{ "bomFormat": "CycloneDX", "specVersion": "1.5", "serialNumber": "urn:uuid:712f0288-f66a-4880-86c4-f8a5ffcaf86f", "version": 1, "metadata": { "timestamp": "2026-10-21T12:53:29Z", "tools": [ { "vendor": "OWASP", "name": "Dependency-Track", "version": "4.14.3" } ], "component": { "type": "firmware", "bom-ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf", "name": "CRA_WaveOS4", "version": "WaveOS_4.36.2.1" } }, "vulnerabilities": [ { "bom-ref": "6c6aca3a-e08b-4487-a640-a2d8f1eb2ebf", "id": "CVE-2025-46394", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 3.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" } ], "cwes": [ 451 ], "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.", "published": "2025-04-23T16:15:48Z", "updated": "2026-06-17T09:26:20Z", "analysis": { "state": "not_affected", "justification": "requires_environment", "response": [ "update" ], "detail": "C" }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "cf569ca7-422c-4488-a82a-00e8ee02b26a", "id": "CVE-2025-60876", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], "cwes": [ 284 ], "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).", "published": "2025-11-10T20:15:48Z", "updated": "2026-06-17T09:50:10Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes BusyBox 1.37.0 and the BusyBox `wget` applet is available. CVE-2025-60876 affects BusyBox `wget` when it processes a malicious URL containing raw CR/LF or other control characters in the HTTP request-target, allowing HTTP request header injection. However, in the tested/default configuration, the product `PATH` is `/sbin:/bin:/usr/sbin:/usr/bin`, and the default `wget` command resolves to `/bin/wget`, which is a symlink to `uclient-fetch`. The product script `/etc/acksys/cloud/mqtt_update` invokes `wget` without an absolute path, so it uses `/bin/wget` in the default runtime environment, not `/usr/bin/wget` / BusyBox `wget`. No `wget` process was running during verification. Therefore, although BusyBox `wget` is present, the vulnerable BusyBox `wget` code path is not used by the product in the default/tested configuration and is not reachable by a remote attacker. Residual risk: the issue could become relevant only if a script explicitly invokes `/usr/bin/wget` or `busybox wget` with an attacker-controlled malicious URL." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "fcf93129-ea89-4259-8576-26ffca6b10d2", "id": "CVE-2026-4873", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "cwes": [ 319, 295 ], "description": "A vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted.", "published": "2026-05-13T13:01:55Z", "updated": "2026-09-15T07:16:28Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes curl/libcurl 8.19.0, which is within the affected version range for CVE-2026-4873. However, this vulnerability only applies to curl/libcurl transfers using IMAP, POP3, or SMTP URL schemes. In the tested product build, `curl -V` shows the supported protocols as `file ftp ftps http https mqtt mqtts`. The affected protocols `imap`, `pop3`, and `smtp` are not enabled in this curl/libcurl build. Product usage found in scripts is related to DDNS, cloud, and MQTT/HTTP-style transfers, not mail protocols. Therefore, although the curl/libcurl version is within the affected range, the vulnerable protocol code path is not available/reachable in the tested product build. Residual risk: the issue could become relevant only if curl/libcurl is rebuilt or replaced with a version that enables IMAP, POP3, or SMTP support and is then used for clear-text and TLS mail transfers to the same host." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "3be917ad-7735-4cb8-9ef3-0a52729c57af", "id": "CVE-2026-5545", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N" } ], "cwes": [ 305, 613 ], "description": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1...", "published": "2026-05-13T13:01:56Z", "updated": "2026-09-15T07:16:28Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes curl/libcurl 8.19.0, which is within the affected version range for CVE-2026-5545. However, this vulnerability requires HTTP Negotiate authentication support and a specific connection reuse scenario involving different credentials to the same host. In the tested product build, `curl -V` does not show Negotiate, SPNEGO, GSS-API, or Kerberos support. Therefore, the authentication mechanism required to trigger this vulnerability is not available in the installed curl/libcurl build. Product scripts using curl were identified, but no usage of HTTP Negotiate authentication was found in the reviewed configuration/scripts. Therefore, although the curl/libcurl version is within the affected range, the vulnerable code path is not reachable in the tested/default product configuration. Residual risk: the issue could become relevant only if curl/libcurl is rebuilt or replaced with HTTP Negotiate/SPNEGO/GSS-API support and then used to perform authenticated HTTP(S) requests with different credentials to the same host while reusing connections." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "076d8fa5-ecc4-47b2-8a1d-eabf9699aaa8", "id": "CVE-2026-5773", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "cwes": [ 488, 918 ], "description": "libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.", "published": "2026-05-13T13:01:56Z", "updated": "2026-09-15T07:16:28Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "response": [ "will_not_fix" ], "detail": "The installed curl/libcurl version is 8.19.0, which falls within the affected version range. However, this WaveOS build does not include SMB or SMBS protocol support in curl/libcurl. `curl -V` lists only file, ftp, ftps, http, https, mqtt and mqtts protocols. Therefore, the SMB(S)-specific vulnerable code path is not reachable." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "d8c2a041-6fec-4562-8889-f0b955e21b1f", "id": "CVE-2026-6253", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 522 ], "description": "curl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n a redirect to a URL using another scheme (say `https://`), accessed using a\n second, different, proxy", "published": "2026-05-13T13:01:56Z", "updated": "2026-09-15T07:16:29Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes curl/libcurl 8.19.0, which is within the affected version range for CVE-2026-6253. This vulnerability requires a specific proxy configuration where curl uses different proxies for different URL schemes, one proxy uses credentials, and a redirect causes a request to be sent through a second proxy. In the tested/default configuration, no proxy environment variable was detected. No curl usage with proxy credentials, proxy-specific options, or redirect-following options (`-L` / `--location`) was found in the reviewed product scripts. The identified product curl usage performs a file upload with `curl -T ... -X PUT` and does not configure proxy behavior. Therefore, although the curl/libcurl version is within the affected range, the required proxy/redirect/credential scenario is not present in the default/tested configuration. Residual risk: the issue could become relevant only if the product is configured to use different authenticated proxies per URL scheme and curl is used with redirect-following behavior." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "9140165d-cb3a-4a28-8ac2-b2d9792b2edc", "id": "CVE-2026-6276", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 346, 319 ], "description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.", "published": "2026-05-13T13:01:56Z", "updated": "2026-09-15T07:16:29Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "response": [ "will_not_fix" ], "detail": "libcurl 8.19.0 is present and within the affected range, but no product application linked to libcurl was identified. Only the curl CLI binary links to libcurl." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "a6538839-556a-46c1-a372-91505ce6a74f", "id": "CVE-2026-6429", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "cwes": [ 200 ], "description": "When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.", "published": "2026-05-13T13:01:56Z", "updated": "2026-09-15T07:16:29Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes curl/libcurl 8.19.0, which is within the affected version range for CVE-2026-6429. However, this vulnerability affects libcurl only under a specific scenario requiring `.netrc` credentials, HTTP redirects, clear-text HTTP URLs, an HTTP proxy, and connection reuse. The curl advisory also states that the curl command line tool is not affected. In the tested/default configuration, no `.netrc` or `_netrc` file was found. No product usage of `CURLOPT_NETRC` or `CURLOPT_FOLLOWLOCATION` was identified. The only detected libcurl-related symbols were found inside the `/usr/bin/curl` binary itself. Therefore, although the curl/libcurl version is within the affected range, the vulnerable `.netrc`/redirect/libcurl code path is not used or reachable in the default/tested product configuration. Residual risk: the issue could become relevant only if a product component starts using libcurl with `.netrc` credentials, HTTP redirects, clear-text HTTP URLs, and an HTTP proxy with connection reuse." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "ba506cb3-3471-4e00-9e56-edafb34b1b5c", "id": "CVE-2026-7009", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "cwes": [ 295 ], "description": "When curl is told to use the Certificate Status Request TLS extension, often\nreferred to as *OCSP stapling*, to verify that the server certificate is\nvalid, it fails to detect OCSP problems and instead wrongly consider the\nresponse as fine.", "published": "2026-05-13T13:01:57Z", "updated": "2026-06-17T11:01:37Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes curl/libcurl 8.19.0, which is within the affected version range for CVE-2026-7009. However, this vulnerability only occurs when curl is built with an OpenSSL-based backend and used with Apple SecTrust, the native certificate trust store on Apple operating systems. The tested product build is `mips64el-openwrt-linux-gnu` using OpenSSL 3.5.6 on OpenWRT/Linux. It does not run on an Apple platform and does not use Apple SecTrust. Therefore, although the curl/libcurl version is within the affected range, the vulnerable Apple SecTrust-related OCSP stapling code path is not present/reachable in this product. Residual risk: the issue could become relevant only if curl/libcurl is rebuilt or replaced for an Apple platform using Apple SecTrust together with OCSP stapling certificate status verification." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "9a994973-0340-48de-8582-58d4d6d2c590", "id": "CVE-2026-7168", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "cwes": [ 294 ], "description": "Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.", "published": "2026-05-13T13:01:57Z", "updated": "2026-09-15T07:16:29Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes curl/libcurl 8.19.0, which is within the affected version range for CVE-2026-7168. However, this vulnerability affects libcurl only in a specific scenario involving an HTTP proxy using Digest authentication, changing from one proxy host to another while reusing the same libcurl handle, which may leak the `Proxy-Authorization` header. In the tested/default configuration, no proxy environment variable was detected and no curl proxy configuration with Digest authentication was identified. The product usages found are command-line `curl` invocations in scripts, and the upstream curl advisory states that the curl command line tool is not affected. Therefore, although the curl/libcurl version is within the affected range, the vulnerable proxy Digest/libcurl handle reuse scenario is not present or reachable in the default/tested product configuration. Residual risk: the issue could become relevant only if a product component starts using libcurl directly with HTTP proxy Digest authentication, changes proxy hosts, and reuses the same libcurl handle across transfers." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "63c1a718-c5be-44d3-a68c-704a01f42dc3", "id": "CVE-2026-32316", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 122, 190 ], "description": "jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.", "published": "2026-04-13T18:16:29Z", "updated": "2026-06-17T10:35:33Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "Version actuelle : jq-1.5 Vulnérable : oui Version corrigeante : à déterminer (aucune version publiée, correctif au commit e47e56d) Commande : jq --version && opkg list-installed | grep jq" }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "272509f5-4b34-4c2b-b3cb-5047f6982f77", "id": "CVE-2026-33947", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 674 ], "description": "jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(), and delpaths_sorted() in jq's src/jv_aux.c use unbounded recursion whose depth is controlled by the length of a caller-supplied path array, with no depth limit enforced. An attacker can supply a JSON document containing a flat array of ~65,000 integers (~200 KB) that, when used as a path argument by a trusted jq filter, exhausts the C call stack and crashes the process with a segmentation fault (SIGSEGV). This bypass works because the existing MAX_PARSING_DEPTH (10,000) limit only protects the JSON parser, not runtime path operations where arrays can be programmatically constructed to arbitrary lengths. The impact is denial of service (unrecoverable crash) affecting any application or service that processes untrusted JSON input through jq's setpath, getpath, or delpaths builtins. This issue has been addressed in commit fb59f1491058d58bdc3e8dd28f1773d1ac690a1f.", "published": "2026-04-13T22:16:29Z", "updated": "2026-06-17T10:38:21Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes jq 1.5, which is within the affected version range for CVE-2026-33947. However, this vulnerability only affects jq path-handling functions such as `setpath`, `getpath`, and `delpaths`, where an attacker-controlled long path array can trigger unbounded recursion and crash the jq process. In the tested/default configuration, jq is used by product scripts to extract or validate JSON fields, but no usage of `setpath`, `getpath`, or `delpaths` was identified. No custom `.jq` filter files were found either. Therefore, although jq is present and the installed version is within the affected range, the vulnerable path-handling code is not used by the product in the default/tested configuration. Residual risk: the issue could become relevant only if product scripts are modified to use `setpath`, `getpath`, or `delpaths` on attacker-controlled JSON input." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "894bedb1-b2bd-4293-9e09-6fd187fa6aee", "id": "CVE-2026-40612", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.4, "severity": "medium", "method": "CVSSv4", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P" } ], "cwes": [ 674 ], "description": "jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since the JSON parser caps at depth 10000), the C stack is exhausted.", "published": "2026-05-11T18:16:33Z", "updated": "2026-06-17T10:45:32Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes jq 1.5, which is within the affected version range for CVE-2026-40612. However, this vulnerability affects jq's internal `jv_contains` function, which is used by the `contains()` and `inside()` builtins, and requires deeply nested attacker-controlled JSON data to trigger unbounded recursion and crash the jq process. In the tested/default configuration, jq is used by product scripts to extract or validate simple JSON fields, but no usage of `contains()` or `inside()` was identified. Therefore, although jq is present and the installed version is within the affected range, the vulnerable `jv_contains` code path is not used by the product in the default/tested configuration. Residual risk: the issue could become relevant only if product scripts are modified to use jq `contains()` or `inside()` on attacker-controlled deeply nested JSON input." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "b80d2456-9e4f-4ef8-ac78-200d31f22f21", "id": "CVE-2026-41256", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" } ], "cwes": [ 158 ], "description": "jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \\x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.", "published": "2026-05-11T18:16:33Z", "updated": "2026-06-17T10:46:23Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes jq 1.5, which is within the affected version range for CVE-2026-41256. However, this vulnerability only applies when jq loads a top-level jq program from a filter file using the `-f` option. In that case, an embedded NUL byte in the filter file may cause jq to compile and execute only the prefix before the NUL byte. In the tested/default configuration, jq is used by product scripts with inline filters to read or validate JSON fields. No usage of `jq -f` was identified, and no custom `.jq` filter files were found. Therefore, although jq is present and the installed version is within the affected range, the vulnerable `-f` filter-file compilation path is not used by the product in the default/tested configuration. Residual risk: the issue could become relevant only if product scripts are modified to load attacker-controllable jq filter files using `jq -f`." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "cb14535e-76f2-4fb3-9882-cb6a6aeda289", "id": "CVE-2026-41257", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 6.4, "severity": "medium", "method": "CVSSv4", "vector": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P" } ], "cwes": [ 190, 787 ], "description": "jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.", "published": "2026-05-11T18:16:34Z", "updated": "2026-06-17T10:46:23Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes jq 1.5, which is within the affected version range for CVE-2026-41257. However, this vulnerability requires a specially crafted jq program/filter that causes excessive jq VM stack growth through deeply nested generator forks, leading to integer overflow and potential process crash. In the tested/default configuration, jq is used by product scripts with fixed simple inline filters to extract or validate JSON fields. No recursive/generator-based jq filters, attacker-controllable jq programs, or custom `.jq` filter files were identified. Therefore, although jq is present and the installed version is within the affected range, the vulnerable jq VM stack growth scenario is not reachable in the default/tested product configuration. Residual risk: the issue could become relevant only if product scripts are modified to execute attacker-controlled or complex recursive/generator-based jq filters." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "2930b395-310f-4a94-9b83-abc103f09998", "id": "CVE-2026-43894", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 190 ], "description": "jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack buffer, and then writes ≈715 million 16-bit units (≈1.4 GiB) at an offset 1.43 GiB below the stack frame. The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).", "published": "2026-05-11T18:16:37Z", "updated": "2026-06-17T10:50:02Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes jq 1.5, which is within the affected version range for CVE-2026-43894. However, this vulnerability requires a specific jq execution path involving `decNumberFromString`, triggered by converting an extremely large numeric string using `tonumber`. The upstream advisory shows a proof of concept using `jq -n '\"1\" * 2147483646 | tonumber'` and states that the issue is not reachable through raw JSON number parsing. In the tested/default configuration, jq is used by product scripts with fixed inline filters to extract or validate JSON fields. Additional verification did not identify product usage of `tonumber`, `fromjson`, `--argjson`, attacker-controlled jq filters, or complex jq programs capable of constructing extremely large numeric strings. The only product-side `jq -n` usage found is a simple arithmetic calculation: `channel_freq=$(jq -n $channel_freq/1000)`. Therefore, although jq is present and the installed version is within the affected range, the vulnerable `tonumber` / extremely large numeric string code path is not reachable in the default/tested product configuration. Residual risk: the issue could become relevant only if product scripts are modified to execute `tonumber` on attacker-controlled extremely large numeric strings or to run attacker-controlled jq programs." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "a0f35670-7111-437a-a66b-c5099652b7f7", "id": "CVE-2026-43895", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 4.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "cwes": [ 20, 158 ], "description": "jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens.", "published": "2026-05-11T18:16:37Z", "updated": "2026-06-17T10:50:02Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes jq 1.5, which is within the affected version range for CVE-2026-43895. However, this vulnerability requires jq import/module or data-file lookup behavior, such as `import`, `include`, or `modulemeta`, where an embedded NUL byte in an import path can cause a mismatch between the logical jq import string and the on-disk file path opened by jq. In the tested/default configuration, jq is used by product scripts with fixed inline filters to extract or validate JSON fields. No product usage of `import`, `include`, `modulemeta`, `jq -L`, `jq -f`, attacker-controlled jq filters, or custom `.jq` module/filter files was identified. Therefore, although jq is present and the installed version is within the affected range, the vulnerable jq import/module path resolution code is not used or reachable in the default/tested product configuration. Residual risk: the issue could become relevant only if product scripts are modified to execute attacker-controlled jq programs using `import`, `include`, `modulemeta`, `jq -L`, or external jq module/filter files." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "2bb8535a-6a1c-41a7-8373-7b31acd674b0", "id": "CVE-2026-43896", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 674 ], "description": "jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.", "published": "2026-05-11T18:16:37Z", "updated": "2026-06-17T10:50:02Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes jq 1.5, which is within the affected version range for CVE-2026-43895. However, this vulnerability requires jq import/module or data-file lookup behavior, such as `import`, `include`, or `modulemeta`, where an embedded NUL byte in an import path can cause a mismatch between the logical jq import string and the on-disk file path opened by jq. In the tested/default configuration, jq is used by product scripts with fixed inline filters to extract or validate JSON fields. No product usage of `import`, `include`, `modulemeta`, `jq -L`, `jq -f`, attacker-controlled jq filters, or custom `.jq` module/filter files was identified. Therefore, although jq is present and the installed version is within the affected range, the vulnerable jq import/module path resolution code is not used or reachable in the default/tested product configuration. Residual risk: the issue could become relevant only if product scripts are modified to execute attacker-controlled jq programs using `import`, `include`, `modulemeta`, `jq -L`, or external jq module/filter files." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "b48a10cc-2fc1-4156-a8f7-badf535585fc", "id": "CVE-2026-39979", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 6.9, "severity": "medium", "method": "CVSSv4", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N" } ], "cwes": [ 125 ], "description": "jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.", "published": "2026-04-13T23:16:27Z", "updated": "2026-07-15T02:20:54Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes jq 1.5, which is within the affected version range for CVE-2026-43895. However, this vulnerability requires jq import/module or data-file lookup behavior, such as `import`, `include`, or `modulemeta`, where an embedded NUL byte in an import path can cause a mismatch between the logical jq import string and the on-disk file path opened by jq. In the tested/default configuration, jq is used by product scripts with fixed inline filters to extract or validate JSON fields. No product usage of `import`, `include`, `modulemeta`, `jq -L`, `jq -f`, attacker-controlled jq filters, or custom `.jq` module/filter files was identified. Therefore, although jq is present and the installed version is within the affected range, the vulnerable jq import/module path resolution code is not used or reachable in the default/tested product configuration. Residual risk: the issue could become relevant only if product scripts are modified to execute attacker-controlled jq programs using `import`, `include`, `modulemeta`, `jq -L`, or external jq module/filter files." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "421fd741-92ea-4803-b9e2-cabd3d5be260", "id": "CVE-2026-33948", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 2.9, "severity": "low", "method": "CVSSv4", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P" } ], "cwes": [ 20, 170 ], "description": "jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.", "published": "2026-04-14T00:16:06Z", "updated": "2026-06-17T10:38:21Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "Although the installed version of jq (1.5-2) is older than the fixed version (1.6), CVE-2026-33948 is not exploitable : Practical testing with a NUL byte shows that jq does not truncate the input and properly processes all data, contrary to the behavior described in the CVE. All uses of jq in system scripts (DDNS, LLDP, MQTT, GPS) exclusively process trusted internal data (system state, static configuration files, signed messages), never unfiltered user input. Even if an attacker could inject a NUL byte into a data source, the observed behavior of jq does not allow any validation bypass." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "d8e7404d-f63f-4976-894e-4fd91ea99cd6", "id": "CVE-2026-44777", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.4, "severity": "medium", "method": "CVSSv4", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P" } ], "cwes": [ 674 ], "description": "jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two\notherwise valid modules include each other.", "published": "2026-05-11T18:16:38Z", "updated": "2026-06-17T10:51:19Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes jq 1.5, which is within the affected version range for CVE-2026-43895. However, this vulnerability requires jq import/module or data-file lookup behavior, such as `import`, `include`, or `modulemeta`, where an embedded NUL byte in an import path can cause a mismatch between the logical jq import string and the on-disk file path opened by jq. In the tested/default configuration, jq is used by product scripts with fixed inline filters to extract or validate JSON fields. No product usage of `import`, `include`, `modulemeta`, `jq -L`, `jq -f`, attacker-controlled jq filters, or custom `.jq` module/filter files was identified. Therefore, although jq is present and the installed version is within the affected range, the vulnerable jq import/module path resolution code is not used or reachable in the default/tested product configuration. Residual risk: the issue could become relevant only if product scripts are modified to execute attacker-controlled jq programs using `import`, `include`, `modulemeta`, `jq -L`, or external jq module/filter files." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "9ec6aa9f-463c-4f17-8e9d-3ab5f5388217", "id": "CVE-2025-48060", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.7, "severity": "high", "method": "CVSSv4", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P" } ], "cwes": [ 121, 787 ], "description": "jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 `void* p = malloc(sz);`. As of time of publication, no patched versions are available.", "published": "2025-05-21T18:15:53Z", "updated": "2026-06-17T09:29:05Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes jq 1.5, which is within the affected version range reported for CVE-2025-48060. However, this vulnerability was reported in the `jq_fuzz_execute` oss-fuzz harness and involves compilation/execution of a specially crafted jq program, leading to a heap-buffer-overflow in `jv_string_vfmt`. In the tested/default configuration, jq is used by product scripts with fixed inline filters to extract or validate JSON fields. No product usage of attacker-controlled jq programs, custom `.jq` filter files, or externally supplied jq filters was identified. Therefore, although jq is present and the installed version is within the affected range, the vulnerable jq program compilation/execution scenario is not reachable in the default/tested product configuration. VEX justification: vulnerable code not in execute path. Residual risk: the issue could become relevant only if product scripts are modified to execute attacker-controlled jq programs or load externally supplied jq filter files." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "451f274e-8e1a-4121-9936-0ad8865e144f", "id": "CVE-2024-53427", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 8.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" } ], "cwes": [ 843 ], "description": "decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., \"1 NaN123\" immediately followed by many more digits).", "published": "2025-02-26T16:15:16Z", "updated": "2026-06-17T08:08:52Z", "analysis": { "state": "not_affected", "response": [ "will_not_fix" ], "detail": "Version actuelle : 1.5 Vulnérable : oui Version corrigeant : 1.7.2 Commande : jq --version && opkg list-installed | grep jq" }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "1eae59fa-2864-4fce-b01e-4f4692964792", "id": "CVE-2024-23337", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "cwes": [ 190 ], "description": "jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.", "published": "2025-05-21T15:16:03Z", "updated": "2026-06-17T07:12:37Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes jq 1.5, which is within the affected version range for CVE-2026-43895. However, this vulnerability requires jq import/module or data-file lookup behavior, such as `import`, `include`, or `modulemeta`, where an embedded NUL byte in an import path can cause a mismatch between the logical jq import string and the on-disk file path opened by jq. In the tested/default configuration, jq is used by product scripts with fixed inline filters to extract or validate JSON fields. No product usage of `import`, `include`, `modulemeta`, `jq -L`, `jq -f`, attacker-controlled jq filters, or custom `.jq` module/filter files was identified. Therefore, although jq is present and the installed version is within the affected range, the vulnerable jq import/module path resolution code is not used or reachable in the default/tested product configuration. Residual risk: the issue could become relevant only if product scripts are modified to execute attacker-controlled jq programs using `import`, `include`, `modulemeta`, `jq -L`, or external jq module/filter files." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "a695ced1-82b3-4002-9a02-0eff64b4d7ce", "id": "CVE-2025-9403", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 1.7, "severity": "low", "method": "CVSSv2", "vector": "AV:L/AC:L/Au:S/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 1.9, "severity": "low", "method": "CVSSv4", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P" } ], "cwes": [ 617 ], "description": "A vulnerability was determined in jqlang jq up to 1.6. Impacted is the function run_jq_tests of the file jq_test.c of the component JSON Parser. Executing manipulation can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Other versions might be affected as well.", "published": "2025-08-25T03:15:37Z", "updated": "2026-06-17T10:08:53Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "Although version 1.5-2 is older than the fixed version (currently non‑existent), CVE‑2025‑9403 is not exploitable on our product because it affects an internal test function (run_jq_tests) that is never called by system scripts, and its exploitation requires local access that an attacker would already have, with no impact on critical services – this is confirmed by the absence of any call to this function in scripts and the absence of any running jq process." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "50284c57-12c6-46e5-885c-7d572e153d84", "id": "CVE-2026-34180", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive\nelement whose content exceeds 2 gigabytes in length may cause a heap buffer\nover-read on 64-bit Unix and Unix-like platforms.\n\nImpact summary: The heap buffer over-read may crash the application (Denial of\nService) or to load into the decoded ASN.1 object contents of memory beyond the\nend of the input buffer. More typically such ASN.1 elements would instead be\ntruncated.\n\nAn integer truncation in OpenSSL's ASN.1 decoder causes the content length of\nan ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the\nworst case the truncated length is treated as a request to scan the binary\ncontent for a terminating zero byte, possibly causing OpenSSL to read either\nless than or beyond the end of the allocated buffer.\n\nApplications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or\nany other d2i_* decoding function are affected. OpenSSL's own command-line\ntools are not vulnerable, as data read through the BIO layer is checked before\nit reaches the affected code. The issue only affects 64-bit Unix and Unix-like\nplatforms; 32-bit platforms and 64-bit Windows are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.", "published": "2026-06-09T17:17:04Z", "updated": "2026-07-23T08:10:00Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "Not vulnerable because CVE-2026-34180 only affects 64-bit Unix and Unix-like platforms (the vulnerability requires an architecture supporting lengths > 2 GB); however, the Acksys product is based on a MIPS 32-bit architecture (uname -m returns mips), making the vulnerable code unreachable." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "8e245eb0-f975-4cf1-923b-93a19d49e553", "id": "CVE-2026-34181", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.4, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "cwes": [ 354 ], "description": "Issue Summary: The PKCS#12 file processing fails to perform sufficient input\nvalidation for files that use Password-Based Message Authentication Code 1\n(PBMAC1) integrity mechanism allowing a certificate and private key forgery.\n\nImpact Summary: An attacker impersonating a user can cause a service reading\nPKCS#12 files to accept forged certificates and private keys with a 1 in 256\nprobability.\n\nIf a service accepting PKCS#12 files is using passwords for authenticating\nthe received files, the attacker can create unencrypted PKCS#12 files that\nuse PBMAC1 authentication that specifies an HMAC key of only one byte, allowing\nthem to craft a file that will be accepted with a 1 in 256 probability.\nThat would then cause the service to accept a certificate and private key\ncontrolled by the attacker.\n\nThe FIPS modules are not affected by this issue, as the affected code is\noutside the OpenSSL FIPS module boundary.", "published": "2026-06-09T17:17:04Z", "updated": "2026-07-23T08:10:00Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "Although the installed OpenSSL version is within the affected range for CVE-2026-34181, the product does not expose any functionality allowing the import or processing of PKCS#12 (.p12/.pfx) containers. File upload mechanisms reject PKCS#12 files, and no product feature relies on processing untrusted PKCS#12 content. Therefore, the vulnerable code path cannot be reached during normal product operation, and the product is considered not affected in its intended use." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "8c98c6c1-129a-4a65-9709-99afafab3c7d", "id": "CVE-2026-34182", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 9.1, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "cwes": [ 354 ], "description": "Issue Summary: Cryptographic Message Services (CMS) processing fails to perform\nsufficient input validation on the cipher and tag length fields of\nAuthEnvelopedData containers, leading to various potential compromises.\n\nImpact Summary: Attackers making use of these vulnerabilities may achieve\nkey-equivalent functionality for a given CMS recipient and/or bypass integrity\nvalidation for a given message.\n\nIn one use case, an attacker may send a CMS message containing\nAuthEnvelopedData with the cipher specified as a non-AEAD cipher. OpenSSL\nerroneously allows this selection, and attempts to decrypt and validate the\nmessage.\n\nAn on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData\naddressed to the victim can re-emit it with the recipientInfos set left\nbyte-for-byte intact, so the victim's private key still unwraps the genuine CEK\n(the content-encryption key), but with the inner OID rewritten to AES-256-OFB\n(Output Feedback Mode, an unauthenticated keystream mode) and with an\nattacker-chosen IV and ciphertext. The victim initializes AES-256-OFB under the\nreal CEK, never consults the MAC field, and CMS_decrypt() returns success.\n\nIf the application under attack responds to the attacker with any indicator\nshowing success or failure of the decryption effort, it is possible for the\nattacker to use this as an oracle to obtain key equivalent functionality for the\nCEK used for the chosen recipient of the message.\n\nIn another use case, an attacker can reduce the tag length of the chosen AEAD\ncipher for a given AuthEnvelopedData container to be a single byte long,\nallowing an attacker to brute force CMS decryption, producing an integrity\nbypass for applications that trust CMS_decrypt() to reject modified content.\n\nThe FIPS modules are not affected by this issue.", "published": "2026-06-09T17:17:04Z", "updated": "2026-07-23T08:10:00Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "This CVE does not apply to our system, as the affected functionality relates to the “CMS” component, which is not included in our software package. Furthermore, our firmware does not support the processing of encrypted email content; S/MIME is implemented solely for TLS-related operations and is not used for email decryption or handling of secure email payloads." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "dc794a90-7efa-4f7a-9c33-af0875e73d74", "id": "CVE-2026-34183", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 1325 ], "description": "Issue summary: Remote peer may exhaust heap memory of the QUIC\nserver or client by flooding it with packets containing PATH_CHALLENGE\nframes.\n\nImpact summary: A malicious remote peer can cause an unbounded\nmemory allocation which can lead to an abnormal termination of the\napplication acting as a QUIC client or server and a Denial of Service.\n\nA remote peer may exhaust heap memory by flooding the local\nQUIC stack with PATH_CHALLENGE frames. The local QUIC stack\nallocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives.\nThe allocated PATH_RESPONSE frame gets freed only when the remote\npeer acknowledges reception of the PATH_RESPONSE frame which will\nnot be done by a malicious peer.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by\nthis issue. The QUIC stack is outside of OpenSSL FIPS module\nboundary.", "published": "2026-06-09T17:17:05Z", "updated": "2026-07-23T08:10:00Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "The product does not expose or utilize QUIC/HTTP3 functionality in its operational services (OpenVPN, IPsec, Wi-Fi authentication). No QUIC-based network service is enabled or reachable. Therefore, while the underlying library contains the affected code, the vulnerable execution path is not reachable in the product’s intended use, and the product is considered not affected in practice." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "0fc7eedc-a31f-47b7-a3bc-342cf9708ff0", "id": "CVE-2026-42764", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 476 ], "description": "Issue summary: Receiving a QUIC initial packet with an invalid token may\ntrigger a NULL pointer dereference in the OpenSSL QUIC server with\naddress validation disabled.\n\nImpact summary: NULL pointer dereference typically causes abnormal termination\nof the affected QUIC server process and a Denial of Service.\n\nIf the address validation is disabled in the OpenSSL QUIC server\nimplementation, an attacker can crash the server by sending an initial\npacket with an invalid or expired token.\n\nBy default, the client address validation is enabled in the OpenSSL QUIC server\nimplementation, which makes the default configuration not vulnerable\nto this issue. However if the SSL_LISTENER_FLAG_NO_VALIDATE is used with\nthe SSL_new_listener() call, the address validation is disabled making the\nvulnerable code reachable.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "published": "2026-06-09T17:17:07Z", "updated": "2026-07-23T08:10:00Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "Although OpenSSL 3.5.6 includes a compiled QUIC stack affected by CVE-2026-42764, the product does not expose or utilize QUIC-based network services. No QUIC listener or HTTP/3 endpoint is enabled, and the vulnerable execution path cannot be triggered in the operational configuration." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "99be48bb-f634-41f4-a6ee-99636a5458d3", "id": "CVE-2026-42766", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 476 ], "description": "Issue summary: A specially crafted password-encrypted CMS message\ncan trigger a NULL pointer dereference during CMS decryption.\n\nImpact summary: This NULL pointer dereference leads to an application crash\nand a Denial of Service.\n\nThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\nOPTIONAL in the ASN.1 specification and may therefore be absent in specially\ncrafted inputs. During the password-based CMS decryption the OpenSSL\nCMS implementation dereferences this field without first checking whether it\nwas present.\n\nAn attacker who supplies such a CMS message to an application performing\npassword-based CMS decryption can trigger an application crash, leading to\na Denial of Service.\n\nApplications that process password-encrypted CMS messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "published": "2026-06-09T17:17:07Z", "updated": "2026-07-23T08:10:00Z", "analysis": { "state": "not_affected", "justification": "protected_by_mitigating_control", "detail": "Although version 3.5.6 is theoretically vulnerable, exploitation is impossible on the product because no service uses the CMS_decrypt() function to decrypt password-protected CMS messages, and exposed services (HTTPS) are not affected." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "57d2891c-fe35-42b1-b6aa-72abcfdf359d", "id": "CVE-2026-42767", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 476 ], "description": "Issue summary: An attacker-controlled CMP (Certificate Management Protocol)\nserver could trigger a NULL pointer dereference in a CMP client application.\n\nImpact summary: A NULL pointer dereference causes a crash of the\napplication and a Denial of Service.\n\nAn attacker controlling a CMP server (or acting as a man-in-the-middle) could\ncraft a CMP response containing a CRMF (Certificate Request Message Format)\nCertRepMessage with an EncryptedValue structure where the symmAlg field\nhas an algorithm OID but no parameters field. When the OpenSSL CMP client\nprocesses this response, the NULL dereference occurs, causing a crash of\nthe CMP client.\n\nApplications that process untrusted CMP/CRMF messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "published": "2026-06-09T17:17:08Z", "updated": "2026-07-23T08:10:00Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "Although the installed OpenSSL version (3.5.6-1) is theoretically vulnerable as it falls within the affected range (3.5.0 to 3.5.6), exploitation of CVE-2026-42767 is impossible on the Acksys product for the following reasons : (1) no instance of the CMP (Certificate Management Protocol) client is active on the system – the OSSL_CMP_* functions are only present in the openssl command-line tool, which is never run as a service ; (2) the standard CMP port (829) is closed (netstat -tulpn | grep 829 returned no results), making any remote attack impossible ; (3) no process or system script uses the CMP protocol (ps w | grep -E \"cmp|cert|pki\" returned no active processes) ; (4) the only configuration file mentioning CMP (openssl.cnf) contains a commented and inactive example, not used by the application. As a result, the vulnerable code is unreachable." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "897872a2-2337-4a60-8c75-dc71d7025c2f", "id": "CVE-2026-42768", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "cwes": [ 514 ], "description": "Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to\nBleichenbacher-style attack when an attacker is able to provide the CMS or\nS/MIME messages and observe the error code and/or decryption output.\n\nImpact summary: The Bleichenbacher-style attack allows an attacker to use the\nvictim's vulnerable application as a way to decrypt or sign messages with the\nvictim's private RSA key.\n\nThe attack is possible in 2 variants.\n\n1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without\nproviding the recipient certificate. In this case OpenSSL iterates over every\nKeyTransRecipientInfo (KTRI) without stopping at the first success.\n\nAn attacker who authors a message with two KTRI entries — the first one\nwrapping a real CEK under the victim's public key, the second with an\narbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to\nget a valid PKCS#1 v1.5 padding if the error code of the application is\navailable.\n\nThat is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an\nadaptive-chosen-ciphertext side channel from which the attacker decrypts any\nRSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under\nit.\n\n2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with\nthe recipient certificate, and the recipient is not found, a random\nkey is substituted.\n\nAn attacker who authors a message and is able to compare both error code and\nthe result of the decryption, can mount a Bleichenbacher oracle.\n\nWe are not aware of any applications that provide a remote attacker\nan opportunity to mount an attack described in these scenarios. We consider\nthe existence of such application very unlikely, and for this reason this\nCVE has been evaluated as Low severity.\n\nTo avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the\ninvoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described\nin draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit\nrejection was explicitly disabled.\n\nThe implicit rejection mechanism always returns a plaintext value,\nthe symmetric key. This result is deterministic for the ciphertext and the\nprivate key. The length of the decryption result can happen to match the\nlength of the key of the symmetric cipher that was used for the content\nencryption. When a certificate is not provided, the last RecipientInfo\nproducing a key that looks valid will be used. It may cause getting garbage\ncontent on decryption. As a proper way to deal with this a recipient\ncertificate has to be provided to identify the particular RecipientInfo for\ndecryption.\n\nThe FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as\nCMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.", "published": "2026-06-09T17:17:08Z", "updated": "2026-07-23T08:10:00Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "FIPS modules from versions 4.0, 3.6, 3.5, and 3.4 are not affected, because CMS and S/MIME processing takes place outside the scope of the OpenSSL FIPS module." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "c6df5c8f-431a-4f69-b6e1-2c245b8e1ebf", "id": "CVE-2026-42769", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "cwes": [ 295 ], "description": "Issue Summary: An error in the callback used to verify the certificate\nprovided in a Root CA key update Certificate Management Protocol (CMP)\nmessage response rendered the certificate validation ineffectual, which\ncould lead to escalation of credentials from the Registration Authority (RA)\nlevel to the root Certification Authority (root CA) level.\n\nImpact Summary: The Registration Autority could replace the root CA\ncertificate for the CMP clients with an arbitrary root CA certificate.\n\nOne of the parts of the Certificate Management Protocol (CMP), specified in\nRFC 9810, is Root Certification Authority (root CA) key Rollover,\nwhich is sent by the server in a message with type 'id-it-rootCaKeyUpdate'.\nAs part of these messages, 'newWithOld' certificate, the new root CA\ncertificate signed with the old root CA key, is provided, and verifying its\nsignature is crucial for transferring the trust from the old CA key to the\nnew one.\n\nThe 'id-it-rootCaKeyUpdate' messages are expected to be processed with\nOSSL_CMP_get1_rootCaKeyUpdate(), that is expected to verify the 'newWithOld'\ncertificate. A typo in the certificate chain building code led to adding\nan incorrect certificate ('newWithOld' instead of 'oldRoot') to the\ncertificate chain, rendering the certificate verification process ineffectual\n(only the issuer name and the algorithm OIDs were verified by other parts\nof the verification code).\n\nAn attacker who already has credentials that satisfy the CMP message\nprotection checks can generate a new key pair and use a crafted self-signed\ncertificate in its 'id-it-rootCaKeyUpdate' CMP messages which affected CMP\nclients would accept as a new trust anchor.\n\nSignificant preconditions for the attack (having valid RA-level credentials)\nare the reason the issue was assigned Low severity.\n\nThe FIPS modules are not affected by this issue, as the affected code is\noutside the OpenSSL FIPS module boundary.", "published": "2026-06-09T17:17:08Z", "updated": "2026-07-23T08:10:00Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "Although version 3.5.6 is theoretically vulnerable as it falls within the affected range (3.5.0 to 3.5.6), exploitation of CVE-2026-42769 is impossible on the Acksys product because: (1) no CMP client instance is active on the system – the vulnerable function OSSL_CMP_get1_rootCaKeyUpdate is only present in the library and openssl tool, never run as a service; (2) the standard CMP port (829) is closed, making remote attacks impossible; (3) no process or system script uses the CMP protocol (ps w returned no active processes); (4) the only configuration file mentioning CMP (openssl.cnf) contains a commented and inactive example, not used by the application. As a result, the vulnerable code is unreachable," }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "bfd06684-06ca-4095-952d-831409458233", "id": "CVE-2026-42770", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "cwes": [ 325 ], "description": "Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42)\npeer key, the peer key is not properly checked for the subgroup membership.\n\nImpact summary: A malicious peer which presents an X9.42 key carrying the\nvictim's p and g parameters, a forged q = r (a small prime factor of the\ncofactor (p−1)/q_local), and a public value Y of order r can recover the\nvictim's private key after a small number of key exchange attempts.\n\nWhen EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the\nsubgroup membership check Y^q ≡ 1 (mod p) is performed using the peer's\nown q parameter, not the local key's q. The peer's domain parameters are\nthen matched against the domain parameters of the private key, but the value\nof q is not compared.\n\nA malicious peer who presents an X9.42 key carrying the victim's p, g,\na forged q = r (a small prime factor of the cofactor), and a public\nvalue Y of order r passes all checks. The shared secret then takes only\nr distinct values, leaking priv mod r. Repeating for each small-prime\nfactor of the cofactor and combining via CRT recovers the full private\nkey (Lim–Lee / small-subgroup-confinement attack).\n\nThe realistic attack surface is narrow: principally CMP deployments with\nlong-lived RA/CA DHX keys and bespoke enterprise or government applications\nusing X9.42 DHX static keys with interactive protocols and therefore this\nissue was assigned Low severity.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, 3.1.2 and 3.0 are affected by this\nissue.", "published": "2026-06-09T17:17:08Z", "updated": "2026-07-23T08:10:00Z", "analysis": { "state": "not_affected", "justification": "protected_by_mitigating_control", "detail": "Although version 3.5.6 is theoretically vulnerable, exploitation is impossible because no service on the product (hostapd, wpa_supplicant, strongSwan) is configured to use static DHX keys, and IPsec ports are not exposed on the network, making the attack unreachable." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "6af62055-418c-4187-915c-49a5d2416352", "id": "CVE-2026-45445", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "cwes": [ 325 ], "description": "Issue summary: When an application drives an AES-OCB context through the\npublic EVP_Cipher() one-shot interface, the application-supplied\ninitialisation vector (IV) is silently discarded.\n\nImpact summary: Every message encrypted under the same key uses the\nsame effective nonce regardless of the IV supplied by the caller,\nresulting in (key, nonce) reuse and loss of confidentiality. If the\nsame code path is used to compute the authentication tag, the tag\ndepends only on the (key, IV) pair and not on the plaintext or\nciphertext, allowing universal forgery of arbitrary ciphertext from a\nsingle captured message.\n\nOpenSSL provides two ways to drive a cipher: the documented streaming\ninterface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level\none-shot, EVP_Cipher(), whose documentation explicitly recommends\nagainst use by applications in favour of EVP_CipherUpdate() and\nEVP_CipherFinal_ex(). The OCB provider's streaming handler flushes\nthe application-supplied IV into the OCB context before processing\ndata; the one-shot handler did not. Every call to EVP_Cipher() on an\nAES-OCB context therefore ran with the all-zero key-derived offset\nstate left by cipher initialisation, regardless of the caller's IV.\n\nIf EVP_EncryptFinal_ex() is subsequently used to obtain the\nauthentication tag, the deferred IV setup runs at that point and\nclears the running checksum that should have been accumulated over the\nplaintext. The resulting tag is a function of (key, IV) only and\nverifies against any ciphertext produced under the same (key, IV)\npair.\n\nThe OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a\nTLS cipher suite, and libssl does not call EVP_Cipher() in any case.\nApplications that drive AES-OCB through the documented streaming AEAD\nAPI (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only\napplications that combine the AES-OCB cipher with the EVP_Cipher()\none-shot API are vulnerable.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by\nthis issue, as AES-OCB is outside the OpenSSL FIPS module boundary.", "published": "2026-06-09T17:17:18Z", "updated": "2026-07-23T08:10:00Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "Although the installed OpenSSL version falls within the affected range for CVE-2026-45445, the product does not provide any functionality to configure or use the AES-OCB cipher mode. No product feature relies on AES-OCB or invokes the vulnerable EVP_Cipher() usage pattern described in the advisory. Therefore, the vulnerable code path is not reachable during normal product operation, and the product is considered not affected in its intended use." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "364eb146-cd7b-441c-8bc6-5a18b088fa49", "id": "CVE-2026-45446", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 4.8, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], "cwes": [ 325 ], "description": "Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV\n(RFC 8452) mishandle the authentication of AAD (Additional Authenticated\nData) with an empty ciphertext allowing a forgery of such messages.\n\nImpact summary: An attacker can forge empty messages with arbitrary AAD\nto the victim's application using these ciphers.\n\nAES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) are nonce-misuse-resistant AEAD\nmodes: they accept a key, nonce, optional AAD (bytes that are authenticated\nbut not encrypted), and plaintext, and produces ciphertext plus a 16-byte\ntag. On decrypt, `EVP_DecryptFinal_ex()` is documented to return success only\nif the tag is verified succesfully.\n\nIn OpenSSL's provider implementation of these ciphers, the expected tag is\ncomputed only when decryption function is invoked with non-empty data.\nIf the caller supplies AAD and then calls `EVP_DecryptFinal_ex()` without\ninvocation of the ciphertext update, which can happen when the received\nciphertext length is zero, the tag is never recalculated and still holds its\nall-zeros value.\n\nWhen AES-GCM-SIV is used, an attacker who sends arbitrary AAD, empty\nciphertext, and all-zeros tag passes authentication under any key they do not\nknow, single-shot. When AES-SIV is used, for mounting the attack it's\nnecessary for the application to reuse the decryption context without\nresetting the key.\n\nAES-SIV is implemented since OpenSSL 3.0. AES-GCM-SIV is implemented since\nOpenSSL 3.2.\n\nNo protocols implemented in OpenSSL itself (TLS/CMS/PKCS7/HPKE/QUIC) support\neither AES-GCM-SIV or AES-SIV. To mount an attack, the applications must\nimplement their own protocol and use the EVP interface. Also they must skip the\nciphertext update when a message with an empty ciphertext arrives.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as these algorithms are not FIPS approved and the affected code is\noutside the OpenSSL FIPS module boundary.", "published": "2026-06-09T17:17:19Z", "updated": "2026-07-23T08:10:00Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "Although version 3.5.6 is theoretically vulnerable as it falls within the affected range (3.5.0 to 3.5.6), exploitation of CVE-2026-45446 is impossible on the Acksys product because: (1) although hostapd uses AES-SIV for DPP (Wi-Fi Easy Connect), it does not use the vulnerable OpenSSL EVP interface – no references to EVP_aes_*siv were found in the binaries; (2) exposed services on the product (HTTPS on port 443) do not use AES-SIV or AES-GCM-SIV modes; (3) no third-party application implements its own protocol using these modes via the EVP interface; (4) no vulnerable active processes are present on the system. As a result, the vulnerable code is unreachable" }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "2ffa0c56-e95e-4a61-8240-19899091662b", "id": "CVE-2026-45447", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 8.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 416, 825 ], "description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "published": "2026-06-09T17:17:19Z", "updated": "2026-09-18T13:18:26Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "Although the bundled OpenSSL library includes the PKCS7_verify() function, no product feature invokes this API. The product does not process or verify PKCS#7 or S/MIME messages from external sources. Therefore, the vulnerable code path described in CVE-2026-45447 is not reachable in the intended product usage, and the product is considered not affected." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "93d37a1c-8e9d-48a6-9c8d-cec4a4851a6a", "id": "CVE-2026-7383", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 8.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 787 ], "description": "Issue summary: A signed integer overflow when sizing the destination\nbuffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap\nbuffer overflow.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nattacker controlled code execution or other undefined behaviour.\n\nIn ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination\nsize for Unicode output is computed in a signed int: by left shift\nof the input character count for BMPSTRING (UTF-16) and\nUNIVERSALSTRING (UTF-32), and by summing per-character byte counts\nfor UTF8STRING. The calculation overflows when the input reaches\naround 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30\ncharacters) the size wraps to zero, OPENSSL_malloc(1) is called, and\nthe subsequent character copy writes several gigabytes past the\none-byte allocation.\n\nX.509 certificate processing routes through ASN1_STRING_set_by_NID(),\nwhose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID\nsize limits cap the input length; no network protocol or\ncertificate-handling path in OpenSSL exercises the overflow.\nTriggering the bug requires an application that calls\nASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers\na custom string type via ASN1_STRING_TABLE_add(), with\nattacker-controlled input on the order of half a gigabyte or more.\nFor these reasons this issue was assigned Low severity.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by\nthis issue, as the affected code is outside the OpenSSL FIPS module\nboundary.", "published": "2026-06-09T17:17:50Z", "updated": "2026-07-23T08:10:00Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "CVE-2026-7383 requires the processing of specially crafted multibyte ASN.1 strings through internal OpenSSL functions such as ASN1_mbstring_copy() or ASN1_mbstring_ncopy() under conditions of extreme input size. In the product’s current design, certificate handling is limited to standard import and verification workflows with constrained input sizes. Therefore, the vulnerable code path is not reachable in the intended use of the product, and it is considered not affected." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "1203cc28-a606-40db-bd14-af083878d75b", "id": "CVE-2026-9076", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kek_unwrap_key().\n\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\n\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads 7 bytes from a heap allocation that is based on the wrapped\nkey length from the message. There is a minimum length check based on the\nblock length of the wrapping cipher. However the cipher is selected from\nan OID carried in the attacker's PWRI keyEncryptionAlgorithm with no\nrequirement that the cipher be a block cipher. When an attacker selects\na stream-mode cipher the guard will be ineffective and the allocated buffer\ncontaining the unwrapped key can be too small to fit the check-bytes\nspecified in the RFC and a buffer over-read can happen.\n\nApplications calling CMS_decrypt() or CMS_decrypt_set1_password()\n(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS\ndata are vulnerable to this issue. No password knowledge is required: the\nover-read happens during the unwrap attempt before any authentication\nsucceeds.\n\nThe over-read is limited to a few bytes and is not written to output, so\nthere is no information disclosure. Triggering a crash requires the\nallocation to border unmapped memory, which is unlikely with the normal\nallocator.\n\nThe FIPS modules are not affected by this issue.", "published": "2026-06-09T17:17:50Z", "updated": "2026-07-23T08:10:00Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "The functional analysis of the product indicates that the affected CMS/S/MIME decryption functionality is not used. The product does not process CMS/S/MIME messages and does not invoke the vulnerable APIs (CMS_decrypt() and CMS_decrypt_set1_password()). Therefore, the prerequisites for exploiting CVE-2026-9076 are not present in the current product implementation." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "54b5acf3-9733-4392-bf1c-83ffbcaa60fe", "id": "CVE-2019-15166", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 120 ], "description": "lmp_print_data_link_subobjs() in print-lmp.c in tcpdump before 4.9.3 lacks certain bounds checks.", "published": "2019-10-03T17:15:11Z", "updated": "2026-06-17T02:19:50Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "Evidence: - tcpdump 4.9.2 installed - tcpdump not started by default - no WaveOS service invokes tcpdump - exploitation requires manual execution of tcpdump on attacker-controlled traffic" }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "56dba0dc-d67f-48ff-abd0-611e184681ee", "id": "CVE-2019-15167", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 9.1, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" } ], "cwes": [ 125 ], "description": "The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print() for VRRP version 3, a different vulnerability than CVE-2018-14463.", "published": "2022-08-27T06:15:07Z", "updated": "2026-06-17T02:19:50Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes tcpdump version 4.9.2, which is affected by CVE-2019-15167. However, tcpdump is not configured as a service, is not started automatically, and is only available as a maintenance and diagnostic utility. Exploitation requires manual execution of tcpdump on crafted VRRP traffic or malicious packet capture files. Therefore, the vulnerable code is not reachable during normal product operation." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "2c7ded3e-43c4-4e8a-bbf0-5e8e5e045edb", "id": "CVE-2018-10103", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 20 ], "description": "tcpdump before 4.9.3 mishandles the printing of SMB data (issue 1 of 2).", "published": "2019-10-03T16:15:11Z", "updated": "2026-06-17T01:33:30Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes tcpdump version 4.9.2, which is affected by CVE-2018-10103. However, tcpdump is not configured as a service, is not started automatically, and is only available as a diagnostic tool. Exploitation requires manual execution of tcpdump on crafted SMB traffic or malicious capture files. Therefore, the vulnerable code is not reachable during normal product operation." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "4a43cd90-2dd1-4c80-94ed-9b1e1b17ad45", "id": "CVE-2018-10105", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 20 ], "description": "tcpdump before 4.9.3 mishandles the printing of SMB data (issue 2 of 2).", "published": "2019-10-03T16:15:11Z", "updated": "2026-06-17T01:33:30Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes tcpdump version 4.9.2, which is affected by CVE-2018-10105. However, tcpdump is not configured as a service, is not started automatically, and is only available as a maintenance and diagnostic tool. Exploitation requires manual execution of tcpdump on crafted SMB traffic or malicious capture files. Therefore, the vulnerable code is not reachable during normal product operation." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "915f2fbc-a6f6-467b-8170-70d6d6c39478", "id": "CVE-2018-14461", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "The LDP parser in tcpdump before 4.9.3 has a buffer over-read in print-ldp.c:ldp_tlv_print().", "published": "2019-10-03T16:15:11Z", "updated": "2026-06-17T01:41:02Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes tcpdump 4.9.2, which is below the fixed version 4.9.3. However, tcpdump is a diagnostic command-line tool and is not running as a daemon or automatically started in the default/tested configuration. CVE-2018-14461 affects the LDP packet parser in tcpdump and requires tcpdump to actively capture or parse a crafted LDP packet. Since tcpdump is not active by default and no remote service exposes this parser, the vulnerable code path is not reachable by a remote attacker in the default product configuration. Residual risk: the issue could be triggered only if a privileged/local user manually runs tcpdump against malicious network traffic or a crafted capture file." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "63ff4422-b606-42cf-91f5-132c1b792451", "id": "CVE-2018-14462", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print().", "published": "2019-10-03T16:15:11Z", "updated": "2026-06-17T01:41:02Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes tcpdump 4.9.2, which is below the fixed version 4.9.3. However, tcpdump is a diagnostic command-line tool and is not running as a daemon or automatically started in the default/tested configuration. CVE-2018-14461 affects the LDP packet parser in tcpdump and requires tcpdump to actively capture or parse a crafted LDP packet. Since tcpdump is not active by default and no remote service exposes this parser, the vulnerable code path is not reachable by a remote attacker in the default product configuration Residual risk: the issue could be triggered only if a privileged/local user manually runs tcpdump against malicious network traffic or a crafted capture file." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "73050606-fbff-4f99-8e3a-7e238192b715", "id": "CVE-2018-14463", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print() for VRRP version 2, a different vulnerability than CVE-2019-15167.", "published": "2019-10-03T16:15:11Z", "updated": "2026-06-17T01:41:02Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes tcpdump 4.9.2, which is below the fixed version 4.9.3. However, tcpdump is a diagnostic command-line tool and is not running as a daemon or automatically started in the default/tested configuration. CVE-2018-14461 affects the LDP packet parser in tcpdump and requires tcpdump to actively capture or parse a crafted LDP packet. Since tcpdump is not active by default and no remote service exposes this parser, the vulnerable code path is not reachable by a remote attacker in the default product configuration. Residual risk: the issue could be triggered only if a privileged/local user manually runs tcpdump against malicious network traffic or a crafted capture file." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "744ccf90-b80b-4894-9feb-661c6e105cce", "id": "CVE-2018-14464", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "The LMP parser in tcpdump before 4.9.3 has a buffer over-read in print-lmp.c:lmp_print_data_link_subobjs().", "published": "2019-10-03T16:15:11Z", "updated": "2026-06-17T01:41:03Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes tcpdump 4.9.2, which is below the fixed version 4.9.3. However, tcpdump is a diagnostic command-line tool and is not running as a daemon or automatically started in the default/tested configuration. CVE-2018-14461 affects the LDP packet parser in tcpdump and requires tcpdump to actively capture or parse a crafted LDP packet. Since tcpdump is not active by default and no remote service exposes this parser, the vulnerable code path is not reachable by a remote attacker in the default product configuration. Residual risk: the issue could be triggered only if a privileged/local user manually runs tcpdump against malicious network traffic or a crafted capture file." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "ae699214-4b9b-40eb-8ee8-c3a38f3cb3a8", "id": "CVE-2018-14465", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "The RSVP parser in tcpdump before 4.9.3 has a buffer over-read in print-rsvp.c:rsvp_obj_print().", "published": "2019-10-03T16:15:11Z", "updated": "2026-06-17T01:41:03Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes tcpdump 4.9.2, which is below the fixed version 4.9.3. However, tcpdump is a diagnostic command-line tool and is not running as a daemon or automatically started in the default/tested configuration. CVE-2018-14461 affects the LDP packet parser in tcpdump and requires tcpdump to actively capture or parse a crafted LDP packet. Since tcpdump is not active by default and no remote service exposes this parser, the vulnerable code path is not reachable by a remote attacker in the default product configuration. Residual risk: the issue could be triggered only if a privileged/local user manually runs tcpdump against malicious network traffic or a crafted capture file." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "0bbbecf7-1ad5-4b1e-8fb2-6f8eba7128f4", "id": "CVE-2018-14466", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "The Rx parser in tcpdump before 4.9.3 has a buffer over-read in print-rx.c:rx_cache_find() and rx_cache_insert().", "published": "2019-10-03T16:15:11Z", "updated": "2026-06-17T01:41:03Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes tcpdump 4.9.2, which is below the fixed version 4.9.3. However, tcpdump is a diagnostic command-line tool and is not running as a daemon or automatically started in the default/tested configuration. CVE-2018-14461 affects the LDP packet parser in tcpdump and requires tcpdump to actively capture or parse a crafted LDP packet. Since tcpdump is not active by default and no remote service exposes this parser, the vulnerable code path is not reachable by a remote attacker in the default product configuration. Residual risk: exploitation would require an administrator or local privileged user to manually run tcpdump on malicious traffic or a crafted capture file. The issue is not remotely exploitable in the default configuration because tcpdump is not running as a service." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "a329c09f-bed0-47cf-9f1e-5de6632758ac", "id": "CVE-2018-14467", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_MP).", "published": "2019-10-03T16:15:11Z", "updated": "2026-06-17T01:41:03Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes tcpdump 4.9.2, which is below the fixed version 4.9.3. However, tcpdump is a diagnostic command-line tool and is not running as a daemon or automatically started in the default/tested configuration. CVE-2018-14461 affects the LDP packet parser in tcpdump and requires tcpdump to actively capture or parse a crafted LDP packet. Since tcpdump is not active by default and no remote service exposes this parser, the vulnerable code path is not reachable by a remote attacker in the default product configuration. Residual risk: exploitation would require an administrator or local privileged user to manually run tcpdump on malicious traffic or a crafted capture file. The issue is not remotely exploitable in the default configuration because tcpdump is not running as a service." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "b04f42ca-b76f-4633-9805-4a506332cf4b", "id": "CVE-2018-14468", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "The FRF.16 parser in tcpdump before 4.9.3 has a buffer over-read in print-fr.c:mfr_print().", "published": "2019-10-03T16:15:11Z", "updated": "2026-06-17T01:41:04Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes tcpdump 4.9.2, which is below the fixed version 4.9.3. However, tcpdump is a diagnostic command-line tool and is not running as a daemon or automatically started in the default/tested configuration. CVE-2018-14461 affects the LDP packet parser in tcpdump and requires tcpdump to actively capture or parse a crafted LDP packet. Since tcpdump is not active by default and no remote service exposes this parser, the vulnerable code path is not reachable by a remote attacker in the default product configuration. Residual risk: exploitation would require an administrator or local privileged user to manually run tcpdump on malicious traffic or a crafted capture file. The issue is not remotely exploitable in the default configuration because tcpdump is not running as a service." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "ffe2bc0e-25ef-4385-b607-ef18becc37ee", "id": "CVE-2018-14469", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "The IKEv1 parser in tcpdump before 4.9.3 has a buffer over-read in print-isakmp.c:ikev1_n_print().", "published": "2019-10-03T16:15:11Z", "updated": "2026-06-17T01:41:04Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes tcpdump 4.9.2, which is below the fixed version 4.9.3. However, tcpdump is a diagnostic command-line tool and is not running as a daemon or automatically started in the default/tested configuration. CVE-2018-14461 affects the LDP packet parser in tcpdump and requires tcpdump to actively capture or parse a crafted LDP packet. Since tcpdump is not active by default and no remote service exposes this parser, the vulnerable code path is not reachable by a remote attacker in the default product configuration. Residual risk: exploitation would require an administrator or local privileged user to manually run tcpdump on malicious traffic or a crafted capture file. The issue is not remotely exploitable in the default configuration because tcpdump is not running as a service." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "92cd953b-cbd9-4114-a97d-7f9ae3226d75", "id": "CVE-2018-14470", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "The Babel parser in tcpdump before 4.9.3 has a buffer over-read in print-babel.c:babel_print_v2().", "published": "2019-10-03T16:15:12Z", "updated": "2026-06-17T01:41:04Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes tcpdump 4.9.2, which is below the fixed version 4.9.3. However, tcpdump is a diagnostic command-line tool and is not running as a daemon or automatically started in the default/tested configuration. CVE-2018-14461 affects the LDP packet parser in tcpdump and requires tcpdump to actively capture or parse a crafted LDP packet. Since tcpdump is not active by default and no remote service exposes this parser, the vulnerable code path is not reachable by a remote attacker in the default product configuration. Residual risk: exploitation would require an administrator or local privileged user to manually run tcpdump on malicious traffic or a crafted capture file. The issue is not remotely exploitable in the default configuration because tcpdump is not running as a service." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "d5eb1733-e6be-46ec-886e-4b8e267af5e6", "id": "CVE-2018-14879", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.1, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.0, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "cwes": [ 120 ], "description": "The command-line argument parser in tcpdump before 4.9.3 has a buffer overflow in tcpdump.c:get_next_file().", "published": "2019-10-03T16:15:12Z", "updated": "2026-06-17T01:41:48Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes tcpdump 4.9.2, which is below the fixed version 4.9.3. However, tcpdump is a diagnostic command-line tool and is not running as a daemon or automatically started in the default/tested configuration. CVE-2018-14461 affects the LDP packet parser in tcpdump and requires tcpdump to actively capture or parse a crafted LDP packet. Since tcpdump is not active by default and no remote service exposes this parser, the vulnerable code path is not reachable by a remote attacker in the default product configuration. Residual risk: exploitation would require an administrator or local privileged user to manually run tcpdump on malicious traffic or a crafted capture file. The issue is not remotely exploitable in the default configuration because tcpdump is not running as a service." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "f3ebb7a3-48af-405d-8c50-1c89fd587d1f", "id": "CVE-2018-14880", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "The OSPFv3 parser in tcpdump before 4.9.3 has a buffer over-read in print-ospf6.c:ospf6_print_lshdr().", "published": "2019-10-03T16:15:12Z", "updated": "2026-06-17T01:41:48Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes tcpdump 4.9.2, which is below the fixed version 4.9.3. However, tcpdump is a diagnostic command-line tool and is not running as a daemon or automatically started in the default/tested configuration. CVE-2018-14461 affects the LDP packet parser in tcpdump and requires tcpdump to actively capture or parse a crafted LDP packet. Since tcpdump is not active by default and no remote service exposes this parser, the vulnerable code path is not reachable by a remote attacker in the default product configuration. Residual risk: exploitation would require an administrator or local privileged user to manually run tcpdump on malicious traffic or a crafted capture file. The issue is not remotely exploitable in the default configuration because tcpdump is not running as a service." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "730088a4-7910-41f2-a077-258909e30da6", "id": "CVE-2018-14881", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_RESTART).", "published": "2019-10-03T16:15:12Z", "updated": "2026-06-17T01:41:49Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "bb4969e0-58d2-4309-8fe1-8f80c6bdafd9", "id": "CVE-2018-14882", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "The ICMPv6 parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp6.c.", "published": "2019-10-03T16:15:12Z", "updated": "2026-06-17T01:41:49Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "adeda1b5-7322-4960-b841-7da380987cbf", "id": "CVE-2018-16227", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "The IEEE 802.11 parser in tcpdump before 4.9.3 has a buffer over-read in print-802_11.c for the Mesh Flags subfield.", "published": "2019-10-03T16:15:12Z", "updated": "2026-06-17T01:43:55Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "ef1e8aea-bd2e-430a-bf73-4250b24232fb", "id": "CVE-2018-16228", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "The HNCP parser in tcpdump before 4.9.3 has a buffer over-read in print-hncp.c:print_prefix().", "published": "2019-10-03T16:15:12Z", "updated": "2026-06-17T01:43:55Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes tcpdump 4.9.2, which is below the fixed version 4.9.3. However, tcpdump is a diagnostic command-line tool and is not running as a daemon or automatically started in the default/tested configuration. CVE-2018-14461 affects the LDP packet parser in tcpdump and requires tcpdump to actively capture or parse a crafted LDP packet. Since tcpdump is not active by default and no remote service exposes this parser, the vulnerable code path is not reachable by a remote attacker in the default product configuration. Residual risk: exploitation would require an administrator or local privileged user to manually run tcpdump on malicious traffic or a crafted capture file. The issue is not remotely exploitable in the default configuration because tcpdump is not running as a service." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "f234df39-2154-4da7-a59a-66b7468ae314", "id": "CVE-2018-16229", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "The DCCP parser in tcpdump before 4.9.3 has a buffer over-read in print-dccp.c:dccp_print_option().", "published": "2019-10-03T16:15:12Z", "updated": "2026-06-17T01:43:55Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes tcpdump 4.9.2, which is below the fixed version 4.9.3. However, tcpdump is a diagnostic command-line tool and is not running as a daemon or automatically started in the default/tested configuration. CVE-2018-14461 affects the LDP packet parser in tcpdump and requires tcpdump to actively capture or parse a crafted LDP packet. Since tcpdump is not active by default and no remote service exposes this parser, the vulnerable code path is not reachable by a remote attacker in the default product configuration. Residual risk: exploitation would require an administrator or local privileged user to manually run tcpdump on malicious traffic or a crafted capture file. The issue is not remotely exploitable in the default configuration because tcpdump is not running as a service." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "08fdf043-da6f-4adc-abc2-853e5da4d548", "id": "CVE-2018-16230", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_attr_print() (MP_REACH_NLRI).", "published": "2019-10-03T16:15:12Z", "updated": "2026-06-17T01:43:55Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes tcpdump 4.9.2, which is below the fixed version 4.9.3. However, tcpdump is a diagnostic command-line tool and is not running as a daemon or automatically started in the default/tested configuration. CVE-2018-14461 affects the LDP packet parser in tcpdump and requires tcpdump to actively capture or parse a crafted LDP packet. Since tcpdump is not active by default and no remote service exposes this parser, the vulnerable code path is not reachable by a remote attacker in the default product configuration. Residual risk: exploitation would require an administrator or local privileged user to manually run tcpdump on malicious traffic or a crafted capture file. The issue is not remotely exploitable in the default configuration because tcpdump is not running as a service." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "f012b2d4-7c0b-4170-bb14-315d44cd9263", "id": "CVE-2018-16300", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 674 ], "description": "The BGP parser in tcpdump before 4.9.3 allows stack consumption in print-bgp.c:bgp_attr_print() because of unlimited recursion.", "published": "2019-10-03T16:15:12Z", "updated": "2026-06-17T01:44:03Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes tcpdump 4.9.2, which is below the fixed version 4.9.3. However, tcpdump is a diagnostic command-line tool and is not running as a daemon or automatically started in the default/tested configuration. CVE-2018-14461 affects the LDP packet parser in tcpdump and requires tcpdump to actively capture or parse a crafted LDP packet. Since tcpdump is not active by default and no remote service exposes this parser, the vulnerable code path is not reachable by a remote attacker in the default product configuration. Residual risk: exploitation would require an administrator or local privileged user to manually run tcpdump on malicious traffic or a crafted capture file. The issue is not remotely exploitable in the default configuration because tcpdump is not running as a service." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "163245f8-40d3-47e5-b22f-39e74e56ca85", "id": "CVE-2018-16451", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "The SMB parser in tcpdump before 4.9.3 has buffer over-reads in print-smb.c:print_trans() for \\MAILSLOT\\BROWSE and \\PIPE\\LANMAN.", "published": "2019-10-03T16:15:12Z", "updated": "2026-06-17T01:44:18Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes tcpdump 4.9.2, which is below the fixed version 4.9.3. However, tcpdump is a diagnostic command-line tool and is not running as a daemon or automatically started in the default/tested configuration. CVE-2018-14461 affects the LDP packet parser in tcpdump and requires tcpdump to actively capture or parse a crafted LDP packet. Since tcpdump is not active by default and no remote service exposes this parser, the vulnerable code path is not reachable by a remote attacker in the default product configuration. Residual risk: exploitation would require an administrator or local privileged user to manually run tcpdump on malicious traffic or a crafted capture file. The issue is not remotely exploitable in the default configuration because tcpdump is not running as a service." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "4d35bbfa-e38c-4a3b-966f-91bb13d62ed1", "id": "CVE-2018-16452", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 674 ], "description": "The SMB parser in tcpdump before 4.9.3 has stack exhaustion in smbutil.c:smb_fdata() via recursion.", "published": "2019-10-03T16:15:12Z", "updated": "2026-06-17T01:44:18Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes tcpdump 4.9.2, which is below the fixed version 4.9.3. However, tcpdump is a diagnostic command-line tool and is not running as a daemon or automatically started in the default/tested configuration. CVE-2018-14461 affects the LDP packet parser in tcpdump and requires tcpdump to actively capture or parse a crafted LDP packet. Since tcpdump is not active by default and no remote service exposes this parser, the vulnerable code path is not reachable by a remote attacker in the default product configuration. Residual risk: exploitation would require an administrator or local privileged user to manually run tcpdump on malicious traffic or a crafted capture file. The issue is not remotely exploitable in the default configuration because tcpdump is not running as a service." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "81e1ecc3-2c49-491d-a1e1-52daf181aa33", "id": "CVE-2018-16301", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 4.4, "severity": "medium", "method": "CVSSv2", "vector": "AV:L/AC:M/Au:N/C:P/I:P/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "cwes": [ 190, 787, 120 ], "description": "The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:read_infile(). To trigger this vulnerability the attacker needs to create a 4GB file on the local filesystem and to specify the file name as the value of the -F command-line argument of tcpdump.", "published": "2019-10-03T16:15:12Z", "updated": "2026-06-17T01:44:03Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes tcpdump 4.9.2, which is below the fixed version 4.9.3. However, tcpdump is a diagnostic command-line tool and is not running as a daemon or automatically started in the default/tested configuration. CVE-2018-14461 affects the LDP packet parser in tcpdump and requires tcpdump to actively capture or parse a crafted LDP packet. Since tcpdump is not active by default and no remote service exposes this parser, the vulnerable code path is not reachable by a remote attacker in the default product configuration. Residual risk: exploitation would require an administrator or local privileged user to manually run tcpdump on malicious traffic or a crafted capture file. The issue is not remotely exploitable in the default configuration because tcpdump is not running as a service." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "be19e501-4b90-44f9-92a1-977e994ce0e7", "id": "CVE-2025-31176", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 6.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 476 ], "description": "A flaw was found in gnuplot. The plot3d_points() function may lead to a segmentation fault and cause a system crash.", "published": "2025-03-27T15:16:03Z", "updated": "2026-06-26T00:16:47Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes gnuplot 5.0 patchlevel 3, which is within the affected version range for CVE-2025-31176. However, this vulnerability affects the gnuplot `plot3d_points()` function, which is associated with 3D plotting behavior. In the tested/default configuration, gnuplot is installed but is not running as a background service. Product usage was identified in `/etc/acksys/wifiplot.sh`, where gnuplot is invoked to generate Wi-Fi plots. The reviewed script usage relies on 2D `plot` commands and no usage of `splot`, `plot3d`, or other 3D plotting paths was identified. Therefore, although the vulnerable component is present, the vulnerable 3D plotting code path is not used or reachable in the default/tested product configuration. Residual risk: the issue could become relevant only if product scripts are modified to execute gnuplot 3D plotting commands, such as `splot`, on local or attacker-controlled plotting input." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "6312d6b7-a2a6-43b7-927c-dc23a88c756c", "id": "CVE-2025-31178", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 6.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 476 ], "description": "A flaw was found in gnuplot. The GetAnnotateString() function may lead to a segmentation fault and cause a system crash.", "published": "2025-03-27T15:16:03Z", "updated": "2026-06-26T00:16:47Z", "analysis": { "state": "resolved", "detail": "gnuplot 5.0.3-1 -> 6.0.5-1 + mitigation wifiplot.sh (filtrage titre + timeout). Ticket #5358.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "98bd83f8-36f6-4f3f-89f3-b05b57f9ddc3", "id": "CVE-2025-31179", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 6.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 476 ], "description": "A flaw was found in gnuplot. The xstrftime() function may lead to a segmentation fault, causing a system crash.", "published": "2025-03-27T15:16:03Z", "updated": "2026-06-26T00:16:47Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes gnuplot 5.0 patchlevel 3, which is within the affected version range for CVE-2025-31179. However, this vulnerability affects the gnuplot `xstrftime()` function, which is related to date/time formatting paths. In the tested/default configuration, gnuplot is installed and product usage was identified in `/etc/acksys/wifiplot.sh`. The reviewed gnuplot usage generates Wi-Fi plots but no usage of date/time plotting or formatting features such as `set xdata time`, `set ydata time`, `set timefmt`, `set format`, `strftime`, or `timecolumn` was identified. The additional grep results only showed date/time format strings inside binary/system components such as `/lib/libc.so`, not in product-generated gnuplot scripts. Therefore, although the vulnerable gnuplot component is present, the vulnerable `xstrftime()` date/time formatting code path is not used or reachable in the default/tested product configuration. Residual risk: the issue could become relevant only if product scripts are modified to use gnuplot date/time formatting features or to process attacker-controlled time-formatting input." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "3c456f82-38b8-49e0-83d0-90b452a51230", "id": "CVE-2025-31180", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 6.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 476 ], "description": "A flaw was found in gnuplot. The CANVAS_text() function may lead to a segmentation fault and cause a system crash.", "published": "2025-03-27T15:16:03Z", "updated": "2026-06-26T00:16:47Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes gnuplot 5.0 patchlevel 3, which is within the affected version range for CVE-2025-31180. However, this vulnerability affects the gnuplot `CANVAS_text()` function, which is related to the Canvas terminal/output rendering path. In the tested/default configuration, gnuplot is installed and product usage was identified in `/etc/acksys/wifiplot.sh`. The product-generated gnuplot scripts use the PNG terminal for Wi-Fi plot generation, not the Canvas terminal. No usage of `set terminal canvas`, `set term canvas`, or Canvas output rendering was identified. Therefore, although the vulnerable gnuplot component is present, the vulnerable Canvas rendering code path is not used or reachable in the default/tested product configuration. Residual risk: the issue could become relevant only if product scripts are modified to use the gnuplot Canvas terminal/output, especially with attacker-controlled text or labels." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "424c1c8b-2891-461d-95f6-58289e961496", "id": "CVE-2025-31181", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 6.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 476 ], "description": "A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and cause a system crash.", "published": "2025-03-27T15:16:03Z", "updated": "2026-06-26T04:17:39Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "3c48d445-9a68-4041-99db-661160dbdd7e", "id": "CVE-2021-38115", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 4.3, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.", "published": "2021-08-04T21:15:08Z", "updated": "2026-06-17T04:01:30Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes LibGD 2.2.5, which is within the affected version range for CVE-2021-38115. LibGD is present on the system and is linked by gnuplot. However, this vulnerability affects the TGA image parsing code in LibGD, specifically `read_header_tga` / `gd_tga.c`, and requires processing a crafted TGA image file. In the tested/default configuration, no product usage of TGA image processing was identified. No usage of `gdImageCreateFromTga`, `imagecreatefromtga`, `.tga` files, or image upload/processing paths handling TGA files was found. The identified gnuplot usage is for generating Wi-Fi plots, and the product uses LibGD for image output, not for parsing attacker-controlled TGA input. Therefore, although the vulnerable LibGD component is present, the vulnerable TGA parsing code path is not used or reachable in the default/tested product configuration. VEX justification: vulnerable code not in execute path. Residual risk: the issue could become relevant only if product functionality is added or modified to accept and process attacker-controlled TGA image files through LibGD." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "fdbd5f1c-c22a-4134-a841-ae3872ef2d2b", "id": "CVE-2021-40145", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 415 ], "description": "gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is \"The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.", "published": "2021-08-26T01:15:11Z", "updated": "2026-06-17T04:06:35Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "Justification: Vulnerable code not in execution path libgd 2.2.5 is installed and falls within the affected version range. Runtime linkage analysis shows that only /usr/bin/gnuplot links against libgd. No product service or exposed interface has been identified that processes attacker-controlled GD2 image files. The vulnerable GD2 image format is obsolete and intended for development/testing purposes according to the vendor. Therefore, the vulnerable code path is not reachable in the intended product usage." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "e3c4f866-8423-4113-8401-3aba84229083", "id": "CVE-2021-40812", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 4.3, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "The GD Graphics Library (aka LibGD) through 2.3.2 has an out-of-bounds read because of the lack of certain gdGetBuf and gdPutBuf return value checks.", "published": "2021-09-08T21:15:14Z", "updated": "2026-06-17T04:07:28Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes LibGD 2.2.5, which is within the affected version range for CVE-2021-40812. LibGD is present on the system and is linked by gnuplot. However, this vulnerability is related to missing `gdGetBuf` / `gdPutBuf` return value checks in specific LibGD image processing paths. The relevant upstream discussion and fix reference corrupted image processing and affected output paths such as BMP, WebP, and GIF. In the tested/default configuration, the identified LibGD usage is through gnuplot for generating Wi-Fi plots using PNG output. No product usage of TGA image parsing, BMP/WebP/GIF generation through LibGD, or attacker-controlled image upload/processing paths was identified. Therefore, although the vulnerable LibGD component is present, the vulnerable LibGD image parsing/output code paths are not used or reachable in the default/tested product configuration. VEX justification: vulnerable code not in execute path. Residual risk: the issue could become relevant only if product functionality is added or modified to process attacker-controlled images through LibGD, especially TGA input or BMP/WebP/GIF output paths." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "3d7b6e83-472f-43eb-adfb-83ee0268b8e1", "id": "CVE-2021-43519", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 4.3, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "cwes": [ 674 ], "description": "Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script file.", "published": "2021-11-09T13:15:08Z", "updated": "2026-06-17T04:11:03Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes Lua 5.1.5, which is within the affected version range for CVE-2021-43519. However, this vulnerability requires execution of a specially crafted Lua script that triggers a stack overflow in `lua_resume`, typically through coroutine/resume behavior. In the tested/default configuration, Lua is present and used as part of the product/LuCI environment, but no product path allowing execution of attacker-controlled Lua scripts was identified. Additional verification did not identify usage of `dofile`, `loadfile`, `loadstring`, `coroutine`, `resume`, or `lua_resume` in the reviewed product paths. Therefore, although the vulnerable Lua component is present, the vulnerable crafted-script execution scenario is not reachable in the default/tested product configuration. VEX justification: vulnerable code not in execute path. Residual risk: the issue could become relevant only if product functionality is added or modified to execute attacker-controlled Lua scripts or dynamically load Lua code from user-controlled files." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "e91d0d3c-2e2f-43d7-bc5c-6bb8d1cc07dd", "id": "CVE-2026-22801", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 125, 190 ], "description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings on 16-bit systems. This vulnerability is fixed in 1.6.54.", "published": "2026-01-12T23:15:52Z", "updated": "2026-06-17T10:20:27Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "libpng 1.6.34 is installed and falls within the affected version range. Runtime dependency analysis identified only /usr/bin/gnuplot as linked against libpng. The vulnerability affects the simplified PNG write API (png_write_image_8bit and png_write_image_16bit) and requires an application to provide an invalid row stride parameter. No product service or exposed functionality has been identified that invokes the affected PNG write API with attacker-controlled parameters. Therefore, the vulnerable code path is not reachable in the intended product usage." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "62e1e0be-ef65-49ef-93cb-c8b4cf60810b", "id": "CVE-2026-25646", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 8.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 8.3, "severity": "high", "method": "CVSSv4", "vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N" } ], "cwes": [ 122, 126, 125 ], "description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55.", "published": "2026-02-10T18:16:37Z", "updated": "2026-08-11T13:17:59Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "libpng 1.6.34 is installed and falls within the affected version range. Runtime dependency analysis identified only /usr/bin/gnuplot as linked against libpng. The vulnerability affects the png_set_quantize() API and requires a specific image processing path involving palette quantization. No product service or exposed functionality has been identified that processes attacker-controlled PNG images through the affected API. Therefore, the vulnerable code path is not reachable in the intended product usage." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "ab030829-b63c-4a93-befc-2ccb83e0eb6f", "id": "CVE-2026-33416", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "cwes": [ 416 ], "description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.2.1 through 1.6.55, `png_set_tRNS` and `png_set_PLTE` each alias a heap-allocated buffer between `png_struct` and `png_info`, sharing a single allocation across two structs with independent lifetimes. The `trans_alpha` aliasing has been present since at least libpng 1.0, and the `palette` aliasing since at least 1.2.1. Both affect all prior release lines `png_set_tRNS` sets `png_ptr->trans_alpha = info_ptr->trans_alpha` (256-byte buffer) and `png_set_PLTE` sets `info_ptr->palette = png_ptr->palette` (768-byte buffer). In both cases, calling `png_free_data` (with `PNG_FREE_TRNS` or `PNG_FREE_PLTE`) frees the buffer through `info_ptr` while the corresponding `png_ptr` pointer remains dangling. Subsequent row-transform functions dereference and, in some code paths, write to the freed memory. A second call to `png_set_tRNS` or `png_set_PLTE` has the same effect, because both functions call `png_free_data` internally before reallocating the `info_ptr` buffer. Version 1.6.56 fixes the issue.", "published": "2026-03-26T17:16:38Z", "updated": "2026-06-17T10:37:27Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "response": [ "will_not_fix" ], "detail": "libpng 1.6.34 is present and falls within the affected version range. Runtime dependency analysis identified only /usr/bin/gnuplot as linked against libpng. The vulnerability affects specific palette and transparency handling APIs (png_set_PLTE and png_set_tRNS) requiring a particular application-level sequence leading to a use-after-free condition. No product service or exposed functionality has been identified that invokes the affected APIs with attacker-controlled PNG data. Therefore, the vulnerable code path is not reachable in the intended product usage." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "b088217d-a53c-428e-8d1e-36d83d4fa81f", "id": "CVE-2026-34757", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 4.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "cwes": [ 416 ], "description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.0.9 to before 1.6.57, passing a pointer obtained from png_get_PLTE, png_get_tRNS, or png_get_hIST back into the corresponding setter on the same png_struct/png_info pair causes the setter to read from freed memory and copy its contents into the replacement buffer. The setter frees the internal buffer before copying from the caller-supplied pointer, which now dangles. The freed region may contain stale data (producing silently corrupted chunk metadata) or data from subsequent heap allocations (leaking unrelated heap contents into the chunk struct). This vulnerability is fixed in 1.6.57.", "published": "2026-04-09T15:16:11Z", "updated": "2026-06-17T10:39:34Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes libpng, which is within the affected version range for CVE-2026-34757. libpng is present and is used indirectly through gnuplot/LibGD for PNG image generation. However, this vulnerability requires a specific application-level misuse pattern: a pointer returned by `png_get_PLTE`, `png_get_tRNS`, or `png_get_hIST` must be passed back into the corresponding `png_set_*` function on the same `png_struct` / `png_info` pair. The issue cannot be triggered by a crafted PNG file alone. In the tested/default configuration, the identified product usage is PNG output generation through gnuplot/LibGD. No product code path was identified that directly calls `png_get_PLTE`, `png_get_tRNS`, or `png_get_hIST` and then passes the returned pointer back to the corresponding setter. Therefore, although the vulnerable libpng component is present, the vulnerable API misuse pattern is not used or reachable in the default/tested product configuration. VEX justification: vulnerable code not in execute path. Residual risk: the issue could become relevant only if product functionality is added or modified to directly manipulate PNG chunk metadata using libpng getter/setter APIs, especially `PLTE`, `tRNS`, or `hIST`." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "30f5b3a2-f534-4804-b659-a1e9aeddc28c", "id": "CVE-2025-64505", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" } ], "cwes": [ 125 ], "description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access. This issue has been patched in version 1.6.51.", "published": "2025-11-25T00:15:47Z", "updated": "2026-06-17T09:54:28Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes libpng, which is within the affected version range for CVE-2025-64505. libpng is present and is used indirectly through gnuplot/LibGD for PNG image generation. However, this vulnerability affects libpng's `png_do_quantize` function when processing crafted PNG files with malformed palette indices. Exploitation requires the application to read/process an attacker-controlled PNG file that triggers the vulnerable quantization code path. In the tested/default configuration, the identified product usage is PNG output generation through gnuplot/LibGD for Wi-Fi plots. No product functionality was identified that accepts, imports, uploads, or processes attacker-controlled PNG image files through libpng. Therefore, although the vulnerable libpng component is present, the vulnerable PNG input processing/quantization code path is not used or reachable in the default/tested product configuration. VEX justification: vulnerable code not in execute path. Residual risk: the issue could become relevant only if product functionality is added or modified to process attacker-controlled PNG files through libpng, especially with palette quantization enabled." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "bd5d8586-631b-4b6e-8c83-f68390374dc5", "id": "CVE-2025-64506", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" } ], "cwes": [ 125 ], "description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51.", "published": "2025-11-25T00:15:47Z", "updated": "2026-06-17T09:54:28Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes libpng, which is within the affected version range for CVE-2025-64506. libpng is present and is used indirectly through gnuplot/LibGD for PNG image generation. However, this vulnerability affects libpng's `png_write_image_8bit` function only when processing 8-bit images through the simplified write API with `convert_to_8bit` enabled. Exploitation requires an application to write a specially formatted 8-bit image using this specific invalid configuration. In the tested/default configuration, the identified product usage is PNG output generation through gnuplot/LibGD for Wi-Fi plots. No product code path was identified that directly uses the libpng simplified write API with `convert_to_8bit` enabled, and no functionality was identified that allows an attacker to provide raw image buffers for PNG writing through this vulnerable path. Therefore, although the vulnerable libpng component is present, the vulnerable simplified PNG write API scenario is not used or reachable in the default/tested product configuration. VEX justification: vulnerable code not in execute path. Residual risk: the issue could become relevant only if product functionality is added or modified to directly write attacker-controlled 8-bit images through libpng's simplified write API with `convert_to_8bit` enabled." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "3129fc5b-ce03-4f36-bc97-36aa29e94817", "id": "CVE-2025-64720", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" } ], "cwes": [ 125 ], "description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component ≤ alpha × 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.", "published": "2025-11-25T00:15:47Z", "updated": "2026-06-17T09:55:06Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "CVE-2025-64720 Detail Description LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component ≤ alpha × 257 required by the simplified PNG API. This issue has been patched in version 1.6.51. Metrics   NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST CVSS scoreNIST: NVD Base Score: N/ANVD assessment not yet provided. Nist CVSS score does not match with CNA score CNA: GitHub, Inc. Base Score: 7.1 HIGHVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/pnggroup/libpng/commit/08da33b4c88cfcd36e5a706558a8d7e0e4773643 GitHub, Inc. Patch https://github.com/pnggroup/libpng/issues/686 GitHub, Inc. Exploit Issue Tracking https://github.com/pnggroup/libpng/pull/751 GitHub, Inc. Issue Tracking Patch https://github.com/pnggroup/libpng/security/advisories/GHSA-hfc7-ph9c-wcww CISA-ADP, GitHub, Inc. Exploit Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-125 Out-of-bounds Read GitHub, Inc.   Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including) 1.6.0 Up to (excluding) 1.6.51 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 3 change records found show changes" }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "cb11ae95-7631-443f-824f-a662effc6e65", "id": "CVE-2025-65018", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H" } ], "cwes": [ 122, 787 ], "description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.", "published": "2025-11-25T00:15:47Z", "updated": "2026-06-17T09:55:21Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "libpng 1.6.34 is installed and falls within the affected version range. Runtime dependency analysis identified only /usr/bin/gnuplot as linked against libpng. The vulnerability affects the simplified PNG API function png_image_read_composite() when processing specially crafted palette PNG images with PNG_FLAG_OPTIMIZE_ALPHA enabled. No product service or exposed functionality has been identified that processes attacker-controlled PNG images through the affected API. Therefore, the vulnerable code path is not reachable in the intended product usage." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "a2d048c3-e5b4-4b38-8df3-0654f21bf055", "id": "CVE-2025-66293", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" } ], "cwes": [ 125 ], "description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management. Upgrade to libpng 1.6.52 or later.", "published": "2025-12-03T21:15:53Z", "updated": "2026-06-17T09:56:37Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "libpng 1.6.34 is installed and falls within the affected version range. Runtime dependency analysis identified only /usr/bin/gnuplot as linked against libpng. The vulnerability affects the simplified PNG API function png_image_read_composite() when processing specially crafted palette PNG images with PNG_FLAG_OPTIMIZE_ALPHA enabled. No product service or exposed functionality has been identified that processes attacker-controlled PNG images through the affected API. Therefore, the vulnerable code path is not reachable in the intended product usage." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "e54e3cf5-df18-4823-a6a1-39b5f25bece6", "id": "CVE-2019-7317", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 2.6, "severity": "low", "method": "CVSSv2", "vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "cwes": [ 416 ], "description": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "published": "2019-02-04T08:29:00Z", "updated": "2026-06-17T02:40:26Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes libpng, which may be within the affected version range for CVE-2019-7317 if the installed libpng version is 1.6.x before 1.6.37. libpng is present and is used indirectly through gnuplot/LibGD for PNG image generation. However, this vulnerability affects the libpng simplified API around `png_image_free` / `png_safe_execute`, where `png_image_free_function` may lead to a use-after-free. The issue requires use of the affected libpng API path. In the tested/default configuration, the identified product usage is PNG output generation through gnuplot/LibGD for Wi-Fi plots. No product code path was identified that directly uses the vulnerable libpng simplified API (`png_image_*`) or processes attacker-controlled PNG input through this vulnerable path. Therefore, although the libpng component is present, the vulnerable `png_image_free` / simplified API code path is not used or reachable in the default/tested product configuration. VEX justification: vulnerable code not in execute path. Residual risk: the issue could become relevant only if product functionality is added or modified to directly process attacker-controlled PNG files through libpng's simplified API." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "36d09388-8bc6-4b3e-bea9-a094b21bb900", "id": "CVE-2023-41913", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 120 ], "description": "strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can occur via a crafted IKE_SA_INIT message.", "published": "2023-12-07T05:15:09Z", "updated": "2026-06-17T06:23:03Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "response": [ "will_not_fix" ], "detail": "CVE-2023-41913 specifically affects the strongSwan charon-tkm DH proxy component. The product uses strongSwan 5.9.5 but does not include or use the charon-tkm plugin. Verification confirmed that no TKM-related packages, binaries, libraries, or configuration are present on the system. Therefore, the vulnerable code is not present in the product." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "94342c97-56d6-4c62-b98e-b3606fb39be9", "id": "CVE-2022-40617", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 400 ], "description": "strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity (and intermediate CA) certificate that contains a CRL/OCSP URL that points to a server (under the attacker's control) that doesn't properly respond but (for example) just does nothing after the initial TCP handshake, or sends an excessive amount of application data.", "published": "2022-10-31T06:15:09Z", "updated": "2026-06-17T05:01:43Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes strongSwan 5.9.5 and the revocation plugin is installed. However, in the tested/default configuration, the IPsec/IKE service is not active or exposed. No listener was detected on UDP ports 500 or 4500, and no active strongSwan runtime status was returned by `ipsec statusall` or `swanctl --stats`. Therefore, although the vulnerable component is present, the vulnerable code path is not reachable by a remote attacker in the default/tested configuration. Residual risk: the product may become affected if IPsec/IKE is enabled with X.509 certificate-based authentication and revocation checking through CRL/OCSP." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "c6f90331-6e38-4a25-87f8-47a86ae6b217", "id": "CVE-2022-4967", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "description": "strongSwan versions 5.9.2 through 5.9.5 are affected by authorization bypass through improper validation of certificate with host mismatch (CWE-297). When certificates are used to authenticate clients in TLS-based EAP methods, the IKE or EAP identity supplied by a client is not enforced to be contained in the client's certificate. So clients can authenticate with any trusted certificate and claim an arbitrary IKE/EAP identity as their own. This is problematic if the identity is used to make policy decisions. A fix was released in strongSwan version 5.9.6 in August 2022 (e4b4aabc4996fc61c37deab7858d07bc4d220136).", "published": "2024-05-14T11:57:00Z", "updated": "2026-06-17T05:22:26Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes strongSwan 5.9.5, which is within the affected version range for CVE-2022-4967. The vulnerability affects strongSwan TLS-based EAP methods when client certificates are used for authentication and the supplied IKE/EAP identity is not enforced to match the client certificate identity. In the tested/default configuration, although strongSwan packages are present, the IPsec/IKE service is not active or exposed, and no TLS-based EAP client-certificate authentication path was identified as running. Therefore, the vulnerable authorization path is not reachable in the default/tested product configuration. VEX justification: vulnerable code not in execute path. Residual risk: the issue could become relevant only if IPsec/IKE is enabled and configured to use TLS-based EAP methods with client certificates, especially if the IKE/EAP identity is used for access-control or policy decisions. In that case, strongSwan should be upgraded to 5.9.6 or later, or the vendor patch should be backported." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "1dc1e6ee-2d3a-416a-812a-262cb229ad15", "id": "CVE-2017-7401", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv3", "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 835 ], "description": "Incorrect interaction of the parse_packet() and parse_part_sign_sha256() functions in network.c in collectd 5.7.1 and earlier allows remote attackers to cause a denial of service (infinite loop) of a collectd instance (configured with \"SecurityLevel None\" and with empty \"AuthFile\" options) via a crafted UDP packet.", "published": "2017-04-03T14:59:00Z", "updated": "2026-06-17T01:24:16Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "will_not_fix" ], "detail": "The product includes collectd 5.5.3, which is within the affected version range for CVE-2017-7401. However, the vulnerability affects the upstream collectd network plugin when configured with SecurityLevel None and an empty AuthFile. In the tested/default configuration, collectd is running, but the vulnerable network plugin is not loaded. The configuration only shows LoadPlugin acksys_network, no LoadPlugin network, and no SecurityLevel or AuthFile configuration. In addition, no UDP listener was detected on port 25826. Therefore, the vulnerable network parser is not exposed and the vulnerable code path is not reachable by a remote attacker in the default/tested configuration. Residual risk: the product could become affected only if the upstream collectd network plugin is installed/enabled and configured with SecurityLevel None and an empty AuthFile." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "3e8afd73-8916-43d8-9d51-715b13c7665c", "id": "CVE-2017-16820", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 10.0, "severity": "high", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 9.8, "severity": "critical", "method": "CVSSv3", "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 415 ], "description": "The csnmp_read_table function in snmp.c in the SNMP plugin in collectd before 5.6.3 is susceptible to a double free in a certain error case, which could lead to a crash (or potentially have other impact).", "published": "2017-11-14T21:29:00Z", "updated": "2026-06-17T01:09:58Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "response": [ "will_not_fix" ], "detail": "CVE-2017-16820 affects the SNMP plugin of collectd (collectd-mod-snmp). Although collectd 5.5.3 is installed, the SNMP plugin is not present on the system. Verification confirmed that no collectd SNMP package, plugin binary, or related configuration is installed. Therefore, the vulnerable code is not present in the product." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "84643eb8-5a1e-480a-bf0f-0597d0f1b0ca", "id": "CVE-2017-18240", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 4.9, "severity": "medium", "method": "CVSSv2", "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.5, "severity": "medium", "method": "CVSSv3", "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 20 ], "description": "The Gentoo app-admin/collectd package before 5.7.2-r1 sets the ownership of PID file directory to the collectd account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL (when the service is stopped).", "published": "2018-03-19T02:29:00Z", "updated": "2026-06-17T01:12:27Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "Not vulnerable because this CVE is specific to the Gentoo Linux package before version 5.7.2-r1 and its init script; the collectd init script on OpenWrt does not contain any checkpath or chown command on the PID directory (only chmod 1777 /tmp is present), confirming the absence of the attack vector." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "2e6c322a-be8b-4a9e-9a8d-97edbbf3c46f", "id": "CVE-2026-47770", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 6.8, "severity": "medium", "method": "CVSSv4", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" } ], "cwes": [ 674 ], "description": "jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion (uncontrolled recursion). The crash occurs in jq's recursive structural comparison code, with the recursion repeating through jvp_array_equal() and jv_equal() in src/jv.c when comparing deeply nested arrays; a nearby sort comparator path through jv_cmp() in src/jv_aux.c overflows the stack at a larger nesting depth from the same missing recursion guard. Anyone running jq comparisons on attacker-controlled deeply nested JSON values, or embedding jq in a context where untrusted data can reach the == comparison path, is affected. This vulnerability is fixed in 1.8.2.", "published": "2026-06-25T18:16:38Z", "updated": "2026-06-26T19:16:41Z", "analysis": { "state": "resolved", "detail": "Corrige par montee jq 1.5 -> 1.8.2. Ticket #5469.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "6d32741e-55c2-4db9-82b1-a7a2ef086dde", "id": "CVE-2026-49839", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H" } ], "cwes": [ 787 ], "description": "jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jv_load_file(raw=1) reads an attacker-controlled file, it repeatedly appends file chunks to the same jv string accumulator. Once jv_string_append_buf() returns jv_invalid_with_msg(\"String too long\"), the raw-file loop does not stop. If the file contains at least one more byte, the next loop iteration appends a new chunk to an object that is already invalid. With assertions enabled this aborts in jvp_string_ptr(). With assertions disabled, the invalid object is interpreted as a string object and ASan reports heap-buffer-overflow. This vulnerability is fixed in 1.8.2.", "published": "2026-06-25T18:16:38Z", "updated": "2026-06-26T18:53:19Z", "analysis": { "state": "resolved", "detail": "Corrige par montee jq 1.5 -> 1.8.2. Ticket #5469.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "5dbfbd2b-fc25-48ab-b202-042b709ded1e", "id": "CVE-2026-54679", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 6.9, "severity": "medium", "method": "CVSSv4", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" } ], "cwes": [ 190 ], "description": "jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append has a chance of integer/multiple overflowing and then causing a massive buffer overrun. This vulnerability is fixed in 1.8.2.", "published": "2026-06-25T18:16:40Z", "updated": "2026-06-26T18:53:32Z", "analysis": { "state": "resolved", "detail": "Corrige par montee jq 1.5 -> 1.8.2. Ticket #5469.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "ab699975-aedd-4f12-bf43-911575dfd7be", "id": "CVE-2026-10536", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 416 ], "description": "A use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation.", "published": "2026-07-03T07:16:23Z", "updated": "2026-09-15T07:16:25Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "Not vulnerable because a comprehensive search in system libraries (/usr/lib/) for the CURLOPT_STREAM_DEPENDS symbols returned no results, proving that no application installed on the product uses the vulnerable libcurl API." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "37edd15a-db75-41b3-b849-87009b9a83b3", "id": "CVE-2026-11352", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 835 ], "description": "An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server\nto trigger a remote denial of service against a curl or libcurl client.\nBecause the helper function discards zero-length UDP datagrams before counting\nthem toward the per-call packet budget, a connected QUIC peer can continuously\nstream empty datagrams to indefinitely stall the client.", "published": "2026-07-03T07:16:23Z", "updated": "2026-09-15T07:16:25Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "Although version 8.19.0 is theoretically vulnerable as it falls within the affected range (8.18.0 to 8.20.0), exploitation of CVE-2026-11352 is impossible on the Acksys product because curl was compiled without HTTP/3 (QUIC) support and no QUIC libraries are installed (curl --http3 immediately fails), making the vulnerable code unreachable." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "870ed123-8c64-4ce9-b477-5f675f77c445", "id": "CVE-2026-9546", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "cwes": [ 200 ], "description": "A vulnerability in libcurl caused the HTTP `Referer:` header to persist even\nwhen explicitly cleared. While the documentation states that passing NULL to\n`CURLOPT_REFERER` suppresses the header, the option failed to clear the\ninternal state. As a result, the previous referrer string was erroneously\nreused and sent in subsequent requests, potentially leaking sensitive\ninformation to unintended servers.", "published": "2026-07-03T07:16:25Z", "updated": "2026-09-15T07:16:35Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "Although version 8.19.0 is theoretically vulnerable as it falls within the affected range (8.18.0 to 8.20.0), exploitation of CVE-2026-9546 is impossible on the Acksys product because the binary analysis revealed no application using the CURLOPT_REFERER option of the libcurl API; only the curl command-line tool (not vulnerable) and uhttpd (server, not a client) were found, making the vulnerable code unreachable." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "4e9b0bb0-8a62-478c-83dc-1e9139cb0ecf", "id": "CVE-2026-11564", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 9.1, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "cwes": [ 295 ], "description": "libcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup.\n\nAn easy handle that first uses default native CA trust can continue trusting\nthe native platform store after the application switches that same handle to\ncustom CA material for a later transfer.", "published": "2026-07-03T07:16:23Z", "updated": "2026-09-15T07:16:25Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "Although version 8.19.0 is theoretically vulnerable as it falls within the affected range (8.17.0 to 8.20.0), exploitation of CVE-2026-11564 is impossible on the Acksys product because the analysis of system binaries revealed no application using the CURLOPT_CAINFO or CURLOPT_SSL_VERIFYPEER options of the libcurl API (the only occurrence is the curl command-line tool, which is not affected), confirming the absence of the attack vector." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "0d3cc9dc-f442-4fe7-8fa6-002046b35aaa", "id": "CVE-2026-11586", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 770 ], "description": "By default, curl automatically responds to WebSocket PING frames. Because curl\nlacks an upper bound on memory allocation for unacknowledged frames, a\nmalicious server can exhaust all available memory by flooding curl with rapid,\nsequential PING messages.", "published": "2026-07-03T07:16:23Z", "updated": "2026-09-15T07:16:25Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "Although version 8.19.0 is theoretically vulnerable as it falls within the affected range (8.16.0 to 8.20.0), exploitation of CVE-2026-11586 is impossible on the Acksys product because curl and libcurl were compiled without WebSocket support (no symbols, protocols, or options related to WebSocket are present), making the vulnerable code completely absent." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "907e4b93-4f50-4575-9bf9-35c2f891bd8b", "id": "CVE-2026-11856", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 294 ], "description": "Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`.", "published": "2026-07-03T07:16:23Z", "updated": "2026-09-15T07:16:25Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "Although version 8.19.0 is theoretically vulnerable as it falls within the affected range (7.10.6 to 8.20.0), exploitation of CVE-2026-11856 is impossible on the Acksys product because the binary analysis revealed no application using the libcurl API with Digest authentication across different hosts; the only programs present (curl, wget, openvpn, uhttpd) are not vulnerable to this attack scenario, making the vulnerable code unreachable" }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "d5c81c89-0ce4-4879-a6e5-d23a273d20b9", "id": "CVE-2026-12064", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "cwes": [ 297, 295 ], "description": "When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.", "published": "2026-07-03T07:16:24Z", "updated": "2026-09-15T07:16:26Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "Although version 8.19.0 is theoretically vulnerable as it falls within the affected range (7.81.0 to 8.20.0), exploitation of CVE-2026-12064 is impossible on the Acksys product because SFTP/SCP support is absent (curl was compiled without these protocols) and the --proto-default option is not recognized, making the vulnerable code unreachable." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "20314fa7-96af-4207-9d52-307238b2c1f5", "id": "CVE-2026-8286", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 8.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" } ], "cwes": [ 295 ], "description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.", "published": "2026-07-03T07:16:24Z", "updated": "2026-09-15T07:16:31Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "Although version 8.19.0 is theoretically vulnerable as it falls within the affected range (7.30.0 to 8.20.0), exploitation of CVE-2026-8286 is impossible on the Acksys product because libcurl was compiled without SMTP/POP3/IMAP protocols (STARTTLS) and no application uses the CURLOPT_USE_SSL option ; the only references found come from standard files (/etc/services) or curl help messages, with no actual usage." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "fa06b923-7edb-465b-8d8c-cf2e41e1d63a", "id": "CVE-2026-8458", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" } ], "cwes": [ 488 ], "description": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services.", "published": "2026-07-03T07:16:24Z", "updated": "2026-09-15T07:16:32Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable" }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "79341b02-93a9-4f8e-ae62-2b28a4ab6afb", "id": "CVE-2026-8924", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 9.1, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "cwes": [ 201 ], "description": "A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set\n\"super cookies\" that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains.", "published": "2026-07-03T07:16:24Z", "updated": "2026-09-15T07:16:32Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable" }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "60e2961d-1dec-4ea8-867b-1af1d68dcacb", "id": "CVE-2026-8925", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 415 ], "description": "The curl logic that works with SASL authentication could end up cleaning up\nthe GSASL context *twice* without clearing the pointer in between, making it\n`free()` the same pointer twice.", "published": "2026-07-03T07:16:24Z", "updated": "2026-09-15T07:16:32Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "Although version 8.19.0 is theoretically vulnerable as it falls within the affected range (8.15.0 to 8.20.0), exploitation of CVE-2026-8925 is impossible on the Acksys product because the libgsasl package is not installed and curl is compiled without SASL support, making the vulnerable code unreachable." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "898530c2-f3fe-4c4c-99c0-0a23fe3170ae", "id": "CVE-2026-8926", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 9.1, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "cwes": [ 522 ], "description": "When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user.", "published": "2026-07-03T07:16:25Z", "updated": "2026-09-15T07:16:32Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable" }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "7042ded6-6dcd-46c8-8cfe-b3c17a2387d7", "id": "CVE-2026-8927", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 9.1, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "cwes": [ 294 ], "description": "When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.", "published": "2026-07-03T07:16:25Z", "updated": "2026-09-15T07:16:33Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "Although version 8.19.0 is theoretically vulnerable as it falls within the affected range (7.12.0 to 8.20.0), exploitation of CVE-2026-8927 is impossible on the Acksys product because the binary analysis revealed no application using the CURLOPT_PROXY or CURLOPT_PROXYUSERPWD options of the libcurl API (only DDNS scripts and OpenVPN using their own proxy mechanisms are present), making the vulnerable code unreachable." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "849803ee-568c-41b3-b62a-1bf5b8f9a70f", "id": "CVE-2026-8932", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "cwes": [ 305 ], "description": "libcurl would reuse a previously created connection even when some mTLS config\nrelated option had been changed that should have prohibited reuse.\n\nlibcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup. However, some TLS\nsettings related to client certificates were left out from the configuration\nmatch checks, making them match too easily. In particular options related to\nthe private key.", "published": "2026-07-03T07:16:25Z", "updated": "2026-09-15T07:16:33Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "Although version 8.19.0 is theoretically vulnerable as it falls within the affected range (7.7 to 8.20.0), exploitation of CVE-2026-8932 is impossible on the Acksys product because no application uses the libcurl API with mTLS options (client certificates, private keys), no curl process is active, and only the uhttpd web server is exposed, which is unrelated to libcurl." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "52aee2bb-6e8c-41f2-89d1-2f0c2dc1154f", "id": "CVE-2026-9079", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 522 ], "description": "libcurl had a flaw that when instructed to clear proxy authentication\ncredentials which made it not do so, leaving the old credentials around to get\nused for subsequent transfers that should not know nor use them.", "published": "2026-07-03T07:16:25Z", "updated": "2026-09-15T07:16:34Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "Although version 8.19.0 is theoretically vulnerable as it falls within the affected range (8.8.0 to 8.20.0), exploitation of CVE-2026-9079 is impossible on the Acksys product because the binary analysis revealed no application using the CURLOPT_PROXY, CURLOPT_PROXYUSERPWD, or CURLOPT_PROXYAUTH options of the libcurl API, nor the curl_easy_reset() function; only DDNS scripts and OpenVPN using environment variables for proxy are present, without any call to the vulnerable API, making the code unreachable." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "8d67c85c-bd62-489b-8688-5209552f3123", "id": "CVE-2026-9080", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.3, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" } ], "cwes": [ 416 ], "description": "Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION`\ncallback triggers a use-after-free vulnerability, where libcurl attempts to\nstore a flag using a dangling struct pointer immediately after that pointer's\nmemory has been freed.", "published": "2026-07-03T07:16:25Z", "updated": "2026-09-15T07:16:34Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable", "detail": "Although version 8.19.0 is theoretically vulnerable as it falls within the affected range (8.13.0 to 8.20.0), exploitation of CVE-2026-9080 is impossible on the Acksys product because no application uses the libcurl multi-interface API with a custom socket callback that calls curl_easy_pause() ; the only references to these functions are in the curl tool (not vulnerable) and no third-party processes are present." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "a9419840-8a7b-442e-8cec-ef7c251d61d9", "id": "CVE-2026-9545", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "cwes": [ 200 ], "description": "In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when it makes a second transfer to the same site it has been\nreplaced by the attacker's impostor machine - without a valid certificate.\n\nWhen libcurl returns to the hostname the second time with a cached SSL session\n(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the\n`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might\nsend off the second request's bytes on that new connection *before* enforcing\nthe certificate verification failure. Potentially leaking sensitive\ninformation.", "published": "2026-07-03T07:16:25Z", "updated": "2026-09-15T07:16:34Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable" }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "39481bd8-888a-4914-837f-b8da05a43497", "id": "CVE-2026-9547", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.4, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "cwes": [ 297 ], "description": "When a libcurl-based application performs transfers via `SCP://` or `SFTP://`\nand utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an\nuntrusted server. This vulnerability occurs when a server presents a host key\ntype that does not match the specific key type already recorded for that host\nin the `known_hosts` file. Instead of rejecting the mismatch, the callback\nmechanism fails to properly enforce the restriction, allowing the connection\nto succeed without warning and risking a potential man-in-the-middle attack.", "published": "2026-07-03T07:16:25Z", "updated": "2026-09-15T07:16:35Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable" }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "af2a2ce0-9924-4da3-9c6c-97c76d6aafab", "id": "CVE-2026-12725", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 122 ], "description": "A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and\nquery logging are both enabled, logging of DS or DNSKEY replies containing\nunsupported algorithm or digest types can cause dnsmasq to write past the end\nof an internal logging buffer. A remote attacker able to supply such a DNS\nresponse may crash the dnsmasq process, resulting in denial of service.", "published": "2026-06-22T16:16:34Z", "updated": "2026-08-31T22:17:19Z", "analysis": { "state": "resolved", "detail": "Corrige par montee dnsmasq 2.92 -> 2.93. Ticket #5468.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "ca4eb9f1-6771-4fbc-b278-7e222dfc452e", "id": "CVE-2026-12969", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "cwes": [ 125 ], "description": "An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.", "published": "2026-06-23T14:17:22Z", "updated": "2026-08-31T12:17:53Z", "analysis": { "state": "resolved", "detail": "Corrige par montee dnsmasq 2.92 -> 2.93. Ticket #5468.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "512005ac-8356-46bf-9440-ef10311e4535", "id": "CVE-2026-14457", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 476 ], "description": "Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs)\nenabled, and only the private key (with no associated certificate) configured locally,\na NULL pointer dereference may occur when the remote peer solicits raw public keys and\nalso sends the typically omitted \"signature_algorithms_cert\" TLS extension.\n\nImpact summary: The impact is limited to a possible Denial of Service as a result of\nan application abort, no data disclosure or remote command execution are possible.\n\nCWE: CWE-476: NULL Pointer Dereference\n\nDescription: While a passing comment in sample code in the documentation suggests\nthat key-only RPK configurations are supported, the best-practice RPK configuration\nis to always configure a corresponding certificate (possibly self-signed or\nsigned by any convenient CA).\n\nWhen the private key is configured along with a matching certificate, the\n\"signature_algorithms_cert\" extension is handled reliably even without the\nfix, and peer clients or servers that don't support raw public keys may be\nable to complete a TLS connection by pinning or verifying the corresponding\ncertificate or its public key.\n\nDeployments that prefer to configure just a private key with no certificate\nneed to upgrade to an updated release as noted below.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue, as the SSL protocol implementation\nis outside the OpenSSL FIPS module boundary.", "published": "2026-08-25T13:17:49Z", "updated": "2026-09-11T21:14:35Z", "analysis": { "state": "resolved", "detail": "Corrige par montee OpenSSL 3.5.6 -> 3.5.8. Ticket #5467.