{ "vulnerabilities": [ { "id": "SNYK-DEBIAN13-ACL-17677866", "cpes": [], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-54369", "title": "https://security-tracker.debian.org/tracker/CVE-2026-54369" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1" }, { "url": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions", "title": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34351", "title": "https://access.redhat.com/errata/RHSA-2026:34351" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42736", "title": "https://access.redhat.com/errata/RHSA-2026:42736" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42739", "title": "https://access.redhat.com/errata/RHSA-2026:42739" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43420", "title": "https://access.redhat.com/errata/RHSA-2026:43420" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54369", "title": "https://access.redhat.com/security/cve/CVE-2026-54369" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44481", "title": "https://access.redhat.com/errata/RHSA-2026:44481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46836", "title": "https://access.redhat.com/errata/RHSA-2026:46836" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50205", "title": "https://access.redhat.com/errata/RHSA-2026:50205" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53371", "title": "https://access.redhat.com/errata/RHSA-2026:53371" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54769", "title": "https://access.redhat.com/errata/RHSA-2026:54769" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:64805", "title": "https://access.redhat.com/errata/RHSA-2026:64805" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67140", "title": "https://access.redhat.com/errata/RHSA-2026:67140" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67142", "title": "https://access.redhat.com/errata/RHSA-2026:67142" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67144", "title": "https://access.redhat.com/errata/RHSA-2026:67144" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `acl` package and not the `acl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nacl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:13` `acl`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-54369](https://security-tracker.debian.org/tracker/CVE-2026-54369)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1)\n- [https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions](https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions)\n- [https://access.redhat.com/errata/RHSA-2026:34351](https://access.redhat.com/errata/RHSA-2026:34351)\n- [https://access.redhat.com/errata/RHSA-2026:42736](https://access.redhat.com/errata/RHSA-2026:42736)\n- [https://access.redhat.com/errata/RHSA-2026:42739](https://access.redhat.com/errata/RHSA-2026:42739)\n- [https://access.redhat.com/errata/RHSA-2026:43420](https://access.redhat.com/errata/RHSA-2026:43420)\n- [https://access.redhat.com/security/cve/CVE-2026-54369](https://access.redhat.com/security/cve/CVE-2026-54369)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490277](https://bugzilla.redhat.com/show_bug.cgi?id=2490277)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json)\n- [https://access.redhat.com/errata/RHSA-2026:44481](https://access.redhat.com/errata/RHSA-2026:44481)\n- [https://access.redhat.com/errata/RHSA-2026:46836](https://access.redhat.com/errata/RHSA-2026:46836)\n- [https://access.redhat.com/errata/RHSA-2026:50205](https://access.redhat.com/errata/RHSA-2026:50205)\n- [https://access.redhat.com/errata/RHSA-2026:53371](https://access.redhat.com/errata/RHSA-2026:53371)\n- [https://access.redhat.com/errata/RHSA-2026:54769](https://access.redhat.com/errata/RHSA-2026:54769)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:64805](https://access.redhat.com/errata/RHSA-2026:64805)\n- [https://access.redhat.com/errata/RHSA-2026:67140](https://access.redhat.com/errata/RHSA-2026:67140)\n- [https://access.redhat.com/errata/RHSA-2026:67142](https://access.redhat.com/errata/RHSA-2026:67142)\n- [https://access.redhat.com/errata/RHSA-2026:67144](https://access.redhat.com/errata/RHSA-2026:67144)\n", "epssDetails": { "percentile": "0.03798", "probability": "0.00153", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54369" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "acl", "creationTime": "2026-06-30T00:27:10.988309Z", "disclosureTime": "2026-06-29T14:16:57.487000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T00:27:10.995039Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T14:05:13.338489Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "coreutils@9.7-3", "acl/libacl1@2.3.2-2+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "acl/libacl1", "version": "2.3.2-2+b1" }, { "id": "SNYK-DEBIAN13-ACL-17677866", "cpes": [], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-54369", "title": "https://security-tracker.debian.org/tracker/CVE-2026-54369" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1" }, { "url": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions", "title": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34351", "title": "https://access.redhat.com/errata/RHSA-2026:34351" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42736", "title": "https://access.redhat.com/errata/RHSA-2026:42736" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42739", "title": "https://access.redhat.com/errata/RHSA-2026:42739" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43420", "title": "https://access.redhat.com/errata/RHSA-2026:43420" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54369", "title": "https://access.redhat.com/security/cve/CVE-2026-54369" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44481", "title": "https://access.redhat.com/errata/RHSA-2026:44481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46836", "title": "https://access.redhat.com/errata/RHSA-2026:46836" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50205", "title": "https://access.redhat.com/errata/RHSA-2026:50205" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53371", "title": "https://access.redhat.com/errata/RHSA-2026:53371" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54769", "title": "https://access.redhat.com/errata/RHSA-2026:54769" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:64805", "title": "https://access.redhat.com/errata/RHSA-2026:64805" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67140", "title": "https://access.redhat.com/errata/RHSA-2026:67140" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67142", "title": "https://access.redhat.com/errata/RHSA-2026:67142" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67144", "title": "https://access.redhat.com/errata/RHSA-2026:67144" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `acl` package and not the `acl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nacl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:13` `acl`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-54369](https://security-tracker.debian.org/tracker/CVE-2026-54369)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1)\n- [https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions](https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions)\n- [https://access.redhat.com/errata/RHSA-2026:34351](https://access.redhat.com/errata/RHSA-2026:34351)\n- [https://access.redhat.com/errata/RHSA-2026:42736](https://access.redhat.com/errata/RHSA-2026:42736)\n- [https://access.redhat.com/errata/RHSA-2026:42739](https://access.redhat.com/errata/RHSA-2026:42739)\n- [https://access.redhat.com/errata/RHSA-2026:43420](https://access.redhat.com/errata/RHSA-2026:43420)\n- [https://access.redhat.com/security/cve/CVE-2026-54369](https://access.redhat.com/security/cve/CVE-2026-54369)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490277](https://bugzilla.redhat.com/show_bug.cgi?id=2490277)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json)\n- [https://access.redhat.com/errata/RHSA-2026:44481](https://access.redhat.com/errata/RHSA-2026:44481)\n- [https://access.redhat.com/errata/RHSA-2026:46836](https://access.redhat.com/errata/RHSA-2026:46836)\n- [https://access.redhat.com/errata/RHSA-2026:50205](https://access.redhat.com/errata/RHSA-2026:50205)\n- [https://access.redhat.com/errata/RHSA-2026:53371](https://access.redhat.com/errata/RHSA-2026:53371)\n- [https://access.redhat.com/errata/RHSA-2026:54769](https://access.redhat.com/errata/RHSA-2026:54769)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:64805](https://access.redhat.com/errata/RHSA-2026:64805)\n- [https://access.redhat.com/errata/RHSA-2026:67140](https://access.redhat.com/errata/RHSA-2026:67140)\n- [https://access.redhat.com/errata/RHSA-2026:67142](https://access.redhat.com/errata/RHSA-2026:67142)\n- [https://access.redhat.com/errata/RHSA-2026:67144](https://access.redhat.com/errata/RHSA-2026:67144)\n", "epssDetails": { "percentile": "0.03798", "probability": "0.00153", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54369" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "acl", "creationTime": "2026-06-30T00:27:10.988309Z", "disclosureTime": "2026-06-29T14:16:57.487000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T00:27:10.995039Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T14:05:13.338489Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "sed@4.9-2", "acl/libacl1@2.3.2-2+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "acl/libacl1", "version": "2.3.2-2+b1" }, { "id": "SNYK-DEBIAN13-ACL-17677866", "cpes": [], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-54369", "title": "https://security-tracker.debian.org/tracker/CVE-2026-54369" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1" }, { "url": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions", "title": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34351", "title": "https://access.redhat.com/errata/RHSA-2026:34351" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42736", "title": "https://access.redhat.com/errata/RHSA-2026:42736" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42739", "title": "https://access.redhat.com/errata/RHSA-2026:42739" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43420", "title": "https://access.redhat.com/errata/RHSA-2026:43420" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54369", "title": "https://access.redhat.com/security/cve/CVE-2026-54369" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44481", "title": "https://access.redhat.com/errata/RHSA-2026:44481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46836", "title": "https://access.redhat.com/errata/RHSA-2026:46836" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50205", "title": "https://access.redhat.com/errata/RHSA-2026:50205" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53371", "title": "https://access.redhat.com/errata/RHSA-2026:53371" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54769", "title": "https://access.redhat.com/errata/RHSA-2026:54769" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:64805", "title": "https://access.redhat.com/errata/RHSA-2026:64805" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67140", "title": "https://access.redhat.com/errata/RHSA-2026:67140" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67142", "title": "https://access.redhat.com/errata/RHSA-2026:67142" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67144", "title": "https://access.redhat.com/errata/RHSA-2026:67144" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `acl` package and not the `acl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nacl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:13` `acl`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-54369](https://security-tracker.debian.org/tracker/CVE-2026-54369)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1)\n- [https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions](https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions)\n- [https://access.redhat.com/errata/RHSA-2026:34351](https://access.redhat.com/errata/RHSA-2026:34351)\n- [https://access.redhat.com/errata/RHSA-2026:42736](https://access.redhat.com/errata/RHSA-2026:42736)\n- [https://access.redhat.com/errata/RHSA-2026:42739](https://access.redhat.com/errata/RHSA-2026:42739)\n- [https://access.redhat.com/errata/RHSA-2026:43420](https://access.redhat.com/errata/RHSA-2026:43420)\n- [https://access.redhat.com/security/cve/CVE-2026-54369](https://access.redhat.com/security/cve/CVE-2026-54369)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490277](https://bugzilla.redhat.com/show_bug.cgi?id=2490277)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json)\n- [https://access.redhat.com/errata/RHSA-2026:44481](https://access.redhat.com/errata/RHSA-2026:44481)\n- [https://access.redhat.com/errata/RHSA-2026:46836](https://access.redhat.com/errata/RHSA-2026:46836)\n- [https://access.redhat.com/errata/RHSA-2026:50205](https://access.redhat.com/errata/RHSA-2026:50205)\n- [https://access.redhat.com/errata/RHSA-2026:53371](https://access.redhat.com/errata/RHSA-2026:53371)\n- [https://access.redhat.com/errata/RHSA-2026:54769](https://access.redhat.com/errata/RHSA-2026:54769)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:64805](https://access.redhat.com/errata/RHSA-2026:64805)\n- [https://access.redhat.com/errata/RHSA-2026:67140](https://access.redhat.com/errata/RHSA-2026:67140)\n- [https://access.redhat.com/errata/RHSA-2026:67142](https://access.redhat.com/errata/RHSA-2026:67142)\n- [https://access.redhat.com/errata/RHSA-2026:67144](https://access.redhat.com/errata/RHSA-2026:67144)\n", "epssDetails": { "percentile": "0.03798", "probability": "0.00153", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54369" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "acl", "creationTime": "2026-06-30T00:27:10.988309Z", "disclosureTime": "2026-06-29T14:16:57.487000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T00:27:10.995039Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T14:05:13.338489Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "dpkg@1.22.22", "tar@1.35+dfsg-3.1", "acl/libacl1@2.3.2-2+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "acl/libacl1", "version": "2.3.2-2+b1" }, { "id": "SNYK-DEBIAN13-ACL-17677866", "cpes": [], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-54369", "title": "https://security-tracker.debian.org/tracker/CVE-2026-54369" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1" }, { "url": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions", "title": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34351", "title": "https://access.redhat.com/errata/RHSA-2026:34351" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42736", "title": "https://access.redhat.com/errata/RHSA-2026:42736" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42739", "title": "https://access.redhat.com/errata/RHSA-2026:42739" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43420", "title": "https://access.redhat.com/errata/RHSA-2026:43420" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54369", "title": "https://access.redhat.com/security/cve/CVE-2026-54369" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44481", "title": "https://access.redhat.com/errata/RHSA-2026:44481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46836", "title": "https://access.redhat.com/errata/RHSA-2026:46836" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50205", "title": "https://access.redhat.com/errata/RHSA-2026:50205" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53371", "title": "https://access.redhat.com/errata/RHSA-2026:53371" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54769", "title": "https://access.redhat.com/errata/RHSA-2026:54769" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:64805", "title": "https://access.redhat.com/errata/RHSA-2026:64805" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67140", "title": "https://access.redhat.com/errata/RHSA-2026:67140" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67142", "title": "https://access.redhat.com/errata/RHSA-2026:67142" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67144", "title": "https://access.redhat.com/errata/RHSA-2026:67144" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `acl` package and not the `acl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nacl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:13` `acl`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-54369](https://security-tracker.debian.org/tracker/CVE-2026-54369)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1)\n- [https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions](https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions)\n- [https://access.redhat.com/errata/RHSA-2026:34351](https://access.redhat.com/errata/RHSA-2026:34351)\n- [https://access.redhat.com/errata/RHSA-2026:42736](https://access.redhat.com/errata/RHSA-2026:42736)\n- [https://access.redhat.com/errata/RHSA-2026:42739](https://access.redhat.com/errata/RHSA-2026:42739)\n- [https://access.redhat.com/errata/RHSA-2026:43420](https://access.redhat.com/errata/RHSA-2026:43420)\n- [https://access.redhat.com/security/cve/CVE-2026-54369](https://access.redhat.com/security/cve/CVE-2026-54369)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490277](https://bugzilla.redhat.com/show_bug.cgi?id=2490277)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json)\n- [https://access.redhat.com/errata/RHSA-2026:44481](https://access.redhat.com/errata/RHSA-2026:44481)\n- [https://access.redhat.com/errata/RHSA-2026:46836](https://access.redhat.com/errata/RHSA-2026:46836)\n- [https://access.redhat.com/errata/RHSA-2026:50205](https://access.redhat.com/errata/RHSA-2026:50205)\n- [https://access.redhat.com/errata/RHSA-2026:53371](https://access.redhat.com/errata/RHSA-2026:53371)\n- [https://access.redhat.com/errata/RHSA-2026:54769](https://access.redhat.com/errata/RHSA-2026:54769)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:64805](https://access.redhat.com/errata/RHSA-2026:64805)\n- [https://access.redhat.com/errata/RHSA-2026:67140](https://access.redhat.com/errata/RHSA-2026:67140)\n- [https://access.redhat.com/errata/RHSA-2026:67142](https://access.redhat.com/errata/RHSA-2026:67142)\n- [https://access.redhat.com/errata/RHSA-2026:67144](https://access.redhat.com/errata/RHSA-2026:67144)\n", "epssDetails": { "percentile": "0.03798", "probability": "0.00153", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54369" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "acl", "creationTime": "2026-06-30T00:27:10.988309Z", "disclosureTime": "2026-06-29T14:16:57.487000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T00:27:10.995039Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T14:05:13.338489Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "adduser@3.152", "shadow/passwd@1:4.17.4-2", "acl/libacl1@2.3.2-2+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "acl/libacl1", "version": "2.3.2-2+b1" }, { "id": "SNYK-DEBIAN13-ATTR-17678182", "cpes": [], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-54371", "title": "https://security-tracker.debian.org/tracker/CVE-2026-54371" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f", "title": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b", "title": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b" }, { "url": "https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr", "title": "https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54371", "title": "https://access.redhat.com/security/cve/CVE-2026-54371" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490283", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490283" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34889", "title": "https://access.redhat.com/errata/RHSA-2026:34889" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56133", "title": "https://access.redhat.com/errata/RHSA-2026:56133" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59380", "title": "https://access.redhat.com/errata/RHSA-2026:59380" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60226", "title": "https://access.redhat.com/errata/RHSA-2026:60226" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61783", "title": "https://access.redhat.com/errata/RHSA-2026:61783" }, { "url": "https://access.redhat.com/errata/RHSA-2026:63135", "title": "https://access.redhat.com/errata/RHSA-2026:63135" }, { "url": "https://access.redhat.com/errata/RHSA-2026:63138", "title": "https://access.redhat.com/errata/RHSA-2026:63138" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66018", "title": "https://access.redhat.com/errata/RHSA-2026:66018" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:53.584255Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-07-03T06:26:07.726913Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-16T11:03:47.219902Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:53.584255Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-07-03T06:26:07.726913Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-16T11:03:47.219902Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `attr` package and not the `attr` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nattr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.\n## Remediation\nThere is no fixed version for `Debian:13` `attr`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-54371](https://security-tracker.debian.org/tracker/CVE-2026-54371)\n- [https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f](https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f)\n- [https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b](https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b)\n- [https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr](https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr)\n- [https://access.redhat.com/security/cve/CVE-2026-54371](https://access.redhat.com/security/cve/CVE-2026-54371)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490283](https://bugzilla.redhat.com/show_bug.cgi?id=2490283)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json)\n- [https://access.redhat.com/errata/RHSA-2026:34889](https://access.redhat.com/errata/RHSA-2026:34889)\n- [https://access.redhat.com/errata/RHSA-2026:56133](https://access.redhat.com/errata/RHSA-2026:56133)\n- [https://access.redhat.com/errata/RHSA-2026:59380](https://access.redhat.com/errata/RHSA-2026:59380)\n- [https://access.redhat.com/errata/RHSA-2026:60226](https://access.redhat.com/errata/RHSA-2026:60226)\n- [https://access.redhat.com/errata/RHSA-2026:61783](https://access.redhat.com/errata/RHSA-2026:61783)\n- [https://access.redhat.com/errata/RHSA-2026:63135](https://access.redhat.com/errata/RHSA-2026:63135)\n- [https://access.redhat.com/errata/RHSA-2026:63138](https://access.redhat.com/errata/RHSA-2026:63138)\n- [https://access.redhat.com/errata/RHSA-2026:66018](https://access.redhat.com/errata/RHSA-2026:66018)\n", "epssDetails": { "percentile": "0.03325", "probability": "0.00146", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54371" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "attr", "creationTime": "2026-06-30T00:33:09.679328Z", "disclosureTime": "2026-06-29T14:16:57.823000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T00:33:09.682988Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:56.896952Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "coreutils@9.7-3", "attr/libattr1@1:2.5.2-3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "attr/libattr1", "version": "1:2.5.2-3" }, { "id": "SNYK-DEBIAN13-ATTR-17678182", "cpes": [], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-54371", "title": "https://security-tracker.debian.org/tracker/CVE-2026-54371" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f", "title": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b", "title": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b" }, { "url": "https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr", "title": "https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54371", "title": "https://access.redhat.com/security/cve/CVE-2026-54371" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490283", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490283" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34889", "title": "https://access.redhat.com/errata/RHSA-2026:34889" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56133", "title": "https://access.redhat.com/errata/RHSA-2026:56133" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59380", "title": "https://access.redhat.com/errata/RHSA-2026:59380" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60226", "title": "https://access.redhat.com/errata/RHSA-2026:60226" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61783", "title": "https://access.redhat.com/errata/RHSA-2026:61783" }, { "url": "https://access.redhat.com/errata/RHSA-2026:63135", "title": "https://access.redhat.com/errata/RHSA-2026:63135" }, { "url": "https://access.redhat.com/errata/RHSA-2026:63138", "title": "https://access.redhat.com/errata/RHSA-2026:63138" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66018", "title": "https://access.redhat.com/errata/RHSA-2026:66018" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:53.584255Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-07-03T06:26:07.726913Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-16T11:03:47.219902Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:53.584255Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-07-03T06:26:07.726913Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-16T11:03:47.219902Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `attr` package and not the `attr` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nattr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.\n## Remediation\nThere is no fixed version for `Debian:13` `attr`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-54371](https://security-tracker.debian.org/tracker/CVE-2026-54371)\n- [https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f](https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f)\n- [https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b](https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b)\n- [https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr](https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr)\n- [https://access.redhat.com/security/cve/CVE-2026-54371](https://access.redhat.com/security/cve/CVE-2026-54371)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490283](https://bugzilla.redhat.com/show_bug.cgi?id=2490283)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json)\n- [https://access.redhat.com/errata/RHSA-2026:34889](https://access.redhat.com/errata/RHSA-2026:34889)\n- [https://access.redhat.com/errata/RHSA-2026:56133](https://access.redhat.com/errata/RHSA-2026:56133)\n- [https://access.redhat.com/errata/RHSA-2026:59380](https://access.redhat.com/errata/RHSA-2026:59380)\n- [https://access.redhat.com/errata/RHSA-2026:60226](https://access.redhat.com/errata/RHSA-2026:60226)\n- [https://access.redhat.com/errata/RHSA-2026:61783](https://access.redhat.com/errata/RHSA-2026:61783)\n- [https://access.redhat.com/errata/RHSA-2026:63135](https://access.redhat.com/errata/RHSA-2026:63135)\n- [https://access.redhat.com/errata/RHSA-2026:63138](https://access.redhat.com/errata/RHSA-2026:63138)\n- [https://access.redhat.com/errata/RHSA-2026:66018](https://access.redhat.com/errata/RHSA-2026:66018)\n", "epssDetails": { "percentile": "0.03325", "probability": "0.00146", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54371" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "attr", "creationTime": "2026-06-30T00:33:09.679328Z", "disclosureTime": "2026-06-29T14:16:57.823000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T00:33:09.682988Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:56.896952Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "adduser@3.152", "shadow/passwd@1:4.17.4-2", "attr/libattr1@1:2.5.2-3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "attr/libattr1", "version": "1:2.5.2-3" }, { "id": "SNYK-DEBIAN13-CYRUSSASL2-20652395", "cpes": [], "title": "Heap-based Buffer Overflow", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-107161", "title": "https://security-tracker.debian.org/tracker/CVE-2026-107161" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-107161", "title": "https://access.redhat.com/security/cve/CVE-2026-107161" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460420", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2460420" }, { "url": "http://www.openwall.com/lists/oss-security/2026/10/09/20", "title": "http://www.openwall.com/lists/oss-security/2026/10/09/20" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-08T01:32:09.250871Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-08T05:38:37.089693Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-08T01:32:09.250871Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-08T05:38:37.089693Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `cyrus-sasl2` package and not the `cyrus-sasl2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application.\n## Remediation\nThere is no fixed version for `Debian:13` `cyrus-sasl2`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-107161](https://security-tracker.debian.org/tracker/CVE-2026-107161)\n- [https://access.redhat.com/security/cve/CVE-2026-107161](https://access.redhat.com/security/cve/CVE-2026-107161)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2460420](https://bugzilla.redhat.com/show_bug.cgi?id=2460420)\n- [http://www.openwall.com/lists/oss-security/2026/10/09/20](http://www.openwall.com/lists/oss-security/2026/10/09/20)\n", "epssDetails": { "percentile": "0.18522", "probability": "0.00277", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-107161" ], "CWE": [ "CWE-122" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "cyrus-sasl2", "creationTime": "2026-10-09T01:11:05.444124Z", "disclosureTime": "2026-10-07T20:17:10.977000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-10-09T01:11:05.452357Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:46:50.371648Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openldap/libldap2@2.6.10+dfsg-1", "cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9", "cyrus-sasl2/libsasl2-modules-db@2.1.28+dfsg1-9" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "cyrus-sasl2/libsasl2-modules-db", "version": "2.1.28+dfsg1-9" }, { "id": "SNYK-DEBIAN13-CYRUSSASL2-20652395", "cpes": [], "title": "Heap-based Buffer Overflow", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-107161", "title": "https://security-tracker.debian.org/tracker/CVE-2026-107161" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-107161", "title": "https://access.redhat.com/security/cve/CVE-2026-107161" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460420", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2460420" }, { "url": "http://www.openwall.com/lists/oss-security/2026/10/09/20", "title": "http://www.openwall.com/lists/oss-security/2026/10/09/20" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-08T01:32:09.250871Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-08T05:38:37.089693Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-08T01:32:09.250871Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-08T05:38:37.089693Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `cyrus-sasl2` package and not the `cyrus-sasl2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application.\n## Remediation\nThere is no fixed version for `Debian:13` `cyrus-sasl2`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-107161](https://security-tracker.debian.org/tracker/CVE-2026-107161)\n- [https://access.redhat.com/security/cve/CVE-2026-107161](https://access.redhat.com/security/cve/CVE-2026-107161)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2460420](https://bugzilla.redhat.com/show_bug.cgi?id=2460420)\n- [http://www.openwall.com/lists/oss-security/2026/10/09/20](http://www.openwall.com/lists/oss-security/2026/10/09/20)\n", "epssDetails": { "percentile": "0.18522", "probability": "0.00277", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-107161" ], "CWE": [ "CWE-122" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "cyrus-sasl2", "creationTime": "2026-10-09T01:11:05.444124Z", "disclosureTime": "2026-10-07T20:17:10.977000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-10-09T01:11:05.452357Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:46:50.371648Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openldap/libldap2@2.6.10+dfsg-1", "cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "cyrus-sasl2/libsasl2-2", "version": "2.1.28+dfsg1-9" }, { "id": "SNYK-DEBIAN13-EXPAT-15158113", "cpes": [], "title": "Integer Overflow or Wraparound", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<2.8.2-1~deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "2.8.2-1~deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-25210", "title": "https://security-tracker.debian.org/tracker/CVE-2026-25210" }, { "url": "https://github.com/libexpat/libexpat/pull/1075", "title": "https://github.com/libexpat/libexpat/pull/1075" }, { "url": "https://github.com/libexpat/libexpat/pull/1075/commits/9c2d990389e6abe2e44527eeaa8b39f16fe859c7", "title": "https://github.com/libexpat/libexpat/pull/1075/commits/9c2d990389e6abe2e44527eeaa8b39f16fe859c7" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-03-11T01:17:33.097754Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "cvssV3BaseScore": 6.9, "modificationTime": "2026-01-30T21:11:35.448524Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-02-27T11:01:01.391245Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-03-11T01:17:33.097754Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.9, "cvssVersion": "3.1", "modificationTime": "2026-01-30T21:11:35.448524Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-02-27T11:01:01.391245Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `expat` package and not the `expat` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIn libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.