patches/CVE-2026-87865.patch: match hashed known_hosts entries by",
                            "      host before accepting them as found in lib/vssh/libssh2.c,",
                            "      tests/data/Makefile.am, tests/libtest/Makefile.am, tests/data/test3500,",
                            "      tests/libtest/test3500.pl.",
                            "    - CVE-2026-87865",
                            "  * SECURITY UPDATE: Cookie jar parsing abort on over-long cookie lines.",
                            "    - debian/patches/CVE-2026-92386.patch: accept cookie jar lines slightly",
                            "      longer than MAX_COOKIE_LINE so that a full cookie fits in lib/cookie.c.",
                            "    - CVE-2026-92386",
                            "  * SECURITY UPDATE: Denial of service from unbounded response reading in FTP,",
                            "    IMAP, POP3 and SMTP.",
                            "    - debian/patches/CVE-2026-92387.patch: add a maximum loop counter to",
                            "      Curl_pp_readresp in lib/pingpong.c.",
                            "    - CVE-2026-92387",
                            "  * SECURITY UPDATE: Use after free in FTP wildcard matching.",
                            "    - debian/patches/CVE-2026-92388-1.patch: stop overwriting set.write_func",
                            "      and set.out in lib/cw-out.c, lib/ftp-int.h, lib/ftp.c,",
                            "      lib/ftplistparser.c, lib/ftplistparser.h.",
                            "    - debian/patches/CVE-2026-92388-2.patch: only use the list parser in the",
                            "      CURLWC_MATCHING state in lib/ftplistparser.c.",
                            "    - CVE-2026-92388",
                            "  * SECURITY UPDATE: Information exposure from TFTP transfer direction",
                            "    confusion.",
                            "    - debian/patches/CVE-2026-92389.patch: return CURLE_TFTP_ILLEGAL when a",
                            "      server response does not match the transfer direction in lib/tftp.c.",
                            "    - CVE-2026-92389",
                            "  * SECURITY UPDATE: Improper file overwrite protection with",
                            "    --remote-header-name.",
                            "    - debian/patches/CVE-2026-92390.patch: buffer headers until the remote",
                            "      filename is selected in src/tool_cb_hdr.c, tests/data/Makefile.am,",
                            "      tests/data/test3037, tests/data/test3038.",
                            "    - CVE-2026-92390",
                            "  * SECURITY UPDATE: Stack overflow from deeply nested MIME structures.",
                            "    - debian/patches/CVE-2026-92391.patch: free MIME handles non-recursively in",
                            "      curl_mime_free in lib/mime.c, tests/data/Makefile.am,",
                            "      tests/libtest/Makefile.inc, tests/data/test3595, tests/libtest/lib3595.c.",
                            "    - CVE-2026-92391",
                            "  * SECURITY UPDATE: Credential exposure in CURLINFO_EFFECTIVE_URL.",
                            "    - debian/patches/CVE-2026-94266.patch: return a copy of the URL without",
                            "      credentials for CURLINFO_EFFECTIVE_URL in lib/getinfo.c, lib/transfer.c,",
                            "      lib/url.c, lib/urldata.h, tests/data/Makefile.am, tests/data/test1876.",
                            "    - CVE-2026-94266",
                            "",
                            "  [ Marc Deslauriers ]",
                            "  * SECURITY UPDATE: HTTP/2 upload Use-After-Free",
                            "    - debian/patches/CVE-2026-92392.patch: multi: adjust the cleanup order in",
                            "      multi_done in lib/multi.c.",
                            "    - CVE-2026-92392",
                            ""
                        ],
                        "package": "curl",
                        "version": "8.20.0-2ubuntu11.1",
                        "urgency": "medium",
                        "distributions": "stonking-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Fri, 16 Oct 2026 09:34:53 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "distro-info-data",
                "from_version": {
                    "source_package_name": "distro-info-data",
                    "source_package_version": "2026.08.20-1",
                    "version": "2026.08.20-1"
                },
                "to_version": {
                    "source_package_name": "distro-info-data",
                    "source_package_version": "2026.10.12-1",
                    "version": "2026.10.12-1"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2170573
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * New upstream release:",
                            "    - Add Ubuntu 27.04 \"Tenacious T-Rex\" (LP: #2170573)",
                            "    - Makefile: Clean .pyc files and mypy cache",
                            ""
                        ],
                        "package": "distro-info-data",
                        "version": "2026.10.12-1",
                        "urgency": "medium",
                        "distributions": "unstable",
                        "launchpad_bugs_fixed": [
                            2170573
                        ],
                        "author": "Benjamin Drung <bdrung@debian.org>",
                        "date": "Mon, 12 Oct 2026 14:24:11 +0200"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "git",
                "from_version": {
                    "source_package_name": "git",
                    "source_package_version": "1:2.55.0-1ubuntu1",
                    "version": "1:2.55.0-1ubuntu1"
                },
                "to_version": {
                    "source_package_name": "git",
                    "source_package_version": "1:2.55.0-1ubuntu1.1",
                    "version": "1:2.55.0-1ubuntu1.1"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2171054
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Fix compatibility with curl security update (LP: #2171054)",
                            "    - http-handle-curl-stripping-creds-from-effective-url.patch:",
                            "      handle curl stripping creds from effective url in git-curl-compat.h,",
                            "      http.c.",
                            ""
                        ],
                        "package": "git",
                        "version": "1:2.55.0-1ubuntu1.1",
                        "urgency": "medium",
                        "distributions": "stonking-security",
                        "launchpad_bugs_fixed": [
                            2171054
                        ],
                        "author": "Charles Cochran <charles.cochran@canonical.com>",
                        "date": "Fri, 16 Oct 2026 10:11:45 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "git-man",
                "from_version": {
                    "source_package_name": "git",
                    "source_package_version": "1:2.55.0-1ubuntu1",
                    "version": "1:2.55.0-1ubuntu1"
                },
                "to_version": {
                    "source_package_name": "git",
                    "source_package_version": "1:2.55.0-1ubuntu1.1",
                    "version": "1:2.55.0-1ubuntu1.1"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2171054
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Fix compatibility with curl security update (LP: #2171054)",
                            "    - http-handle-curl-stripping-creds-from-effective-url.patch:",
                            "      handle curl stripping creds from effective url in git-curl-compat.h,",
                            "      http.c.",
                            ""
                        ],
                        "package": "git",
                        "version": "1:2.55.0-1ubuntu1.1",
                        "urgency": "medium",
                        "distributions": "stonking-security",
                        "launchpad_bugs_fixed": [
                            2171054
                        ],
                        "author": "Charles Cochran <charles.cochran@canonical.com>",
                        "date": "Fri, 16 Oct 2026 10:11:45 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libcurl3t64-gnutls",
                "from_version": {
                    "source_package_name": "curl",
                    "source_package_version": "8.20.0-2ubuntu11",
                    "version": "8.20.0-2ubuntu11"
                },
                "to_version": {
                    "source_package_name": "curl",
                    "source_package_version": "8.20.0-2ubuntu11.1",
                    "version": "8.20.0-2ubuntu11.1"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-107928",
                        "url": "https://ubuntu.com/security/CVE-2026-107928",
                        "cve_description": "When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent greater than the number of bytes it was given to send. GnuTLS does that after a blocked send.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-107929",
                        "url": "https://ubuntu.com/security/CVE-2026-107929",
                        "cve_description": "When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-86409",
                        "url": "https://ubuntu.com/security/CVE-2026-86409",
                        "cve_description": "Setting `CURLOPT_AWS_SIGV4` to NULL does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL is set next, leaking state information.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-86410",
                        "url": "https://ubuntu.com/security/CVE-2026-86410",
                        "cve_description": "A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect. This means `--knownhosts`, `--hostpubsha256`, and `--hostpubmd5` are never installed when the initial URL is HTTPS. If `--location` and `--proto-redir +sftp` is used and the server returns a `Location: sftp://example.com` redirect, the SFTP connection proceeds without any of the user's requested SSH host verification methods.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-86412",
                        "url": "https://ubuntu.com/security/CVE-2026-86412",
                        "cve_description": "A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-86414",
                        "url": "https://ubuntu.com/security/CVE-2026-86414",
                        "cve_description": "A HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-87862",
                        "url": "https://ubuntu.com/security/CVE-2026-87862",
                        "cve_description": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-87863",
                        "url": "https://ubuntu.com/security/CVE-2026-87863",
                        "cve_description": "An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-87864",
                        "url": "https://ubuntu.com/security/CVE-2026-87864",
                        "cve_description": "Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-87865",
                        "url": "https://ubuntu.com/security/CVE-2026-87865",
                        "cve_description": "When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-92386",
                        "url": "https://ubuntu.com/security/CVE-2026-92386",
                        "cve_description": "When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` will silently abort parsing prematurely upon encountering the oversized line, ignoring all subsequent valid cookies in the file.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-92387",
                        "url": "https://ubuntu.com/security/CVE-2026-92387",
                        "cve_description": "By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-92388",