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "2a5d5267-de25-45f2-884c-c5f7365ff819", "id": "CVE-2026-54874", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 405 ], "description": "Issue summary: Receiving a DTLS record for a future epoch while a handshake\nis in progress causes OpenSSL to buffer far more memory than the record\nitself requires.\n\nImpact summary: A peer can use a small amount of network traffic to make an\nOpenSSL DTLS endpoint retain a disproportionately large amount of memory,\nwhich may lead to a Denial of Service.\n\nCWE: CWE-405: Asymmetric Resource Consumption (Amplification)\n\nDescription: While a DTLS handshake is in progress, a peer may legitimately\nhave already moved on to the next epoch (for example, having sent its\nChangeCipherSpec and Finished messages) before the local endpoint has\nprocessed the same transition, typically because of reordering on the\nunderlying UDP transport. OpenSSL buffers such early records so that they\ncan be processed once the local endpoint catches up.\n\nBuffering a record currently retains the entire read buffer it arrived in,\nwhich is sized to hold the largest possible DTLS record (around 16\nkilobytes), rather than just the bytes that make up the record itself. Up\nto 100 such records may be buffered per connection. As a result, a peer\nthat sends a stream of small forged records claiming to belong to the next\nepoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of\nmemory, despite sending only a small fraction of that amount of data over\nthe network.\n\nAn attacker therefore gains a memory amplification factor of around 1200,\nand can multiply the effect across as many associations as it is able to\nopen, making this a remote memory exhaustion Denial of Service risk for\nDTLS servers. Since the memory retained per connection remains bounded,\nand any limit an application already places on the number of concurrent\nassociations also bounds the total exposure, this issue has been assessed\nas Low severity.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary.\n\nOpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this\nissue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.2.\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.4.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.8.\nOpenSSL 3.4 users should upgrade to OpenSSL 3.4.7.\nOpenSSL 3.0 users should upgrade to OpenSSL 3.0.22.\n\nPremium support customers only:\nOpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi\nOpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr\n\nThis issue was reported on 18 May 2026 by Amazon Web Services.\nThe fix has been developed by Matt Caswell.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Amazon Web Services\nFixed by: Matt Caswell", "published": "2026-08-25T13:19:24Z", "updated": "2026-09-11T21:16:28Z", "analysis": { "state": "resolved", "detail": "Corrige par montee OpenSSL 3.5.6 -> 3.5.8. Ticket #5467.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "146dcb0e-aa71-47e4-8576-38f094d75629", "id": "CVE-2026-63072", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 787 ], "description": "Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-bounds heap write.\n\nImpact summary: An attacker who supplies a crafted CMS message can trigger a\ndeterministic 8-byte out-of-bounds heap write when the victim decrypts it\nwith CMS_decrypt(), corrupting the heap and typically resulting in a Denial\nof Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: The key-wrap OID is potentially attacker-controlled on the wire.\nCMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.\nAn attacker can take a legitimate message and change a single OID byte to\nselect the padded variant while leaving the message otherwise valid. Since\nthe unwrap key is derived from the recipient's private operation (ECDH key\nagreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot\npass, and the decryption fails with integrity failure.\n\nThe write is a fixed-size (8-byte), fixed-value (zero) heap overflow\nimmediately past the allocation, requires no special configuration, and is\nreachable from the public CMS_decrypt() function. The consequence is\na heap corruption leading to a Denial of Service. The fix in the CMS code\nsizes the unwrap output buffer for the worst case so a failed unwrap cannot\nwrite past the allocation.\n\nFIPS impact: no\n\nAs the CMS code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE.", "published": "2026-08-25T13:19:26Z", "updated": "2026-09-11T21:16:34Z", "analysis": { "state": "resolved", "detail": "Corrige par montee OpenSSL 3.5.6 -> 3.5.8. Ticket #5467.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "85ae7bc6-a747-4b37-85f5-61f30d74809e", "id": "CVE-2026-63073", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 134 ], "description": "Issue summary: OpenSSL CMP response validation passed an unexpected response\nsender distinguished name directly as the format string to `ERR_raise_data()`.\n\nImpact summary: A malicious or intercepted CMP endpoint can crash a CMP client\nthat enforces an expected sender or uses a pinned server certificate whose\nsubject becomes the default expected sender.\n\nCWE: CWE-134 (Use of Externally-Controlled Format String)\n\nDescription: When validating a received CMP message, ossl_cmp_msg_check_update()\nconverts the peer-supplied sender distinguished name with X509_NAME_oneline()\nand passes it directly as the format argument to ERR_raise_data(). Percent\ncharacters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches\nBIO_vsnprintf() as an attacker-controlled format string with no matching variadic\narguments. This path is only reached when the caller configures an expected\nsender or pins a server certificate, which is the normal configuration for a\nCMP client validating server responses.\n\nSince the attacker controls the format string but none of the variadic\narguments, such specifiers as %s and %n dereference or write through unrelated\nstack contents and crash the client. The reliable consequence is a denial of\nservice, when the response comes from a malicious or intercepted CMP endpoint.\nThere is no controlled memory write, arbitrary-address read, or reliable path\nto remote code execution.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue, as the CMP protocol\nimplementation is outside the OpenSSL FIPS module boundary.", "published": "2026-08-25T13:19:26Z", "updated": "2026-09-11T21:16:45Z", "analysis": { "state": "resolved", "detail": "Corrige par montee OpenSSL 3.5.6 -> 3.5.8. Ticket #5467.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "2218425d-8412-4387-b61d-e7780c181ffd", "id": "CVE-2026-63074", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 770 ], "description": "Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches\nadditional certificates (extraCerts) sent in a CMP message, but never expunges\nthem (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX\nfrequently, this cache of extraCerts may grow unboundedly, and a malicious\nclient may flood a CMP server with requests driving this growth.\n\nImpact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX\nfor the lifetime of a server process may observe unbounded memory growth in the\nevent a malicious client repeatedly sends requests containing unique extra\ncertificates, which may lead to OOM conditions.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: If a remote user sends CMP messages to a server with a list of\nextraCerts and the message is rejected, the extraCerts from the message remains\nin the server contexts untrusted certificate stack. This exposes servers with\nlong lived ctx objects to Denial of Service attacks in which an attacker sends\nmessages intending to be rejected with a large list of additional certificates\nrepeatedly, forcing the server to store them indefinitely.\n \nThe issue was fixed by removing the added extra certs if the message is\nrejected, using the same method as when the context is configured to not do\ncaching at all.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE.", "published": "2026-08-25T13:19:26Z", "updated": "2026-09-11T21:16:58Z", "analysis": { "state": "resolved", "detail": "Corrige par montee OpenSSL 3.5.6 -> 3.5.8. Ticket #5467.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "6608809f-abdb-4d79-9f9a-38fc29efb079", "id": "CVE-2026-63075", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 770 ], "description": "Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly\nsends ack-eliciting packets while not acknowledging ACK-only responses, the\nQUIC stack can retain ACK-only packet metadata for the lifetime of the\nconnection.\n\nImpact summary: A remote peer that can complete a QUIC handshake can\ncause connection-scoped memory growth which may lead to Denial of Service\nthrough memory exhaustion, especially with sustained traffic or many concurrent\nQUIC connections.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: When the OpenSSL QUIC stack sends an ACK-only packet,\nthere is no requirement by the QUIC protocol that the peer will acknowledge\nthat ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL\nimplementation stores the metadata about the ACK frames regardless.\nIn and of itself that's ok, but if a malicious peer establishes a connection, and\nthen drives the connection such that ACK-only packets are forced from the \nOpenSSL implementation peer (i.e., by sending numerous PING frames),\nand then withholding any subsequent acks for ack-eliciting data, like\nlegitimate data, said malicious peer can force inappropriate memory growth\non the OpenSSL peer, potentially leading to a Denial of Service.\n\nThe fix is to ensure that we account for the transmission of the ACK-only\npacket in the packet histories high and low watermark without actually storing\nthe ACK-only packet metadata itself.\n\nFIPS impact: no\nThe OpenSSL FIPS module is not affected as the QUIC code is\noutside the FIPS module boundary.", "published": "2026-08-25T13:19:26Z", "updated": "2026-09-11T21:17:05Z", "analysis": { "state": "resolved", "detail": "Corrige par montee OpenSSL 3.5.6 -> 3.5.8. Ticket #5467.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "f87b8c2e-49e5-4bb5-8f31-e079bb976954", "id": "CVE-2026-63076", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 476 ], "description": "Issue summary: OpenSSL CMP password based protection verification only\nchecks whether the protectionAlg parameter was not NULL and not its\nASN.1 type, before treating it as a PBMParameter. A crafted message can\ncontain a parameter of a different type, which is then dereferenced as an\ninvalid pointer.\n\nImpact summary: A remote, unauthenticated attacker can crash an application\nacting as a CMP server that accepts PBM-protected messages, or a CMP client\ntalking to a malicious or intercepted CMP server, resulting in a Denial of\nService.\n\nCWE: CWE-476: NULL Pointer Dereference\n\nDescription: When verifying the password-based MAC protection of a CMP\nmessage, OpenSSL library reads the protectionAlg algorithm parameter with\nX509_ALGOR_get0(), which returns both the parameter type and its value\npointer. The value is then cast to an ASN1_STRING and treated as the\nexpected PBMParameter after only checking that pointer is not NULL. The\nparameter type returned by X509_ALGOR_get0() was never consulted.\n\nThis happens during protection verification, before any MAC is computed, so\nno knowledge of the PBM shared secret is required; the only precondition is\nthat PBM verification is reachable. On the server side this is reached from\nOSSL_CMP_SRV_process_request() for any application that stands up a CMP\nserver accepting PBM-protected messages, and on the client side from CMP\nresponse validation against a malicious or on-path (MITM) server. The\nreliable consequence is a denial of service; there is no memory disclosure,\nno controlled memory write, and no path to code execution. CMP is a\nspecialized feature that an application must explicitly enable.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS modules\nare affected by this CVE.", "published": "2026-08-25T13:19:26Z", "updated": "2026-09-11T21:17:12Z", "analysis": { "state": "resolved", "detail": "Corrige par montee OpenSSL 3.5.6 -> 3.5.8. Ticket #5467.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "fa48bcbd-c410-4842-b77b-054c94f823c6", "id": "CVE-2026-75803", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 9.1, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "cwes": [ 354 ], "description": "Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty\nciphertext can report success without verifying the supplied authentication\ntag when the operation is finalized by calling the EVP_Cipher() function.\n\nImpact summary: Applications calling EVP_Cipher() on an empty ciphertext and\nexpecting the call to check the AEAD tag may accept forged messages.\n\nCWE: CWE-354 (Improper Validation of Integrity Check Value)\n\nDescription: The EVP_Cipher() API call for AEAD ciphers behaves like a one\nshot encryption and decryption call. It also verifies the AEAD tag after the\ndecryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers\nit skipped the AEAD tag verification when an empty ciphertext was passed to\nthe function. The callers of this function might believe that a successful\nreturn indicates a valid AEAD tag for these ciphers, even when that has not\ntruly been validated in this case.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE\nas the affected algorithms are not FIPS approved and thus not implemented\nin the FIPS module.", "published": "2026-08-25T13:19:29Z", "updated": "2026-09-11T21:17:17Z", "analysis": { "state": "resolved", "detail": "Corrige par montee OpenSSL 3.5.6 -> 3.5.8. Ticket #5467.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "51bd169c-c5ed-47ea-81fa-d935c112818d", "id": "CVE-2026-13608", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.4, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "cwes": [ 923 ], "description": "A flaw in the libcurl SASL negotiation for LDAP authentication allows an\nincomplete handshake sequence to be misinterpreted as a successful\ncryptographic verification. An attacker executing a Man-in-the-Middle (MITM)\nattack can inject a premature or shortcut response that bypasses complete peer\nvalidation.", "published": "2026-09-06T18:17:19Z", "updated": "2026-09-15T07:16:26Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable" }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "cb1d426d-9d9a-4b25-9210-ffe553cf4faf", "id": "CVE-2026-18924", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 9.1, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" } ], "cwes": [ 416 ], "description": "A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process.", "published": "2026-09-06T18:17:20Z", "updated": "2026-09-15T07:16:27Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable" }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "cb1158af-cc89-4c86-8000-6afe87ee7be3", "id": "CVE-2026-19931", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 488 ], "description": "A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B's request get sent over user A's\npreviously authenticated connection.", "published": "2026-09-06T18:17:20Z", "updated": "2026-09-15T07:16:27Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable" }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "d932342b-484d-4772-8b2d-37552068eb01", "id": "CVE-2026-80229", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 416 ], "description": "When performing transfers via libcurl’s multi interface, pooled TLS\nconnections can outlive their originating easy handles. In OpenSSL 3 provider\nconfigurations, libcurl attaches an allocated library context to the easy\nhandle's state and passes it to OpenSSL without acquiring an ownership\nreference; destroying the easy handle prematurely frees this context while the\nactive connection retains a dangling pointer, leading to a heap-use-after-free\nupon subsequent I/O or post-handshake operations.", "published": "2026-09-06T18:17:22Z", "updated": "2026-09-15T07:16:30Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable" }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "71fea0a0-2dca-46b1-9c55-7b5466156a0f", "id": "CVE-2026-80230", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 295 ], "description": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected.", "published": "2026-09-06T18:17:22Z", "updated": "2026-09-15T07:16:30Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable" }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "1aad2dc9-4a87-4bb9-aa5e-13cd9ad91cf3", "id": "CVE-2026-80231", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 488 ], "description": "A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created.", "published": "2026-09-06T18:17:22Z", "updated": "2026-09-15T07:16:30Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable" }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "9659aea1-a83f-49ff-a594-f8e60c17cbc4", "id": "CVE-2026-80255", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "cwes": [ 201 ], "description": "A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of\nspace (ascii code 32) immediately before the `Secure` attribute causes curl to\nstore the cookie without its Secure flag. The cookie might then wrongfully be\nsent over plaintext HTTP on subsequent requests to the same host.", "published": "2026-09-06T18:17:22Z", "updated": "2026-09-15T07:16:30Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable" }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "6554d4c6-ba66-4f89-aaab-ad01729f2300", "id": "CVE-2026-82208", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "cwes": [ 295 ], "description": "With the wolfSSL backend, when CA caching is enabled and an\n`CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can\nsilently reinstall the cached store after the callback returns. A certificate\ntrusted by the cached store but rejected by the callback-selected store is\nthen incorrectly accepted.", "published": "2026-09-06T18:17:22Z", "updated": "2026-09-15T07:16:31Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable" }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "80bcc460-5316-46cd-8bb5-114adb1c7661", "id": "CVE-2026-82209", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 8.2, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N" } ], "cwes": [ 201 ], "description": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`).", "published": "2026-09-06T18:17:22Z", "updated": "2026-09-15T07:16:31Z", "analysis": { "state": "not_affected", "justification": "code_not_reachable" }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "f5110bee-1aa4-4d90-87bf-b51717f5ce65", "id": "CVE-2026-78123", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 825 ], "description": "strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 parsing in the openssl plugin.", "published": "2026-09-11T02:18:33Z", "updated": "2026-09-15T16:17:24Z", "analysis": { "state": "resolved", "detail": "Corrige par montee strongSwan 5.9.5 -> 6.1.0. Ticket #5466.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "7eee47e8-cf7b-4068-9197-fc1b5e60e1a9", "id": "CVE-2026-78124", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "cwes": [ 401 ], "description": "strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime.", "published": "2026-09-11T02:18:33Z", "updated": "2026-09-14T20:09:47Z", "analysis": { "state": "resolved", "detail": "Corrige par montee strongSwan 5.9.5 -> 6.1.0. Ticket #5466.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "30d7039d-7d7a-487a-94ba-0821c71a760a", "id": "CVE-2026-78126", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 476 ], "description": "strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin.", "published": "2026-09-11T02:18:33Z", "updated": "2026-09-14T20:09:26Z", "analysis": { "state": "resolved", "detail": "Corrige par montee strongSwan 5.9.5 -> 6.1.0. Ticket #5466.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "41798530-e0bf-4fb6-857d-d5d698ab4ef6", "id": "CVE-2026-78127", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "cwes": [ 401 ], "description": "libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser.", "published": "2026-09-11T02:18:34Z", "updated": "2026-09-14T20:09:10Z", "analysis": { "state": "resolved", "detail": "Corrige par montee strongSwan 5.9.5 -> 6.1.0. Ticket #5466.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "bae04fd2-db3a-490e-b0ca-ad513541a6e1", "id": "CVE-2026-78129", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 835 ], "description": "strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption.", "published": "2026-09-11T02:18:34Z", "updated": "2026-09-14T20:08:56Z", "analysis": { "state": "resolved", "detail": "Corrige par montee strongSwan 5.9.5 -> 6.1.0. Ticket #5466.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "c5213972-1290-4fe6-9287-69e2291cdb1d", "id": "CVE-2026-78130", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 476 ], "description": "strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser.", "published": "2026-09-11T02:18:34Z", "updated": "2026-09-15T16:17:24Z", "analysis": { "state": "resolved", "detail": "Corrige par montee strongSwan 5.9.5 -> 6.1.0. Ticket #5466.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "b6a9c145-848a-45fd-98fc-0e48b7a5fd24", "id": "CVE-2026-78131", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "cwes": [ 401 ], "description": "strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser.", "published": "2026-09-11T02:18:34Z", "updated": "2026-09-14T20:08:24Z", "analysis": { "state": "resolved", "detail": "Corrige par montee strongSwan 5.9.5 -> 6.1.0. Ticket #5466.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "c171ecef-8774-4f60-b2d5-f9306a9eaf7a", "id": "CVE-2026-78132", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 835 ], "description": "strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax.", "published": "2026-09-11T02:18:34Z", "updated": "2026-09-14T20:08:12Z", "analysis": { "state": "resolved", "detail": "Corrige par montee strongSwan 5.9.5 -> 6.1.0. Ticket #5466.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "45eeb970-e1a5-4348-9875-a71e7c194173", "id": "CVE-2026-78134", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L" } ], "cwes": [ 863 ], "description": "strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity.", "published": "2026-09-11T02:18:34Z", "updated": "2026-09-14T20:06:44Z", "analysis": { "state": "resolved", "detail": "Corrige par montee strongSwan 5.9.5 -> 6.1.0. Ticket #5466.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "e16d6c03-aabc-4270-992f-deb371a597c3", "id": "CVE-2026-46300", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 787, 123 ], "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: preserve shared-frag marker during coalescing\n\nskb_try_coalesce() can attach paged frags from @from to @to. If @from\nhas SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same\nexternally-owned or page-cache-backed frags, but the shared-frag marker\nis currently lost.\n\nThat breaks the invariant relied on by later in-place writers. In\nparticular, ESP input checks skb_has_shared_frag() before deciding\nwhether an uncloned nonlinear skb can skip skb_cow_data(). If TCP\nreceive coalescing has moved shared frags into an unmarked skb, ESP can\nsee skb_has_shared_frag() as false and decrypt in place over page-cache\nbacked frags.\n\nPropagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged\nfrags. The tailroom copy path does not need the marker because it copies\nbytes into @to's linear data rather than transferring frag descriptors.", "published": "2026-05-23T12:17:02Z", "updated": "2026-09-08T09:18:09Z", "analysis": { "state": "not_affected", "detail": "Code ESP-in-TCP (espintcp) absent (config noyau, binaire, /proc/kallsyms). Ticket #5494.", "justification": "code_not_present", "response": [ "will_not_fix" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "7c899e36-4f11-433a-9587-9c96e82ab02a", "id": "CVE-2025-21760", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 8.