Dangerzone Security Dashboard
- Target
- ghcr.io/freedomofpress/dangerzone/v1:latest
- Date
- 2026-09-05T02:13:44.541010276Z
Critical
7
High
108
Medium
139
Low
37
Unknown
45
| Name | Version | Type | Vulnerability | Severity | State | Fixed In | Description | Related URLs | PURL |
|---|---|---|---|---|---|---|---|---|---|
| libssl3t64 | 3.5.6-1~deb13u2 | deb | CVE-2026-18798 | High | fixed |
|
Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. CWE: CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary. | [] | pkg:deb/debian/libssl3t64@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openssl |
| openssl | 3.5.6-1~deb13u2 | deb | CVE-2026-18798 | High | fixed |
|
Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. CWE: CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary. | [] | pkg:deb/debian/openssl@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6 |
| openssl-provider-legacy | 3.5.6-1~deb13u2 | deb | CVE-2026-18798 | High | fixed |
|
Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. CWE: CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary. | [] | pkg:deb/debian/openssl-provider-legacy@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openssl |
| libssl3t64 | 3.5.6-1~deb13u2 | deb | CVE-2026-63076 | High | fixed |
|
Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer. Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service. CWE: CWE-476: NULL Pointer Dereference Description: When verifying the password-based MAC protection of a CMP message, OpenSSL library reads the protectionAlg algorithm parameter with X509_ALGOR_get0(), which returns both the parameter type and its value pointer. The value is then cast to an ASN1_STRING and treated as the expected PBMParameter after only checking that pointer is not NULL. The parameter type returned by X509_ALGOR_get0() was never consulted. This happens during protection verification, before any MAC is computed, so no knowledge of the PBM shared secret is required; the only precondition is that PBM verification is reachable. On the server side this is reached from OSSL_CMP_SRV_process_request() for any application that stands up a CMP server accepting PBM-protected messages, and on the client side from CMP response validation against a malicious or on-path (MITM) server. The reliable consequence is a denial of service; there is no memory disclosure, no controlled memory write, and no path to code execution. CMP is a specialized feature that an application must explicitly enable. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE. | [] | pkg:deb/debian/libssl3t64@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openssl |
| openssl | 3.5.6-1~deb13u2 | deb | CVE-2026-63076 | High | fixed |
|
Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer. Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service. CWE: CWE-476: NULL Pointer Dereference Description: When verifying the password-based MAC protection of a CMP message, OpenSSL library reads the protectionAlg algorithm parameter with X509_ALGOR_get0(), which returns both the parameter type and its value pointer. The value is then cast to an ASN1_STRING and treated as the expected PBMParameter after only checking that pointer is not NULL. The parameter type returned by X509_ALGOR_get0() was never consulted. This happens during protection verification, before any MAC is computed, so no knowledge of the PBM shared secret is required; the only precondition is that PBM verification is reachable. On the server side this is reached from OSSL_CMP_SRV_process_request() for any application that stands up a CMP server accepting PBM-protected messages, and on the client side from CMP response validation against a malicious or on-path (MITM) server. The reliable consequence is a denial of service; there is no memory disclosure, no controlled memory write, and no path to code execution. CMP is a specialized feature that an application must explicitly enable. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE. | [] | pkg:deb/debian/openssl@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6 |
| openssl-provider-legacy | 3.5.6-1~deb13u2 | deb | CVE-2026-63076 | High | fixed |
|
Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer. Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service. CWE: CWE-476: NULL Pointer Dereference Description: When verifying the password-based MAC protection of a CMP message, OpenSSL library reads the protectionAlg algorithm parameter with X509_ALGOR_get0(), which returns both the parameter type and its value pointer. The value is then cast to an ASN1_STRING and treated as the expected PBMParameter after only checking that pointer is not NULL. The parameter type returned by X509_ALGOR_get0() was never consulted. This happens during protection verification, before any MAC is computed, so no knowledge of the PBM shared secret is required; the only precondition is that PBM verification is reachable. On the server side this is reached from OSSL_CMP_SRV_process_request() for any application that stands up a CMP server accepting PBM-protected messages, and on the client side from CMP response validation against a malicious or on-path (MITM) server. The reliable consequence is a denial of service; there is no memory disclosure, no controlled memory write, and no path to code execution. CMP is a specialized feature that an application must explicitly enable. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE. | [] | pkg:deb/debian/openssl-provider-legacy@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openssl |
| libpoppler147 | 25.03.0-5+deb13u4 | deb | CVE-2019-9543 | Low | wont-fix | N/A | An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit. | [] | pkg:deb/debian/libpoppler147@25.03.0-5%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=poppler |
| libssl3t64 | 3.5.6-1~deb13u2 | deb | CVE-2026-63073 | Critical | fixed |
|
Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose subject becomes the default expected sender. CWE: CWE-134 (Use of Externally-Controlled Format String) Description: When validating a received CMP message, ossl_cmp_msg_check_update() converts the peer-supplied sender distinguished name with X509_NAME_oneline() and passes it directly as the format argument to ERR_raise_data(). Percent characters survive the conversion, so a sender DN such as "CN=%s%n" reaches BIO_vsnprintf() as an attacker-controlled format string with no matching variadic arguments. This path is only reached when the caller configures an expected sender or pins a server certificate, which is the normal configuration for a CMP client validating server responses. Since the attacker controls the format string but none of the variadic arguments, such specifiers as %s and %n dereference or write through unrelated stack contents and crash the client. The reliable consequence is a denial of service, when the response comes from a malicious or intercepted CMP endpoint. There is no controlled memory write, arbitrary-address read, or reliable path to remote code execution. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary. | [] | pkg:deb/debian/libssl3t64@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openssl |
| openssl | 3.5.6-1~deb13u2 | deb | CVE-2026-63073 | Critical | fixed |
|
Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose subject becomes the default expected sender. CWE: CWE-134 (Use of Externally-Controlled Format String) Description: When validating a received CMP message, ossl_cmp_msg_check_update() converts the peer-supplied sender distinguished name with X509_NAME_oneline() and passes it directly as the format argument to ERR_raise_data(). Percent characters survive the conversion, so a sender DN such as "CN=%s%n" reaches BIO_vsnprintf() as an attacker-controlled format string with no matching variadic arguments. This path is only reached when the caller configures an expected sender or pins a server certificate, which is the normal configuration for a CMP client validating server responses. Since the attacker controls the format string but none of the variadic arguments, such specifiers as %s and %n dereference or write through unrelated stack contents and crash the client. The reliable consequence is a denial of service, when the response comes from a malicious or intercepted CMP endpoint. There is no controlled memory write, arbitrary-address read, or reliable path to remote code execution. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary. | [] | pkg:deb/debian/openssl@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6 |
| openssl-provider-legacy | 3.5.6-1~deb13u2 | deb | CVE-2026-63073 | Critical | fixed |
|
Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose subject becomes the default expected sender. CWE: CWE-134 (Use of Externally-Controlled Format String) Description: When validating a received CMP message, ossl_cmp_msg_check_update() converts the peer-supplied sender distinguished name with X509_NAME_oneline() and passes it directly as the format argument to ERR_raise_data(). Percent characters survive the conversion, so a sender DN such as "CN=%s%n" reaches BIO_vsnprintf() as an attacker-controlled format string with no matching variadic arguments. This path is only reached when the caller configures an expected sender or pins a server certificate, which is the normal configuration for a CMP client validating server responses. Since the attacker controls the format string but none of the variadic arguments, such specifiers as %s and %n dereference or write through unrelated stack contents and crash the client. The reliable consequence is a denial of service, when the response comes from a malicious or intercepted CMP endpoint. There is no controlled memory write, arbitrary-address read, or reliable path to remote code execution. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary. | [] | pkg:deb/debian/openssl-provider-legacy@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openssl |
| libssl3t64 | 3.5.6-1~deb13u2 | deb | CVE-2026-14457 | High | fixed |
|
Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted "signature_algorithms_cert" TLS extension. Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible. CWE: CWE-476: NULL Pointer Dereference Description: While a passing comment in sample code in the documentation suggests that key-only RPK configurations are supported, the best-practice RPK configuration is to always configure a corresponding certificate (possibly self-signed or signed by any convenient CA). When the private key is configured along with a matching certificate, the "signature_algorithms_cert" extension is handled reliably even without the fix, and peer clients or servers that don't support raw public keys may be able to complete a TLS connection by pinning or verifying the corresponding certificate or its public key. Deployments that prefer to configure just a private key with no certificate need to upgrade to an updated release as noted below. FIPS impact: no No FIPS modules are affected by this issue, as the SSL protocol implementation is outside the OpenSSL FIPS module boundary. | [] | pkg:deb/debian/libssl3t64@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openssl |
| openssl | 3.5.6-1~deb13u2 | deb | CVE-2026-14457 | High | fixed |
|
Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted "signature_algorithms_cert" TLS extension. Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible. CWE: CWE-476: NULL Pointer Dereference Description: While a passing comment in sample code in the documentation suggests that key-only RPK configurations are supported, the best-practice RPK configuration is to always configure a corresponding certificate (possibly self-signed or signed by any convenient CA). When the private key is configured along with a matching certificate, the "signature_algorithms_cert" extension is handled reliably even without the fix, and peer clients or servers that don't support raw public keys may be able to complete a TLS connection by pinning or verifying the corresponding certificate or its public key. Deployments that prefer to configure just a private key with no certificate need to upgrade to an updated release as noted below. FIPS impact: no No FIPS modules are affected by this issue, as the SSL protocol implementation is outside the OpenSSL FIPS module boundary. | [] | pkg:deb/debian/openssl@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6 |
| openssl-provider-legacy | 3.5.6-1~deb13u2 | deb | CVE-2026-14457 | High | fixed |
|
Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted "signature_algorithms_cert" TLS extension. Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible. CWE: CWE-476: NULL Pointer Dereference Description: While a passing comment in sample code in the documentation suggests that key-only RPK configurations are supported, the best-practice RPK configuration is to always configure a corresponding certificate (possibly self-signed or signed by any convenient CA). When the private key is configured along with a matching certificate, the "signature_algorithms_cert" extension is handled reliably even without the fix, and peer clients or servers that don't support raw public keys may be able to complete a TLS connection by pinning or verifying the corresponding certificate or its public key. Deployments that prefer to configure just a private key with no certificate need to upgrade to an updated release as noted below. FIPS impact: no No FIPS modules are affected by this issue, as the SSL protocol implementation is outside the OpenSSL FIPS module boundary. | [] | pkg:deb/debian/openssl-provider-legacy@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openssl |
| libpython3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-11940 | High | wont-fix | N/A | tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-11940 | High | wont-fix | N/A | tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u4 | deb | CVE-2026-11940 | High | wont-fix | N/A | tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-11940 | High | wont-fix | N/A | tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6 |
| python3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-11940 | High | wont-fix | N/A | tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower path, letting a relative target the filter judged contained escape the destination directory. This allowed a malicious tar archive to create a symlink pointing outside the destination, enabling out-of-destination file reads or writes. This was an incomplete fix of CVE-2025-4330. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libcairo2 | 1.18.4-1+b1 | deb | CVE-2017-7475 | Low | wont-fix | N/A | Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash. | [] | pkg:deb/debian/libcairo2@1.18.4-1%2Bb1?arch=amd64&distro=debian-13.6&upstream=cairo%401.18.4-1 |
| libpoppler147 | 25.03.0-5+deb13u4 | deb | CVE-2019-9545 | Low | wont-fix | N/A | An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JBIG2Bitmap::clearToZero. | [] | pkg:deb/debian/libpoppler147@25.03.0-5%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=poppler |
| libssl3t64 | 3.5.6-1~deb13u2 | deb | CVE-2026-14456 | High | fixed |
|
Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The function that handles inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC channel). If no existing connection is found and the packet type is INITIAL, the function treats the packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial channel objects may grow without bounds if the application is not able to call SSL_accept() frequently enough to serve these inbound connection requests. The issue is present since OpenSSL 3.5 when the QUIC server implementation was added. The fix introduces a limit for pending connections. The default limit is set to 256 pending connections (waiting to be accepted by the local application). Applications may change the default by calling SSL_set_value_uint(3ossl). FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary. | [] | pkg:deb/debian/libssl3t64@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openssl |
| openssl | 3.5.6-1~deb13u2 | deb | CVE-2026-14456 | High | fixed |
|
Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The function that handles inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC channel). If no existing connection is found and the packet type is INITIAL, the function treats the packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial channel objects may grow without bounds if the application is not able to call SSL_accept() frequently enough to serve these inbound connection requests. The issue is present since OpenSSL 3.5 when the QUIC server implementation was added. The fix introduces a limit for pending connections. The default limit is set to 256 pending connections (waiting to be accepted by the local application). Applications may change the default by calling SSL_set_value_uint(3ossl). FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary. | [] | pkg:deb/debian/openssl@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6 |
| openssl-provider-legacy | 3.5.6-1~deb13u2 | deb | CVE-2026-14456 | High | fixed |
|
Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The function that handles inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC channel). If no existing connection is found and the packet type is INITIAL, the function treats the packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial channel objects may grow without bounds if the application is not able to call SSL_accept() frequently enough to serve these inbound connection requests. The issue is present since OpenSSL 3.5 when the QUIC server implementation was added. The fix introduces a limit for pending connections. The default limit is set to 256 pending connections (waiting to be accepted by the local application). Applications may change the default by calling SSL_set_value_uint(3ossl). FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary. | [] | pkg:deb/debian/openssl-provider-legacy@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openssl |
| libopenjp2-7 | 2.5.3-2.1~deb13u2 | deb | CVE-2019-6988 | Low | wont-fix | N/A | An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress. | [] | pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openjpeg2 |
| libpython3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-15308 | High | wont-fix | N/A | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-15308 | High | wont-fix | N/A | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u4 | deb | CVE-2026-15308 | High | wont-fix | N/A | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-15308 | High | wont-fix | N/A | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6 |
| python3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-15308 | High | wont-fix | N/A | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libexpat1 | 2.8.2-1~deb13u1 | deb | CVE-2026-66046 | High | wont-fix | N/A | Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options. | [] | pkg:deb/debian/libexpat1@2.8.2-1~deb13u1?arch=amd64&distro=debian-13.6&upstream=expat |
| libglib2.0-0t64 | 2.84.4-3~deb13u3 | deb | CVE-2026-58015 | High | wont-fix | N/A | A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash. | [] | pkg:deb/debian/libglib2.0-0t64@2.84.4-3~deb13u3?arch=amd64&distro=debian-13.6&upstream=glib2.0 |
| libssl3t64 | 3.5.6-1~deb13u2 | deb | CVE-2026-63072 | High | fixed |
|
Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers. An attacker can take a legitimate message and change a single OID byte to select the padded variant while leaving the message otherwise valid. Since the unwrap key is derived from the recipient's private operation (ECDH key agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot pass, and the decryption fails with integrity failure. The write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the allocation, requires no special configuration, and is reachable from the public CMS_decrypt() function. The consequence is a heap corruption leading to a Denial of Service. The fix in the CMS code sizes the unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation. FIPS impact: no As the CMS code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE. | [] | pkg:deb/debian/libssl3t64@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openssl |
| openssl | 3.5.6-1~deb13u2 | deb | CVE-2026-63072 | High | fixed |
|
Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers. An attacker can take a legitimate message and change a single OID byte to select the padded variant while leaving the message otherwise valid. Since the unwrap key is derived from the recipient's private operation (ECDH key agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot pass, and the decryption fails with integrity failure. The write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the allocation, requires no special configuration, and is reachable from the public CMS_decrypt() function. The consequence is a heap corruption leading to a Denial of Service. The fix in the CMS code sizes the unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation. FIPS impact: no As the CMS code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE. | [] | pkg:deb/debian/openssl@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6 |
| openssl-provider-legacy | 3.5.6-1~deb13u2 | deb | CVE-2026-63072 | High | fixed |
|
Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers. An attacker can take a legitimate message and change a single OID byte to select the padded variant while leaving the message otherwise valid. Since the unwrap key is derived from the recipient's private operation (ECDH key agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot pass, and the decryption fails with integrity failure. The write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the allocation, requires no special configuration, and is reachable from the public CMS_decrypt() function. The consequence is a heap corruption leading to a Denial of Service. The fix in the CMS code sizes the unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation. FIPS impact: no As the CMS code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE. | [] | pkg:deb/debian/openssl-provider-legacy@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openssl |
| libjbig2dec0 | 0.20-1+b3 | deb | CVE-2026-38076 | High | wont-fix | N/A | An integer overflow in the jbig2_arith_iaid_ctx_new() function of Artifex commit cc37d0 allows attackers to cause a Denial of Service (DoS) via a crafted input. | [] | pkg:deb/debian/libjbig2dec0@0.20-1%2Bb3?arch=amd64&distro=debian-13.6&upstream=jbig2dec%400.20-1 |
| libmupdf25.1 | 1.25.1+ds1-6+deb13u1 | deb | CVE-2025-71382 | High | wont-fix | N/A | MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of service by supplying a maliciously crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function value_from_inheritable_property() in css-apply.c recurses through the CSS property inheritance chain without a depth limit, exhausting the process stack and causing a crash in any application using MuPDF for EPUB rendering. | [] | pkg:deb/debian/libmupdf25.1@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=mupdf |
| python3-mupdf | 1.25.1+ds1-6+deb13u1 | deb | CVE-2025-71382 | High | wont-fix | N/A | MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of service by supplying a maliciously crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function value_from_inheritable_property() in css-apply.c recurses through the CSS property inheritance chain without a depth limit, exhausting the process stack and causing a crash in any application using MuPDF for EPUB rendering. | [] | pkg:deb/debian/python3-mupdf@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=mupdf |