                        "url": "https://ubuntu.com/security/CVE-2026-92388",
                        "cve_description": "When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while reconfiguring only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-92389",
                        "url": "https://ubuntu.com/security/CVE-2026-92389",
                        "cve_description": "libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-92390",
                        "url": "https://ubuntu.com/security/CVE-2026-92390",
                        "cve_description": "When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-92391",
                        "url": "https://ubuntu.com/security/CVE-2026-92391",
                        "cve_description": "A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-94266",
                        "url": "https://ubuntu.com/security/CVE-2026-94266",
                        "cve_description": "libcurl could accidentally return a URL for curl_easy_getinfo's `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did. The curl tool exposes the same information using the command line option `--write-out '%{url_effective}'`. This credential leak can happen when curl retrieves credentials from a `.netrc` file.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-92392",
                        "url": "https://ubuntu.com/security/CVE-2026-92392",
                        "cve_description": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-10-14 08:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-107928",
                                "url": "https://ubuntu.com/security/CVE-2026-107928",
                                "cve_description": "When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent greater than the number of bytes it was given to send. GnuTLS does that after a blocked send.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-107929",
                                "url": "https://ubuntu.com/security/CVE-2026-107929",
                                "cve_description": "When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-86409",
                                "url": "https://ubuntu.com/security/CVE-2026-86409",
                                "cve_description": "Setting `CURLOPT_AWS_SIGV4` to NULL does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL is set next, leaking state information.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-86410",
                                "url": "https://ubuntu.com/security/CVE-2026-86410",
                                "cve_description": "A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect. This means `--knownhosts`, `--hostpubsha256`, and `--hostpubmd5` are never installed when the initial URL is HTTPS. If `--location` and `--proto-redir +sftp` is used and the server returns a `Location: sftp://example.com` redirect, the SFTP connection proceeds without any of the user's requested SSH host verification methods.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-86412",
                                "url": "https://ubuntu.com/security/CVE-2026-86412",
                                "cve_description": "A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-86414",
                                "url": "https://ubuntu.com/security/CVE-2026-86414",
                                "cve_description": "A HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-87862",
                                "url": "https://ubuntu.com/security/CVE-2026-87862",
                                "cve_description": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-87863",
                                "url": "https://ubuntu.com/security/CVE-2026-87863",
                                "cve_description": "An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-87864",
                                "url": "https://ubuntu.com/security/CVE-2026-87864",
                                "cve_description": "Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-87865",
                                "url": "https://ubuntu.com/security/CVE-2026-87865",
                                "cve_description": "When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-92386",
                                "url": "https://ubuntu.com/security/CVE-2026-92386",
                                "cve_description": "When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` will silently abort parsing prematurely upon encountering the oversized line, ignoring all subsequent valid cookies in the file.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-92387",
                                "url": "https://ubuntu.com/security/CVE-2026-92387",
                                "cve_description": "By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-92388",
                                "url": "https://ubuntu.com/security/CVE-2026-92388",
                                "cve_description": "When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while reconfiguring only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-92389",
                                "url": "https://ubuntu.com/security/CVE-2026-92389",
                                "cve_description": "libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-92390",
                                "url": "https://ubuntu.com/security/CVE-2026-92390",
                                "cve_description": "When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-92391",
                                "url": "https://ubuntu.com/security/CVE-2026-92391",
                                "cve_description": "A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-94266",
                                "url": "https://ubuntu.com/security/CVE-2026-94266",
                                "cve_description": "libcurl could accidentally return a URL for curl_easy_getinfo's `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did. The curl tool exposes the same information using the command line option `--write-out '%{url_effective}'`. This credential leak can happen when curl retrieves credentials from a `.netrc` file.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-92392",
                                "url": "https://ubuntu.com/security/CVE-2026-92392",
                                "cve_description": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-10-14 08:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  [ Charles Cochran ]",
                            "  * SECURITY UPDATE: Out-of-bounds read in GnuTLS send path.",
                            "    - debian/patches/CVE-2026-107928.patch: reject a gnutls_record_send()",
                            "      return value larger than the length given in lib/vtls/gtls.c.",
                            "    - CVE-2026-107928",
                            "  * SECURITY UPDATE: Improper connection reuse with CURLOPT_INTERFACE.",
                            "    - debian/patches/CVE-2026-107929.patch: include the CURLOPT_INTERFACE",
                            "      binding in the connection reuse match in lib/cf-socket.c, lib/setopt.c,",
                            "      lib/url.c, lib/urldata.h.",
                            "    - CVE-2026-107929",
                            "  * SECURITY UPDATE: Information exposure from stale AWS SigV4 authentication.",
                            "    - debian/patches/CVE-2026-86409.patch: clear CURLAUTH_AWS_SIGV4 when",
                            "      CURLOPT_AWS_SIGV4 is set to NULL in lib/setopt.c, tests/data/test1978,",
                            "      tests/libtest/lib1978.c.",
                            "    - CVE-2026-86409",
                            "  * SECURITY UPDATE: Missing SSH host verification when redirected to SFTP/SCP.",
                            "    - debian/patches/CVE-2026-86410.patch: always set the SSH host verification",
                            "      options, falling back to ~/.ssh/known_hosts in src/config2setopts.c.",
                            "    - CVE-2026-86410",
                            "  * SECURITY UPDATE: Cookie jar data loss from an unloadable cookie.",
                            "    - debian/patches/CVE-2026-86412.patch: ignore individual cookie errors,",
                            "      except out of memory, when loading a cookie jar in lib/cookie.c.",
                            "    - CVE-2026-86412",
                            "  * SECURITY UPDATE: Credential exposure to an HTTP proxy in CONNECT.",
                            "    - debian/patches/CVE-2026-86414.patch: do not react to 401 responses to a",
                            "      CONNECT request in lib/cf-h1-proxy.c, lib/cf-h2-proxy.c,",
                            "      tests/data/Makefile.am, tests/data/test2173.",
                            "    - CVE-2026-86414",
                            "  * SECURITY UPDATE: Improper handling of HSTS entries on load.",
                            "    - debian/patches/CVE-2026-87862.patch: match only the exact host, not",
                            "      parent domains, when removing duplicates while loading an HSTS file in",
                            "      lib/hsts.c, tests/data/Makefile.am, tests/data/test3109.",
                            "    - CVE-2026-87862",
                            "  * SECURITY UPDATE: Data loss from out-of-range HSTS max-age.",
                            "    - debian/patches/CVE-2026-87863.patch: cap max-age to two years and skip",
                            "      entries whose expiry cannot be formatted in lib/hsts.c,",
                            "      tests/data/Makefile.am, tests/data/test1862.",
                            "    - CVE-2026-87863",
                            "  * SECURITY UPDATE: Command injection in IMAP APPEND with CURLOPT_CRLF.",
                            "    - debian/patches/CVE-2026-87864.patch: reject APPEND when CRLF conversion",
                            "      makes the upload size unknown in lib/imap.c.",
                            "    - CVE-2026-87864",
                            "  * SECURITY UPDATE: Improper host key verification with libssh2 hashed",
                            "    known_hosts.",
                            "    - debian/patches/CVE-2026-87865.patch: match hashed known_hosts entries by",
                            "      host before accepting them as found in lib/vssh/libssh2.c,",
                            "      tests/data/Makefile.am, tests/libtest/Makefile.am, tests/data/test3500,",
                            "      tests/libtest/test3500.pl.",
                            "    - CVE-2026-87865",
                            "  * SECURITY UPDATE: Cookie jar parsing abort on over-long cookie lines.",
                            "    - debian/patches/CVE-2026-92386.patch: accept cookie jar lines slightly",
                            "      longer than MAX_COOKIE_LINE so that a full cookie fits in lib/cookie.c.",
                            "    - CVE-2026-92386",
                            "  * SECURITY UPDATE: Denial of service from unbounded response reading in FTP,",
                            "    IMAP, POP3 and SMTP.",
                            "    - debian/patches/CVE-2026-92387.patch: add a maximum loop counter to",
                            "      Curl_pp_readresp in lib/pingpong.c.",
                            "    - CVE-2026-92387",
                            "  * SECURITY UPDATE: Use after free in FTP wildcard matching.",
                            "    - debian/patches/CVE-2026-92388-1.patch: stop overwriting set.write_func",
                            "      and set.out in lib/cw-out.c, lib/ftp-int.h, lib/ftp.c,",
                            "      lib/ftplistparser.c, lib/ftplistparser.h.",
                            "    - debian/patches/CVE-2026-92388-2.patch: only use the list parser in the",
                            "      CURLWC_MATCHING state in lib/ftplistparser.c.",
                            "    - CVE-2026-92388",
                            "  * SECURITY UPDATE: Information exposure from TFTP transfer direction",