\n## Remediation\nUpgrade `Debian:13` `expat` to version 2.8.2-1~deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-25210](https://security-tracker.debian.org/tracker/CVE-2026-25210)\n- [https://github.com/libexpat/libexpat/pull/1075](https://github.com/libexpat/libexpat/pull/1075)\n- [https://github.com/libexpat/libexpat/pull/1075/commits/9c2d990389e6abe2e44527eeaa8b39f16fe859c7](https://github.com/libexpat/libexpat/pull/1075/commits/9c2d990389e6abe2e44527eeaa8b39f16fe859c7)\n- [https://cert-portal.siemens.com/productcert/html/ssa-253495.html](https://cert-portal.siemens.com/productcert/html/ssa-253495.html)\n", "epssDetails": { "percentile": "0.10558", "probability": "0.00214", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-25210" ], "CWE": [ "CWE-190" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "expat", "creationTime": "2026-01-31T04:14:37.139101Z", "disclosureTime": "2026-01-30T07:16:15.570000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-01-31T04:14:37.145033Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-27T14:05:48.869946Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "lua-expat/lua-expat@1.5.2-1+b1", "expat/libexpat1@2.7.1-2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "expat/libexpat1", "version": "2.7.1-2", "nearestFixedInVersion": "2.8.2-1~deb13u1" }, { "id": "SNYK-DEBIAN13-EXPAT-16650098", "cpes": [], "title": "Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<2.8.2-1~deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "2.8.2-1~deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-45186", "title": "https://security-tracker.debian.org/tracker/CVE-2026-45186" }, { "url": "https://github.com/libexpat/libexpat/pull/1216", "title": "https://github.com/libexpat/libexpat/pull/1216" }, { "url": "http://www.openwall.com/lists/oss-security/2026/05/11/16", "title": "http://www.openwall.com/lists/oss-security/2026/05/11/16" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22715", "title": "https://access.redhat.com/errata/RHSA-2026:22715" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22721", "title": "https://access.redhat.com/errata/RHSA-2026:22721" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23230", "title": "https://access.redhat.com/errata/RHSA-2026:23230" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:27201", "title": "https://access.redhat.com/errata/RHSA-2026:27201" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-45186", "title": "https://access.redhat.com/security/cve/CVE-2026-45186" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468575", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2468575" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45186.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45186.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-15T01:17:34.441251Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-20T05:26:34.072921Z" }, { "assigner": "SUSE", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 2.9, "modificationTime": "2026-08-22T22:00:04.406229Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-15T01:17:34.441251Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-20T05:26:34.072921Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "low", "baseScore": 2.9, "cvssVersion": "3.1", "modificationTime": "2026-08-22T22:00:04.406229Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `expat` package and not the `expat` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIn libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.\n## Remediation\nUpgrade `Debian:13` `expat` to version 2.8.2-1~deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-45186](https://security-tracker.debian.org/tracker/CVE-2026-45186)\n- [https://github.com/libexpat/libexpat/pull/1216](https://github.com/libexpat/libexpat/pull/1216)\n- [http://www.openwall.com/lists/oss-security/2026/05/11/16](http://www.openwall.com/lists/oss-security/2026/05/11/16)\n- [https://access.redhat.com/errata/RHSA-2026:22715](https://access.redhat.com/errata/RHSA-2026:22715)\n- [https://access.redhat.com/errata/RHSA-2026:22721](https://access.redhat.com/errata/RHSA-2026:22721)\n- [https://access.redhat.com/errata/RHSA-2026:23230](https://access.redhat.com/errata/RHSA-2026:23230)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:27201](https://access.redhat.com/errata/RHSA-2026:27201)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/security/cve/CVE-2026-45186](https://access.redhat.com/security/cve/CVE-2026-45186)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2468575](https://bugzilla.redhat.com/show_bug.cgi?id=2468575)\n- [https://cert-portal.siemens.com/productcert/html/ssa-082556.html](https://cert-portal.siemens.com/productcert/html/ssa-082556.html)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45186.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45186.json)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n", "epssDetails": { "percentile": "0.38900", "probability": "0.00479", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45186" ], "CWE": [ "CWE-407" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "expat", "creationTime": "2026-05-14T03:14:57.908531Z", "disclosureTime": "2026-05-10T07:16:07.883000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-14T03:14:57.914104Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-27T14:04:51.142011Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "lua-expat/lua-expat@1.5.2-1+b1", "expat/libexpat1@2.7.1-2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "expat/libexpat1", "version": "2.7.1-2", "nearestFixedInVersion": "2.8.2-1~deb13u1" }, { "id": "SNYK-DEBIAN13-EXPAT-18968950", "cpes": [], "title": "Algorithmic Complexity", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<2.9.0-1~deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "2.9.0-1~deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-66046", "title": "https://security-tracker.debian.org/tracker/CVE-2026-66046" }, { "url": "https://github.com/libexpat/libexpat/pull/1321", "title": "https://github.com/libexpat/libexpat/pull/1321" }, { "url": "https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity", "title": "https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-19T01:29:39.086183Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-16T05:57:24.568113Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-30T11:06:23.146464Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-19T01:29:39.086183Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-16T05:57:24.568113Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-30T11:06:23.146464Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `expat` package and not the `expat` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nExpat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.\n## Remediation\nUpgrade `Debian:13` `expat` to version 2.9.0-1~deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-66046](https://security-tracker.debian.org/tracker/CVE-2026-66046)\n- [https://github.com/libexpat/libexpat/pull/1321](https://github.com/libexpat/libexpat/pull/1321)\n- [https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity](https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity)\n", "epssDetails": { "percentile": "0.52836", "probability": "0.00742", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-66046" ], "CWE": [ "CWE-407" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "expat", "creationTime": "2026-08-20T01:02:45.245706Z", "disclosureTime": "2026-08-18T15:16:57Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-08-20T01:02:45.252831Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-16T13:01:35.004190Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "lua-expat/lua-expat@1.5.2-1+b1", "expat/libexpat1@2.7.1-2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "expat/libexpat1", "version": "2.7.1-2", "nearestFixedInVersion": "2.9.0-1~deb13u1" }, { "id": "SNYK-DEBIAN13-EXPAT-19012842", "cpes": [], "title": "Use After Free", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<2.9.0-1~deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "2.9.0-1~deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-76957", "title": "https://security-tracker.debian.org/tracker/CVE-2026-76957" }, { "url": "https://github.com/libexpat/libexpat/pull/1322", "title": "https://github.com/libexpat/libexpat/pull/1322" }, { "url": "https://github.com/libexpat/libexpat/pull/1329", "title": "https://github.com/libexpat/libexpat/pull/1329" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-09-09T01:19:07.896372Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 4.9, "modificationTime": "2026-08-27T06:32:39.373495Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 4.9, "modificationTime": "2026-09-30T11:06:25.726504Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-09-09T01:19:07.896372Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "Red Hat", "severity": "medium", "baseScore": 4.9, "cvssVersion": "3.1", "modificationTime": "2026-08-27T06:32:39.373495Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 4.9, "cvssVersion": "3.1", "modificationTime": "2026-09-30T11:06:25.726504Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `expat` package and not the `expat` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nlibexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.\n## Remediation\nUpgrade `Debian:13` `expat` to version 2.9.0-1~deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-76957](https://security-tracker.debian.org/tracker/CVE-2026-76957)\n- [https://github.com/libexpat/libexpat/pull/1322](https://github.com/libexpat/libexpat/pull/1322)\n- [https://github.com/libexpat/libexpat/pull/1329](https://github.com/libexpat/libexpat/pull/1329)\n", "epssDetails": { "percentile": "0.01032", "probability": "0.00107", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-76957" ], "CWE": [ "CWE-416" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "expat", "creationTime": "2026-08-20T23:49:37.108106Z", "disclosureTime": "2026-08-20T05:16:29.747000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-08-20T23:49:37.161037Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-16T13:01:19.937779Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "lua-expat/lua-expat@1.5.2-1+b1", "expat/libexpat1@2.7.1-2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "expat/libexpat1", "version": "2.7.1-2", "nearestFixedInVersion": "2.9.0-1~deb13u1" }, { "id": "SNYK-DEBIAN13-EXPAT-19012850", "cpes": [], "title": "Unexpected Status Code or Return Value", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<2.9.0-1~deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "2.9.0-1~deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-76956", "title": "https://security-tracker.debian.org/tracker/CVE-2026-76956" }, { "url": "https://github.com/libexpat/libexpat/pull/1326", "title": "https://github.com/libexpat/libexpat/pull/1326" }, { "url": "https://github.com/libexpat/libexpat/pull/1329", "title": "https://github.com/libexpat/libexpat/pull/1329" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-09T01:19:52.934894Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-08-27T06:32:30.374440Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-30T11:06:27.618965Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-09T01:19:52.934894Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-08-27T06:32:30.374440Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-30T11:06:27.618965Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `expat` package and not the `expat` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIn libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.\n## Remediation\nUpgrade `Debian:13` `expat` to version 2.9.0-1~deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-76956](https://security-tracker.debian.org/tracker/CVE-2026-76956)\n- [https://github.com/libexpat/libexpat/pull/1326](https://github.com/libexpat/libexpat/pull/1326)\n- [https://github.com/libexpat/libexpat/pull/1329](https://github.com/libexpat/libexpat/pull/1329)\n", "epssDetails": { "percentile": "0.19092", "probability": "0.00287", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-76956" ], "CWE": [ "CWE-394" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "expat", "creationTime": "2026-08-20T23:49:45.576839Z", "disclosureTime": "2026-08-20T05:16:29.610000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-08-20T23:49:45.581001Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-16T13:01:36.095327Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "lua-expat/lua-expat@1.5.2-1+b1", "expat/libexpat1@2.7.1-2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "expat/libexpat1", "version": "2.7.1-2", "nearestFixedInVersion": "2.9.0-1~deb13u1" }, { "id": "SNYK-DEBIAN13-EXPAT-19964593", "cpes": [], "title": "Improper Handling of Unicode Encoding", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "<2.9.0-1~deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "2.9.0-1~deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-93990", "title": "https://security-tracker.debian.org/tracker/CVE-2026-93990" }, { "url": "https://github.com/libexpat/libexpat", "title": "https://github.com/libexpat/libexpat" }, { "url": "https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a", "title": "https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a" }, { "url": "https://github.com/libexpat/libexpat/pull/1282", "title": "https://github.com/libexpat/libexpat/pull/1282" }, { "url": "https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate", "title": "https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate" }, { "url": "https://blog.hartwork.org/posts/expat-2-8-5-released/", "title": "https://blog.hartwork.org/posts/expat-2-8-5-released/" }, { "url": "https://github.com/libexpat/libexpat/releases/tag/R_2_8_5", "title": "https://github.com/libexpat/libexpat/releases/tag/R_2_8_5" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-20T01:29:53.027508Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-23T13:35:17.823744Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "cvssV3BaseScore": 5.3, "modificationTime": "2026-10-13T11:05:45.498850Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-20T01:29:53.027508Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-23T13:35:17.823744Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-10-13T11:05:45.498850Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `expat` package and not the `expat` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nExpat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.