| libssl3t64 | 3.5.6-1~deb13u2 | deb | CVE-2026-54874 | High | fixed |
|
Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource Consumption (Amplification) Description: While a DTLS handshake is in progress, a peer may legitimately have already moved on to the next epoch (for example, having sent its ChangeCipherSpec and Finished messages) before the local endpoint has processed the same transition, typically because of reordering on the underlying UDP transport. OpenSSL buffers such early records so that they can be processed once the local endpoint catches up. Buffering a record currently retains the entire read buffer it arrived in, which is sized to hold the largest possible DTLS record (around 16 kilobytes), rather than just the bytes that make up the record itself. Up to 100 such records may be buffered per connection. As a result, a peer that sends a stream of small forged records claiming to belong to the next epoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of memory, despite sending only a small fraction of that amount of data over the network. An attacker therefore gains a memory amplification factor of around 1200, and can multiply the effect across as many associations as it is able to open, making this a remote memory exhaustion Denial of Service risk for DTLS servers. Since the memory retained per connection remains bounded, and any limit an application already places on the number of concurrent associations also bounds the total exposure, this issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary. OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.2. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.4. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.8. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.7. OpenSSL 3.0 users should upgrade to OpenSSL 3.0.22. Premium support customers only: OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr This issue was reported on 18 May 2026 by Amazon Web Services. The fix has been developed by Matt Caswell. -- cut (non-publishing metadata for internal use) -- Reported by: Amazon Web Services Fixed by: Matt Caswell | [] | pkg:deb/debian/libssl3t64@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openssl |
| openssl | 3.5.6-1~deb13u2 | deb | CVE-2026-54874 | High | fixed |
|
Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource Consumption (Amplification) Description: While a DTLS handshake is in progress, a peer may legitimately have already moved on to the next epoch (for example, having sent its ChangeCipherSpec and Finished messages) before the local endpoint has processed the same transition, typically because of reordering on the underlying UDP transport. OpenSSL buffers such early records so that they can be processed once the local endpoint catches up. Buffering a record currently retains the entire read buffer it arrived in, which is sized to hold the largest possible DTLS record (around 16 kilobytes), rather than just the bytes that make up the record itself. Up to 100 such records may be buffered per connection. As a result, a peer that sends a stream of small forged records claiming to belong to the next epoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of memory, despite sending only a small fraction of that amount of data over the network. An attacker therefore gains a memory amplification factor of around 1200, and can multiply the effect across as many associations as it is able to open, making this a remote memory exhaustion Denial of Service risk for DTLS servers. Since the memory retained per connection remains bounded, and any limit an application already places on the number of concurrent associations also bounds the total exposure, this issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary. OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.2. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.4. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.8. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.7. OpenSSL 3.0 users should upgrade to OpenSSL 3.0.22. Premium support customers only: OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr This issue was reported on 18 May 2026 by Amazon Web Services. The fix has been developed by Matt Caswell. -- cut (non-publishing metadata for internal use) -- Reported by: Amazon Web Services Fixed by: Matt Caswell | [] | pkg:deb/debian/openssl@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6 |
| openssl-provider-legacy | 3.5.6-1~deb13u2 | deb | CVE-2026-54874 | High | fixed |
|
Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource Consumption (Amplification) Description: While a DTLS handshake is in progress, a peer may legitimately have already moved on to the next epoch (for example, having sent its ChangeCipherSpec and Finished messages) before the local endpoint has processed the same transition, typically because of reordering on the underlying UDP transport. OpenSSL buffers such early records so that they can be processed once the local endpoint catches up. Buffering a record currently retains the entire read buffer it arrived in, which is sized to hold the largest possible DTLS record (around 16 kilobytes), rather than just the bytes that make up the record itself. Up to 100 such records may be buffered per connection. As a result, a peer that sends a stream of small forged records claiming to belong to the next epoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of memory, despite sending only a small fraction of that amount of data over the network. An attacker therefore gains a memory amplification factor of around 1200, and can multiply the effect across as many associations as it is able to open, making this a remote memory exhaustion Denial of Service risk for DTLS servers. Since the memory retained per connection remains bounded, and any limit an application already places on the number of concurrent associations also bounds the total exposure, this issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary. OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.2. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.4. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.8. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.7. OpenSSL 3.0 users should upgrade to OpenSSL 3.0.22. Premium support customers only: OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr This issue was reported on 18 May 2026 by Amazon Web Services. The fix has been developed by Matt Caswell. -- cut (non-publishing metadata for internal use) -- Reported by: Amazon Web Services Fixed by: Matt Caswell | [] | pkg:deb/debian/openssl-provider-legacy@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openssl |
| libtiff6 | 4.7.0-3+deb13u3 | deb | CVE-2026-52490 | Critical | not-fixed | N/A | An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c | [] | pkg:deb/debian/libtiff6@4.7.0-3%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=tiff |
| libglib2.0-0t64 | 2.84.4-3~deb13u3 | deb | CVE-2026-58013 | High | wont-fix | N/A | A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary. | [] | pkg:deb/debian/libglib2.0-0t64@2.84.4-3~deb13u3?arch=amd64&distro=debian-13.6&upstream=glib2.0 |
| libglib2.0-0t64 | 2.84.4-3~deb13u3 | deb | CVE-2026-58010 | High | wont-fix | N/A | A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary. | [] | pkg:deb/debian/libglib2.0-0t64@2.84.4-3~deb13u3?arch=amd64&distro=debian-13.6&upstream=glib2.0 |
| libglib2.0-0t64 | 2.84.4-3~deb13u3 | deb | CVE-2026-58012 | High | wont-fix | N/A | A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary. | [] | pkg:deb/debian/libglib2.0-0t64@2.84.4-3~deb13u3?arch=amd64&distro=debian-13.6&upstream=glib2.0 |
| libssl3t64 | 3.5.6-1~deb13u2 | deb | CVE-2026-63075 | High | fixed |
|
Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer, potentially leading to a Denial of Service. The fix is to ensure that we account for the transmission of the ACK-only packet in the packet histories high and low watermark without actually storing the ACK-only packet metadata itself. FIPS impact: no The OpenSSL FIPS module is not affected as the QUIC code is outside the FIPS module boundary. | [] | pkg:deb/debian/libssl3t64@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openssl |
| openssl | 3.5.6-1~deb13u2 | deb | CVE-2026-63075 | High | fixed |
|
Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer, potentially leading to a Denial of Service. The fix is to ensure that we account for the transmission of the ACK-only packet in the packet histories high and low watermark without actually storing the ACK-only packet metadata itself. FIPS impact: no The OpenSSL FIPS module is not affected as the QUIC code is outside the FIPS module boundary. | [] | pkg:deb/debian/openssl@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6 |
| openssl-provider-legacy | 3.5.6-1~deb13u2 | deb | CVE-2026-63075 | High | fixed |
|
Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer, potentially leading to a Denial of Service. The fix is to ensure that we account for the transmission of the ACK-only packet in the packet histories high and low watermark without actually storing the ACK-only packet metadata itself. FIPS impact: no The OpenSSL FIPS module is not affected as the QUIC code is outside the FIPS module boundary. | [] | pkg:deb/debian/openssl-provider-legacy@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openssl |
| libmupdf25.1 | 1.25.1+ds1-6+deb13u1 | deb | CVE-2026-25556 | High | wont-fix | N/A | MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path before rethrowing the exception. Callers (including the barcode decoding path in fz_decode_barcode_from_display_list) also drop the same pixmap in cleanup, resulting in a double-free that can corrupt the heap and crash the process. This issue affects applications that enable and use MuPDF barcode decoding and can be triggered by processing crafted input that causes a rendering-time error while decoding barcodes. | [] | pkg:deb/debian/libmupdf25.1@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=mupdf |
| python3-mupdf | 1.25.1+ds1-6+deb13u1 | deb | CVE-2026-25556 | High | wont-fix | N/A | MuPDF versions 1.23.0 through 1.27.0 contain a double-free vulnerability in fz_fill_pixmap_from_display_list() when an exception occurs during display list rendering. The function accepts a caller-owned fz_pixmap pointer but incorrectly drops the pixmap in its error handling path before rethrowing the exception. Callers (including the barcode decoding path in fz_decode_barcode_from_display_list) also drop the same pixmap in cleanup, resulting in a double-free that can corrupt the heap and crash the process. This issue affects applications that enable and use MuPDF barcode decoding and can be triggered by processing crafted input that causes a rendering-time error while decoding barcodes. | [] | pkg:deb/debian/python3-mupdf@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=mupdf |
| libpython3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-11972 | High | wont-fix | N/A | When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-11972 | High | wont-fix | N/A | When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u4 | deb | CVE-2026-11972 | High | wont-fix | N/A | When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-11972 | High | wont-fix | N/A | When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6 |
| python3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-11972 | High | wont-fix | N/A | When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| zlib1g | 1:1.3.dfsg+really1.3.1-1+b1 | deb | CVE-2026-85091 | High | not-fixed | N/A | zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary. | [] | pkg:deb/debian/zlib1g@1%3A1.3.dfsg%2Breally1.3.1-1%2Bb1?arch=amd64&distro=debian-13.6&upstream=zlib%401%3A1.3.dfsg%2Breally1.3.1-1 |