                            "    confusion.",
                            "    - debian/patches/CVE-2026-92389.patch: return CURLE_TFTP_ILLEGAL when a",
                            "      server response does not match the transfer direction in lib/tftp.c.",
                            "    - CVE-2026-92389",
                            "  * SECURITY UPDATE: Improper file overwrite protection with",
                            "    --remote-header-name.",
                            "    - debian/patches/CVE-2026-92390.patch: buffer headers until the remote",
                            "      filename is selected in src/tool_cb_hdr.c, tests/data/Makefile.am,",
                            "      tests/data/test3037, tests/data/test3038.",
                            "    - CVE-2026-92390",
                            "  * SECURITY UPDATE: Stack overflow from deeply nested MIME structures.",
                            "    - debian/patches/CVE-2026-92391.patch: free MIME handles non-recursively in",
                            "      curl_mime_free in lib/mime.c, tests/data/Makefile.am,",
                            "      tests/libtest/Makefile.inc, tests/data/test3595, tests/libtest/lib3595.c.",
                            "    - CVE-2026-92391",
                            "  * SECURITY UPDATE: Credential exposure in CURLINFO_EFFECTIVE_URL.",
                            "    - debian/patches/CVE-2026-94266.patch: return a copy of the URL without",
                            "      credentials for CURLINFO_EFFECTIVE_URL in lib/getinfo.c, lib/transfer.c,",
                            "      lib/url.c, lib/urldata.h, tests/data/Makefile.am, tests/data/test1876.",
                            "    - CVE-2026-94266",
                            "",
                            "  [ Marc Deslauriers ]",
                            "  * SECURITY UPDATE: HTTP/2 upload Use-After-Free",
                            "    - debian/patches/CVE-2026-92392.patch: multi: adjust the cleanup order in",
                            "      multi_done in lib/multi.c.",
                            "    - CVE-2026-92392",
                            ""
                        ],
                        "package": "curl",
                        "version": "8.20.0-2ubuntu11.1",
                        "urgency": "medium",
                        "distributions": "stonking-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Fri, 16 Oct 2026 09:34:53 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libcurl4t64",
                "from_version": {
                    "source_package_name": "curl",
                    "source_package_version": "8.20.0-2ubuntu11",
                    "version": "8.20.0-2ubuntu11"
                },
                "to_version": {
                    "source_package_name": "curl",
                    "source_package_version": "8.20.0-2ubuntu11.1",
                    "version": "8.20.0-2ubuntu11.1"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-107928",
                        "url": "https://ubuntu.com/security/CVE-2026-107928",
                        "cve_description": "When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent greater than the number of bytes it was given to send. GnuTLS does that after a blocked send.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-107929",
                        "url": "https://ubuntu.com/security/CVE-2026-107929",
                        "cve_description": "When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-86409",
                        "url": "https://ubuntu.com/security/CVE-2026-86409",
                        "cve_description": "Setting `CURLOPT_AWS_SIGV4` to NULL does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL is set next, leaking state information.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-86410",
                        "url": "https://ubuntu.com/security/CVE-2026-86410",
                        "cve_description": "A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect. This means `--knownhosts`, `--hostpubsha256`, and `--hostpubmd5` are never installed when the initial URL is HTTPS. If `--location` and `--proto-redir +sftp` is used and the server returns a `Location: sftp://example.com` redirect, the SFTP connection proceeds without any of the user's requested SSH host verification methods.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-86412",
                        "url": "https://ubuntu.com/security/CVE-2026-86412",
                        "cve_description": "A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-86414",
                        "url": "https://ubuntu.com/security/CVE-2026-86414",
                        "cve_description": "A HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-87862",
                        "url": "https://ubuntu.com/security/CVE-2026-87862",
                        "cve_description": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-87863",
                        "url": "https://ubuntu.com/security/CVE-2026-87863",
                        "cve_description": "An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-87864",
                        "url": "https://ubuntu.com/security/CVE-2026-87864",
                        "cve_description": "Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-87865",
                        "url": "https://ubuntu.com/security/CVE-2026-87865",
                        "cve_description": "When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-92386",
                        "url": "https://ubuntu.com/security/CVE-2026-92386",
                        "cve_description": "When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` will silently abort parsing prematurely upon encountering the oversized line, ignoring all subsequent valid cookies in the file.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-92387",
                        "url": "https://ubuntu.com/security/CVE-2026-92387",
                        "cve_description": "By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-92388",
                        "url": "https://ubuntu.com/security/CVE-2026-92388",
                        "cve_description": "When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while reconfiguring only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-92389",
                        "url": "https://ubuntu.com/security/CVE-2026-92389",
                        "cve_description": "libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-92390",
                        "url": "https://ubuntu.com/security/CVE-2026-92390",
                        "cve_description": "When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-92391",
                        "url": "https://ubuntu.com/security/CVE-2026-92391",
                        "cve_description": "A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-94266",
                        "url": "https://ubuntu.com/security/CVE-2026-94266",
                        "cve_description": "libcurl could accidentally return a URL for curl_easy_getinfo's `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did. The curl tool exposes the same information using the command line option `--write-out '%{url_effective}'`. This credential leak can happen when curl retrieves credentials from a `.netrc` file.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-10-14 06:00:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-92392",
                        "url": "https://ubuntu.com/security/CVE-2026-92392",
                        "cve_description": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.",
                        "cve_priority": "high",
                        "cve_public_date": "2026-10-14 08:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-107928",
                                "url": "https://ubuntu.com/security/CVE-2026-107928",
                                "cve_description": "When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent greater than the number of bytes it was given to send. GnuTLS does that after a blocked send.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-107929",
                                "url": "https://ubuntu.com/security/CVE-2026-107929",
                                "cve_description": "When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-86409",
                                "url": "https://ubuntu.com/security/CVE-2026-86409",
                                "cve_description": "Setting `CURLOPT_AWS_SIGV4` to NULL does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL is set next, leaking state information.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-86410",
                                "url": "https://ubuntu.com/security/CVE-2026-86410",
                                "cve_description": "A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect. This means `--knownhosts`, `--hostpubsha256`, and `--hostpubmd5` are never installed when the initial URL is HTTPS. If `--location` and `--proto-redir +sftp` is used and the server returns a `Location: sftp://example.com` redirect, the SFTP connection proceeds without any of the user's requested SSH host verification methods.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-86412",
                                "url": "https://ubuntu.com/security/CVE-2026-86412",
                                "cve_description": "A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-86414",
                                "url": "https://ubuntu.com/security/CVE-2026-86414",
                                "cve_description": "A HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-87862",
                                "url": "https://ubuntu.com/security/CVE-2026-87862",
                                "cve_description": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-87863",
                                "url": "https://ubuntu.com/security/CVE-2026-87863",
                                "cve_description": "An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-87864",
                                "url": "https://ubuntu.com/security/CVE-2026-87864",
                                "cve_description": "Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-87865",
                                "url": "https://ubuntu.com/security/CVE-2026-87865",
                                "cve_description": "When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-92386",
                                "url": "https://ubuntu.com/security/CVE-2026-92386",
                                "cve_description": "When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` will silently abort parsing prematurely upon encountering the oversized line, ignoring all subsequent valid cookies in the file.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-92387",
                                "url": "https://ubuntu.com/security/CVE-2026-92387",
                                "cve_description": "By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-92388",
                                "url": "https://ubuntu.com/security/CVE-2026-92388",
                                "cve_description": "When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while reconfiguring only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-92389",
                                "url": "https://ubuntu.com/security/CVE-2026-92389",
                                "cve_description": "libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-92390",
                                "url": "https://ubuntu.com/security/CVE-2026-92390",
                                "cve_description": "When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-92391",
                                "url": "https://ubuntu.com/security/CVE-2026-92391",
                                "cve_description": "A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-94266",
                                "url": "https://ubuntu.com/security/CVE-2026-94266",
