Operating systems stack vulnerabilities · Page 89

Security update for go1.26-openssl

This update for go1.26-openssl fixes the following issues: Update to version 1.26.10 (bsc#1255111, jsc#SLE-18320): - CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766). - CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection (bsc#1284767). - CVE-2026-78659: net/http: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1284768). - CVE-2026-78660: net/http: HTTP/2 transport accepts malformed framing-related headers (bsc#1284769). - CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770). - CVE-2026-78667: net/http:

• Update to 1.26.10-150600.13.18.1

body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates th

• Update to 1.20.9
• Update to 2.4.0
• Update to 2.4.0+~1.19.6-1

ALPINE-CVE-2026-111497

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

• Update to 1.1.1-r0
• Update to 1.2.1-r0

Security update for go1.26

This update for go1.26 fixes the following issues: Update to go1.26.10 (bsc#1255111): - CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams (bsc#1284770). - CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes (bsc#1284772). - CVE-2026-111943: crypto/x509: mitigation for security concerns with a specific Certificate Authority (bsc#1286317, bsc#1286261).

• Update to 1.26.10-150000.1.36.1

Security update for go1.27

This update for go1.27 fixes the following issues: Update to go 1.27.3 (bsc#1272545): - CVE-2026-111943: crypto/x509: mitigation for security concerns with a specific Certificate Authority (bsc#1286317, bsc#1286261).

• Update to 1.27.3-150000.1.15.1

Out-of-Bounds Write in Google Brotli Decoder

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

• Update to 1.0.10
• Update to 1.0.3-1ubuntu1.3+esm1
• Update to 1.0.3-1ubuntu1~16.04.2+esm1
• Update to 1.0.7-6ubuntu0.1+esm1
• Update to 1.0.9-2+deb12u1
• Update to 1.0.9-2ubuntu0.1
• Update to 1.1.0-2+deb13u1
• Update to 1.1.0-2ubuntu0.1
• Update to 1.1.1
• Update to 1.2.0-4ubuntu0.1
• Update to 1.2.1
• Update to 1.2.1.0
• Update to 1.2.1.0+ds-1
• Update to 10.0.114-10.0.14-0ubuntu1~24.04.1
• Update to 8.0.133-8.0.33-0ubuntu1~22.04.1
• Update to 8.0.133-8.0.33-0ubuntu1~24.04.1

Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE

Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling. In that configuration, the rendered path can escape the operator's intended log directory. This is not limited to the RFC5424 HOSTNAME field. Any untrusted value that reaches a dynaFile path c

Security update for distribution

This update for distribution rebuilds it against the current go security release.

• Update to 3.1.1-150400.9.43.1

Important: php:8.2 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765) * php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618) * php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• Update to 0:1.7.3-1.module+el8.10.0+1596+477f03f8
• Update to 0:1.7.3-1.module+el8.10.0+1605+02e07af7
• Update to 0:1.7.3-1.module+el8.10.0+1911+f499711e
• Update to 0:2.0.3-1.module+el8.10.0+1596+477f03f8
• Update to 0:2.0.3-1.module+el8.10.0+1605+02e07af7
• Update to 0:2.0.3-1.module+el8.10.0+1911+f499711e
• Update to 0:3.2.2-2.module+el8.10.0+1911+f499711e
• Update to 0:5.1.23-1.module+el8.10.0+1596+477f03f8
• Update to 0:5.1.23-1.module+el8.10.0+1911+f499711e
• Update to 0:8.2.35-1.module+el8.10.0+40394+d21b33fb
• Update to 1:1.10.14-1.module+el8.10.0+1596+477f03f8
• Update to 1:1.10.14-1.module+el8.10.0+1911+f499711e

libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.

fzf 0.36.0 through 0.74.5 Denial of Service via maskActionContents

fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server through quadratic string concatenation. Attackers can repeatedly send POST bodies of about 1 MB to the unauthenticated localhost port, blocking the single-threaded server for about 30 seconds each time.

Patch: filename validation bypass in reversal fallback allows file creation outside the working directory

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.

• Update to 2.8.1-1

Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Security issues fixed: WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (bsc#1284619): - CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. - CVE-2024-43091: Out of bounds write due to an integer overflow in filterMask of SkEmbossMaskFilter.cpp could lead to remote code execution. - CVE-2024-43097: Out of bounds write due to an integer overflow in resizeToAtLeast of SkRegion.cpp could lead to local escalation of privilege. - CVE-2024-43767: Heap overflow due to improper in

• Update to 2.54.1-150600.12.81.3
• Update to 2.54.1-150600.12.81.4

Security update for mutt

This update for mutt fixes the following issue: - CVE-2026-107570: heap out-of-bounds write in `convert_file_from_to()` via a crafted `Content-Type` header (bsc#1284739).

• Update to 2.2.14-150600.3.9.1

Security update for ca-certificates-mozilla

This update for ca-certificates-mozilla fixes the following issue: Updated to 2.92 state (bsc#1286261) Removed: - emSign ECC Root CA - C3 - emSign ECC Root CA - G3 - emSign Root CA - C1

• Update to 2.92-160000.1.1
• Update to 2.92-160000.1.4

webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions from 5.1.0 before 5.2.7 and in version 6.0.0, the unauthenticated open-editor endpoint validates the Host header with a regular expression meant for browser Origin schemes, so a Host value beginning with file: or with an extension scheme short-circuits the hostname and allowedHosts checks. A network peer that can reach the dev server can send a request with a malformed Host that passes validation and then causes the endpoint's URL construction to throw, and in the default non-production mode the server returns an HTTP 500 body containing

• Update to 5.2.7
• Update to 6.1.0

webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating the Host or Origin headers, so the allowedHosts protection does not apply to those proxied upgrades. A malicious web page visited by a developer can open a cross-origin WebSocket through the dev server and read from and write to the proxied backend, even when the server is bound to loopback. The issue is fixed in webpack-dev-server 5.2.7 and 6.1.0, where pr

• Update to 5.2.7
• Update to 6.1.0

CVE-2026-106017

Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions.

Security update for the Linux Kernel (Live Patch 56 for SUSE Linux Enterprise 15 SP4)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.225 fixes various security issues: The following security issues were fixed: - CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269775). - CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271965). - CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272386). - CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1276303).

• Update to 7-150400.2.1

Security update for podman

This update for podman rebuilds it against the current go security release.

• Update to 4.9.5-150500.3.84.1