| libavahi-client3 | 0.8-16 | deb | CVE-2024-52616 | Medium | wont-fix | N/A | A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs. | [] | pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common-data | 0.8-16 | deb | CVE-2024-52616 | Medium | wont-fix | N/A | A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs. | [] | pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common3 | 0.8-16 | deb | CVE-2024-52616 | Medium | wont-fix | N/A | A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs. | [] | pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libglib2.0-0t64 | 2.84.4-3~deb13u3 | deb | CVE-2026-58011 | High | wont-fix | N/A | A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service. | [] | pkg:deb/debian/libglib2.0-0t64@2.84.4-3~deb13u3?arch=amd64&distro=debian-13.6&upstream=glib2.0 |
| libncursesw6 | 6.5+20250216-2 | deb | CVE-2025-69720 | High | wont-fix | N/A | The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c. | [] | pkg:deb/debian/libncursesw6@6.5%2B20250216-2?arch=amd64&distro=debian-13.6&upstream=ncurses |
| libtinfo6 | 6.5+20250216-2 | deb | CVE-2025-69720 | High | wont-fix | N/A | The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c. | [] | pkg:deb/debian/libtinfo6@6.5%2B20250216-2?arch=amd64&distro=debian-13.6&upstream=ncurses |
| ncurses-base | 6.5+20250216-2 | deb | CVE-2025-69720 | High | wont-fix | N/A | The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c. | [] | pkg:deb/debian/ncurses-base@6.5%2B20250216-2?arch=all&distro=debian-13.6&upstream=ncurses |
| ncurses-bin | 6.5+20250216-2 | deb | CVE-2025-69720 | High | wont-fix | N/A | The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c. | [] | pkg:deb/debian/ncurses-bin@6.5%2B20250216-2?arch=amd64&distro=debian-13.6&upstream=ncurses |
| libopenjp2-7 | 2.5.3-2.1~deb13u2 | deb | CVE-2023-39329 | Medium | wont-fix | N/A | A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service. | [] | pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openjpeg2 |
| libmupdf25.1 | 1.25.1+ds1-6+deb13u1 | deb | CVE-2025-55780 | High | wont-fix | N/A | A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node->next is valid before accessing node->next->overflow_wrap, resulting in a crash if the split fails or returns a partial node chain. | [] | pkg:deb/debian/libmupdf25.1@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=mupdf |
| python3-mupdf | 1.25.1+ds1-6+deb13u1 | deb | CVE-2025-55780 | High | wont-fix | N/A | A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node->next is valid before accessing node->next->overflow_wrap, resulting in a crash if the split fails or returns a partial node chain. | [] | pkg:deb/debian/python3-mupdf@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=mupdf |
| libglib2.0-0t64 | 2.84.4-3~deb13u3 | deb | CVE-2026-58014 | High | wont-fix | N/A | A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary. | [] | pkg:deb/debian/libglib2.0-0t64@2.84.4-3~deb13u3?arch=amd64&distro=debian-13.6&upstream=glib2.0 |
| gzip | 1.13-1 | deb | CVE-2026-41992 | High | wont-fix | N/A | GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation. By decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer. This issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and e7378c2d421be6a286922374425680bbe9ad8b7d. | [] | pkg:deb/debian/gzip@1.13-1?arch=amd64&distro=debian-13.6 |
| dirmngr | 2.4.7-21+deb13u1+b4 | deb | CVE-2026-24882 | High | wont-fix | N/A | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. | [] | pkg:deb/debian/dirmngr@2.4.7-21%2Bdeb13u1%2Bb4?arch=amd64&distro=debian-13.6&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| gnupg | 2.4.7-21+deb13u1 | deb | CVE-2026-24882 | High | wont-fix | N/A | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. | [] | pkg:deb/debian/gnupg@2.4.7-21%2Bdeb13u1?arch=all&distro=debian-13.6&upstream=gnupg2 |
| gnupg-l10n | 2.4.7-21+deb13u1 | deb | CVE-2026-24882 | High | wont-fix | N/A | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. | [] | pkg:deb/debian/gnupg-l10n@2.4.7-21%2Bdeb13u1?arch=all&distro=debian-13.6&upstream=gnupg2 |
| gpg | 2.4.7-21+deb13u1+b4 | deb | CVE-2026-24882 | High | wont-fix | N/A | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. | [] | pkg:deb/debian/gpg@2.4.7-21%2Bdeb13u1%2Bb4?arch=amd64&distro=debian-13.6&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| gpg-agent | 2.4.7-21+deb13u1+b4 | deb | CVE-2026-24882 | High | wont-fix | N/A | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. | [] | pkg:deb/debian/gpg-agent@2.4.7-21%2Bdeb13u1%2Bb4?arch=amd64&distro=debian-13.6&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| gpgconf | 2.4.7-21+deb13u1+b4 | deb | CVE-2026-24882 | High | wont-fix | N/A | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. | [] | pkg:deb/debian/gpgconf@2.4.7-21%2Bdeb13u1%2Bb4?arch=amd64&distro=debian-13.6&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| gpgsm | 2.4.7-21+deb13u1+b4 | deb | CVE-2026-24882 | High | wont-fix | N/A | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. | [] | pkg:deb/debian/gpgsm@2.4.7-21%2Bdeb13u1%2Bb4?arch=amd64&distro=debian-13.6&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| libavahi-client3 | 0.8-16 | deb | CVE-2024-52615 | Medium | wont-fix | N/A | A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. | [] | pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common-data | 0.8-16 | deb | CVE-2024-52615 | Medium | wont-fix | N/A | A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. | [] | pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common3 | 0.8-16 | deb | CVE-2024-52615 | Medium | wont-fix | N/A | A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. | [] | pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libc-bin | 2.41-12+deb13u3 | deb | CVE-2026-5928 | High | wont-fix | N/A | Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets. | [] | pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc |
| libc6 | 2.41-12+deb13u3 | deb | CVE-2026-5928 | High | wont-fix | N/A | Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets. | [] | pkg:deb/debian/libc6@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc |
| libpython3.13 | 3.13.5-2+deb13u4 | deb | CVE-2025-12781 | Medium | wont-fix | N/A | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues. This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet. The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2025-12781 | Medium | wont-fix | N/A | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues. This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet. The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u4 | deb | CVE-2025-12781 | Medium | wont-fix | N/A | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues. This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet. The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u4 | deb | CVE-2025-12781 | Medium | wont-fix | N/A | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues. This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet. The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6 |
| python3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2025-12781 | Medium | wont-fix | N/A | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues. This behavior can only be insecure if your application uses an alternate base64 alphabet (without "+/"). If your application does not use the "altchars" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet. The attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python. Users are recommended to mitigate by verifying user-controlled inputs match the base64 alphabet they are expecting or verify that their application would not be affected if the b64decode() functions accepted "+" or "/" outside of altchars. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| openjdk-21-jre-headless | 21.0.11+10-1~deb13u2 | deb | CVE-2026-41254 | High | fixed |
|
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication. | [] | pkg:deb/debian/openjdk-21-jre-headless@21.0.11%2B10-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openjdk-21 |
| libpython3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-17084 | Medium | wont-fix | N/A | The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-17084 | Medium | wont-fix | N/A | The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u4 | deb | CVE-2026-17084 | Medium | wont-fix | N/A | The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-17084 | Medium | wont-fix | N/A | The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6 |
| python3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-17084 | Medium | wont-fix | N/A | The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libssl3t64 | 3.5.6-1~deb13u2 | deb | CVE-2026-63074 | Medium | fixed |
|
Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX for the lifetime of a server process may observe unbounded memory growth in the event a malicious client repeatedly sends requests containing unique extra certificates, which may lead to OOM conditions. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: If a remote user sends CMP messages to a server with a list of extraCerts and the message is rejected, the extraCerts from the message remains in the server contexts untrusted certificate stack. This exposes servers with long lived ctx objects to Denial of Service attacks in which an attacker sends messages intending to be rejected with a large list of additional certificates repeatedly, forcing the server to store them indefinitely. The issue was fixed by removing the added extra certs if the message is rejected, using the same method as when the context is configured to not do caching at all. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE. | [] | pkg:deb/debian/libssl3t64@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openssl |
| openssl | 3.5.6-1~deb13u2 | deb | CVE-2026-63074 | Medium | fixed |
|
Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX for the lifetime of a server process may observe unbounded memory growth in the event a malicious client repeatedly sends requests containing unique extra certificates, which may lead to OOM conditions. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: If a remote user sends CMP messages to a server with a list of extraCerts and the message is rejected, the extraCerts from the message remains in the server contexts untrusted certificate stack. This exposes servers with long lived ctx objects to Denial of Service attacks in which an attacker sends messages intending to be rejected with a large list of additional certificates repeatedly, forcing the server to store them indefinitely. The issue was fixed by removing the added extra certs if the message is rejected, using the same method as when the context is configured to not do caching at all. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE. | [] | pkg:deb/debian/openssl@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6 |
| openssl-provider-legacy | 3.5.6-1~deb13u2 | deb | CVE-2026-63074 | Medium | fixed |
|
Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX for the lifetime of a server process may observe unbounded memory growth in the event a malicious client repeatedly sends requests containing unique extra certificates, which may lead to OOM conditions. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: If a remote user sends CMP messages to a server with a list of extraCerts and the message is rejected, the extraCerts from the message remains in the server contexts untrusted certificate stack. This exposes servers with long lived ctx objects to Denial of Service attacks in which an attacker sends messages intending to be rejected with a large list of additional certificates repeatedly, forcing the server to store them indefinitely. The issue was fixed by removing the added extra certs if the message is rejected, using the same method as when the context is configured to not do caching at all. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE. | [] | pkg:deb/debian/openssl-provider-legacy@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openssl |