                                "cve_description": "libcurl could accidentally return a URL for curl_easy_getinfo's `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did. The curl tool exposes the same information using the command line option `--write-out '%{url_effective}'`. This credential leak can happen when curl retrieves credentials from a `.netrc` file.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-10-14 06:00:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-92392",
                                "url": "https://ubuntu.com/security/CVE-2026-92392",
                                "cve_description": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.",
                                "cve_priority": "high",
                                "cve_public_date": "2026-10-14 08:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  [ Charles Cochran ]",
                            "  * SECURITY UPDATE: Out-of-bounds read in GnuTLS send path.",
                            "    - debian/patches/CVE-2026-107928.patch: reject a gnutls_record_send()",
                            "      return value larger than the length given in lib/vtls/gtls.c.",
                            "    - CVE-2026-107928",
                            "  * SECURITY UPDATE: Improper connection reuse with CURLOPT_INTERFACE.",
                            "    - debian/patches/CVE-2026-107929.patch: include the CURLOPT_INTERFACE",
                            "      binding in the connection reuse match in lib/cf-socket.c, lib/setopt.c,",
                            "      lib/url.c, lib/urldata.h.",
                            "    - CVE-2026-107929",
                            "  * SECURITY UPDATE: Information exposure from stale AWS SigV4 authentication.",
                            "    - debian/patches/CVE-2026-86409.patch: clear CURLAUTH_AWS_SIGV4 when",
                            "      CURLOPT_AWS_SIGV4 is set to NULL in lib/setopt.c, tests/data/test1978,",
                            "      tests/libtest/lib1978.c.",
                            "    - CVE-2026-86409",
                            "  * SECURITY UPDATE: Missing SSH host verification when redirected to SFTP/SCP.",
                            "    - debian/patches/CVE-2026-86410.patch: always set the SSH host verification",
                            "      options, falling back to ~/.ssh/known_hosts in src/config2setopts.c.",
                            "    - CVE-2026-86410",
                            "  * SECURITY UPDATE: Cookie jar data loss from an unloadable cookie.",
                            "    - debian/patches/CVE-2026-86412.patch: ignore individual cookie errors,",
                            "      except out of memory, when loading a cookie jar in lib/cookie.c.",
                            "    - CVE-2026-86412",
                            "  * SECURITY UPDATE: Credential exposure to an HTTP proxy in CONNECT.",
                            "    - debian/patches/CVE-2026-86414.patch: do not react to 401 responses to a",
                            "      CONNECT request in lib/cf-h1-proxy.c, lib/cf-h2-proxy.c,",
                            "      tests/data/Makefile.am, tests/data/test2173.",
                            "    - CVE-2026-86414",
                            "  * SECURITY UPDATE: Improper handling of HSTS entries on load.",
                            "    - debian/patches/CVE-2026-87862.patch: match only the exact host, not",
                            "      parent domains, when removing duplicates while loading an HSTS file in",
                            "      lib/hsts.c, tests/data/Makefile.am, tests/data/test3109.",
                            "    - CVE-2026-87862",
                            "  * SECURITY UPDATE: Data loss from out-of-range HSTS max-age.",
                            "    - debian/patches/CVE-2026-87863.patch: cap max-age to two years and skip",
                            "      entries whose expiry cannot be formatted in lib/hsts.c,",
                            "      tests/data/Makefile.am, tests/data/test1862.",
                            "    - CVE-2026-87863",
                            "  * SECURITY UPDATE: Command injection in IMAP APPEND with CURLOPT_CRLF.",
                            "    - debian/patches/CVE-2026-87864.patch: reject APPEND when CRLF conversion",
                            "      makes the upload size unknown in lib/imap.c.",
                            "    - CVE-2026-87864",
                            "  * SECURITY UPDATE: Improper host key verification with libssh2 hashed",
                            "    known_hosts.",
                            "    - debian/patches/CVE-2026-87865.patch: match hashed known_hosts entries by",
                            "      host before accepting them as found in lib/vssh/libssh2.c,",
                            "      tests/data/Makefile.am, tests/libtest/Makefile.am, tests/data/test3500,",
                            "      tests/libtest/test3500.pl.",
                            "    - CVE-2026-87865",
                            "  * SECURITY UPDATE: Cookie jar parsing abort on over-long cookie lines.",
                            "    - debian/patches/CVE-2026-92386.patch: accept cookie jar lines slightly",
                            "      longer than MAX_COOKIE_LINE so that a full cookie fits in lib/cookie.c.",
                            "    - CVE-2026-92386",
                            "  * SECURITY UPDATE: Denial of service from unbounded response reading in FTP,",
                            "    IMAP, POP3 and SMTP.",
                            "    - debian/patches/CVE-2026-92387.patch: add a maximum loop counter to",
                            "      Curl_pp_readresp in lib/pingpong.c.",
                            "    - CVE-2026-92387",
                            "  * SECURITY UPDATE: Use after free in FTP wildcard matching.",
                            "    - debian/patches/CVE-2026-92388-1.patch: stop overwriting set.write_func",
                            "      and set.out in lib/cw-out.c, lib/ftp-int.h, lib/ftp.c,",
                            "      lib/ftplistparser.c, lib/ftplistparser.h.",
                            "    - debian/patches/CVE-2026-92388-2.patch: only use the list parser in the",
                            "      CURLWC_MATCHING state in lib/ftplistparser.c.",
                            "    - CVE-2026-92388",
                            "  * SECURITY UPDATE: Information exposure from TFTP transfer direction",
                            "    confusion.",
                            "    - debian/patches/CVE-2026-92389.patch: return CURLE_TFTP_ILLEGAL when a",
                            "      server response does not match the transfer direction in lib/tftp.c.",
                            "    - CVE-2026-92389",
                            "  * SECURITY UPDATE: Improper file overwrite protection with",
                            "    --remote-header-name.",
                            "    - debian/patches/CVE-2026-92390.patch: buffer headers until the remote",
                            "      filename is selected in src/tool_cb_hdr.c, tests/data/Makefile.am,",
                            "      tests/data/test3037, tests/data/test3038.",
                            "    - CVE-2026-92390",
                            "  * SECURITY UPDATE: Stack overflow from deeply nested MIME structures.",
                            "    - debian/patches/CVE-2026-92391.patch: free MIME handles non-recursively in",
                            "      curl_mime_free in lib/mime.c, tests/data/Makefile.am,",
                            "      tests/libtest/Makefile.inc, tests/data/test3595, tests/libtest/lib3595.c.",
                            "    - CVE-2026-92391",
                            "  * SECURITY UPDATE: Credential exposure in CURLINFO_EFFECTIVE_URL.",
                            "    - debian/patches/CVE-2026-94266.patch: return a copy of the URL without",
                            "      credentials for CURLINFO_EFFECTIVE_URL in lib/getinfo.c, lib/transfer.c,",
                            "      lib/url.c, lib/urldata.h, tests/data/Makefile.am, tests/data/test1876.",
                            "    - CVE-2026-94266",
                            "",
                            "  [ Marc Deslauriers ]",
                            "  * SECURITY UPDATE: HTTP/2 upload Use-After-Free",
                            "    - debian/patches/CVE-2026-92392.patch: multi: adjust the cleanup order in",
                            "      multi_done in lib/multi.c.",
                            "    - CVE-2026-92392",
                            ""
                        ],
                        "package": "curl",
                        "version": "8.20.0-2ubuntu11.1",
                        "urgency": "medium",
                        "distributions": "stonking-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Fri, 16 Oct 2026 09:34:53 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "liblzma5",
                "from_version": {
                    "source_package_name": "xz-utils",
                    "source_package_version": "5.8.3-1",
                    "version": "5.8.3-1"
                },
                "to_version": {
                    "source_package_name": "xz-utils",
                    "source_package_version": "5.8.3-1ubuntu1",
                    "version": "5.8.3-1ubuntu1"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2170056
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: invalid memory write during decoder reinitialization",
                            "    after allocation failure (LP: #2170056)",
                            "    - debian/patches/LP-2170056_1.patch: Make lzma_lz_decoder_init()",
                            "      safe to reinit after alloc failure in src/liblzma/lz/lz_decoder.c.",
                            "    - debian/patches/LP-2170056_2.patch: Clean up after a filter chain",
                            "      initialization error in src/liblzma/common/alone_decoder.c,",
                            "      src/liblzma/common/lzip_decoder.c,",
                            "      src/liblzma/common/microlzma_decoder.c.",
                            "    - debian/patches/LP-2170056_3.patch: Test lzma_alone_decoder() reuse",
                            "      after dictionary allocation failure in tests/Makefile.am,",
                            "      tests/test_alone_decoder.c, tests/tests.cmake.",
                            "    - No CVE number",
                            ""
                        ],
                        "package": "xz-utils",
                        "version": "5.8.3-1ubuntu1",
                        "urgency": "medium",
                        "distributions": "stonking",
                        "launchpad_bugs_fixed": [
                            2170056
                        ],
                        "author": "Shafayat Hossain Majumder <shafayat.majumder@canonical.com>",
                        "date": "Fri, 09 Oct 2026 11:54:18 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libnss3",
                "from_version": {
                    "source_package_name": "nss",
                    "source_package_version": "2:3.127-1",
                    "version": "2:3.127-1"
                },
                "to_version": {
                    "source_package_name": "nss",
                    "source_package_version": "2:3.127-1ubuntu0.1",
                    "version": "2:3.127-1ubuntu0.1"
                },
                "cves": [],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * d/p/certdata-remove-compromised-certs.patch: remove the following",
                            "    CA certs from ckfw/builtins/certdata due to intermediate cert",
                            "    compromise",
                            "    + \"emSign ECC Root CA - G3\"",
                            "    + \"Comodo AAA Services root\"",
                            ""
                        ],
                        "package": "nss",
                        "version": "2:3.127-1ubuntu0.1",
                        "urgency": "medium",