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 416 ], "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nndisc: extend RCU protection in ndisc_send_skb()\n\nndisc_send_skb() can be called without RTNL or RCU held.\n\nAcquire rcu_read_lock() earlier, so that we can use dev_net_rcu()\nand avoid a potential UAF.", "published": "2025-02-27T03:15:16Z", "updated": "2026-07-30T06:21:28Z", "analysis": { "state": "resolved", "detail": "ND IPv6 UAF corrige en RC3 (ndisc_send_skb 872->880, extension RCU). Ticket #5492.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "e947dd53-6e61-4e1d-947c-41cc72ad1efd", "id": "CVE-2025-22037", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 476 ], "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix null pointer dereference in alloc_preauth_hash()\n\nThe Client send malformed smb2 negotiate request. ksmbd return error\nresponse. Subsequently, the client can send smb2 session setup even\nthought conn->preauth_info is not allocated.\nThis patch add KSMBD_SESS_NEED_SETUP status of connection to ignore\nsession setup request if smb2 negotiate phase is not complete.", "published": "2025-04-16T15:15:56Z", "updated": "2026-07-30T06:22:04Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "This vulnerability affects ksmbd, the in-kernel SMB/CIFS server. CONFIG_SMB_SERVER does not even exist as an option in this kernel's Kconfig tree (ksmbd introduced in Linux 5.15; this device runs 4.9.111). No SMB port (445) is listening." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "e36c13fd-2dad-41d2-8369-842af7911c4e", "id": "CVE-2025-38352", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 367 ], "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nposix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()\n\nIf an exiting non-autoreaping task has already passed exit_notify() and\ncalls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent\nor debugger right after unlock_task_sighand().\n\nIf a concurrent posix_cpu_timer_del() runs at that moment, it won't be\nable to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or\nlock_task_sighand() will fail.\n\nAdd the tsk->exit_state check into run_posix_cpu_timers() to fix this.\n\nThis fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because\nexit_task_work() is called before exit_notify(). But the check still\nmakes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail\nanyway in this case.", "published": "2025-07-22T08:15:23Z", "updated": "2026-09-08T18:17:32Z", "analysis": { "state": "resolved", "detail": "Race POSIX CPU timers corrigee en RC3 (run_posix_cpu_timers/set_process_cpu_timer modifiees). Ticket #5484.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "d8c0a9d4-bd31-4b48-bb29-09cd44c62ad2", "id": "CVE-2025-39964", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 362 ], "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Disallow concurrent writes in af_alg_sendmsg\n\nIssuing two writes to the same af_alg socket is bogus as the\ndata will be interleaved in an unpredictable fashion. Furthermore,\nconcurrent writes may create inconsistencies in the internal\nsocket state.\n\nDisallow this by adding a new ctx->write field that indiciates\nexclusive ownership for writing.", "published": "2025-10-13T14:15:34Z", "updated": "2026-09-19T04:17:48Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "This vulnerability affects the AF_ALG cryptographic socket interface. Verified on two independent levels: no af_alg or algif_* kernel module files exist anywhere on this system's filesystem (confirmed via find), and all CONFIG_CRYPTO_USER_API_* options (HASH, SKCIPHER, RNG, AEAD) are explicitly not set in the kernel configuration." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "9de4cd1d-016a-4914-819e-81e8588be4f0", "id": "CVE-2024-1086", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 416 ], "description": "A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.\n\n\n\nThe nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT.\n\n\n\nWe recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.", "published": "2024-01-31T13:15:10Z", "updated": "2026-08-07T19:59:58Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "This vulnerability requires both nf_tables enabled and unprivileged user namespaces accessible. Neither condition is met on this device: CONFIG_NF_TABLES is not set in the kernel configuration, and CONFIG_USER_NS is absent. This system uses legacy iptables/x_tables, not nf_tables. The vulnerable code path is not compiled into this kernel." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "2031b38e-eed7-4e9c-84cd-d0a259fe61f6", "id": "CVE-2024-26594", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" } ], "cwes": [ 125 ], "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate mech token in session setup\n\nIf client send invalid mech token in session setup request, ksmbd\nvalidate and make the error if it is invalid.", "published": "2024-02-23T14:15:45Z", "updated": "2026-08-04T11:16:46Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "This vulnerability affects ksmbd, the in-kernel SMB/CIFS server (fs/smb/server/). CONFIG_SMB_SERVER does not exist in this kernel's Kconfig tree (ksmbd introduced in Linux 5.15; this device runs 4.9.111)." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "27a8fd97-9dba-42cd-8e70-da513aa5fe5d", "id": "CVE-2024-36971", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 416 ], "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix __dst_negative_advice() race\n\n__dst_negative_advice() does not enforce proper RCU rules when\nsk->dst_cache must be cleared, leading to possible UAF.\n\nRCU rules are that we must first clear sk->sk_dst_cache,\nthen call dst_release(old_dst).\n\nNote that sk_dst_reset(sk) is implementing this protocol correctly,\nwhile __dst_negative_advice() uses the wrong order.\n\nGiven that ip6_negative_advice() has special logic\nagainst RTF_CACHE, this means each of the three ->negative_advice()\nexisting methods must perform the sk_dst_reset() themselves.\n\nNote the check against NULL dst is centralized in\n__dst_negative_advice(), there is no need to duplicate\nit in various callbacks.\n\nMany thanks to Clement Lecigne for tracking this issue.\n\nThis old bug became visible after the blamed commit, using UDP sockets.", "published": "2024-06-10T09:15:09Z", "updated": "2026-06-17T07:37:30Z", "analysis": { "state": "resolved", "detail": "UAF route corrige en RC3 (ipv4_negative_advice 88->72, ip6_negative_advice 144->192). Ticket #5484.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "2fd4cec2-8ce5-47ad-8d0c-bf5e4e1b30f9", "id": "CVE-2024-50302", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "cwes": [ 908 ], "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: zero-initialize the report buffer\n\nSince the report buffer is used by all kinds of drivers in various ways, let's\nzero-initialize it during allocation to make sure that it can't be ever used\nto leak kernel memory via specially-crafted report.", "published": "2024-11-19T02:16:32Z", "updated": "2026-06-17T08:04:10Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "This vulnerability affects the HID (Human Interface Device) core subsystem's report buffer allocation. CONFIG_HID is not set in this kernel's configuration — the entire HID subsystem is absent. The only USB device present is a cellular modem (Quectel), unrelated to HID." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "e95b815f-bf5a-41f1-bebb-03707f73c531", "id": "CVE-2024-53104", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 787 ], "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format\n\nThis can lead to out of bounds writes since frames of this type were not\ntaken into account when calculating the size of the frames buffer in\nuvc_parse_streaming.", "published": "2024-12-02T08:15:08Z", "updated": "2026-06-17T08:08:17Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "This vulnerability affects the USB Video Class (uvcvideo) driver's frame parsing logic. Neither CONFIG_USB_VIDEO, CONFIG_MEDIA_USB, nor CONFIG_VIDEO_DEV are set in this kernel's configuration, and no uvc module is loaded. This industrial router has no camera/video functionality." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "9bbad1c7-7a78-4748-9279-f2b46505e57f", "id": "CVE-2024-53197", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 787 ], "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices\n\nA bogus device can provide a bNumConfigurations value that exceeds the\ninitial value used in usb_get_configuration for allocating dev->config.\n\nThis can lead to out-of-bounds accesses later, e.g. in\nusb_destroy_configuration.", "published": "2024-12-27T14:15:27Z", "updated": "2026-06-17T08:08:33Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "This vulnerability affects the ALSA usb-audio driver's clock descriptor parsing logic (sound/usb/). CONFIG_SOUND is not set in this kernel's configuration — the entire ALSA sound subsystem is absent. No USB-audio driver code exists on this device to process any USB device's clock descriptors." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "f8d987fd-7074-4227-ad7d-a97558c70cd6", "id": "CVE-2024-53150", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" } ], "cwes": [ 125 ], "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix out of bounds reads when finding clock sources\n\nThe current USB-audio driver code doesn't check bLength of each\ndescriptor at traversing for clock descriptors. That is, when a\ndevice provides a bogus descriptor with a shorter bLength, the driver\nmight hit out-of-bounds reads.\n\nFor addressing it, this patch adds sanity checks to the validator\nfunctions for the clock descriptor traversal. When the descriptor\nlength is shorter than expected, it's skipped in the loop.\n\nFor the clock source and clock multiplier descriptors, we can just\ncheck bLength against the sizeof() of each descriptor type.\nOTOH, the clock selector descriptor of UAC2 and UAC3 has an array\nof bNrInPins elements and two more fields at its tail, hence those\nhave to be checked in addition to the sizeof() check.", "published": "2024-12-24T12:15:23Z", "updated": "2026-06-17T08:08:25Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "This vulnerability affects the ALSA usb-audio driver's clock descriptor parsing logic (sound/usb/). CONFIG_SOUND is not set in this kernel's configuration — the entire ALSA sound subsystem is absent." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "ad45d824-59ae-49c2-bfec-2e7b9bd24bcb", "id": "CVE-2021-33909", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.2, "severity": "high", "method": "CVSSv2", "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 190, 787 ], "description": "fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05.", "published": "2021-07-20T19:15:09Z", "updated": "2026-06-17T03:55:21Z", "analysis": { "state": "not_affected", "justification": "requires_environment", "detail": "This vulnerability (Sequoia) is triggered by mounting a very long directory path (>1GB) and requires either an unprivileged user namespace or a FUSE-based mount, per the original researchers (Qualys). CONFIG_USER_NS is absent from this kernel, and CONFIG_FUSE_FS is not set / no fuse module is loaded. Neither documented exploitation path is available on this device." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "228bf233-c3eb-4481-a79a-130efa8c7066", "id": "CVE-2023-1380", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" } ], "cwes": [ 125 ], "description": "A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service.", "published": "2023-03-27T21:15:10Z", "updated": "2026-09-18T01:16:55Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "This vulnerability affects the Broadcom brcmfmac WiFi driver. This device uses a Qualcomm Atheros WiFi chipset (ath11k), not Broadcom hardware. No brcmfmac module is loaded, configured, or present on disk." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "8cdb4db3-9f1f-48d6-9ff0-2614ea0c926c", "id": "CVE-2023-32233", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 416 ], "description": "In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.", "published": "2023-05-08T20:15:20Z", "updated": "2026-06-17T05:58:22Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "This vulnerability affects the Netfilter nf_tables subsystem (net/netfilter/nf_tables_api.c). CONFIG_NF_TABLES is not set in this kernel's configuration — this system uses legacy iptables/x_tables exclusively." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "d8360aa4-3e15-4957-b8b9-414b7def719d", "id": "CVE-2022-0492", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 6.9, "severity": "medium", "method": "CVSSv2", "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 287, 862 ], "description": "A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.", "published": "2022-03-03T19:15:08Z", "updated": "2026-06-17T04:20:42Z", "analysis": { "state": "not_affected", "justification": "requires_environment", "detail": "Exploitation requires CAP_SYS_ADMIN within an unprivileged user namespace (e.g., an unprivileged container) to bypass the release_agent ownership check. CONFIG_USER_NS is absent from this kernel, making this specific privilege-escalation path structurally unavailable." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "238b5290-9c38-4146-bb65-d8fac6cff89d", "id": "CVE-2022-0435", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 9.0, "severity": "high", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 8.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 787 ], "description": "A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed. This flaw allows a remote user to crash the system or possibly escalate their privileges if they have access to the TIPC network.", "published": "2022-03-25T19:15:10Z", "updated": "2026-06-17T04:20:35Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "This vulnerability affects the TIPC cluster networking protocol. CONFIG_TIPC is not set, no tipc module is loaded, and no tipc.ko file exists anywhere on the filesystem. TIPC is unrelated to this product's networking functions." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "3ef03c18-1852-41a8-8fdb-b5b9d711b4bc", "id": "CVE-2022-43945", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 131, 770 ], "description": "The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC message with garbage data is still correctly formed according to the specification and is passed forward to handlers. Vulnerable code in NFSD is not expecting the oversized request and writes beyond the allocated buffer space. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "published": "2022-11-04T19:15:11Z", "updated": "2026-06-17T05:07:31Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "This vulnerability affects the NFSD (NFS server) implementation. CONFIG_NFSD is not set, no nfsd module is loaded, no module file exists on disk, and no NFS/RPC ports (2049, 111) are listening." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "30323146-d3e7-4722-9e9e-8cd31af8781c", "id": "CVE-2021-22555", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 4.6, "severity": "medium", "method": "CVSSv2", "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 787 ], "description": "A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space", "published": "2021-07-07T12:15:08Z", "updated": "2026-06-17T03:37:25Z", "analysis": { "state": "not_affected", "justification": "requires_environment", "detail": "Netfilter/x_tables code is present and loaded (ip_tables, ip6_tables, x_tables active), but the only documented exploitation vector requires unprivileged user namespaces (CLONE_NEWUSER) to obtain CAP_NET_ADMIN within an isolated namespace. CONFIG_USER_NS is not present in this kernel's configuration (confirmed via /proc/config.gz), and no service on this device relies on self-created user namespaces to obtain CAP_NET_ADMIN — the only processes holding this capability (hostapd, wpa_supplicant) receive it directly from the system via ujail sandboxing, not through the namespace mechanism the vulnerability exploits. No alternative exploitation path is documented in public research." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "c1d2afba-af2c-4d02-bc99-6132952e2a76", "id": "CVE-2021-0920", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 6.9, "severity": "medium", "method": "CVSSv2", "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 6.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 362, 416 ], "description": "In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel", "published": "2021-12-15T19:15:11Z", "updated": "2026-06-17T03:30:39Z", "analysis": { "state": "resolved", "detail": "UAF AF_UNIX/SCM_RIGHTS corrige en RC3 (unix_gc_barrier ajoutee, unix_dgram_recvmsg modifiee). Ticket #5487.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "d3cad96c-9f4e-423a-8b75-f93566b62516", "id": "CVE-2019-6974", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 6.8, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 8.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 362, 416 ], "description": "In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.", "published": "2019-02-15T15:29:00Z", "updated": "2026-06-17T02:39:51Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "This vulnerability affects the KVM hypervisor, requiring access to /dev/kvm and the ability to issue KVM_CREATE_DEVICE ioctls. No /dev/kvm device node exists, no kvm module is loaded, and CONFIG_KVM is not present in this kernel's configuration. This embedded router has no virtualization/hypervisor functionality." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "6ff6c186-9e48-4176-9e60-198a4d23f4c2", "id": "CVE-2019-11477", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.8, "severity": "high", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 190 ], "description": "Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff.", "published": "2019-06-19T00:15:12Z", "updated": "2026-06-17T02:12:58Z", "analysis": { "state": "resolved", "detail": "SACK Panic corrige en RC3 (tcp_fragment/tcp_sync_mss modifiees, tcp_min_snd_mss=48). Ticket #5482.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "0645c798-1d6c-44a5-a15a-1e2db419fc2c", "id": "CVE-2019-11478", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv3", "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 770, 400 ], "description": "Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit f070ef2ac66716357066b683fb0baf55f8191a2e.", "published": "2019-06-19T00:15:12Z", "updated": "2026-06-17T02:12:58Z", "analysis": { "state": "resolved", "detail": "SACK corrige en RC3 (fonctions TCP modifiees). Ticket #5488.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "4d9d7a2d-dc8d-4bd2-9119-31437ceb73b3", "id": "CVE-2019-11479", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 5.0, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 405, 770 ], "description": "Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits 967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363.", "published": "2019-06-19T00:15:12Z", "updated": "2026-06-17T02:12:58Z", "analysis": { "state": "resolved", "detail": "SACK low MSS corrige en RC3 (tcp_min_snd_mss=48). Ticket #5488.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "d6792169-021a-4987-b37e-937c78be187f", "id": "CVE-2019-13272", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.2, "severity": "high", "method": "CVSSv2", "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "description": "In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.", "published": "2019-07-17T13:15:10Z", "updated": "2026-06-17T02:16:26Z", "analysis": { "state": "not_affected", "justification": "requires_environment", "detail": "The documented exploitation path for this vulnerability relies on Polkit's pkexec helper combined with PTRACE_TRACEME. Neither pkexec nor any Polkit component is present on this system (confirmed via filesystem search). No alternative privileged setuid/ptrace relationship exploiting this flaw has been identified on this minimal embedded system." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "34907a39-c32b-41e7-b3a3-62b149cf4675", "id": "CVE-2019-16746", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 120 ], "description": "An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. It does not check the length of variable elements in a beacon head, leading to a buffer overflow.", "published": "2019-09-24T06:15:10Z", "updated": "2026-06-17T02:22:43Z", "analysis": { "state": "not_affected", "detail": "Code cfg80211/nl80211 vulnerable absent du firmware (backports WiFi non presents). Ticket #5493.", "justification": "code_not_present", "response": [ "will_not_fix" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "2a85d99c-5855-400f-98b2-20d02f147348", "id": "CVE-2019-14901", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 10.0, "severity": "high", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 122, 400, 787 ], "description": "A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the availability of the system. If code execution occurs, the code will run with the permissions of root. This will affect both confidentiality and integrity of files on the system.", "published": "2019-11-29T15:15:11Z", "updated": "2026-06-17T02:19:17Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "This vulnerability affects the Marvell mwifiex WiFi driver. This device uses a Qualcomm Atheros WiFi chipset (ath11k, confirmed via loaded kernel modules), not Marvell hardware. No mwifiex module is loaded, configured, or present on disk." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "b10d89c9-00b7-4460-b0c4-a9567404c286", "id": "CVE-2018-5390", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.8, "severity": "high", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 400 ], "description": "Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service.", "published": "2018-08-06T20:29:01Z", "updated": "2026-06-17T02:00:14Z", "analysis": { "state": "resolved", "detail": "SegmentSmack corrige en RC3 (tcp_prune_ofo_queue/tcp_data_queue modifiees). Ticket #5489.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "b04e4657-134a-4799-87f9-0b6023fdc115", "id": "CVE-2018-5391", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.8, "severity": "high", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C" }, { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 400, 20 ], "description": "The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a denial of service condition by sending specially crafted IP fragments. Various vulnerabilities in IP fragmentation have been discovered and fixed over the years. The current vulnerability (CVE-2018-5391) became exploitable in the Linux kernel with the increase of the IP fragment reassembly queue size.", "published": "2018-09-06T21:29:00Z", "updated": "2026-06-17T02:00:14Z", "analysis": { "state": "resolved", "detail": "FragmentSmack corrige en RC3 (inet_frag/ip_defrag modifiees). Ticket #5489.", "response": [ "update" ] }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] }, { "bom-ref": "49b92322-4b6c-48b2-827b-f5102fdaabc7", "id": "CVE-2022-2586", "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "ratings": [ { "source": { "name": "NVD", "url": "https://nvd.nist.gov/" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 416 ], "description": "It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.", "published": "2024-01-08T18:15:44Z", "updated": "2026-08-20T14:17:08Z", "analysis": { "state": "not_affected", "justification": "code_not_present", "detail": "This vulnerability exists in the nftables (nf_tables) subsystem's cross-table reference handling. CONFIG_NF_TABLES is not set in this kernel's configuration — this system uses legacy iptables/x_tables exclusively. The vulnerable code is not compiled into this kernel and cannot be reached." }, "affects": [ { "ref": "8ddfe889-7646-4d34-bc4c-3bc594802edf" } ] } ] }