| libopenjp2-7 | 2.5.3-2.1~deb13u2 | deb | CVE-2023-39327 | Medium | wont-fix | N/A | A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal. | [] | pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openjpeg2 |
| libpython3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-19672 | Medium | wont-fix | N/A | The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-19672 | Medium | wont-fix | N/A | The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u4 | deb | CVE-2026-19672 | Medium | wont-fix | N/A | The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-19672 | Medium | wont-fix | N/A | The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6 |
| python3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-19672 | Medium | wont-fix | N/A | The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| bsdutils | 1:2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/bsdutils@1%3A2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 |
| libblkid1 | 2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/libblkid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| liblastlog2-2 | 2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libmount1 | 2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/libmount1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libsmartcols1 | 2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libuuid1 | 2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/libuuid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| login | 1:4.16.0-2+really2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 |
| mount | 2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/mount@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| util-linux | 2.41-5 | deb | CVE-2026-3184 | Medium | wont-fix | N/A | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | [] | pkg:deb/debian/util-linux@2.41-5?arch=amd64&distro=debian-13.6 |
| libpython3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-15806 | Medium | wont-fix | N/A | The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-15806 | Medium | wont-fix | N/A | The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u4 | deb | CVE-2026-15806 | Medium | wont-fix | N/A | The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-15806 | Medium | wont-fix | N/A | The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6 |
| python3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-15806 | Medium | wont-fix | N/A | The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libmupdf25.1 | 1.25.1+ds1-6+deb13u1 | deb | CVE-2025-46206 | Medium | wont-fix | N/A | An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clean` utility. When processing a crafted PDF file containing cyclic /Next references in the outline structure, the `strip_outline()` function enters infinite recursion | [] | pkg:deb/debian/libmupdf25.1@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=mupdf |
| python3-mupdf | 1.25.1+ds1-6+deb13u1 | deb | CVE-2025-46206 | Medium | wont-fix | N/A | An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clean` utility. When processing a crafted PDF file containing cyclic /Next references in the outline structure, the `strip_outline()` function enters infinite recursion | [] | pkg:deb/debian/python3-mupdf@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=mupdf |
| libavahi-client3 | 0.8-16 | deb | CVE-2025-68471 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart. | [] | pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common-data | 0.8-16 | deb | CVE-2025-68471 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart. | [] | pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common3 | 0.8-16 | deb | CVE-2025-68471 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart. | [] | pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libc-bin | 2.41-12+deb13u3 | deb | CVE-2026-6238 | Medium | wont-fix | N/A | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions. | [] | pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc |
| libc6 | 2.41-12+deb13u3 | deb | CVE-2026-6238 | Medium | wont-fix | N/A | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions. | [] | pkg:deb/debian/libc6@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc |
| libpython3.13 | 3.13.5-2+deb13u4 | deb | CVE-2025-15366 | Medium | wont-fix | N/A | The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2025-15366 | Medium | wont-fix | N/A | The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u4 | deb | CVE-2025-15366 | Medium | wont-fix | N/A | The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u4 | deb | CVE-2025-15366 | Medium | wont-fix | N/A | The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6 |
| python3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2025-15366 | Medium | wont-fix | N/A | The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libavahi-client3 | 0.8-16 | deb | CVE-2025-68468 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes. | [] | pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common-data | 0.8-16 | deb | CVE-2025-68468 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes. | [] | pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common3 | 0.8-16 | deb | CVE-2025-68468 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes. | [] | pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| tar | 1.35+dfsg-3.1 | deb | CVE-2026-5704 | Medium | wont-fix | N/A | A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection. | [] | pkg:deb/debian/tar@1.35%2Bdfsg-3.1?arch=amd64&distro=debian-13.6 |
| openjdk-21-jre-headless | 21.0.11+10-1~deb13u2 | deb | CVE-2026-47063 | High | fixed |
|
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). | [] | pkg:deb/debian/openjdk-21-jre-headless@21.0.11%2B10-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openjdk-21 |
| libpam-modules | 1.7.0-5 | deb | CVE-2026-54411 | Medium | wont-fix | N/A | Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. | [] | pkg:deb/debian/libpam-modules@1.7.0-5?arch=amd64&distro=debian-13.6&upstream=pam |
| libpam-modules-bin | 1.7.0-5 | deb | CVE-2026-54411 | Medium | wont-fix | N/A | Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. | [] | pkg:deb/debian/libpam-modules-bin@1.7.0-5?arch=amd64&distro=debian-13.6&upstream=pam |
| libpam-runtime | 1.7.0-5 | deb | CVE-2026-54411 | Medium | wont-fix | N/A | Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. | [] | pkg:deb/debian/libpam-runtime@1.7.0-5?arch=all&distro=debian-13.6&upstream=pam |
| libpam0g | 1.7.0-5 | deb | CVE-2026-54411 | Medium | wont-fix | N/A | Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. | [] | pkg:deb/debian/libpam0g@1.7.0-5?arch=amd64&distro=debian-13.6&upstream=pam |
| libssl3t64 | 3.5.6-1~deb13u2 | deb | CVE-2026-75803 | Critical | fixed |
|
Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module. | [] | pkg:deb/debian/libssl3t64@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openssl |
| openssl | 3.5.6-1~deb13u2 | deb | CVE-2026-75803 | Critical | fixed |
|
Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module. | [] | pkg:deb/debian/openssl@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6 |
| openssl-provider-legacy | 3.5.6-1~deb13u2 | deb | CVE-2026-75803 | Critical | fixed |
|
Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module. | [] | pkg:deb/debian/openssl-provider-legacy@3.5.6-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openssl |
| openjdk-21-jre-headless | 21.0.11+10-1~deb13u2 | deb | CVE-2026-61308 | Medium | fixed |
|
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N). | [] | pkg:deb/debian/openjdk-21-jre-headless@21.0.11%2B10-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openjdk-21 |
| libpython3.13 | 3.13.5-2+deb13u4 | deb | CVE-2025-15367 | Medium | wont-fix | N/A | The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2025-15367 | Medium | wont-fix | N/A | The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u4 | deb | CVE-2025-15367 | Medium | wont-fix | N/A | The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u4 | deb | CVE-2025-15367 | Medium | wont-fix | N/A | The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6 |
| python3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2025-15367 | Medium | wont-fix | N/A | The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libc-bin | 2.41-12+deb13u3 | deb | CVE-2026-5435 | High | wont-fix | N/A | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records. | [] | pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc |
| libc6 | 2.41-12+deb13u3 | deb | CVE-2026-5435 | High | wont-fix | N/A | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records. | [] | pkg:deb/debian/libc6@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc |
| openjdk-21-jre-headless | 21.0.11+10-1~deb13u2 | deb | CVE-2026-60147 | Medium | fixed |
|
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). | [] | pkg:deb/debian/openjdk-21-jre-headless@21.0.11%2B10-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openjdk-21 |
| openjdk-21-jre-headless | 21.0.11+10-1~deb13u2 | deb | CVE-2026-46968 | Medium | fixed |
|
Vulnerability in Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N). | [] | pkg:deb/debian/openjdk-21-jre-headless@21.0.11%2B10-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openjdk-21 |
| openjdk-21-jre-headless | 21.0.11+10-1~deb13u2 | deb | CVE-2026-47021 | Medium | fixed |
|
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). | [] | pkg:deb/debian/openjdk-21-jre-headless@21.0.11%2B10-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openjdk-21 |
| libexpat1 | 2.8.2-1~deb13u1 | deb | CVE-2026-76956 | Medium | wont-fix | N/A | In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content. | [] | pkg:deb/debian/libexpat1@2.8.2-1~deb13u1?arch=amd64&distro=debian-13.6&upstream=expat |
| openjdk-21-jre-headless | 21.0.11+10-1~deb13u2 | deb | CVE-2026-46917 | Medium | fixed |
|
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). | [] | pkg:deb/debian/openjdk-21-jre-headless@21.0.11%2B10-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openjdk-21 |
| openjdk-21-jre-headless | 21.0.11+10-1~deb13u2 | deb | CVE-2026-47027 | Medium | fixed |
|
Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). | [] | pkg:deb/debian/openjdk-21-jre-headless@21.0.11%2B10-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openjdk-21 |
| libavahi-client3 | 0.8-16 | deb | CVE-2026-24401 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524. | [] | pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common-data | 0.8-16 | deb | CVE-2026-24401 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524. | [] | pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common3 | 0.8-16 | deb | CVE-2026-24401 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524. | [] | pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| openjdk-21-jre-headless | 21.0.11+10-1~deb13u2 | deb | CVE-2026-70907 | Medium | fixed |
|
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). | [] | pkg:deb/debian/openjdk-21-jre-headless@21.0.11%2B10-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openjdk-21 |
| libnghttp2-14 | 1.64.0-1.1+deb13u1 | deb | CVE-2026-58055 | Medium | wont-fix | N/A | nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning. | [] | pkg:deb/debian/libnghttp2-14@1.64.0-1.1%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=nghttp2 |