                        "distributions": "stonking-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Elise Hlady <elise.hlady@canonical.com>",
                        "date": "Tue, 20 Oct 2026 15:54:59 -0700"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "openssh-client",
                "from_version": {
                    "source_package_name": "openssh",
                    "source_package_version": "1:10.5p1-1ubuntu2",
                    "version": "1:10.5p1-1ubuntu2"
                },
                "to_version": {
                    "source_package_name": "openssh",
                    "source_package_version": "1:10.5p1-1ubuntu3.1",
                    "version": "1:10.5p1-1ubuntu3.1"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-106552",
                        "url": "https://ubuntu.com/security/CVE-2026-106552",
                        "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106553",
                        "url": "https://ubuntu.com/security/CVE-2026-106553",
                        "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106555",
                        "url": "https://ubuntu.com/security/CVE-2026-106555",
                        "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106582",
                        "url": "https://ubuntu.com/security/CVE-2026-106582",
                        "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106583",
                        "url": "https://ubuntu.com/security/CVE-2026-106583",
                        "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-07 00:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106584",
                        "url": "https://ubuntu.com/security/CVE-2026-106584",
                        "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106585",
                        "url": "https://ubuntu.com/security/CVE-2026-106585",
                        "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106586",
                        "url": "https://ubuntu.com/security/CVE-2026-106586",
                        "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106587",
                        "url": "https://ubuntu.com/security/CVE-2026-106587",
                        "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 22:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2169738
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-106552",
                                "url": "https://ubuntu.com/security/CVE-2026-106552",
                                "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106553",
                                "url": "https://ubuntu.com/security/CVE-2026-106553",
                                "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106555",
                                "url": "https://ubuntu.com/security/CVE-2026-106555",
                                "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106582",
                                "url": "https://ubuntu.com/security/CVE-2026-106582",
                                "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106583",
                                "url": "https://ubuntu.com/security/CVE-2026-106583",
                                "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-07 00:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106584",
                                "url": "https://ubuntu.com/security/CVE-2026-106584",
                                "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106585",
                                "url": "https://ubuntu.com/security/CVE-2026-106585",
                                "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106586",
                                "url": "https://ubuntu.com/security/CVE-2026-106586",
                                "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106587",
                                "url": "https://ubuntu.com/security/CVE-2026-106587",
                                "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 22:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: sftp directory traversal",
                            "    - debian/patches/CVE-2026-106552.patch: upstream: sftp: be stricter in",
                            "      accepting paths returned by the in sftp-client.c, sftp.c.",
                            "    - CVE-2026-106552",
                            "  * SECURITY UPDATE: incorrect GSSAPIAuthentication auth persistence",
                            "    - debian/patches/CVE-2026-106553-1.patch: upstream: Reset GSSAPI client",
                            "      state before authentication in auth2.c, gss-serv.c, monitor.c, ssh-gss.h.",
                            "    - debian/patches/CVE-2026-106553-2.patch: upstream: Only store GSSAPI creds",
                            "      when authn succeeds in gss-serv.c, ssh-gss.h.",
                            "    - debian/patches/CVE-2026-106553-3.patch: upstream:",
                            "      ssh_gssapi_cleanup_global_client() needs a prototype in gss-serv.c, ssh-",
                            "      gss.h.",
                            "    - CVE-2026-106553",
                            "    - CVE-2026-106555",
                            "  * SECURITY UPDATE: incorrect use of LZ77 dictionary coder",
                            "    - debian/patches/CVE-2026-106582.patch: upstream: Disable LZ77 dictionary",
                            "      coder to avoid a potential in packet.c.",
                            "    - CVE-2026-106582",
                            "  * SECURITY UPDATE: invalid chars in command-line username",
                            "    - debian/patches/CVE-2026-106583-1.patch: upstream: Further restrict the",
                            "      characters allowed in a command-line in readconf.c.",
                            "    - debian/patches/CVE-2026-106583-2.patch: upstream: Add test for",
                            "      proxycommand percent expansions. in regress/percent.sh.",
                            "    - debian/patches/CVE-2026-106583-3.patch: avoid ksh-ism in regress test in",
                            "      regress/percent.sh.",
                            "    - CVE-2026-106583",
                            "  * SECURITY UPDATE: incorrect cert expiry in ssh-keygen",
                            "    - debian/patches/CVE-2026-106584.patch: upstream: Correct handling of DST",
                            "      when converting dates in misc.c.",
                            "    - CVE-2026-106584",
                            "  * SECURITY UPDATE: missing maximum packet length check",
                            "    - debian/patches/CVE-2026-106585.patch: upstream: Check that compressed",
                            "      payloads don't inflate beyond the in packet.c.",
                            "    - CVE-2026-106585",
                            "  * SECURITY UPDATE: incorrect restrict keyword usage in tunnel forwarding",
                            "    - debian/patches/CVE-2026-106586-1.patch: upstream: Propagate",
                            "      authorized_keys \"resrict\" keyword in auth-options.c.",
                            "    - debian/patches/CVE-2026-106586-2.patch: upstream: correctly check",
                            "      sshauthopt->restricted merging in regress/unittests/authopt/tests.c.",
                            "    - debian/patches/CVE-2026-106586-3.patch: upstream: simpler in",
                            "      regress/unittests/authopt/tests.c.",
                            "    - CVE-2026-106586",
                            "  * SECURITY UPDATE: \"none\" value confusion in options",
                            "    - debian/patches/CVE-2026-106587.patch: upstream: Correctly handle some",
                            "      options that accept \"none\" in servconf.c.",
                            "    - CVE-2026-106587",
                            ""
                        ],
                        "package": "openssh",
                        "version": "1:10.5p1-1ubuntu3.1",
                        "urgency": "medium",
                        "distributions": "stonking-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Thu, 15 Oct 2026 09:24:26 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  [ Colin Watson ]",
                            "  * d/openssh-{server,client}.postrm: Skip purging if",
                            "    openssh-{client,server}-gssapi is installed",
                            "    (Closes: #1148080 LP: #2169738)",
                            "",
                            "  * d/t/control, d/t/purge-keeps-config-with-counterpart: test to validate",
                            "    that switching to the openssh counterparts and then purging the",
                            "    removed packages keeps the configuration intact",
                            ""
                        ],
                        "package": "openssh",
                        "version": "1:10.5p1-1ubuntu3",
                        "urgency": "medium",
                        "distributions": "stonking",
                        "launchpad_bugs_fixed": [
                            2169738
                        ],
                        "author": "Andreas Hasenack <andreas.hasenack@canonical.com>",
                        "date": "Tue, 06 Oct 2026 15:04:38 -0300"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "openssh-common",
                "from_version": {
                    "source_package_name": "openssh",
                    "source_package_version": "1:10.5p1-1ubuntu2",
                    "version": "1:10.5p1-1ubuntu2"
                },
                "to_version": {
                    "source_package_name": "openssh",
                    "source_package_version": "1:10.5p1-1ubuntu3.1",
                    "version": "1:10.5p1-1ubuntu3.1"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-106552",
                        "url": "https://ubuntu.com/security/CVE-2026-106552",
                        "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106553",
                        "url": "https://ubuntu.com/security/CVE-2026-106553",
                        "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106555",
                        "url": "https://ubuntu.com/security/CVE-2026-106555",
                        "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106582",
                        "url": "https://ubuntu.com/security/CVE-2026-106582",
                        "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106583",
                        "url": "https://ubuntu.com/security/CVE-2026-106583",
                        "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-07 00:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106584",
                        "url": "https://ubuntu.com/security/CVE-2026-106584",
                        "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106585",
                        "url": "https://ubuntu.com/security/CVE-2026-106585",
                        "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106586",
                        "url": "https://ubuntu.com/security/CVE-2026-106586",
                        "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106587",
                        "url": "https://ubuntu.com/security/CVE-2026-106587",
                        "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 22:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2169738
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-106552",
                                "url": "https://ubuntu.com/security/CVE-2026-106552",
                                "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106553",
                                "url": "https://ubuntu.com/security/CVE-2026-106553",
                                "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106555",
                                "url": "https://ubuntu.com/security/CVE-2026-106555",