\n## Remediation\nUpgrade `Debian:13` `expat` to version 2.9.0-1~deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-93990](https://security-tracker.debian.org/tracker/CVE-2026-93990)\n- [https://github.com/libexpat/libexpat](https://github.com/libexpat/libexpat)\n- [https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a](https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a)\n- [https://github.com/libexpat/libexpat/pull/1282](https://github.com/libexpat/libexpat/pull/1282)\n- [https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate](https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate)\n- [https://blog.hartwork.org/posts/expat-2-8-5-released/](https://blog.hartwork.org/posts/expat-2-8-5-released/)\n- [https://github.com/libexpat/libexpat/releases/tag/R_2_8_5](https://github.com/libexpat/libexpat/releases/tag/R_2_8_5)\n", "epssDetails": { "percentile": "0.32021", "probability": "0.00403", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-93990" ], "CWE": [ "CWE-176" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "expat", "creationTime": "2026-09-20T12:52:35.659607Z", "disclosureTime": "2026-09-19T23:17:10.203000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-20T12:52:35.665975Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-16T13:01:25.350467Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "lua-expat/lua-expat@1.5.2-1+b1", "expat/libexpat1@2.7.1-2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "expat/libexpat1", "version": "2.7.1-2", "nearestFixedInVersion": "2.9.0-1~deb13u1" }, { "id": "SNYK-DEBIAN13-EXPAT-20514789", "cpes": [], "title": "Out-of-bounds Read", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L", "credit": [ "" ], "semver": { "vulnerable": [ "<2.9.0-1~deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "2.9.0-1~deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.2, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-77214", "title": "https://security-tracker.debian.org/tracker/CVE-2026-77214" }, { "url": "https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0", "title": "https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0" }, { "url": "https://github.com/libexpat/libexpat/pull/1393", "title": "https://github.com/libexpat/libexpat/pull/1393" }, { "url": "https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer", "title": "https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L", "cvssV3BaseScore": 8.2, "modificationTime": "2026-10-08T01:31:04.086141Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L", "cvssV3BaseScore": 8.2, "modificationTime": "2026-10-08T05:37:44.008642Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "cvssV3BaseScore": 8.2, "modificationTime": "2026-10-13T11:05:41.785312Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L", "assigner": "NVD", "severity": "high", "baseScore": 8.2, "cvssVersion": "3.1", "modificationTime": "2026-10-08T01:31:04.086141Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L", "assigner": "Red Hat", "severity": "high", "baseScore": 8.2, "cvssVersion": "3.1", "modificationTime": "2026-10-08T05:37:44.008642Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 8.2, "cvssVersion": "3.1", "modificationTime": "2026-10-13T11:05:41.785312Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `expat` package and not the `expat` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nlibexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.\n## Remediation\nUpgrade `Debian:13` `expat` to version 2.9.0-1~deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-77214](https://security-tracker.debian.org/tracker/CVE-2026-77214)\n- [https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0](https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0)\n- [https://github.com/libexpat/libexpat/pull/1393](https://github.com/libexpat/libexpat/pull/1393)\n- [https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer](https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer)\n", "epssDetails": { "percentile": "0.44207", "probability": "0.00549", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-77214" ], "CWE": [ "CWE-125" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "expat", "creationTime": "2026-10-06T01:15:10.632943Z", "disclosureTime": "2026-10-07T15:17:53.327000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-10-06T01:15:10.638615Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-16T13:01:23.111706Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "lua-expat/lua-expat@1.5.2-1+b1", "expat/libexpat1@2.7.1-2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "expat/libexpat1", "version": "2.7.1-2", "nearestFixedInVersion": "2.9.0-1~deb13u1" }, { "id": "SNYK-DEBIAN13-GNUTLS28-16344298", "cpes": [], "title": "Improper Validation of Specified Quantity in Input", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "<3.8.9-3+deb13u4" ] }, "exploit": "Not Defined", "fixedIn": [ "3.8.9-3+deb13u4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.2, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-42013", "title": "https://security-tracker.debian.org/tracker/CVE-2026-42013" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-42013", "title": "https://access.redhat.com/security/cve/CVE-2026-42013" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20611", "title": "https://access.redhat.com/errata/RHSA-2026:20611" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20613", "title": "https://access.redhat.com/errata/RHSA-2026:20613" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20612", "title": "https://access.redhat.com/errata/RHSA-2026:20612" }, { "url": "https://access.redhat.com/errata/RHSA-2026:13274", "title": "https://access.redhat.com/errata/RHSA-2026:13274" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26409", "title": "https://access.redhat.com/errata/RHSA-2026:26409" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30004", "title": "https://access.redhat.com/errata/RHSA-2026:30004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30849", "title": "https://access.redhat.com/errata/RHSA-2026:30849" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30850", "title": "https://access.redhat.com/errata/RHSA-2026:30850" }, { "url": "https://access.redhat.com/errata/RHSA-2026:32962", "title": "https://access.redhat.com/errata/RHSA-2026:32962" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33125", "title": "https://access.redhat.com/errata/RHSA-2026:33125" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40762", "title": "https://access.redhat.com/errata/RHSA-2026:40762" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41921", "title": "https://access.redhat.com/errata/RHSA-2026:41921" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43575", "title": "https://access.redhat.com/errata/RHSA-2026:43575" }, { "url": "https://www.gnutls.org/security-new.html%23GNUTLS-SA-2026-04-29-8", "title": "https://www.gnutls.org/security-new.html%23GNUTLS-SA-2026-04-29-8" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57483", "title": "https://access.redhat.com/errata/RHSA-2026:57483" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56853", "title": "https://access.redhat.com/errata/RHSA-2026:56853" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60019", "title": "https://access.redhat.com/errata/RHSA-2026:60019" }, { "url": "https://access.redhat.com/errata/RHSA-2026:72502", "title": "https://access.redhat.com/errata/RHSA-2026:72502" }, { "url": "https://access.redhat.com/errata/RHSA-2026:74674", "title": "https://access.redhat.com/errata/RHSA-2026:74674" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82304", "title": "https://access.redhat.com/errata/RHSA-2026:82304" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82322", "title": "https://access.redhat.com/errata/RHSA-2026:82322" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82347", "title": "https://access.redhat.com/errata/RHSA-2026:82347" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82354", "title": "https://access.redhat.com/errata/RHSA-2026:82354" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82372", "title": "https://access.redhat.com/errata/RHSA-2026:82372" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82857", "title": "https://access.redhat.com/errata/RHSA-2026:82857" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82888", "title": "https://access.redhat.com/errata/RHSA-2026:82888" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "cvssV3BaseScore": 8.2, "modificationTime": "2026-05-27T01:20:29.680083Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "cvssV3BaseScore": 8.2, "modificationTime": "2026-05-27T05:26:35.954355Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-05-28T11:03:19.130070Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 8.2, "cvssVersion": "3.1", "modificationTime": "2026-05-27T01:20:29.680083Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 8.2, "cvssVersion": "3.1", "modificationTime": "2026-05-27T05:26:35.954355Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-05-28T11:03:19.130070Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnutls28` package and not the `gnutls28` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.\n## Remediation\nUpgrade `Debian:13` `gnutls28` to version 3.8.9-3+deb13u4 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-42013](https://security-tracker.debian.org/tracker/CVE-2026-42013)\n- [https://access.redhat.com/security/cve/CVE-2026-42013](https://access.redhat.com/security/cve/CVE-2026-42013)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2467448](https://bugzilla.redhat.com/show_bug.cgi?id=2467448)\n- [https://access.redhat.com/errata/RHSA-2026:20611](https://access.redhat.com/errata/RHSA-2026:20611)\n- [https://access.redhat.com/errata/RHSA-2026:20613](https://access.redhat.com/errata/RHSA-2026:20613)\n- [https://access.redhat.com/errata/RHSA-2026:20612](https://access.redhat.com/errata/RHSA-2026:20612)\n- [https://access.redhat.com/errata/RHSA-2026:13274](https://access.redhat.com/errata/RHSA-2026:13274)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:26409](https://access.redhat.com/errata/RHSA-2026:26409)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:30004](https://access.redhat.com/errata/RHSA-2026:30004)\n- [https://access.redhat.com/errata/RHSA-2026:30849](https://access.redhat.com/errata/RHSA-2026:30849)\n- [https://access.redhat.com/errata/RHSA-2026:30850](https://access.redhat.com/errata/RHSA-2026:30850)\n- [https://access.redhat.com/errata/RHSA-2026:32962](https://access.redhat.com/errata/RHSA-2026:32962)\n- [https://access.redhat.com/errata/RHSA-2026:33125](https://access.redhat.com/errata/RHSA-2026:33125)\n- [https://access.redhat.com/errata/RHSA-2026:40762](https://access.redhat.com/errata/RHSA-2026:40762)\n- [https://access.redhat.com/errata/RHSA-2026:41921](https://access.redhat.com/errata/RHSA-2026:41921)\n- [https://access.redhat.com/errata/RHSA-2026:43575](https://access.redhat.com/errata/RHSA-2026:43575)\n- [https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-8](https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-8)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:57483](https://access.redhat.com/errata/RHSA-2026:57483)\n- [https://access.redhat.com/errata/RHSA-2026:56853](https://access.redhat.com/errata/RHSA-2026:56853)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:60019](https://access.redhat.com/errata/RHSA-2026:60019)\n- [https://access.redhat.com/errata/RHSA-2026:72502](https://access.redhat.com/errata/RHSA-2026:72502)\n- [https://access.redhat.com/errata/RHSA-2026:74674](https://access.redhat.com/errata/RHSA-2026:74674)\n- [https://access.redhat.com/errata/RHSA-2026:82304](https://access.redhat.com/errata/RHSA-2026:82304)\n- [https://access.redhat.com/errata/RHSA-2026:82322](https://access.redhat.com/errata/RHSA-2026:82322)\n- [https://access.redhat.com/errata/RHSA-2026:82347](https://access.redhat.com/errata/RHSA-2026:82347)\n- [https://access.redhat.com/errata/RHSA-2026:82354](https://access.redhat.com/errata/RHSA-2026:82354)\n- [https://access.redhat.com/errata/RHSA-2026:82372](https://access.redhat.com/errata/RHSA-2026:82372)\n- [https://access.redhat.com/errata/RHSA-2026:82857](https://access.redhat.com/errata/RHSA-2026:82857)\n- [https://access.redhat.com/errata/RHSA-2026:82888](https://access.redhat.com/errata/RHSA-2026:82888)\n", "epssDetails": { "percentile": "0.44469", "probability": "0.00564", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-42013" ], "CWE": [ "CWE-1284" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "gnutls28", "creationTime": "2026-05-02T16:24:21.942546Z", "disclosureTime": "2026-05-26T22:16:42.050000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-02T16:24:21.945511Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T01:31:40.470302Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "luarocks@3.8.0+dfsg1-1", "wget@1.25.0-2", "gnutls28/libgnutls30t64@3.8.9-3+deb13u2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "gnutls28/libgnutls30t64", "version": "3.8.9-3+deb13u2", "nearestFixedInVersion": "3.8.9-3+deb13u4" }, { "id": "SNYK-DEBIAN13-GNUTLS28-16344302", "cpes": [], "title": "Improper Handling of Length Parameter Inconsistency", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.8.9-3+deb13u4" ] }, "exploit": "Not Defined", "fixedIn": [ "3.8.9-3+deb13u4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-33846", "title": "https://security-tracker.debian.org/tracker/CVE-2026-33846" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33846.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33846.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:72502", "title": "https://access.redhat.com/errata/RHSA-2026:72502" }, { "url": "https://access.redhat.com/errata/RHSA-2026:74674", "title": "https://access.redhat.com/errata/RHSA-2026:74674" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82304", "title": "https://access.redhat.com/errata/RHSA-2026:82304" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82322", "title": "https://access.redhat.com/errata/RHSA-2026:82322" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82347", "title": "https://access.redhat.com/errata/RHSA-2026:82347" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82354", "title": "https://access.redhat.com/errata/RHSA-2026:82354" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82372", "title": "https://access.redhat.com/errata/RHSA-2026:82372" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82857", "title": "https://access.redhat.com/errata/RHSA-2026:82857" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82888", "title": "https://access.redhat.com/errata/RHSA-2026:82888" }, { "url": "https://access.redhat.com/errata/RHSA-2026:13274", "title": "https://access.redhat.com/errata/RHSA-2026:13274" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20611", "title": "https://access.redhat.com/errata/RHSA-2026:20611" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20612", "title": "https://access.redhat.com/errata/RHSA-2026:20612" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20613", "title": "https://access.redhat.com/errata/RHSA-2026:20613" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26409", "title": "https://access.redhat.com/errata/RHSA-2026:26409" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30004", "title": "https://access.redhat.com/errata/RHSA-2026:30004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30849", "title": "https://access.redhat.com/errata/RHSA-2026:30849" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30850", "title": "https://access.redhat.com/errata/RHSA-2026:30850" }, { "url": "https://access.redhat.com/errata/RHSA-2026:32962", "title": "https://access.redhat.com/errata/RHSA-2026:32962" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33125", "title": "https://access.redhat.com/errata/RHSA-2026:33125" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34372", "title": "https://access.redhat.com/errata/RHSA-2026:34372" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36004", "title": "https://access.redhat.com/errata/RHSA-2026:36004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36005", "title": "https://access.redhat.com/errata/RHSA-2026:36005" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36006", "title": "https://access.redhat.com/errata/RHSA-2026:36006" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41921", "title": "https://access.redhat.com/errata/RHSA-2026:41921" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56786", "title": "https://access.redhat.com/errata/RHSA-2026:56786" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56853", "title": "https://access.redhat.com/errata/RHSA-2026:56853" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56911", "title": "https://access.redhat.com/errata/RHSA-2026:56911" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57402", "title": "https://access.redhat.com/errata/RHSA-2026:57402" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57483", "title": "https://access.redhat.com/errata/RHSA-2026:57483" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60019", "title": "https://access.redhat.com/errata/RHSA-2026:60019" }, { "url": "https://access.redhat.com/errata/RHSA-2026:65839", "title": "https://access.redhat.com/errata/RHSA-2026:65839" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-33846", "title": "https://access.redhat.com/security/cve/CVE-2026-33846" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450625", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2450625" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-04T13:18:50.685622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-04T14:11:05.322162Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-28T11:03:05.454188Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-04T13:18:50.685622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-04T14:11:05.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-28T11:03:05.454188Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnutls28` package and not the `gnutls28` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.\n## Remediation\nUpgrade `Debian:13` `gnutls28` to version 3.8.9-3+deb13u4 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-33846](https://security-tracker.debian.org/tracker/CVE-2026-33846)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33846.