| login.defs | 1:4.17.4-2 | deb | CVE-2024-56433 | Low | wont-fix | N/A | shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid. | [] | pkg:deb/debian/login.defs@1%3A4.17.4-2?arch=all&distro=debian-13.6&upstream=shadow |
| passwd | 1:4.17.4-2 | deb | CVE-2024-56433 | Low | wont-fix | N/A | shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid. | [] | pkg:deb/debian/passwd@1%3A4.17.4-2?arch=amd64&distro=debian-13.6&upstream=shadow |
| libmupdf25.1 | 1.25.1+ds1-6+deb13u1 | deb | CVE-2026-7233 | Medium | wont-fix | N/A | A vulnerability was determined in Artifex MuPDF up to 1.28.0. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet. | [] | pkg:deb/debian/libmupdf25.1@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=mupdf |
| python3-mupdf | 1.25.1+ds1-6+deb13u1 | deb | CVE-2026-7233 | Medium | wont-fix | N/A | A vulnerability was determined in Artifex MuPDF up to 1.28.0. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of the component CFF Index Handler. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet. | [] | pkg:deb/debian/python3-mupdf@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=mupdf |
| bsdutils | 1:2.41-5 | deb | CVE-2026-76642 | High | wont-fix | N/A | [] | pkg:deb/debian/bsdutils@1%3A2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 | |
| libblkid1 | 2.41-5 | deb | CVE-2026-76642 | High | wont-fix | N/A | [] | pkg:deb/debian/libblkid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| liblastlog2-2 | 2.41-5 | deb | CVE-2026-76642 | High | wont-fix | N/A | [] | pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libmount1 | 2.41-5 | deb | CVE-2026-76642 | High | wont-fix | N/A | [] | pkg:deb/debian/libmount1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libsmartcols1 | 2.41-5 | deb | CVE-2026-76642 | High | wont-fix | N/A | [] | pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libuuid1 | 2.41-5 | deb | CVE-2026-76642 | High | wont-fix | N/A | [] | pkg:deb/debian/libuuid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| login | 1:4.16.0-2+really2.41-5 | deb | CVE-2026-76642 | High | wont-fix | N/A | [] | pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 | |
| mount | 2.41-5 | deb | CVE-2026-76642 | High | wont-fix | N/A | [] | pkg:deb/debian/mount@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| util-linux | 2.41-5 | deb | CVE-2026-76642 | High | wont-fix | N/A | [] | pkg:deb/debian/util-linux@2.41-5?arch=amd64&distro=debian-13.6 | |
| libopenjp2-7 | 2.5.3-2.1~deb13u2 | deb | CVE-2023-39328 | Medium | wont-fix | N/A | A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file. | [] | pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openjpeg2 |
| libc-bin | 2.41-12+deb13u3 | deb | CVE-2026-6791 | Medium | wont-fix | N/A | When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash. | [] | pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc |
| libc6 | 2.41-12+deb13u3 | deb | CVE-2026-6791 | Medium | wont-fix | N/A | When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash. | [] | pkg:deb/debian/libc6@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc |
| zlib1g | 1:1.3.dfsg+really1.3.1-1+b1 | deb | CVE-2026-27171 | Medium | wont-fix | N/A | zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition. | [] | pkg:deb/debian/zlib1g@1%3A1.3.dfsg%2Breally1.3.1-1%2Bb1?arch=amd64&distro=debian-13.6&upstream=zlib%401%3A1.3.dfsg%2Breally1.3.1-1 |
| libacl1 | 2.3.2-2+b1 | deb | CVE-2026-54369 | High | wont-fix | N/A | acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation. | [] | pkg:deb/debian/libacl1@2.3.2-2%2Bb1?arch=amd64&distro=debian-13.6&upstream=acl%402.3.2-2 |
| libexpat1 | 2.8.2-1~deb13u1 | deb | CVE-2026-72522 | Medium | fixed |
|
libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions. | [] | pkg:deb/debian/libexpat1@2.8.2-1~deb13u1?arch=amd64&distro=debian-13.6&upstream=expat |
| libavahi-client3 | 0.8-16 | deb | CVE-2026-34933 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4. | [] | pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common-data | 0.8-16 | deb | CVE-2026-34933 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4. | [] | pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common3 | 0.8-16 | deb | CVE-2026-34933 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4. | [] | pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libexpat1 | 2.8.2-1~deb13u1 | deb | CVE-2025-66382 | Medium | wont-fix | N/A | In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time. | [] | pkg:deb/debian/libexpat1@2.8.2-1~deb13u1?arch=amd64&distro=debian-13.6&upstream=expat |
| libglib2.0-0t64 | 2.84.4-3~deb13u3 | deb | CVE-2026-15588 | Medium | wont-fix | N/A | A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang. | [] | pkg:deb/debian/libglib2.0-0t64@2.84.4-3~deb13u3?arch=amd64&distro=debian-13.6&upstream=glib2.0 |
| openjdk-21-jre-headless | 21.0.11+10-1~deb13u2 | deb | CVE-2026-47059 | Low | fixed |
|
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). | [] | pkg:deb/debian/openjdk-21-jre-headless@21.0.11%2B10-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openjdk-21 |
| libglib2.0-0t64 | 2.84.4-3~deb13u3 | deb | CVE-2026-16118 | High | wont-fix | N/A | A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption. | [] | pkg:deb/debian/libglib2.0-0t64@2.84.4-3~deb13u3?arch=amd64&distro=debian-13.6&upstream=glib2.0 |
| libpython3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-6879 | Low | wont-fix | N/A | `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-6879 | Low | wont-fix | N/A | `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u4 | deb | CVE-2026-6879 | Low | wont-fix | N/A | `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-6879 | Low | wont-fix | N/A | `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6 |
| python3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-6879 | Low | wont-fix | N/A | `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when the first match is near the end of the sibling list, such as with `[last()]` or `[last()-N]`; `.//item[1]` short-circuits after the first match. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libavahi-client3 | 0.8-16 | deb | CVE-2025-59529 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-daemon is started. But avahi-daemon does not provide any configuration for it. Additional access restrictions like SELinux can also prevent unwanted tools to access the socket and keep resolution working for trusted users. | [] | pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common-data | 0.8-16 | deb | CVE-2025-59529 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-daemon is started. But avahi-daemon does not provide any configuration for it. Additional access restrictions like SELinux can also prevent unwanted tools to access the socket and keep resolution working for trusted users. | [] | pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common3 | 0.8-16 | deb | CVE-2025-59529 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-daemon is started. But avahi-daemon does not provide any configuration for it. Additional access restrictions like SELinux can also prevent unwanted tools to access the socket and keep resolution working for trusted users. | [] | pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libxslt1.1 | 1.1.35-1.2+deb13u3 | deb | CVE-2025-10911 | Medium | wont-fix | N/A | A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash. | [] | pkg:deb/debian/libxslt1.1@1.1.35-1.2%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=libxslt |
| gzip | 1.13-1 | deb | CVE-2026-41991 | Medium | wont-fix | N/A | GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks. A local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite. This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269 | [] | pkg:deb/debian/gzip@1.13-1?arch=amd64&distro=debian-13.6 |
| openjdk-21-jre-headless | 21.0.11+10-1~deb13u2 | deb | CVE-2026-60589 | Low | fixed |
|
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). | [] | pkg:deb/debian/openjdk-21-jre-headless@21.0.11%2B10-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openjdk-21 |
| bsdutils | 1:2.41-5 | deb | CVE-2026-78409 | High | wont-fix | N/A | The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint. | [] | pkg:deb/debian/bsdutils@1%3A2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 |
| libblkid1 | 2.41-5 | deb | CVE-2026-78409 | High | wont-fix | N/A | The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint. | [] | pkg:deb/debian/libblkid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| liblastlog2-2 | 2.41-5 | deb | CVE-2026-78409 | High | wont-fix | N/A | The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint. | [] | pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libmount1 | 2.41-5 | deb | CVE-2026-78409 | High | wont-fix | N/A | The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint. | [] | pkg:deb/debian/libmount1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libsmartcols1 | 2.41-5 | deb | CVE-2026-78409 | High | wont-fix | N/A | The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint. | [] | pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libuuid1 | 2.41-5 | deb | CVE-2026-78409 | High | wont-fix | N/A | The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint. | [] | pkg:deb/debian/libuuid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| login | 1:4.16.0-2+really2.41-5 | deb | CVE-2026-78409 | High | wont-fix | N/A | The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint. | [] | pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 |
| mount | 2.41-5 | deb | CVE-2026-78409 | High | wont-fix | N/A | The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint. | [] | pkg:deb/debian/mount@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| util-linux | 2.41-5 | deb | CVE-2026-78409 | High | wont-fix | N/A | The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint. | [] | pkg:deb/debian/util-linux@2.41-5?arch=amd64&distro=debian-13.6 |
| bsdutils | 1:2.41-5 | deb | CVE-2026-13595 | Medium | fixed |
|
A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/bsdutils@1%3A2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 |
| libblkid1 | 2.41-5 | deb | CVE-2026-13595 | Medium | fixed |
|
A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/libblkid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| liblastlog2-2 | 2.41-5 | deb | CVE-2026-13595 | Medium | fixed |
|
A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libmount1 | 2.41-5 | deb | CVE-2026-13595 | Medium | fixed |
|
A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/libmount1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libsmartcols1 | 2.41-5 | deb | CVE-2026-13595 | Medium | fixed |
|
A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libuuid1 | 2.41-5 | deb | CVE-2026-13595 | Medium | fixed |
|
A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/libuuid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| login | 1:4.16.0-2+really2.41-5 | deb | CVE-2026-13595 | Medium | fixed |
|
A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 |
| mount | 2.41-5 | deb | CVE-2026-13595 | Medium | fixed |
|
A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/mount@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| util-linux | 2.41-5 | deb | CVE-2026-13595 | Medium | fixed |
|
A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. | [] | pkg:deb/debian/util-linux@2.41-5?arch=amd64&distro=debian-13.6 |
| bsdutils | 1:2.41-5 | deb | CVE-2026-78408 | High | wont-fix | N/A | The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes. | [] | pkg:deb/debian/bsdutils@1%3A2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 |