                                "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106582",
                                "url": "https://ubuntu.com/security/CVE-2026-106582",
                                "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106583",
                                "url": "https://ubuntu.com/security/CVE-2026-106583",
                                "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-07 00:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106584",
                                "url": "https://ubuntu.com/security/CVE-2026-106584",
                                "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106585",
                                "url": "https://ubuntu.com/security/CVE-2026-106585",
                                "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106586",
                                "url": "https://ubuntu.com/security/CVE-2026-106586",
                                "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106587",
                                "url": "https://ubuntu.com/security/CVE-2026-106587",
                                "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 22:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: sftp directory traversal",
                            "    - debian/patches/CVE-2026-106552.patch: upstream: sftp: be stricter in",
                            "      accepting paths returned by the in sftp-client.c, sftp.c.",
                            "    - CVE-2026-106552",
                            "  * SECURITY UPDATE: incorrect GSSAPIAuthentication auth persistence",
                            "    - debian/patches/CVE-2026-106553-1.patch: upstream: Reset GSSAPI client",
                            "      state before authentication in auth2.c, gss-serv.c, monitor.c, ssh-gss.h.",
                            "    - debian/patches/CVE-2026-106553-2.patch: upstream: Only store GSSAPI creds",
                            "      when authn succeeds in gss-serv.c, ssh-gss.h.",
                            "    - debian/patches/CVE-2026-106553-3.patch: upstream:",
                            "      ssh_gssapi_cleanup_global_client() needs a prototype in gss-serv.c, ssh-",
                            "      gss.h.",
                            "    - CVE-2026-106553",
                            "    - CVE-2026-106555",
                            "  * SECURITY UPDATE: incorrect use of LZ77 dictionary coder",
                            "    - debian/patches/CVE-2026-106582.patch: upstream: Disable LZ77 dictionary",
                            "      coder to avoid a potential in packet.c.",
                            "    - CVE-2026-106582",
                            "  * SECURITY UPDATE: invalid chars in command-line username",
                            "    - debian/patches/CVE-2026-106583-1.patch: upstream: Further restrict the",
                            "      characters allowed in a command-line in readconf.c.",
                            "    - debian/patches/CVE-2026-106583-2.patch: upstream: Add test for",
                            "      proxycommand percent expansions. in regress/percent.sh.",
                            "    - debian/patches/CVE-2026-106583-3.patch: avoid ksh-ism in regress test in",
                            "      regress/percent.sh.",
                            "    - CVE-2026-106583",
                            "  * SECURITY UPDATE: incorrect cert expiry in ssh-keygen",
                            "    - debian/patches/CVE-2026-106584.patch: upstream: Correct handling of DST",
                            "      when converting dates in misc.c.",
                            "    - CVE-2026-106584",
                            "  * SECURITY UPDATE: missing maximum packet length check",
                            "    - debian/patches/CVE-2026-106585.patch: upstream: Check that compressed",
                            "      payloads don't inflate beyond the in packet.c.",
                            "    - CVE-2026-106585",
                            "  * SECURITY UPDATE: incorrect restrict keyword usage in tunnel forwarding",
                            "    - debian/patches/CVE-2026-106586-1.patch: upstream: Propagate",
                            "      authorized_keys \"resrict\" keyword in auth-options.c.",
                            "    - debian/patches/CVE-2026-106586-2.patch: upstream: correctly check",
                            "      sshauthopt->restricted merging in regress/unittests/authopt/tests.c.",
                            "    - debian/patches/CVE-2026-106586-3.patch: upstream: simpler in",
                            "      regress/unittests/authopt/tests.c.",
                            "    - CVE-2026-106586",
                            "  * SECURITY UPDATE: \"none\" value confusion in options",
                            "    - debian/patches/CVE-2026-106587.patch: upstream: Correctly handle some",
                            "      options that accept \"none\" in servconf.c.",
                            "    - CVE-2026-106587",
                            ""
                        ],
                        "package": "openssh",
                        "version": "1:10.5p1-1ubuntu3.1",
                        "urgency": "medium",
                        "distributions": "stonking-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Thu, 15 Oct 2026 09:24:26 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  [ Colin Watson ]",
                            "  * d/openssh-{server,client}.postrm: Skip purging if",
                            "    openssh-{client,server}-gssapi is installed",
                            "    (Closes: #1148080 LP: #2169738)",
                            "",
                            "  * d/t/control, d/t/purge-keeps-config-with-counterpart: test to validate",
                            "    that switching to the openssh counterparts and then purging the",
                            "    removed packages keeps the configuration intact",
                            ""
                        ],
                        "package": "openssh",
                        "version": "1:10.5p1-1ubuntu3",
                        "urgency": "medium",
                        "distributions": "stonking",
                        "launchpad_bugs_fixed": [
                            2169738
                        ],
                        "author": "Andreas Hasenack <andreas.hasenack@canonical.com>",
                        "date": "Tue, 06 Oct 2026 15:04:38 -0300"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "openssh-server",
                "from_version": {
                    "source_package_name": "openssh",
                    "source_package_version": "1:10.5p1-1ubuntu2",
                    "version": "1:10.5p1-1ubuntu2"
                },
                "to_version": {
                    "source_package_name": "openssh",
                    "source_package_version": "1:10.5p1-1ubuntu3.1",
                    "version": "1:10.5p1-1ubuntu3.1"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-106552",
                        "url": "https://ubuntu.com/security/CVE-2026-106552",
                        "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106553",
                        "url": "https://ubuntu.com/security/CVE-2026-106553",
                        "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106555",
                        "url": "https://ubuntu.com/security/CVE-2026-106555",
                        "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106582",
                        "url": "https://ubuntu.com/security/CVE-2026-106582",
                        "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106583",
                        "url": "https://ubuntu.com/security/CVE-2026-106583",
                        "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-07 00:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106584",
                        "url": "https://ubuntu.com/security/CVE-2026-106584",
                        "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106585",
                        "url": "https://ubuntu.com/security/CVE-2026-106585",
                        "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106586",
                        "url": "https://ubuntu.com/security/CVE-2026-106586",
                        "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106587",
                        "url": "https://ubuntu.com/security/CVE-2026-106587",
                        "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 22:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2169738
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-106552",
                                "url": "https://ubuntu.com/security/CVE-2026-106552",
                                "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106553",
                                "url": "https://ubuntu.com/security/CVE-2026-106553",
                                "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106555",
                                "url": "https://ubuntu.com/security/CVE-2026-106555",
                                "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106582",
                                "url": "https://ubuntu.com/security/CVE-2026-106582",
                                "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106583",
                                "url": "https://ubuntu.com/security/CVE-2026-106583",
                                "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-07 00:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106584",
                                "url": "https://ubuntu.com/security/CVE-2026-106584",
                                "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106585",
                                "url": "https://ubuntu.com/security/CVE-2026-106585",
                                "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106586",
                                "url": "https://ubuntu.com/security/CVE-2026-106586",
                                "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106587",
                                "url": "https://ubuntu.com/security/CVE-2026-106587",
                                "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 22:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: sftp directory traversal",
                            "    - debian/patches/CVE-2026-106552.patch: upstream: sftp: be stricter in",
                            "      accepting paths returned by the in sftp-client.c, sftp.c.",
                            "    - CVE-2026-106552",
                            "  * SECURITY UPDATE: incorrect GSSAPIAuthentication auth persistence",
                            "    - debian/patches/CVE-2026-106553-1.patch: upstream: Reset GSSAPI client",
                            "      state before authentication in auth2.c, gss-serv.c, monitor.c, ssh-gss.h.",
                            "    - debian/patches/CVE-2026-106553-2.patch: upstream: Only store GSSAPI creds",
                            "      when authn succeeds in gss-serv.c, ssh-gss.h.",
                            "    - debian/patches/CVE-2026-106553-3.patch: upstream:",
                            "      ssh_gssapi_cleanup_global_client() needs a prototype in gss-serv.c, ssh-",
                            "      gss.h.",
                            "    - CVE-2026-106553",
                            "    - CVE-2026-106555",
                            "  * SECURITY UPDATE: incorrect use of LZ77 dictionary coder",
                            "    - debian/patches/CVE-2026-106582.patch: upstream: Disable LZ77 dictionary",
                            "      coder to avoid a potential in packet.c.",
                            "    - CVE-2026-106582",
                            "  * SECURITY UPDATE: invalid chars in command-line username",