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33846.json)\n- [https://access.redhat.com/errata/RHSA-2026:72502](https://access.redhat.com/errata/RHSA-2026:72502)\n- [https://access.redhat.com/errata/RHSA-2026:74674](https://access.redhat.com/errata/RHSA-2026:74674)\n- [https://access.redhat.com/errata/RHSA-2026:82304](https://access.redhat.com/errata/RHSA-2026:82304)\n- [https://access.redhat.com/errata/RHSA-2026:82322](https://access.redhat.com/errata/RHSA-2026:82322)\n- [https://access.redhat.com/errata/RHSA-2026:82347](https://access.redhat.com/errata/RHSA-2026:82347)\n- [https://access.redhat.com/errata/RHSA-2026:82354](https://access.redhat.com/errata/RHSA-2026:82354)\n- [https://access.redhat.com/errata/RHSA-2026:82372](https://access.redhat.com/errata/RHSA-2026:82372)\n- [https://access.redhat.com/errata/RHSA-2026:82857](https://access.redhat.com/errata/RHSA-2026:82857)\n- [https://access.redhat.com/errata/RHSA-2026:82888](https://access.redhat.com/errata/RHSA-2026:82888)\n- [https://access.redhat.com/errata/RHSA-2026:13274](https://access.redhat.com/errata/RHSA-2026:13274)\n- [https://access.redhat.com/errata/RHSA-2026:20611](https://access.redhat.com/errata/RHSA-2026:20611)\n- [https://access.redhat.com/errata/RHSA-2026:20612](https://access.redhat.com/errata/RHSA-2026:20612)\n- [https://access.redhat.com/errata/RHSA-2026:20613](https://access.redhat.com/errata/RHSA-2026:20613)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:26409](https://access.redhat.com/errata/RHSA-2026:26409)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:30004](https://access.redhat.com/errata/RHSA-2026:30004)\n- [https://access.redhat.com/errata/RHSA-2026:30849](https://access.redhat.com/errata/RHSA-2026:30849)\n- [https://access.redhat.com/errata/RHSA-2026:30850](https://access.redhat.com/errata/RHSA-2026:30850)\n- [https://access.redhat.com/errata/RHSA-2026:32962](https://access.redhat.com/errata/RHSA-2026:32962)\n- [https://access.redhat.com/errata/RHSA-2026:33125](https://access.redhat.com/errata/RHSA-2026:33125)\n- [https://access.redhat.com/errata/RHSA-2026:34372](https://access.redhat.com/errata/RHSA-2026:34372)\n- [https://access.redhat.com/errata/RHSA-2026:36004](https://access.redhat.com/errata/RHSA-2026:36004)\n- [https://access.redhat.com/errata/RHSA-2026:36005](https://access.redhat.com/errata/RHSA-2026:36005)\n- [https://access.redhat.com/errata/RHSA-2026:36006](https://access.redhat.com/errata/RHSA-2026:36006)\n- [https://access.redhat.com/errata/RHSA-2026:41921](https://access.redhat.com/errata/RHSA-2026:41921)\n- [https://access.redhat.com/errata/RHSA-2026:56786](https://access.redhat.com/errata/RHSA-2026:56786)\n- [https://access.redhat.com/errata/RHSA-2026:56853](https://access.redhat.com/errata/RHSA-2026:56853)\n- [https://access.redhat.com/errata/RHSA-2026:56911](https://access.redhat.com/errata/RHSA-2026:56911)\n- [https://access.redhat.com/errata/RHSA-2026:57402](https://access.redhat.com/errata/RHSA-2026:57402)\n- [https://access.redhat.com/errata/RHSA-2026:57483](https://access.redhat.com/errata/RHSA-2026:57483)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:60019](https://access.redhat.com/errata/RHSA-2026:60019)\n- [https://access.redhat.com/errata/RHSA-2026:65839](https://access.redhat.com/errata/RHSA-2026:65839)\n- [https://access.redhat.com/security/cve/CVE-2026-33846](https://access.redhat.com/security/cve/CVE-2026-33846)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2450625](https://bugzilla.redhat.com/show_bug.cgi?id=2450625)\n", "epssDetails": { "percentile": "0.64763", "probability": "0.01123", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33846" ], "CWE": [ "CWE-130" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "gnutls28", "creationTime": "2026-05-02T16:24:29.516977Z", "disclosureTime": "2026-05-04T10:15:59.690000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-02T16:24:29.520339Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T01:31:34.449316Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "luarocks@3.8.0+dfsg1-1", "wget@1.25.0-2", "gnutls28/libgnutls30t64@3.8.9-3+deb13u2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "gnutls28/libgnutls30t64", "version": "3.8.9-3+deb13u2", "nearestFixedInVersion": "3.8.9-3+deb13u4" }, { "id": "SNYK-DEBIAN13-GNUTLS28-16344305", "cpes": [], "title": "Undefined Behavior for Input to API", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.8.9-3+deb13u4" ] }, "exploit": "Not Defined", "fixedIn": [ "3.8.9-3+deb13u4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-42009", "title": "https://security-tracker.debian.org/tracker/CVE-2026-42009" }, { "url": "https://www.gnutls.org/security-new.html%23GNUTLS-SA-2026-04-29-2", "title": "https://www.gnutls.org/security-new.html%23GNUTLS-SA-2026-04-29-2" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42009.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42009.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:72502", "title": "https://access.redhat.com/errata/RHSA-2026:72502" }, { "url": "https://access.redhat.com/errata/RHSA-2026:74674", "title": "https://access.redhat.com/errata/RHSA-2026:74674" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82304", "title": "https://access.redhat.com/errata/RHSA-2026:82304" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82322", "title": "https://access.redhat.com/errata/RHSA-2026:82322" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82347", "title": "https://access.redhat.com/errata/RHSA-2026:82347" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82354", "title": "https://access.redhat.com/errata/RHSA-2026:82354" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82372", "title": "https://access.redhat.com/errata/RHSA-2026:82372" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82857", "title": "https://access.redhat.com/errata/RHSA-2026:82857" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82888", "title": "https://access.redhat.com/errata/RHSA-2026:82888" }, { "url": "https://access.redhat.com/errata/RHSA-2026:13274", "title": "https://access.redhat.com/errata/RHSA-2026:13274" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20611", "title": "https://access.redhat.com/errata/RHSA-2026:20611" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20612", "title": "https://access.redhat.com/errata/RHSA-2026:20612" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20613", "title": "https://access.redhat.com/errata/RHSA-2026:20613" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26409", "title": "https://access.redhat.com/errata/RHSA-2026:26409" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29794", "title": "https://access.redhat.com/errata/RHSA-2026:29794" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30004", "title": "https://access.redhat.com/errata/RHSA-2026:30004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30849", "title": "https://access.redhat.com/errata/RHSA-2026:30849" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30850", "title": "https://access.redhat.com/errata/RHSA-2026:30850" }, { "url": "https://access.redhat.com/errata/RHSA-2026:32962", "title": "https://access.redhat.com/errata/RHSA-2026:32962" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33125", "title": "https://access.redhat.com/errata/RHSA-2026:33125" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34372", "title": "https://access.redhat.com/errata/RHSA-2026:34372" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34764", "title": "https://access.redhat.com/errata/RHSA-2026:34764" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34788", "title": "https://access.redhat.com/errata/RHSA-2026:34788" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36004", "title": "https://access.redhat.com/errata/RHSA-2026:36004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36005", "title": "https://access.redhat.com/errata/RHSA-2026:36005" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36006", "title": "https://access.redhat.com/errata/RHSA-2026:36006" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40762", "title": "https://access.redhat.com/errata/RHSA-2026:40762" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41921", "title": "https://access.redhat.com/errata/RHSA-2026:41921" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56786", "title": "https://access.redhat.com/errata/RHSA-2026:56786" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56853", "title": "https://access.redhat.com/errata/RHSA-2026:56853" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56911", "title": "https://access.redhat.com/errata/RHSA-2026:56911" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57483", "title": "https://access.redhat.com/errata/RHSA-2026:57483" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60019", "title": "https://access.redhat.com/errata/RHSA-2026:60019" }, { "url": "https://access.redhat.com/errata/RHSA-2026:65839", "title": "https://access.redhat.com/errata/RHSA-2026:65839" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-42009", "title": "https://access.redhat.com/security/cve/CVE-2026-42009" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467279", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2467279" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-19T01:29:28.559900Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-19T02:45:22.528690Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-28T11:03:18.680808Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-19T01:29:28.559900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-19T02:45:22.528690Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-28T11:03:18.680808Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnutls28` package and not the `gnutls28` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.\n## Remediation\nUpgrade `Debian:13` `gnutls28` to version 3.8.9-3+deb13u4 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-42009](https://security-tracker.debian.org/tracker/CVE-2026-42009)\n- [https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-2](https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-2)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42009.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42009.json)\n- [https://access.redhat.com/errata/RHSA-2026:72502](https://access.redhat.com/errata/RHSA-2026:72502)\n- [https://access.redhat.com/errata/RHSA-2026:74674](https://access.redhat.com/errata/RHSA-2026:74674)\n- [https://access.redhat.com/errata/RHSA-2026:82304](https://access.redhat.com/errata/RHSA-2026:82304)\n- [https://access.redhat.com/errata/RHSA-2026:82322](https://access.redhat.com/errata/RHSA-2026:82322)\n- [https://access.redhat.com/errata/RHSA-2026:82347](https://access.redhat.com/errata/RHSA-2026:82347)\n- [https://access.redhat.com/errata/RHSA-2026:82354](https://access.redhat.com/errata/RHSA-2026:82354)\n- [https://access.redhat.com/errata/RHSA-2026:82372](https://access.redhat.com/errata/RHSA-2026:82372)\n- [https://access.redhat.com/errata/RHSA-2026:82857](https://access.redhat.com/errata/RHSA-2026:82857)\n- [https://access.redhat.com/errata/RHSA-2026:82888](https://access.redhat.com/errata/RHSA-2026:82888)\n- [https://access.redhat.com/errata/RHSA-2026:13274](https://access.redhat.com/errata/RHSA-2026:13274)\n- [https://access.redhat.com/errata/RHSA-2026:20611](https://access.redhat.com/errata/RHSA-2026:20611)\n- [https://access.redhat.com/errata/RHSA-2026:20612](https://access.redhat.com/errata/RHSA-2026:20612)\n- [https://access.redhat.com/errata/RHSA-2026:20613](https://access.redhat.com/errata/RHSA-2026:20613)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:26409](https://access.redhat.com/errata/RHSA-2026:26409)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:29794](https://access.redhat.com/errata/RHSA-2026:29794)\n- [https://access.redhat.com/errata/RHSA-2026:30004](https://access.redhat.com/errata/RHSA-2026:30004)\n- [https://access.redhat.com/errata/RHSA-2026:30849](https://access.redhat.com/errata/RHSA-2026:30849)\n- [https://access.redhat.com/errata/RHSA-2026:30850](https://access.redhat.com/errata/RHSA-2026:30850)\n- [https://access.redhat.com/errata/RHSA-2026:32962](https://access.redhat.com/errata/RHSA-2026:32962)\n- [https://access.redhat.com/errata/RHSA-2026:33125](https://access.redhat.com/errata/RHSA-2026:33125)\n- [https://access.redhat.com/errata/RHSA-2026:34372](https://access.redhat.com/errata/RHSA-2026:34372)\n- [https://access.redhat.com/errata/RHSA-2026:34764](https://access.redhat.com/errata/RHSA-2026:34764)\n- [https://access.redhat.com/errata/RHSA-2026:34788](https://access.redhat.com/errata/RHSA-2026:34788)\n- [https://access.redhat.com/errata/RHSA-2026:36004](https://access.redhat.com/errata/RHSA-2026:36004)\n- [https://access.redhat.com/errata/RHSA-2026:36005](https://access.redhat.com/errata/RHSA-2026:36005)\n- [https://access.redhat.com/errata/RHSA-2026:36006](https://access.redhat.com/errata/RHSA-2026:36006)\n- [https://access.redhat.com/errata/RHSA-2026:40762](https://access.redhat.com/errata/RHSA-2026:40762)\n- [https://access.redhat.com/errata/RHSA-2026:41921](https://access.redhat.com/errata/RHSA-2026:41921)\n- [https://access.redhat.com/errata/RHSA-2026:56786](https://access.redhat.com/errata/RHSA-2026:56786)\n- [https://access.redhat.com/errata/RHSA-2026:56853](https://access.redhat.com/errata/RHSA-2026:56853)\n- [https://access.redhat.com/errata/RHSA-2026:56911](https://access.redhat.com/errata/RHSA-2026:56911)\n- [https://access.redhat.com/errata/RHSA-2026:57483](https://access.redhat.com/errata/RHSA-2026:57483)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:60019](https://access.redhat.com/errata/RHSA-2026:60019)\n- [https://access.redhat.com/errata/RHSA-2026:65839](https://access.redhat.com/errata/RHSA-2026:65839)\n- [https://access.redhat.com/security/cve/CVE-2026-42009](https://access.redhat.com/security/cve/CVE-2026-42009)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2467279](https://bugzilla.redhat.com/show_bug.cgi?id=2467279)\n", "epssDetails": { "percentile": "0.64923", "probability": "0.01129", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-42009" ], "CWE": [ "CWE-475" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "gnutls28", "creationTime": "2026-05-02T16:24:34.801888Z", "disclosureTime": "2026-05-18T13:16:32.707000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-02T16:24:34.804862Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T01:31:41.645011Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "luarocks@3.8.0+dfsg1-1", "wget@1.25.0-2", "gnutls28/libgnutls30t64@3.8.9-3+deb13u2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "gnutls28/libgnutls30t64", "version": "3.8.9-3+deb13u2", "nearestFixedInVersion": "3.8.9-3+deb13u4" }, { "id": "SNYK-DEBIAN13-GNUTLS28-16344307", "cpes": [], "title": "Improper Certificate Validation", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "<3.8.9-3+deb13u4" ] }, "exploit": "Not Defined", "fixedIn": [ "3.8.9-3+deb13u4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-42012", "title": "https://security-tracker.debian.org/tracker/CVE-2026-42012" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-42012", "title": "https://access.redhat.com/security/cve/CVE-2026-42012" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467441", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2467441" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20611", "title": "https://access.redhat.com/errata/RHSA-2026:20611" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20613", "title": "https://access.redhat.com/errata/RHSA-2026:20613" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20612", "title": "https://access.redhat.com/errata/RHSA-2026:20612" }, { "url": "https://access.redhat.com/errata/RHSA-2026:13274", "title": "https://access.redhat.com/errata/RHSA-2026:13274" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26409", "title": "https://access.redhat.com/errata/RHSA-2026:26409" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30004", "title": "https://access.redhat.com/errata/RHSA-2026:30004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30849", "title": "https://access.redhat.com/errata/RHSA-2026:30849" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30850", "title": "https://access.redhat.com/errata/RHSA-2026:30850" }, { "url": "https://access.redhat.com/errata/RHSA-2026:32962", "title": "https://access.redhat.com/errata/RHSA-2026:32962" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33125", "title": "https://access.redhat.com/errata/RHSA-2026:33125" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41921", "title": "https://access.redhat.com/errata/RHSA-2026:41921" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43575", "title": "https://access.redhat.com/errata/RHSA-2026:43575" }, { "url": "https://www.gnutls.org/security-new.html%23GNUTLS-SA-2026-04-29-7", "title": "https://www.gnutls.org/security-new.html%23GNUTLS-SA-2026-04-29-7" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:72502", "title": "https://access.redhat.com/errata/RHSA-2026:72502" }, { "url": "https://access.redhat.com/errata/RHSA-2026:74674", "title": "https://access.redhat.com/errata/RHSA-2026:74674" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82304", "title": "https://access.redhat.com/errata/RHSA-2026:82304" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82322", "title": "https://access.redhat.com/errata/RHSA-2026:82322" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82347", "title": "https://access.redhat.com/errata/RHSA-2026:82347" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82354", "title": "https://access.redhat.com/errata/RHSA-2026:82354" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82372", "title": "https://access.redhat.com/errata/RHSA-2026:82372" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82857", "title": "https://access.redhat.com/errata/RHSA-2026:82857" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82888", "title": "https://access.redhat.com/errata/RHSA-2026:82888" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-05-27T01:20:29.572738Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-05-27T05:26:44.782325Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:16:06.073944Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-05-27T01:20:29.572738Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-05-27T05:26:44.782325Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:16:06.073944Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnutls28` package and not the `gnutls28` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or intercept sensitive information.