| libblkid1 | 2.41-5 | deb | CVE-2026-78408 | High | wont-fix | N/A | The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes. | [] | pkg:deb/debian/libblkid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| liblastlog2-2 | 2.41-5 | deb | CVE-2026-78408 | High | wont-fix | N/A | The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes. | [] | pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libmount1 | 2.41-5 | deb | CVE-2026-78408 | High | wont-fix | N/A | The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes. | [] | pkg:deb/debian/libmount1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libsmartcols1 | 2.41-5 | deb | CVE-2026-78408 | High | wont-fix | N/A | The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes. | [] | pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libuuid1 | 2.41-5 | deb | CVE-2026-78408 | High | wont-fix | N/A | The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes. | [] | pkg:deb/debian/libuuid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| login | 1:4.16.0-2+really2.41-5 | deb | CVE-2026-78408 | High | wont-fix | N/A | The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes. | [] | pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 |
| mount | 2.41-5 | deb | CVE-2026-78408 | High | wont-fix | N/A | The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes. | [] | pkg:deb/debian/mount@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| util-linux | 2.41-5 | deb | CVE-2026-78408 | High | wont-fix | N/A | The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes. | [] | pkg:deb/debian/util-linux@2.41-5?arch=amd64&distro=debian-13.6 |
| openjdk-21-jre-headless | 21.0.11+10-1~deb13u2 | deb | CVE-2026-47010 | Low | fixed |
|
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). | [] | pkg:deb/debian/openjdk-21-jre-headless@21.0.11%2B10-1~deb13u2?arch=amd64&distro=debian-13.6&upstream=openjdk-21 |
| libncursesw6 | 6.5+20250216-2 | deb | CVE-2025-6141 | Medium | wont-fix | N/A | A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component. | [] | pkg:deb/debian/libncursesw6@6.5%2B20250216-2?arch=amd64&distro=debian-13.6&upstream=ncurses |
| libtinfo6 | 6.5+20250216-2 | deb | CVE-2025-6141 | Medium | wont-fix | N/A | A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component. | [] | pkg:deb/debian/libtinfo6@6.5%2B20250216-2?arch=amd64&distro=debian-13.6&upstream=ncurses |
| ncurses-base | 6.5+20250216-2 | deb | CVE-2025-6141 | Medium | wont-fix | N/A | A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component. | [] | pkg:deb/debian/ncurses-base@6.5%2B20250216-2?arch=all&distro=debian-13.6&upstream=ncurses |
| ncurses-bin | 6.5+20250216-2 | deb | CVE-2025-6141 | Medium | wont-fix | N/A | A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component. | [] | pkg:deb/debian/ncurses-bin@6.5%2B20250216-2?arch=amd64&distro=debian-13.6&upstream=ncurses |
| libp11-kit0 | 0.25.5-3 | deb | CVE-2026-13757 | Medium | wont-fix | N/A | A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services. | [] | pkg:deb/debian/libp11-kit0@0.25.5-3?arch=amd64&distro=debian-13.6&upstream=p11-kit |
| libmupdf25.1 | 1.25.1+ds1-6+deb13u1 | deb | CVE-2026-40505 | Medium | wont-fix | N/A | MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicious ANSI escape codes in PDF metadata that are passed unsanitized to terminal output when running mutool info, enabling them to manipulate terminal display for social engineering attacks such as presenting fake prompts or spoofed commands. | [] | pkg:deb/debian/libmupdf25.1@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=mupdf |
| python3-mupdf | 1.25.1+ds1-6+deb13u1 | deb | CVE-2026-40505 | Medium | wont-fix | N/A | MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicious ANSI escape codes in PDF metadata that are passed unsanitized to terminal output when running mutool info, enabling them to manipulate terminal display for social engineering attacks such as presenting fake prompts or spoofed commands. | [] | pkg:deb/debian/python3-mupdf@1.25.1%2Bds1-6%2Bdeb13u1?arch=amd64&distro=debian-13.6&upstream=mupdf |
| libxslt1.1 | 1.1.35-1.2+deb13u3 | deb | CVE-2025-11731 | Low | wont-fix | N/A | A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT <func:result> elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes. While difficult to exploit, the flaw could lead to application instability or denial of service. | [] | pkg:deb/debian/libxslt1.1@1.1.35-1.2%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=libxslt |
| libattr1 | 1:2.5.2-3 | deb | CVE-2026-54371 | Medium | wont-fix | N/A | attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path. | [] | pkg:deb/debian/libattr1@1%3A2.5.2-3?arch=amd64&distro=debian-13.6&upstream=attr |
| libavahi-client3 | 0.8-16 | deb | CVE-2025-68276 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves. | [] | pkg:deb/debian/libavahi-client3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common-data | 0.8-16 | deb | CVE-2025-68276 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves. | [] | pkg:deb/debian/libavahi-common-data@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libavahi-common3 | 0.8-16 | deb | CVE-2025-68276 | Medium | wont-fix | N/A | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves. | [] | pkg:deb/debian/libavahi-common3@0.8-16?arch=amd64&distro=debian-13.6&upstream=avahi |
| libpython3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-15310 | Low | wont-fix | N/A | When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-15310 | Low | wont-fix | N/A | When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u4 | deb | CVE-2026-15310 | Low | wont-fix | N/A | When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-15310 | Low | wont-fix | N/A | When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6 |
| python3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-15310 | Low | wont-fix | N/A | When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libc-bin | 2.41-12+deb13u3 | deb | CVE-2026-18374 | Medium | wont-fix | N/A | Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation. | [] | pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc |
| libc6 | 2.41-12+deb13u3 | deb | CVE-2026-18374 | Medium | wont-fix | N/A | Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation. | [] | pkg:deb/debian/libc6@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc |
| bsdutils | 1:2.41-5 | deb | CVE-2026-78410 | High | wont-fix | N/A | A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode. | [] | pkg:deb/debian/bsdutils@1%3A2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 |
| libblkid1 | 2.41-5 | deb | CVE-2026-78410 | High | wont-fix | N/A | A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode. | [] | pkg:deb/debian/libblkid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| liblastlog2-2 | 2.41-5 | deb | CVE-2026-78410 | High | wont-fix | N/A | A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode. | [] | pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libmount1 | 2.41-5 | deb | CVE-2026-78410 | High | wont-fix | N/A | A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode. | [] | pkg:deb/debian/libmount1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libsmartcols1 | 2.41-5 | deb | CVE-2026-78410 | High | wont-fix | N/A | A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode. | [] | pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libuuid1 | 2.41-5 | deb | CVE-2026-78410 | High | wont-fix | N/A | A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode. | [] | pkg:deb/debian/libuuid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| login | 1:4.16.0-2+really2.41-5 | deb | CVE-2026-78410 | High | wont-fix | N/A | A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode. | [] | pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 |
| mount | 2.41-5 | deb | CVE-2026-78410 | High | wont-fix | N/A | A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode. | [] | pkg:deb/debian/mount@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| util-linux | 2.41-5 | deb | CVE-2026-78410 | High | wont-fix | N/A | A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode. | [] | pkg:deb/debian/util-linux@2.41-5?arch=amd64&distro=debian-13.6 |
| tar | 1.35+dfsg-3.1 | deb | CVE-2026-18508 | Medium | wont-fix | N/A | A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction. | [] | pkg:deb/debian/tar@1.35%2Bdfsg-3.1?arch=amd64&distro=debian-13.6 |
| libpython3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-0864 | Medium | wont-fix | N/A | When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value. | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-0864 | Medium | wont-fix | N/A | When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value. | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u4 | deb | CVE-2026-0864 | Medium | wont-fix | N/A | When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value. | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-0864 | Medium | wont-fix | N/A | When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value. | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6 |
| python3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-0864 | Medium | wont-fix | N/A | When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value. | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libacl1 | 2.3.2-2+b1 | deb | CVE-2026-54370 | High | wont-fix | N/A | acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation. | [] | pkg:deb/debian/libacl1@2.3.2-2%2Bb1?arch=amd64&distro=debian-13.6&upstream=acl%402.3.2-2 |
| libcairo2 | 1.18.4-1+b1 | deb | CVE-2025-50422 | Low | wont-fix | N/A | Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c. | [] | pkg:deb/debian/libcairo2@1.18.4-1%2Bb1?arch=amd64&distro=debian-13.6&upstream=cairo%401.18.4-1 |
| libsystemd0 | 257.13-1~deb13u1 | deb | CVE-2026-15059 | Medium | wont-fix | N/A | Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation. | [] | pkg:deb/debian/libsystemd0@257.13-1~deb13u1?arch=amd64&distro=debian-13.6&upstream=systemd |
| libudev1 | 257.13-1~deb13u1 | deb | CVE-2026-15059 | Medium | wont-fix | N/A | Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation. | [] | pkg:deb/debian/libudev1@257.13-1~deb13u1?arch=amd64&distro=debian-13.6&upstream=systemd |
| libbz2-1.0 | 1.0.8-6 | deb | CVE-2026-42250 | Medium | wont-fix | N/A | bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service). This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67 | [] | pkg:deb/debian/libbz2-1.0@1.0.8-6?arch=amd64&distro=debian-13.6&upstream=bzip2 |
| libp11-kit0 | 0.25.5-3 | deb | CVE-2026-18938 | Medium | wont-fix | N/A | A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to a memory corruption issue, specifically a heap out-of-bounds write, which can crash the p11-kit RPC parsing process, resulting in a Denial of Service (DoS). This vulnerability is only exploitable on 32 bit systems. | [] | pkg:deb/debian/libp11-kit0@0.25.5-3?arch=amd64&distro=debian-13.6&upstream=p11-kit |
| bsdutils | 1:2.41-5 | deb | CVE-2026-27456 | Medium | fixed |
|
util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/bsdutils@1%3A2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 |
| libblkid1 | 2.41-5 | deb | CVE-2026-27456 | Medium | fixed |
|
util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/libblkid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| liblastlog2-2 | 2.41-5 | deb | CVE-2026-27456 | Medium | fixed |
|
util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libmount1 | 2.41-5 | deb | CVE-2026-27456 | Medium | fixed |
|
util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/libmount1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libsmartcols1 | 2.41-5 | deb | CVE-2026-27456 | Medium | fixed |
|
util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| libuuid1 | 2.41-5 | deb | CVE-2026-27456 | Medium | fixed |
|
util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/libuuid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| login | 1:4.16.0-2+really2.41-5 | deb | CVE-2026-27456 | Medium | fixed |
|
util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 |