                            "    - debian/patches/CVE-2026-106583-1.patch: upstream: Further restrict the",
                            "      characters allowed in a command-line in readconf.c.",
                            "    - debian/patches/CVE-2026-106583-2.patch: upstream: Add test for",
                            "      proxycommand percent expansions. in regress/percent.sh.",
                            "    - debian/patches/CVE-2026-106583-3.patch: avoid ksh-ism in regress test in",
                            "      regress/percent.sh.",
                            "    - CVE-2026-106583",
                            "  * SECURITY UPDATE: incorrect cert expiry in ssh-keygen",
                            "    - debian/patches/CVE-2026-106584.patch: upstream: Correct handling of DST",
                            "      when converting dates in misc.c.",
                            "    - CVE-2026-106584",
                            "  * SECURITY UPDATE: missing maximum packet length check",
                            "    - debian/patches/CVE-2026-106585.patch: upstream: Check that compressed",
                            "      payloads don't inflate beyond the in packet.c.",
                            "    - CVE-2026-106585",
                            "  * SECURITY UPDATE: incorrect restrict keyword usage in tunnel forwarding",
                            "    - debian/patches/CVE-2026-106586-1.patch: upstream: Propagate",
                            "      authorized_keys \"resrict\" keyword in auth-options.c.",
                            "    - debian/patches/CVE-2026-106586-2.patch: upstream: correctly check",
                            "      sshauthopt->restricted merging in regress/unittests/authopt/tests.c.",
                            "    - debian/patches/CVE-2026-106586-3.patch: upstream: simpler in",
                            "      regress/unittests/authopt/tests.c.",
                            "    - CVE-2026-106586",
                            "  * SECURITY UPDATE: \"none\" value confusion in options",
                            "    - debian/patches/CVE-2026-106587.patch: upstream: Correctly handle some",
                            "      options that accept \"none\" in servconf.c.",
                            "    - CVE-2026-106587",
                            ""
                        ],
                        "package": "openssh",
                        "version": "1:10.5p1-1ubuntu3.1",
                        "urgency": "medium",
                        "distributions": "stonking-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Thu, 15 Oct 2026 09:24:26 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  [ Colin Watson ]",
                            "  * d/openssh-{server,client}.postrm: Skip purging if",
                            "    openssh-{client,server}-gssapi is installed",
                            "    (Closes: #1148080 LP: #2169738)",
                            "",
                            "  * d/t/control, d/t/purge-keeps-config-with-counterpart: test to validate",
                            "    that switching to the openssh counterparts and then purging the",
                            "    removed packages keeps the configuration intact",
                            ""
                        ],
                        "package": "openssh",
                        "version": "1:10.5p1-1ubuntu3",
                        "urgency": "medium",
                        "distributions": "stonking",
                        "launchpad_bugs_fixed": [
                            2169738
                        ],
                        "author": "Andreas Hasenack <andreas.hasenack@canonical.com>",
                        "date": "Tue, 06 Oct 2026 15:04:38 -0300"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "openssh-sftp-server",
                "from_version": {
                    "source_package_name": "openssh",
                    "source_package_version": "1:10.5p1-1ubuntu2",
                    "version": "1:10.5p1-1ubuntu2"
                },
                "to_version": {
                    "source_package_name": "openssh",
                    "source_package_version": "1:10.5p1-1ubuntu3.1",
                    "version": "1:10.5p1-1ubuntu3.1"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-106552",
                        "url": "https://ubuntu.com/security/CVE-2026-106552",
                        "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106553",
                        "url": "https://ubuntu.com/security/CVE-2026-106553",
                        "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106555",
                        "url": "https://ubuntu.com/security/CVE-2026-106555",
                        "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106582",
                        "url": "https://ubuntu.com/security/CVE-2026-106582",
                        "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106583",
                        "url": "https://ubuntu.com/security/CVE-2026-106583",
                        "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-07 00:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106584",
                        "url": "https://ubuntu.com/security/CVE-2026-106584",
                        "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106585",
                        "url": "https://ubuntu.com/security/CVE-2026-106585",
                        "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106586",
                        "url": "https://ubuntu.com/security/CVE-2026-106586",
                        "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-106587",
                        "url": "https://ubuntu.com/security/CVE-2026-106587",
                        "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-10-06 22:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2169738
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-106552",
                                "url": "https://ubuntu.com/security/CVE-2026-106552",
                                "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106553",
                                "url": "https://ubuntu.com/security/CVE-2026-106553",
                                "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106555",
                                "url": "https://ubuntu.com/security/CVE-2026-106555",
                                "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106582",
                                "url": "https://ubuntu.com/security/CVE-2026-106582",
                                "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106583",
                                "url": "https://ubuntu.com/security/CVE-2026-106583",
                                "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-07 00:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106584",
                                "url": "https://ubuntu.com/security/CVE-2026-106584",
                                "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106585",
                                "url": "https://ubuntu.com/security/CVE-2026-106585",
                                "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106586",
                                "url": "https://ubuntu.com/security/CVE-2026-106586",
                                "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-106587",
                                "url": "https://ubuntu.com/security/CVE-2026-106587",
                                "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-10-06 22:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: sftp directory traversal",
                            "    - debian/patches/CVE-2026-106552.patch: upstream: sftp: be stricter in",
                            "      accepting paths returned by the in sftp-client.c, sftp.c.",
                            "    - CVE-2026-106552",
                            "  * SECURITY UPDATE: incorrect GSSAPIAuthentication auth persistence",
                            "    - debian/patches/CVE-2026-106553-1.patch: upstream: Reset GSSAPI client",
                            "      state before authentication in auth2.c, gss-serv.c, monitor.c, ssh-gss.h.",
                            "    - debian/patches/CVE-2026-106553-2.patch: upstream: Only store GSSAPI creds",
                            "      when authn succeeds in gss-serv.c, ssh-gss.h.",
                            "    - debian/patches/CVE-2026-106553-3.patch: upstream:",
                            "      ssh_gssapi_cleanup_global_client() needs a prototype in gss-serv.c, ssh-",
                            "      gss.h.",
                            "    - CVE-2026-106553",
                            "    - CVE-2026-106555",
                            "  * SECURITY UPDATE: incorrect use of LZ77 dictionary coder",
                            "    - debian/patches/CVE-2026-106582.patch: upstream: Disable LZ77 dictionary",
                            "      coder to avoid a potential in packet.c.",
                            "    - CVE-2026-106582",
                            "  * SECURITY UPDATE: invalid chars in command-line username",
                            "    - debian/patches/CVE-2026-106583-1.patch: upstream: Further restrict the",
                            "      characters allowed in a command-line in readconf.c.",
                            "    - debian/patches/CVE-2026-106583-2.patch: upstream: Add test for",
                            "      proxycommand percent expansions. in regress/percent.sh.",
                            "    - debian/patches/CVE-2026-106583-3.patch: avoid ksh-ism in regress test in",
                            "      regress/percent.sh.",
                            "    - CVE-2026-106583",
                            "  * SECURITY UPDATE: incorrect cert expiry in ssh-keygen",
                            "    - debian/patches/CVE-2026-106584.patch: upstream: Correct handling of DST",
                            "      when converting dates in misc.c.",
                            "    - CVE-2026-106584",
                            "  * SECURITY UPDATE: missing maximum packet length check",
                            "    - debian/patches/CVE-2026-106585.patch: upstream: Check that compressed",
                            "      payloads don't inflate beyond the in packet.c.",
                            "    - CVE-2026-106585",
                            "  * SECURITY UPDATE: incorrect restrict keyword usage in tunnel forwarding",
                            "    - debian/patches/CVE-2026-106586-1.patch: upstream: Propagate",
                            "      authorized_keys \"resrict\" keyword in auth-options.c.",
                            "    - debian/patches/CVE-2026-106586-2.patch: upstream: correctly check",
                            "      sshauthopt->restricted merging in regress/unittests/authopt/tests.c.",
                            "    - debian/patches/CVE-2026-106586-3.patch: upstream: simpler in",
                            "      regress/unittests/authopt/tests.c.",
                            "    - CVE-2026-106586",
                            "  * SECURITY UPDATE: \"none\" value confusion in options",
                            "    - debian/patches/CVE-2026-106587.patch: upstream: Correctly handle some",
                            "      options that accept \"none\" in servconf.c.",
                            "    - CVE-2026-106587",
                            ""
                        ],
                        "package": "openssh",
                        "version": "1:10.5p1-1ubuntu3.1",
                        "urgency": "medium",
                        "distributions": "stonking-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Thu, 15 Oct 2026 09:24:26 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  [ Colin Watson ]",
                            "  * d/openssh-{server,client}.postrm: Skip purging if",
                            "    openssh-{client,server}-gssapi is installed",
                            "    (Closes: #1148080 LP: #2169738)",
                            "",
                            "  * d/t/control, d/t/purge-keeps-config-with-counterpart: test to validate",
                            "    that switching to the openssh counterparts and then purging the",
                            "    removed packages keeps the configuration intact",
                            ""
                        ],
                        "package": "openssh",
                        "version": "1:10.5p1-1ubuntu3",
                        "urgency": "medium",
                        "distributions": "stonking",
                        "launchpad_bugs_fixed": [
                            2169738
                        ],
                        "author": "Andreas Hasenack <andreas.hasenack@canonical.com>",
                        "date": "Tue, 06 Oct 2026 15:04:38 -0300"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "python3-jwt",
                "from_version": {
                    "source_package_name": "pyjwt",
                    "source_package_version": "2.13.0-1ubuntu1",
                    "version": "2.13.0-1ubuntu1"
                },
                "to_version": {
                    "source_package_name": "pyjwt",
                    "source_package_version": "2.13.0-1ubuntu1.1",
                    "version": "2.13.0-1ubuntu1.1"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-101917",
                        "url": "https://ubuntu.com/security/CVE-2026-101917",
                        "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-09-28 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-101918",
                        "url": "https://ubuntu.com/security/CVE-2026-101918",
                        "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-09-28 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-102274",
                        "url": "https://ubuntu.com/security/CVE-2026-102274",
                        "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in  jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-09-28 21:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-102275",
                        "url": "https://ubuntu.com/security/CVE-2026-102275",
                        "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in  jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-09-28 21:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-101917",
                                "url": "https://ubuntu.com/security/CVE-2026-101917",
                                "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when unauthenticated tokens repeatedly use the same unknown kid or varying kid values absent from the cached JWKS. As a result, each cache miss causes PyJWKClient to refresh the JWKS. Consequently, attacker traffic can amplify outbound requests to the configured JWKS endpoint. This issue is fixed in version 2.14.0.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-09-28 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-101918",
                                "url": "https://ubuntu.com/security/CVE-2026-101918",
                                "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-09-28 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-102274",
                                "url": "https://ubuntu.com/security/CVE-2026-102274",
                                "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in  jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-09-28 21:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-102275",
                                "url": "https://ubuntu.com/security/CVE-2026-102275",
                                "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in  jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-09-28 21:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Unauthenticated Denial of Service via unbounded thread",
                            "    lock waiting during JWKS cache refreshes",
                            "    - debian/patches/CVE-2026-101917.patch: Throttle repeated PyJWKClient",
                            "      refreshes in jwt/jwks_client.py, tests/test_jwks_client.py.",
                            "    - CVE-2026-101917",
                            "  * SECURITY UPDATE: Uncaught recursion exception in get_signing_key_from_jwt",
                            "    - debian/patches/CVE-2026-101918.patch: fix: normalize recursive JWT",
                            "      payload errors in jwt/api_jwt.py, tests/test_api_jwt.py,",
                            "      tests/test_jwks_client.py.",
                            "    - CVE-2026-101918",
                            "  * SECURITY UPDATE: Uncaught exception in RSAAlgorithm.from_jwk when",
                            "    processing malformed RSA key.",
                            "    - debian/patches/CVE-2026-102274.patch: Skip malformed JWKs in JWK sets in",
                            "      jwt/api_jwk.py, tests/test_api_jwk.py.",
                            "    - CVE-2026-102274",
                            "  * SECURITY UPDATE: Public/private key identity confusion via mismatched x",
                            "    and d parameters in OKPAlgorithm.from_jwk",
                            "    - debian/patches/CVE-2026-102275.patch: fix: reject inconsistent OKP",
                            "      private keys in jwt/algorithms.py, tests/test_algorithms.py.",
                            "    - CVE-2026-102275",
                            ""
                        ],
                        "package": "pyjwt",
                        "version": "2.13.0-1ubuntu1.1",
                        "urgency": "medium",
                        "distributions": "stonking-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Hurman <hurman@canonical.com>",
                        "date": "Mon, 19 Oct 2026 23:52:44 +0800"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "sudo-rs",
                "from_version": {
                    "source_package_name": "rust-sudo-rs",
                    "source_package_version": "0.2.14-1ubuntu4",
                    "version": "0.2.14-1ubuntu4"
                },
                "to_version": {
                    "source_package_name": "rust-sudo-rs",
                    "source_package_version": "0.2.14-1ubuntu4.1",
                    "version": "0.2.14-1ubuntu4.1"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2165142
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Privilege Escalation via sudoedit (LP: #2165142)",
                            "    - debian/patches/fix-sudoedit.patch: Prevent unauthorized sudoedits Fix an",
                            "      issue where users with limited sudoedit rights could exploit a race",
                            "      condition to get escalated sudoedit permissions. in src/common/context.rs.",
                            "    - No CVE number",
                            ""
                        ],
                        "package": "rust-sudo-rs",
                        "version": "0.2.14-1ubuntu4.1",
                        "urgency": "medium",
                        "distributions": "stonking-security",
                        "launchpad_bugs_fixed": [
                            2165142
                        ],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Tue, 20 Oct 2026 07:26:12 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "xz-utils",
                "from_version": {
                    "source_package_name": "xz-utils",
                    "source_package_version": "5.8.3-1",
                    "version": "5.8.3-1"
                },
                "to_version": {
                    "source_package_name": "xz-utils",
                    "source_package_version": "5.8.3-1ubuntu1",
                    "version": "5.8.3-1ubuntu1"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2170056
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: invalid memory write during decoder reinitialization",
                            "    after allocation failure (LP: #2170056)",
                            "    - debian/patches/LP-2170056_1.patch: Make lzma_lz_decoder_init()",
                            "      safe to reinit after alloc failure in src/liblzma/lz/lz_decoder.c.",
                            "    - debian/patches/LP-2170056_2.patch: Clean up after a filter chain",
                            "      initialization error in src/liblzma/common/alone_decoder.c,",
                            "      src/liblzma/common/lzip_decoder.c,",
                            "      src/liblzma/common/microlzma_decoder.c.",
                            "    - debian/patches/LP-2170056_3.patch: Test lzma_alone_decoder() reuse",
                            "      after dictionary allocation failure in tests/Makefile.am,",
                            "      tests/test_alone_decoder.c, tests/tests.cmake.",
                            "    - No CVE number",
                            ""
                        ],
                        "package": "xz-utils",
                        "version": "5.8.3-1ubuntu1",
                        "urgency": "medium",
                        "distributions": "stonking",
                        "launchpad_bugs_fixed": [
                            2170056
                        ],
                        "author": "Shafayat Hossain Majumder <shafayat.majumder@canonical.com>",
                        "date": "Fri, 09 Oct 2026 11:54:18 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "zlib1g",
                "from_version": {
                    "source_package_name": "zlib",
                    "source_package_version": "1:1.3.dfsg+really1.3.2-3ubuntu1",
                    "version": "1:1.3.dfsg+really1.3.2-3ubuntu1"
                },
                "to_version": {
                    "source_package_name": "zlib",
                    "source_package_version": "1:1.3.dfsg+really1.3.2-3ubuntu1.1",
                    "version": "1:1.3.dfsg+really1.3.2-3ubuntu1.1"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-85091",
                        "url": "https://ubuntu.com/security/CVE-2026-85091",
                        "cve_description": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-09-03 13:06:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-85091",
                                "url": "https://ubuntu.com/security/CVE-2026-85091",
                                "cve_description": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-09-03 13:06:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: heap buffer overflow in gz_vacate() during non-blocking",
                            "    gzwrite() operations",
                            "    - debian/patches/CVE-2026-85091.patch: reset stale input buffer pointer",
                            "      on gz_comp() error in gz_write() in gzwrite.c",
                            "    - CVE-2026-85091",
                            ""
                        ],
                        "package": "zlib",
                        "version": "1:1.3.dfsg+really1.3.2-3ubuntu1.1",
                        "urgency": "medium",
                        "distributions": "stonking-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Shafayat Hossain Majumder <shafayat.majumder@canonical.com>",
                        "date": "Wed, 21 Oct 2026 16:56:24 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            }
        ],
        "snap": []
    },
    "added": {
        "deb": [],
        "snap": []
    },
    "removed": {
        "deb": [],
        "snap": []
    },
    "notes": "Changelog diff for Ubuntu 26.10 stonking image from release image serial 20261019 to 20261025",
    "from_series": "stonking",
    "to_series": "stonking",
    "from_serial": "20261019",
    "to_serial": "20261025",
    "from_manifest_filename": "release_manifest.previous",
    "to_manifest_filename": "manifest.current"
}