| mount | 2.41-5 | deb | CVE-2026-27456 | Medium | fixed |
|
util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/mount@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux |
| util-linux | 2.41-5 | deb | CVE-2026-27456 | Medium | fixed |
|
util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4. | [] | pkg:deb/debian/util-linux@2.41-5?arch=amd64&distro=debian-13.6 |
| libsystemd0 | 257.13-1~deb13u1 | deb | CVE-2026-40228 | Low | wont-fix | N/A | In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToWall=yes is set. | [] | pkg:deb/debian/libsystemd0@257.13-1~deb13u1?arch=amd64&distro=debian-13.6&upstream=systemd |
| libudev1 | 257.13-1~deb13u1 | deb | CVE-2026-40228 | Low | wont-fix | N/A | In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToWall=yes is set. | [] | pkg:deb/debian/libudev1@257.13-1~deb13u1?arch=amd64&distro=debian-13.6&upstream=systemd |
| libexpat1 | 2.8.2-1~deb13u1 | deb | CVE-2026-76957 | Medium | wont-fix | N/A | libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412. | [] | pkg:deb/debian/libexpat1@2.8.2-1~deb13u1?arch=amd64&distro=debian-13.6&upstream=expat |
| dirmngr | 2.4.7-21+deb13u1+b4 | deb | CVE-2026-57062 | Low | wont-fix | N/A | CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182. | [] | pkg:deb/debian/dirmngr@2.4.7-21%2Bdeb13u1%2Bb4?arch=amd64&distro=debian-13.6&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| gnupg | 2.4.7-21+deb13u1 | deb | CVE-2026-57062 | Low | wont-fix | N/A | CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182. | [] | pkg:deb/debian/gnupg@2.4.7-21%2Bdeb13u1?arch=all&distro=debian-13.6&upstream=gnupg2 |
| gnupg-l10n | 2.4.7-21+deb13u1 | deb | CVE-2026-57062 | Low | wont-fix | N/A | CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182. | [] | pkg:deb/debian/gnupg-l10n@2.4.7-21%2Bdeb13u1?arch=all&distro=debian-13.6&upstream=gnupg2 |
| gpg | 2.4.7-21+deb13u1+b4 | deb | CVE-2026-57062 | Low | wont-fix | N/A | CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182. | [] | pkg:deb/debian/gpg@2.4.7-21%2Bdeb13u1%2Bb4?arch=amd64&distro=debian-13.6&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| gpg-agent | 2.4.7-21+deb13u1+b4 | deb | CVE-2026-57062 | Low | wont-fix | N/A | CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182. | [] | pkg:deb/debian/gpg-agent@2.4.7-21%2Bdeb13u1%2Bb4?arch=amd64&distro=debian-13.6&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| gpgconf | 2.4.7-21+deb13u1+b4 | deb | CVE-2026-57062 | Low | wont-fix | N/A | CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182. | [] | pkg:deb/debian/gpgconf@2.4.7-21%2Bdeb13u1%2Bb4?arch=amd64&distro=debian-13.6&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| gpgsm | 2.4.7-21+deb13u1+b4 | deb | CVE-2026-57062 | Low | wont-fix | N/A | CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182. | [] | pkg:deb/debian/gpgsm@2.4.7-21%2Bdeb13u1%2Bb4?arch=amd64&distro=debian-13.6&upstream=gnupg2%402.4.7-21%2Bdeb13u1 |
| tar | 1.35+dfsg-3.1 | deb | CVE-2026-18477 | Medium | wont-fix | N/A | A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue. | [] | pkg:deb/debian/tar@1.35%2Bdfsg-3.1?arch=amd64&distro=debian-13.6 |
| libsystemd0 | 257.13-1~deb13u1 | deb | CVE-2026-16742 | Medium | wont-fix | N/A | systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user | [] | pkg:deb/debian/libsystemd0@257.13-1~deb13u1?arch=amd64&distro=debian-13.6&upstream=systemd |
| libudev1 | 257.13-1~deb13u1 | deb | CVE-2026-16742 | Medium | wont-fix | N/A | systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user | [] | pkg:deb/debian/libudev1@257.13-1~deb13u1?arch=amd64&distro=debian-13.6&upstream=systemd |
| libpython3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-18503 | Low | wont-fix | N/A | Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff(). | [] | pkg:deb/debian/libpython3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-18503 | Low | wont-fix | N/A | Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff(). | [] | pkg:deb/debian/libpython3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libpython3.13-stdlib | 3.13.5-2+deb13u4 | deb | CVE-2026-18503 | Low | wont-fix | N/A | Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff(). | [] | pkg:deb/debian/libpython3.13-stdlib@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| python3.13 | 3.13.5-2+deb13u4 | deb | CVE-2026-18503 | Low | wont-fix | N/A | Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff(). | [] | pkg:deb/debian/python3.13@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6 |
| python3.13-minimal | 3.13.5-2+deb13u4 | deb | CVE-2026-18503 | Low | wont-fix | N/A | Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff(). | [] | pkg:deb/debian/python3.13-minimal@3.13.5-2%2Bdeb13u4?arch=amd64&distro=debian-13.6&upstream=python3.13 |
| libc-bin | 2.41-12+deb13u3 | deb | CVE-2026-6368 | Low | wont-fix | N/A | Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process. | [] | pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc |
| libc6 | 2.41-12+deb13u3 | deb | CVE-2026-6368 | Low | wont-fix | N/A | Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process. | [] | pkg:deb/debian/libc6@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc |
| bsdutils | 1:2.41-5 | deb | CVE-2026-53612 | Unknown | fixed |
|
[] | pkg:deb/debian/bsdutils@1%3A2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 | |
| bsdutils | 1:2.41-5 | deb | CVE-2026-53613 | Unknown | fixed |
|
[] | pkg:deb/debian/bsdutils@1%3A2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 | |
| bsdutils | 1:2.41-5 | deb | CVE-2026-53614 | Unknown | fixed |
|
[] | pkg:deb/debian/bsdutils@1%3A2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 | |
| bsdutils | 1:2.41-5 | deb | CVE-2026-53615 | Unknown | fixed |
|
[] | pkg:deb/debian/bsdutils@1%3A2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 | |
| libblkid1 | 2.41-5 | deb | CVE-2026-53612 | Unknown | fixed |
|
[] | pkg:deb/debian/libblkid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libblkid1 | 2.41-5 | deb | CVE-2026-53613 | Unknown | fixed |
|
[] | pkg:deb/debian/libblkid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libblkid1 | 2.41-5 | deb | CVE-2026-53614 | Unknown | fixed |
|
[] | pkg:deb/debian/libblkid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libblkid1 | 2.41-5 | deb | CVE-2026-53615 | Unknown | fixed |
|
[] | pkg:deb/debian/libblkid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libc-bin | 2.41-12+deb13u3 | deb | CVE-2026-19499 | Unknown | wont-fix | N/A | [] | pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc | |
| libc-bin | 2.41-12+deb13u3 | deb | CVE-2026-19542 | Unknown | wont-fix | N/A | [] | pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc | |
| libc-bin | 2.41-12+deb13u3 | deb | CVE-2026-77117 | Unknown | wont-fix | N/A | [] | pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc | |
| libc-bin | 2.41-12+deb13u3 | deb | CVE-2026-80489 | Unknown | wont-fix | N/A | [] | pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc | |
| libc6 | 2.41-12+deb13u3 | deb | CVE-2026-19499 | Unknown | wont-fix | N/A | [] | pkg:deb/debian/libc6@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc | |
| libc6 | 2.41-12+deb13u3 | deb | CVE-2026-19542 | Unknown | wont-fix | N/A | [] | pkg:deb/debian/libc6@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc | |
| libc6 | 2.41-12+deb13u3 | deb | CVE-2026-77117 | Unknown | wont-fix | N/A | [] | pkg:deb/debian/libc6@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc | |
| libc6 | 2.41-12+deb13u3 | deb | CVE-2026-80489 | Unknown | wont-fix | N/A | [] | pkg:deb/debian/libc6@2.41-12%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=glibc | |
| liblastlog2-2 | 2.41-5 | deb | CVE-2026-53612 | Unknown | fixed |
|
[] | pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| liblastlog2-2 | 2.41-5 | deb | CVE-2026-53613 | Unknown | fixed |
|
[] | pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| liblastlog2-2 | 2.41-5 | deb | CVE-2026-53614 | Unknown | fixed |
|
[] | pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| liblastlog2-2 | 2.41-5 | deb | CVE-2026-53615 | Unknown | fixed |
|
[] | pkg:deb/debian/liblastlog2-2@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libmount1 | 2.41-5 | deb | CVE-2026-53612 | Unknown | fixed |
|
[] | pkg:deb/debian/libmount1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libmount1 | 2.41-5 | deb | CVE-2026-53613 | Unknown | fixed |
|
[] | pkg:deb/debian/libmount1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libmount1 | 2.41-5 | deb | CVE-2026-53614 | Unknown | fixed |
|
[] | pkg:deb/debian/libmount1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libmount1 | 2.41-5 | deb | CVE-2026-53615 | Unknown | fixed |
|
[] | pkg:deb/debian/libmount1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libsmartcols1 | 2.41-5 | deb | CVE-2026-53612 | Unknown | fixed |
|
[] | pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libsmartcols1 | 2.41-5 | deb | CVE-2026-53613 | Unknown | fixed |
|
[] | pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libsmartcols1 | 2.41-5 | deb | CVE-2026-53614 | Unknown | fixed |
|
[] | pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libsmartcols1 | 2.41-5 | deb | CVE-2026-53615 | Unknown | fixed |
|
[] | pkg:deb/debian/libsmartcols1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libtiff6 | 4.7.0-3+deb13u3 | deb | CVE-2026-36849 | Unknown | wont-fix | N/A | [] | pkg:deb/debian/libtiff6@4.7.0-3%2Bdeb13u3?arch=amd64&distro=debian-13.6&upstream=tiff | |
| libuuid1 | 2.41-5 | deb | CVE-2026-53612 | Unknown | fixed |
|
[] | pkg:deb/debian/libuuid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libuuid1 | 2.41-5 | deb | CVE-2026-53613 | Unknown | fixed |
|
[] | pkg:deb/debian/libuuid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libuuid1 | 2.41-5 | deb | CVE-2026-53614 | Unknown | fixed |
|
[] | pkg:deb/debian/libuuid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| libuuid1 | 2.41-5 | deb | CVE-2026-53615 | Unknown | fixed |
|
[] | pkg:deb/debian/libuuid1@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| login | 1:4.16.0-2+really2.41-5 | deb | CVE-2026-53612 | Unknown | fixed |
|
[] | pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 | |
| login | 1:4.16.0-2+really2.41-5 | deb | CVE-2026-53613 | Unknown | fixed |
|
[] | pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 | |
| login | 1:4.16.0-2+really2.41-5 | deb | CVE-2026-53614 | Unknown | fixed |
|
[] | pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 | |
| login | 1:4.16.0-2+really2.41-5 | deb | CVE-2026-53615 | Unknown | fixed |
|
[] | pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux%402.41-5 | |
| mount | 2.41-5 | deb | CVE-2026-53612 | Unknown | fixed |
|
[] | pkg:deb/debian/mount@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| mount | 2.41-5 | deb | CVE-2026-53613 | Unknown | fixed |
|
[] | pkg:deb/debian/mount@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| mount | 2.41-5 | deb | CVE-2026-53614 | Unknown | fixed |
|
[] | pkg:deb/debian/mount@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| mount | 2.41-5 | deb | CVE-2026-53615 | Unknown | fixed |
|
[] | pkg:deb/debian/mount@2.41-5?arch=amd64&distro=debian-13.6&upstream=util-linux | |
| util-linux | 2.41-5 | deb | CVE-2026-53612 | Unknown | fixed |
|
[] | pkg:deb/debian/util-linux@2.41-5?arch=amd64&distro=debian-13.6 | |
| util-linux | 2.41-5 | deb | CVE-2026-53613 | Unknown | fixed |
|
[] | pkg:deb/debian/util-linux@2.41-5?arch=amd64&distro=debian-13.6 | |
| util-linux | 2.41-5 | deb | CVE-2026-53614 | Unknown | fixed |
|
[] | pkg:deb/debian/util-linux@2.41-5?arch=amd64&distro=debian-13.6 | |
| util-linux | 2.41-5 | deb | CVE-2026-53615 | Unknown | fixed |
|
[] | pkg:deb/debian/util-linux@2.41-5?arch=amd64&distro=debian-13.6 |
You can always download 💾 the full Grype report in JSON format.