\n## Remediation\nUpgrade `Debian:13` `gnutls28` to version 3.8.9-3+deb13u4 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-42012](https://security-tracker.debian.org/tracker/CVE-2026-42012)\n- [https://access.redhat.com/security/cve/CVE-2026-42012](https://access.redhat.com/security/cve/CVE-2026-42012)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2467441](https://bugzilla.redhat.com/show_bug.cgi?id=2467441)\n- [https://access.redhat.com/errata/RHSA-2026:20611](https://access.redhat.com/errata/RHSA-2026:20611)\n- [https://access.redhat.com/errata/RHSA-2026:20613](https://access.redhat.com/errata/RHSA-2026:20613)\n- [https://access.redhat.com/errata/RHSA-2026:20612](https://access.redhat.com/errata/RHSA-2026:20612)\n- [https://access.redhat.com/errata/RHSA-2026:13274](https://access.redhat.com/errata/RHSA-2026:13274)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:26409](https://access.redhat.com/errata/RHSA-2026:26409)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:30004](https://access.redhat.com/errata/RHSA-2026:30004)\n- [https://access.redhat.com/errata/RHSA-2026:30849](https://access.redhat.com/errata/RHSA-2026:30849)\n- [https://access.redhat.com/errata/RHSA-2026:30850](https://access.redhat.com/errata/RHSA-2026:30850)\n- [https://access.redhat.com/errata/RHSA-2026:32962](https://access.redhat.com/errata/RHSA-2026:32962)\n- [https://access.redhat.com/errata/RHSA-2026:33125](https://access.redhat.com/errata/RHSA-2026:33125)\n- [https://access.redhat.com/errata/RHSA-2026:41921](https://access.redhat.com/errata/RHSA-2026:41921)\n- [https://access.redhat.com/errata/RHSA-2026:43575](https://access.redhat.com/errata/RHSA-2026:43575)\n- [https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-7](https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-7)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:72502](https://access.redhat.com/errata/RHSA-2026:72502)\n- [https://access.redhat.com/errata/RHSA-2026:74674](https://access.redhat.com/errata/RHSA-2026:74674)\n- [https://access.redhat.com/errata/RHSA-2026:82304](https://access.redhat.com/errata/RHSA-2026:82304)\n- [https://access.redhat.com/errata/RHSA-2026:82322](https://access.redhat.com/errata/RHSA-2026:82322)\n- [https://access.redhat.com/errata/RHSA-2026:82347](https://access.redhat.com/errata/RHSA-2026:82347)\n- [https://access.redhat.com/errata/RHSA-2026:82354](https://access.redhat.com/errata/RHSA-2026:82354)\n- [https://access.redhat.com/errata/RHSA-2026:82372](https://access.redhat.com/errata/RHSA-2026:82372)\n- [https://access.redhat.com/errata/RHSA-2026:82857](https://access.redhat.com/errata/RHSA-2026:82857)\n- [https://access.redhat.com/errata/RHSA-2026:82888](https://access.redhat.com/errata/RHSA-2026:82888)\n", "epssDetails": { "percentile": "0.39286", "probability": "0.00487", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-42012" ], "CWE": [ "CWE-295" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "gnutls28", "creationTime": "2026-05-02T16:24:37.614791Z", "disclosureTime": "2026-05-26T22:16:41.913000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-02T16:24:37.617212Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T01:31:40.501592Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "luarocks@3.8.0+dfsg1-1", "wget@1.25.0-2", "gnutls28/libgnutls30t64@3.8.9-3+deb13u2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "gnutls28/libgnutls30t64", "version": "3.8.9-3+deb13u2", "nearestFixedInVersion": "3.8.9-3+deb13u4" }, { "id": "SNYK-DEBIAN13-GNUTLS28-16344314", "cpes": [], "title": "Integer Underflow", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.8.9-3+deb13u4" ] }, "exploit": "Not Defined", "fixedIn": [ "3.8.9-3+deb13u4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-33845", "title": "https://security-tracker.debian.org/tracker/CVE-2026-33845" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33845.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33845.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:72502", "title": "https://access.redhat.com/errata/RHSA-2026:72502" }, { "url": "https://access.redhat.com/errata/RHSA-2026:74674", "title": "https://access.redhat.com/errata/RHSA-2026:74674" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82304", "title": "https://access.redhat.com/errata/RHSA-2026:82304" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82322", "title": "https://access.redhat.com/errata/RHSA-2026:82322" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82347", "title": "https://access.redhat.com/errata/RHSA-2026:82347" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82354", "title": "https://access.redhat.com/errata/RHSA-2026:82354" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82372", "title": "https://access.redhat.com/errata/RHSA-2026:82372" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82857", "title": "https://access.redhat.com/errata/RHSA-2026:82857" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82888", "title": "https://access.redhat.com/errata/RHSA-2026:82888" }, { "url": "https://access.redhat.com/errata/RHSA-2026:13274", "title": "https://access.redhat.com/errata/RHSA-2026:13274" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20611", "title": "https://access.redhat.com/errata/RHSA-2026:20611" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20612", "title": "https://access.redhat.com/errata/RHSA-2026:20612" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20613", "title": "https://access.redhat.com/errata/RHSA-2026:20613" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26409", "title": "https://access.redhat.com/errata/RHSA-2026:26409" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30004", "title": "https://access.redhat.com/errata/RHSA-2026:30004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30849", "title": "https://access.redhat.com/errata/RHSA-2026:30849" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30850", "title": "https://access.redhat.com/errata/RHSA-2026:30850" }, { "url": "https://access.redhat.com/errata/RHSA-2026:32962", "title": "https://access.redhat.com/errata/RHSA-2026:32962" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33125", "title": "https://access.redhat.com/errata/RHSA-2026:33125" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34372", "title": "https://access.redhat.com/errata/RHSA-2026:34372" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36004", "title": "https://access.redhat.com/errata/RHSA-2026:36004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36005", "title": "https://access.redhat.com/errata/RHSA-2026:36005" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36006", "title": "https://access.redhat.com/errata/RHSA-2026:36006" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41921", "title": "https://access.redhat.com/errata/RHSA-2026:41921" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56786", "title": "https://access.redhat.com/errata/RHSA-2026:56786" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56853", "title": "https://access.redhat.com/errata/RHSA-2026:56853" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56911", "title": "https://access.redhat.com/errata/RHSA-2026:56911" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57402", "title": "https://access.redhat.com/errata/RHSA-2026:57402" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57483", "title": "https://access.redhat.com/errata/RHSA-2026:57483" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60019", "title": "https://access.redhat.com/errata/RHSA-2026:60019" }, { "url": "https://access.redhat.com/errata/RHSA-2026:65839", "title": "https://access.redhat.com/errata/RHSA-2026:65839" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-33845", "title": "https://access.redhat.com/security/cve/CVE-2026-33845" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450624", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2450624" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 9.1, "modificationTime": "2026-05-05T13:13:51.910844Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-03T06:31:47.350814Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "cvssV3BaseScore": 8.2, "modificationTime": "2026-05-28T11:03:10.673322Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-05-05T13:13:51.910844Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-03T06:31:47.350814Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 8.2, "cvssVersion": "3.1", "modificationTime": "2026-05-28T11:03:10.673322Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnutls28` package and not the `gnutls28` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.\n## Remediation\nUpgrade `Debian:13` `gnutls28` to version 3.8.9-3+deb13u4 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-33845](https://security-tracker.debian.org/tracker/CVE-2026-33845)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33845.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33845.json)\n- [https://access.redhat.com/errata/RHSA-2026:72502](https://access.redhat.com/errata/RHSA-2026:72502)\n- [https://access.redhat.com/errata/RHSA-2026:74674](https://access.redhat.com/errata/RHSA-2026:74674)\n- [https://access.redhat.com/errata/RHSA-2026:82304](https://access.redhat.com/errata/RHSA-2026:82304)\n- [https://access.redhat.com/errata/RHSA-2026:82322](https://access.redhat.com/errata/RHSA-2026:82322)\n- [https://access.redhat.com/errata/RHSA-2026:82347](https://access.redhat.com/errata/RHSA-2026:82347)\n- [https://access.redhat.com/errata/RHSA-2026:82354](https://access.redhat.com/errata/RHSA-2026:82354)\n- [https://access.redhat.com/errata/RHSA-2026:82372](https://access.redhat.com/errata/RHSA-2026:82372)\n- [https://access.redhat.com/errata/RHSA-2026:82857](https://access.redhat.com/errata/RHSA-2026:82857)\n- [https://access.redhat.com/errata/RHSA-2026:82888](https://access.redhat.com/errata/RHSA-2026:82888)\n- [https://access.redhat.com/errata/RHSA-2026:13274](https://access.redhat.com/errata/RHSA-2026:13274)\n- [https://access.redhat.com/errata/RHSA-2026:20611](https://access.redhat.com/errata/RHSA-2026:20611)\n- [https://access.redhat.com/errata/RHSA-2026:20612](https://access.redhat.com/errata/RHSA-2026:20612)\n- [https://access.redhat.com/errata/RHSA-2026:20613](https://access.redhat.com/errata/RHSA-2026:20613)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:26409](https://access.redhat.com/errata/RHSA-2026:26409)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:30004](https://access.redhat.com/errata/RHSA-2026:30004)\n- [https://access.redhat.com/errata/RHSA-2026:30849](https://access.redhat.com/errata/RHSA-2026:30849)\n- [https://access.redhat.com/errata/RHSA-2026:30850](https://access.redhat.com/errata/RHSA-2026:30850)\n- [https://access.redhat.com/errata/RHSA-2026:32962](https://access.redhat.com/errata/RHSA-2026:32962)\n- [https://access.redhat.com/errata/RHSA-2026:33125](https://access.redhat.com/errata/RHSA-2026:33125)\n- [https://access.redhat.com/errata/RHSA-2026:34372](https://access.redhat.com/errata/RHSA-2026:34372)\n- [https://access.redhat.com/errata/RHSA-2026:36004](https://access.redhat.com/errata/RHSA-2026:36004)\n- [https://access.redhat.com/errata/RHSA-2026:36005](https://access.redhat.com/errata/RHSA-2026:36005)\n- [https://access.redhat.com/errata/RHSA-2026:36006](https://access.redhat.com/errata/RHSA-2026:36006)\n- [https://access.redhat.com/errata/RHSA-2026:41921](https://access.redhat.com/errata/RHSA-2026:41921)\n- [https://access.redhat.com/errata/RHSA-2026:56786](https://access.redhat.com/errata/RHSA-2026:56786)\n- [https://access.redhat.com/errata/RHSA-2026:56853](https://access.redhat.com/errata/RHSA-2026:56853)\n- [https://access.redhat.com/errata/RHSA-2026:56911](https://access.redhat.com/errata/RHSA-2026:56911)\n- [https://access.redhat.com/errata/RHSA-2026:57402](https://access.redhat.com/errata/RHSA-2026:57402)\n- [https://access.redhat.com/errata/RHSA-2026:57483](https://access.redhat.com/errata/RHSA-2026:57483)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:60019](https://access.redhat.com/errata/RHSA-2026:60019)\n- [https://access.redhat.com/errata/RHSA-2026:65839](https://access.redhat.com/errata/RHSA-2026:65839)\n- [https://access.redhat.com/security/cve/CVE-2026-33845](https://access.redhat.com/security/cve/CVE-2026-33845)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2450624](https://bugzilla.redhat.com/show_bug.cgi?id=2450624)\n", "epssDetails": { "percentile": "0.57492", "probability": "0.00886", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33845" ], "CWE": [ "CWE-191" ], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "gnutls28", "creationTime": "2026-05-02T16:24:47.385803Z", "disclosureTime": "2026-04-30T18:16:28.003000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-02T16:24:47.389097Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T01:31:38.483982Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "luarocks@3.8.0+dfsg1-1", "wget@1.25.0-2", "gnutls28/libgnutls30t64@3.8.9-3+deb13u2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "gnutls28/libgnutls30t64", "version": "3.8.9-3+deb13u2", "nearestFixedInVersion": "3.8.9-3+deb13u4" }, { "id": "SNYK-DEBIAN13-GNUTLS28-16344321", "cpes": [], "title": "Improper Handling of Case Sensitivity", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "<3.8.9-3+deb13u4" ] }, "exploit": "Not Defined", "fixedIn": [ "3.8.9-3+deb13u4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-3833", "title": "https://security-tracker.debian.org/tracker/CVE-2026-3833" }, { "url": "https://access.redhat.com/errata/RHSA-2026:13274", "title": "https://access.redhat.com/errata/RHSA-2026:13274" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-3833", "title": "https://access.redhat.com/security/cve/CVE-2026-3833" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20611", "title": "https://access.redhat.com/errata/RHSA-2026:20611" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20613", "title": "https://access.redhat.com/errata/RHSA-2026:20613" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20612", "title": "https://access.redhat.com/errata/RHSA-2026:20612" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26409", "title": "https://access.redhat.com/errata/RHSA-2026:26409" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30004", "title": "https://access.redhat.com/errata/RHSA-2026:30004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30849", "title": "https://access.redhat.com/errata/RHSA-2026:30849" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30850", "title": "https://access.redhat.com/errata/RHSA-2026:30850" }, { "url": "https://access.redhat.com/errata/RHSA-2026:32962", "title": "https://access.redhat.com/errata/RHSA-2026:32962" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33125", "title": "https://access.redhat.com/errata/RHSA-2026:33125" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41921", "title": "https://access.redhat.com/errata/RHSA-2026:41921" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43575", "title": "https://access.redhat.com/errata/RHSA-2026:43575" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57402", "title": "https://access.redhat.com/errata/RHSA-2026:57402" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60019", "title": "https://access.redhat.com/errata/RHSA-2026:60019" }, { "url": "https://access.redhat.com/errata/RHSA-2026:62549", "title": "https://access.redhat.com/errata/RHSA-2026:62549" }, { "url": "https://access.redhat.com/errata/RHSA-2026:62409", "title": "https://access.redhat.com/errata/RHSA-2026:62409" }, { "url": "https://access.redhat.com/errata/RHSA-2026:65851", "title": "https://access.redhat.com/errata/RHSA-2026:65851" }, { "url": "https://access.redhat.com/errata/RHSA-2026:65839", "title": "https://access.redhat.com/errata/RHSA-2026:65839" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67857", "title": "https://access.redhat.com/errata/RHSA-2026:67857" }, { "url": "https://access.redhat.com/errata/RHSA-2026:72502", "title": "https://access.redhat.com/errata/RHSA-2026:72502" }, { "url": "https://access.redhat.com/errata/RHSA-2026:74674", "title": "https://access.redhat.com/errata/RHSA-2026:74674" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82304", "title": "https://access.redhat.com/errata/RHSA-2026:82304" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82322", "title": "https://access.redhat.com/errata/RHSA-2026:82322" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82347", "title": "https://access.redhat.com/errata/RHSA-2026:82347" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82354", "title": "https://access.redhat.com/errata/RHSA-2026:82354" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82372", "title": "https://access.redhat.com/errata/RHSA-2026:82372" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82857", "title": "https://access.redhat.com/errata/RHSA-2026:82857" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82888", "title": "https://access.redhat.com/errata/RHSA-2026:82888" }, { "url": "https://gitlab.com/gnutls/gnutls/-/issues/1803", "title": "https://gitlab.com/gnutls/gnutls/-/issues/1803" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.4, "modificationTime": "2026-05-07T13:17:18.084368Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-05-03T06:31:44.374935Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-05-28T11:03:07.215839Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-05-07T13:17:18.084368Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-05-03T06:31:44.374935Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-05-28T11:03:07.215839Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnutls28` package and not the `gnutls28` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.\n## Remediation\nUpgrade `Debian:13` `gnutls28` to version 3.8.9-3+deb13u4 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-3833](https://security-tracker.debian.org/tracker/CVE-2026-3833)\n- [https://access.redhat.com/errata/RHSA-2026:13274](https://access.redhat.com/errata/RHSA-2026:13274)\n- [https://access.redhat.com/security/cve/CVE-2026-3833](https://access.redhat.com/security/cve/CVE-2026-3833)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2445763](https://bugzilla.redhat.com/show_bug.cgi?id=2445763)\n- [https://access.redhat.com/errata/RHSA-2026:20611](https://access.redhat.com/errata/RHSA-2026:20611)\n- [https://access.redhat.com/errata/RHSA-2026:20613](https://access.redhat.com/errata/RHSA-2026:20613)\n- [https://access.redhat.com/errata/RHSA-2026:20612](https://access.redhat.com/errata/RHSA-2026:20612)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:26409](https://access.redhat.com/errata/RHSA-2026:26409)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:30004](https://access.redhat.com/errata/RHSA-2026:30004)\n- [https://access.redhat.com/errata/RHSA-2026:30849](https://access.redhat.com/errata/RHSA-2026:30849)\n- [https://access.redhat.com/errata/RHSA-2026:30850](https://access.redhat.com/errata/RHSA-2026:30850)\n- [https://access.redhat.com/errata/RHSA-2026:32962](https://access.redhat.com/errata/RHSA-2026:32962)\n- [https://access.redhat.com/errata/RHSA-2026:33125](https://access.redhat.com/errata/RHSA-2026:33125)\n- [https://access.redhat.com/errata/RHSA-2026:41921](https://access.redhat.com/errata/RHSA-2026:41921)\n- [https://access.redhat.com/errata/RHSA-2026:43575](https://access.redhat.com/errata/RHSA-2026:43575)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:57402](https://access.redhat.com/errata/RHSA-2026:57402)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:60019](https://access.redhat.com/errata/RHSA-2026:60019)\n- [https://access.redhat.com/errata/RHSA-2026:62549](https://access.redhat.com/errata/RHSA-2026:62549)\n- [https://access.redhat.com/errata/RHSA-2026:62409](https://access.redhat.com/errata/RHSA-2026:62409)\n- [https://access.redhat.com/errata/RHSA-2026:65851](https://access.redhat.com/errata/RHSA-2026:65851)\n- [https://access.redhat.com/errata/RHSA-2026:65839](https://access.redhat.com/errata/RHSA-2026:65839)\n- [https://access.redhat.com/errata/RHSA-2026:67857](https://access.redhat.com/errata/RHSA-2026:67857)\n- [https://access.redhat.com/errata/RHSA-2026:72502](https://access.redhat.com/errata/RHSA-2026:72502)\n- [https://access.redhat.com/errata/RHSA-2026:74674](https://access.redhat.com/errata/RHSA-2026:74674)\n- [https://access.redhat.com/errata/RHSA-2026:82304](https://access.redhat.com/errata/RHSA-2026:82304)\n- [https://access.redhat.com/errata/RHSA-2026:82322](https://access.redhat.com/errata/RHSA-2026:82322)\n- [https://access.redhat.com/errata/RHSA-2026:82347](https://access.redhat.com/errata/RHSA-2026:82347)\n- [https://access.redhat.com/errata/RHSA-2026:82354](https://access.redhat.com/errata/RHSA-2026:82354)\n- [https://access.redhat.com/errata/RHSA-2026:82372](https://access.redhat.com/errata/RHSA-2026:82372)\n- [https://access.redhat.com/errata/RHSA-2026:82857](https://access.redhat.com/errata/RHSA-2026:82857)\n- [https://access.redhat.com/errata/RHSA-2026:82888](https://access.redhat.com/errata/RHSA-2026:82888)\n- [https://gitlab.com/gnutls/gnutls/-/issues/1803](https://gitlab.com/gnutls/gnutls/-/issues/1803)\n", "epssDetails": { "percentile": "0.57686", "probability": "0.00892", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-3833" ], "CWE": [ "CWE-178" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "gnutls28", "creationTime": "2026-05-02T16:24:55.549982Z", "disclosureTime": "2026-04-30T18:16:30.577000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-02T16:24:55.553386Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T01:31:36.564465Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "luarocks@3.8.0+dfsg1-1", "wget@1.25.0-2", "gnutls28/libgnutls30t64@3.8.9-3+deb13u2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "gnutls28/libgnutls30t64", "version": "3.8.9-3+deb13u2", "nearestFixedInVersion": "3.8.9-3+deb13u4" }, { "id": "SNYK-DEBIAN13-GNUTLS28-16344330", "cpes": [], "title": "Improper Validation of Specified Quantity in Input", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.8.9-3+deb13u4" ] }, "exploit": "Not Defined", "fixedIn": [ "3.8.9-3+deb13u4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.2, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-5260", "title": "https://security-tracker.debian.org/tracker/CVE-2026-5260" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-5260", "title": "https://access.redhat.com/security/cve/CVE-2026-5260" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20611", "title": "https://access.redhat.com/errata/RHSA-2026:20611" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20613", "title": "https://access.redhat.com/errata/RHSA-2026:20613" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20612", "title": "https://access.redhat.com/errata/RHSA-2026:20612" }, { "url": "https://access.redhat.com/errata/RHSA-2026:13274", "title": "https://access.redhat.com/errata/RHSA-2026:13274" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26409", "title": "https://access.redhat.com/errata/RHSA-2026:26409" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30004", "title": "https://access.redhat.com/errata/RHSA-2026:30004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30849", "title": "https://access.redhat.com/errata/RHSA-2026:30849" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30850", "title": "https://access.redhat.com/errata/RHSA-2026:30850" }, { "url": "https://access.redhat.com/errata/RHSA-2026:32962", "title": "https://access.redhat.com/errata/RHSA-2026:32962" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33125", "title": "https://access.redhat.com/errata/RHSA-2026:33125" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40762", "title": "https://access.redhat.com/errata/RHSA-2026:40762" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41921", "title": "https://access.redhat.com/errata/RHSA-2026:41921" }, { "url": "https://www.gnutls.org/security-new.html%23GNUTLS-SA-2026-04-29-10", "title": "https://www.gnutls.org/security-new.html%23GNUTLS-SA-2026-04-29-10" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57483", "title": "https://access.redhat.com/errata/RHSA-2026:57483" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56853", "title": "https://access.redhat.com/errata/RHSA-2026:56853" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60019", "title": "https://access.redhat.com/errata/RHSA-2026:60019" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67837", "title": "https://access.redhat.com/errata/RHSA-2026:67837" }, { "url": "https://access.redhat.com/errata/RHSA-2026:72502", "title": "https://access.redhat.com/errata/RHSA-2026:72502" }, { "url": "https://access.redhat.com/errata/RHSA-2026:74674", "title": "https://access.redhat.com/errata/RHSA-2026:74674" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82304", "title": "https://access.redhat.com/errata/RHSA-2026:82304" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82322", "title": "https://access.redhat.com/errata/RHSA-2026:82322" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82347", "title": "https://access.redhat.com/errata/RHSA-2026:82347" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82354", "title": "https://access.redhat.com/errata/RHSA-2026:82354" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82372", "title": "https://access.redhat.com/errata/RHSA-2026:82372" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82857", "title": "https://access.redhat.com/errata/RHSA-2026:82857" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82888", "title": "https://access.redhat.com/errata/RHSA-2026:82888" }, { "url": "https://access.redhat.com/errata/RHSA-2026:77320", "title": "https://access.redhat.com/errata/RHSA-2026:77320" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "cvssV3BaseScore": 8.2, "modificationTime": "2026-05-27T01:20:30.889352Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "cvssV3BaseScore": 8.2, "modificationTime": "2026-05-27T05:26:47.000997Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-05-28T11:03:28.107931Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.2, "cvssVersion": "3.1", "modificationTime": "2026-05-27T01:20:30.889352Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 8.2, "cvssVersion": "3.1", "modificationTime": "2026-05-27T05:26:47.000997Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-05-28T11:03:28.107931Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnutls28` package and not the `gnutls28` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.\n## Remediation\nUpgrade `Debian:13` `gnutls28` to version 3.8.9-3+deb13u4 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-5260](https://security-tracker.debian.org/tracker/CVE-2026-5260)\n- [https://access.redhat.com/security/cve/CVE-2026-5260](https://access.redhat.com/security/cve/CVE-2026-5260)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2467450](https://bugzilla.redhat.com/show_bug.cgi?id=2467450)\n- [https://access.redhat.com/errata/RHSA-2026:20611](https://access.redhat.com/errata/RHSA-2026:20611)\n- [https://access.redhat.com/errata/RHSA-2026:20613](https://access.redhat.com/errata/RHSA-2026:20613)\n- [https://access.redhat.com/errata/RHSA-2026:20612](https://access.redhat.com/errata/RHSA-2026:20612)\n- [https://access.redhat.com/errata/RHSA-2026:13274](https://access.redhat.com/errata/RHSA-2026:13274)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:26409](https://access.redhat.com/errata/RHSA-2026:26409)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:30004](https://access.redhat.com/errata/RHSA-2026:30004)\n- [https://access.redhat.com/errata/RHSA-2026:30849](https://access.redhat.com/errata/RHSA-2026:30849)\n- [https://access.redhat.com/errata/RHSA-2026:30850](https://access.redhat.com/errata/RHSA-2026:30850)\n- [https://access.redhat.com/errata/RHSA-2026:32962](https://access.redhat.com/errata/RHSA-2026:32962)\n- [https://access.redhat.com/errata/RHSA-2026:33125](https://access.redhat.com/errata/RHSA-2026:33125)\n- [https://access.redhat.com/errata/RHSA-2026:40762](https://access.redhat.com/errata/RHSA-2026:40762)\n- [https://access.redhat.com/errata/RHSA-2026:41921](https://access.redhat.com/errata/RHSA-2026:41921)\n- [https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-10](https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-10)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:57483](https://access.redhat.com/errata/RHSA-2026:57483)\n- [https://access.redhat.com/errata/RHSA-2026:56853](https://access.redhat.com/errata/RHSA-2026:56853)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:60019](https://access.redhat.com/errata/RHSA-2026:60019)\n- [https://access.redhat.com/errata/RHSA-2026:67837](https://access.redhat.com/errata/RHSA-2026:67837)\n- [https://access.redhat.com/errata/RHSA-2026:72502](https://access.redhat.com/errata/RHSA-2026:72502)\n- [https://access.redhat.com/errata/RHSA-2026:74674](https://access.redhat.com/errata/RHSA-2026:74674)\n- [https://access.redhat.com/errata/RHSA-2026:82304](https://access.redhat.com/errata/RHSA-2026:82304)\n- [https://access.redhat.com/errata/RHSA-2026:82322](https://access.redhat.com/errata/RHSA-2026:82322)\n- [https://access.redhat.com/errata/RHSA-2026:82347](https://access.redhat.com/errata/RHSA-2026:82347)\n- [https://access.redhat.com/errata/RHSA-2026:82354](https://access.redhat.com/errata/RHSA-2026:82354)\n- [https://access.redhat.com/errata/RHSA-2026:82372](https://access.redhat.com/errata/RHSA-2026:82372)\n- [https://access.redhat.com/errata/RHSA-2026:82857](https://access.redhat.com/errata/RHSA-2026:82857)\n- [https://access.redhat.com/errata/RHSA-2026:82888](https://access.redhat.com/errata/RHSA-2026:82888)\n- [https://access.redhat.com/errata/RHSA-2026:77320](https://access.redhat.com/errata/RHSA-2026:77320)\n", "epssDetails": { "percentile": "0.59391", "probability": "0.00945", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-5260" ], "CWE": [ "CWE-1284" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "gnutls28", "creationTime": "2026-05-02T16:25:05.831333Z", "disclosureTime": "2026-05-26T22:16:44.170000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-02T16:25:05.834502Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-16T01:15:39.340442Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "luarocks@3.8.0+dfsg1-1", "wget@1.25.0-2", "gnutls28/libgnutls30t64@3.8.9-3+deb13u2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "gnutls28/libgnutls30t64", "version": "3.8.9-3+deb13u2", "nearestFixedInVersion": "3.8.9-3+deb13u4" }, { "id": "SNYK-DEBIAN13-GNUTLS28-16344352", "cpes": [], "title": "Improper Certificate Validation", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "<3.8.9-3+deb13u4" ] }, "exploit": "Not Defined", "fixedIn": [ "3.8.9-3+deb13u4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-42011", "title": "https://security-tracker.debian.org/tracker/CVE-2026-42011" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-42011", "title": "https://access.redhat.com/security/cve/CVE-2026-42011" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437" }, { "url": "https://access.redhat.com/errata/RHSA-2026:13274", "title": "https://access.redhat.com/errata/RHSA-2026:13274" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20611", "title": "https://access.redhat.com/errata/RHSA-2026:20611" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20613", "title": "https://access.redhat.com/errata/RHSA-2026:20613" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20612", "title": "https://access.redhat.com/errata/RHSA-2026:20612" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26409", "title": "https://access.redhat.com/errata/RHSA-2026:26409" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30004", "title": "https://access.redhat.com/errata/RHSA-2026:30004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30849", "title": "https://access.redhat.com/errata/RHSA-2026:30849" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30850", "title": "https://access.redhat.com/errata/RHSA-2026:30850" }, { "url": "https://access.redhat.com/errata/RHSA-2026:32962", "title": "https://access.redhat.com/errata/RHSA-2026:32962" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33125", "title": "https://access.redhat.com/errata/RHSA-2026:33125" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40762", "title": "https://access.redhat.com/errata/RHSA-2026:40762" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41921", "title": "https://access.redhat.com/errata/RHSA-2026:41921" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43575", "title": "https://access.redhat.com/errata/RHSA-2026:43575" }, { "url": "https://www.gnutls.org/security-new.html%23GNUTLS-SA-2026-04-29-6", "title": "https://www.gnutls.org/security-new.html%23GNUTLS-SA-2026-04-29-6" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57483", "title": "https://access.redhat.com/errata/RHSA-2026:57483" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56853", "title": "https://access.redhat.com/errata/RHSA-2026:56853" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60019", "title": "https://access.redhat.com/errata/RHSA-2026:60019" }, { "url": "https://access.redhat.com/errata/RHSA-2026:72502", "title": "https://access.redhat.com/errata/RHSA-2026:72502" }, { "url": "https://access.redhat.com/errata/RHSA-2026:74674", "title": "https://access.redhat.com/errata/RHSA-2026:74674" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82304", "title": "https://access.redhat.com/errata/RHSA-2026:82304" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82322", "title": "https://access.redhat.com/errata/RHSA-2026:82322" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82347", "title": "https://access.redhat.com/errata/RHSA-2026:82347" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82354", "title": "https://access.redhat.com/errata/RHSA-2026:82354" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82372", "title": "https://access.redhat.com/errata/RHSA-2026:82372" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82857", "title": "https://access.redhat.com/errata/RHSA-2026:82857" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82888", "title": "https://access.redhat.com/errata/RHSA-2026:82888" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.4, "modificationTime": "2026-05-08T01:24:22.687463Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.4, "modificationTime": "2026-05-08T13:01:38.342523Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "cvssV3BaseScore": 4.8, "modificationTime": "2026-05-28T11:03:14.070348Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-05-08T01:24:22.687463Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-05-08T13:01:38.342523Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "assigner": "SUSE", "severity": "medium", "baseScore": 4.8, "cvssVersion": "3.1", "modificationTime": "2026-05-28T11:03:14.070348Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnutls28` package and not the `gnutls28` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.\n## Remediation\nUpgrade `Debian:13` `gnutls28` to version 3.8.9-3+deb13u4 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-42011](https://security-tracker.debian.org/tracker/CVE-2026-42011)\n- [https://access.redhat.com/security/cve/CVE-2026-42011](https://access.redhat.com/security/cve/CVE-2026-42011)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2467437](https://bugzilla.redhat.com/show_bug.cgi?id=2467437)\n- [https://access.redhat.com/errata/RHSA-2026:13274](https://access.redhat.com/errata/RHSA-2026:13274)\n- [https://access.redhat.com/errata/RHSA-2026:20611](https://access.redhat.com/errata/RHSA-2026:20611)\n- [https://access.redhat.com/errata/RHSA-2026:20613](https://access.redhat.com/errata/RHSA-2026:20613)\n- [https://access.redhat.com/errata/RHSA-2026:20612](https://access.redhat.com/errata/RHSA-2026:20612)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:26409](https://access.redhat.com/errata/RHSA-2026:26409)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:30004](https://access.redhat.com/errata/RHSA-2026:30004)\n- [https://access.redhat.com/errata/RHSA-2026:30849](https://access.redhat.com/errata/RHSA-2026:30849)\n- [https://access.redhat.com/errata/RHSA-2026:30850](https://access.redhat.com/errata/RHSA-2026:30850)\n- [https://access.redhat.com/errata/RHSA-2026:32962](https://access.redhat.com/errata/RHSA-2026:32962)\n- [https://access.redhat.com/errata/RHSA-2026:33125](https://access.redhat.com/errata/RHSA-2026:33125)\n- [https://access.redhat.com/errata/RHSA-2026:40762](https://access.redhat.com/errata/RHSA-2026:40762)\n- [https://access.redhat.com/errata/RHSA-2026:41921](https://access.redhat.com/errata/RHSA-2026:41921)\n- [https://access.redhat.com/errata/RHSA-2026:43575](https://access.redhat.com/errata/RHSA-2026:43575)\n- [https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-6](https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-6)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:57483](https://access.redhat.com/errata/RHSA-2026:57483)\n- [https://access.redhat.com/errata/RHSA-2026:56853](https://access.redhat.com/errata/RHSA-2026:56853)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:60019](https://access.redhat.com/errata/RHSA-2026:60019)\n- [https://access.redhat.com/errata/RHSA-2026:72502](https://access.redhat.com/errata/RHSA-2026:72502)\n- [https://access.redhat.com/errata/RHSA-2026:74674](https://access.redhat.com/errata/RHSA-2026:74674)\n- [https://access.redhat.com/errata/RHSA-2026:82304](https://access.redhat.com/errata/RHSA-2026:82304)\n- [https://access.redhat.com/errata/RHSA-2026:82322](https://access.redhat.com/errata/RHSA-2026:82322)\n- [https://access.redhat.com/errata/RHSA-2026:82347](https://access.redhat.com/errata/RHSA-2026:82347)\n- [https://access.redhat.com/errata/RHSA-2026:82354](https://access.redhat.com/errata/RHSA-2026:82354)\n- [https://access.redhat.com/errata/RHSA-2026:82372](https://access.redhat.com/errata/RHSA-2026:82372)\n- [https://access.redhat.com/errata/RHSA-2026:82857](https://access.redhat.com/errata/RHSA-2026:82857)\n- [https://access.redhat.com/errata/RHSA-2026:82888](https://access.redhat.com/errata/RHSA-2026:82888)\n", "epssDetails": { "percentile": "0.39331", "probability": "0.00475", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-42011" ], "CWE": [ "CWE-295" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "gnutls28", "creationTime": "2026-05-02T16:25:53.625227Z", "disclosureTime": "2026-05-07T15:16:09.760000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-02T16:25:53.627670Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T01:31:37.799848Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "luarocks@3.8.0+dfsg1-1", "wget@1.25.0-2", "gnutls28/libgnutls30t64@3.8.9-3+deb13u2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "gnutls28/libgnutls30t64", "version": "3.8.9-3+deb13u2", "nearestFixedInVersion": "3.8.9-3+deb13u4" }, { "id": "SNYK-DEBIAN13-GNUTLS28-16344357", "cpes": [], "title": "Improper Null Termination", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.8.9-3+deb13u4" ] }, "exploit": "Not Defined", "fixedIn": [ "3.8.9-3+deb13u4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-42010", "title": "https://security-tracker.debian.org/tracker/CVE-2026-42010" }, { "url": "https://www.gnutls.org/security-new.html%23GNUTLS-SA-2026-04-29-4", "title": "https://www.gnutls.org/security-new.html%23GNUTLS-SA-2026-04-29-4" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42010.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42010.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67857", "title": "https://access.redhat.com/errata/RHSA-2026:67857" }, { "url": "https://access.redhat.com/errata/RHSA-2026:72502", "title": "https://access.redhat.com/errata/RHSA-2026:72502" }, { "url": "https://access.redhat.com/errata/RHSA-2026:74674", "title": "https://access.redhat.com/errata/RHSA-2026:74674" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82304", "title": "https://access.redhat.com/errata/RHSA-2026:82304" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82322", "title": "https://access.redhat.com/errata/RHSA-2026:82322" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82347", "title": "https://access.redhat.com/errata/RHSA-2026:82347" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82354", "title": "https://access.redhat.com/errata/RHSA-2026:82354" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82372", "title": "https://access.redhat.com/errata/RHSA-2026:82372" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82857", "title": "https://access.redhat.com/errata/RHSA-2026:82857" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82888", "title": "https://access.redhat.com/errata/RHSA-2026:82888" }, { "url": "https://access.redhat.com/errata/RHSA-2026:13274", "title": "https://access.redhat.com/errata/RHSA-2026:13274" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20611", "title": "https://access.redhat.com/errata/RHSA-2026:20611" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20612", "title": "https://access.redhat.com/errata/RHSA-2026:20612" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20613", "title": "https://access.redhat.com/errata/RHSA-2026:20613" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26409", "title": "https://access.redhat.com/errata/RHSA-2026:26409" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30004", "title": "https://access.redhat.com/errata/RHSA-2026:30004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30849", "title": "https://access.redhat.com/errata/RHSA-2026:30849" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30850", "title": "https://access.redhat.com/errata/RHSA-2026:30850" }, { "url": "https://access.redhat.com/errata/RHSA-2026:32962", "title": "https://access.redhat.com/errata/RHSA-2026:32962" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33125", "title": "https://access.redhat.com/errata/RHSA-2026:33125" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34764", "title": "https://access.redhat.com/errata/RHSA-2026:34764" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34788", "title": "https://access.redhat.com/errata/RHSA-2026:34788" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34790", "title": "https://access.redhat.com/errata/RHSA-2026:34790" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36004", "title": "https://access.redhat.com/errata/RHSA-2026:36004" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36005", "title": "https://access.redhat.com/errata/RHSA-2026:36005" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36006", "title": "https://access.redhat.com/errata/RHSA-2026:36006" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40762", "title": "https://access.redhat.com/errata/RHSA-2026:40762" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41921", "title": "https://access.redhat.com/errata/RHSA-2026:41921" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56853", "title": "https://access.redhat.com/errata/RHSA-2026:56853" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57483", "title": "https://access.redhat.com/errata/RHSA-2026:57483" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60019", "title": "https://access.redhat.com/errata/RHSA-2026:60019" }, { "url": "https://access.redhat.com/errata/RHSA-2026:62409", "title": "https://access.redhat.com/errata/RHSA-2026:62409" }, { "url": "https://access.redhat.com/errata/RHSA-2026:65839", "title": "https://access.redhat.com/errata/RHSA-2026:65839" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-42010", "title": "https://access.redhat.com/security/cve/CVE-2026-42010" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467289", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2467289" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-05-14T01:14:25.281118Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-05-07T20:51:07.200810Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-05-28T11:03:11.486144Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-05-14T01:14:25.281118Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-05-07T20:51:07.200810Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "assigner": "SUSE", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-05-28T11:03:11.486144Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnutls28` package and not the `gnutls28` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.\n## Remediation\nUpgrade `Debian:13` `gnutls28` to version 3.8.9-3+deb13u4 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-42010](https://security-tracker.debian.org/tracker/CVE-2026-42010)\n- [https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-4](https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-4)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42010.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42010.json)\n- [https://access.redhat.com/errata/RHSA-2026:67857](https://access.redhat.com/errata/RHSA-2026:67857)\n- [https://access.redhat.com/errata/RHSA-2026:72502](https://access.redhat.com/errata/RHSA-2026:72502)\n- [https://access.redhat.com/errata/RHSA-2026:74674](https://access.redhat.com/errata/RHSA-2026:74674)\n- [https://access.redhat.com/errata/RHSA-2026:82304](https://access.redhat.com/errata/RHSA-2026:82304)\n- [https://access.redhat.com/errata/RHSA-2026:82322](https://access.redhat.com/errata/RHSA-2026:82322)\n- [https://access.redhat.com/errata/RHSA-2026:82347](https://access.redhat.com/errata/RHSA-2026:82347)\n- [https://access.redhat.com/errata/RHSA-2026:82354](https://access.redhat.com/errata/RHSA-2026:82354)\n- [https://access.redhat.com/errata/RHSA-2026:82372](https://access.redhat.com/errata/RHSA-2026:82372)\n- [https://access.redhat.com/errata/RHSA-2026:82857](https://access.redhat.com/errata/RHSA-2026:82857)\n- [https://access.redhat.com/errata/RHSA-2026:82888](https://access.redhat.com/errata/RHSA-2026:82888)\n- [https://access.redhat.com/errata/RHSA-2026:13274](https://access.redhat.com/errata/RHSA-2026:13274)\n- [https://access.redhat.com/errata/RHSA-2026:20611](https://access.redhat.com/errata/RHSA-2026:20611)\n- [https://access.redhat.com/errata/RHSA-2026:20612](https://access.redhat.com/errata/RHSA-2026:20612)\n- [https://access.redhat.com/errata/RHSA-2026:20613](https://access.redhat.com/errata/RHSA-2026:20613)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:26409](https://access.redhat.com/errata/RHSA-2026:26409)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:30004](https://access.redhat.com/errata/RHSA-2026:30004)\n- [https://access.redhat.com/errata/RHSA-2026:30849](https://access.redhat.com/errata/RHSA-2026:30849)\n- [https://access.redhat.com/errata/RHSA-2026:30850](https://access.redhat.com/errata/RHSA-2026:30850)\n- [https://access.redhat.com/errata/RHSA-2026:32962](https://access.redhat.com/errata/RHSA-2026:32962)\n- [https://access.redhat.com/errata/RHSA-2026:33125](https://access.redhat.com/errata/RHSA-2026:33125)\n- [https://access.redhat.com/errata/RHSA-2026:34764](https://access.redhat.com/errata/RHSA-2026:34764)\n- [https://access.redhat.com/errata/RHSA-2026:34788](https://access.redhat.com/errata/RHSA-2026:34788)\n- [https://access.redhat.com/errata/RHSA-2026:34790](https://access.redhat.com/errata/RHSA-2026:34790)\n- [https://access.redhat.com/errata/RHSA-2026:36004](https://access.redhat.com/errata/RHSA-2026:36004)\n- [https://access.redhat.com/errata/RHSA-2026:36005](https://access.redhat.com/errata/RHSA-2026:36005)\n- [https://access.redhat.com/errata/RHSA-2026:36006](https://access.redhat.com/errata/RHSA-2026:36006)\n- [https://access.redhat.com/errata/RHSA-2026:40762](https://access.redhat.com/errata/RHSA-2026:40762)\n- [https://access.redhat.com/errata/RHSA-2026:41921](https://access.redhat.com/errata/RHSA-2026:41921)\n- [https://access.redhat.com/errata/RHSA-2026:56853](https://access.redhat.com/errata/RHSA-2026:56853)\n- [https://access.redhat.com/errata/RHSA-2026:57483](https://access.redhat.com/errata/RHSA-2026:57483)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:60019](https://access.redhat.com/errata/RHSA-2026:60019)\n- [https://access.redhat.com/errata/RHSA-2026:62409](https://access.redhat.com/errata/RHSA-2026:62409)\n- [https://access.redhat.com/errata/RHSA-2026:65839](https://access.redhat.com/errata/RHSA-2026:65839)\n- [https://access.redhat.com/security/cve/CVE-2026-42010](https://access.redhat.com/security/cve/CVE-2026-42010)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2467289](https://bugzilla.redhat.com/show_bug.cgi?id=2467289)\n", "epssDetails": { "percentile": "0.59365", "probability": "0.00944", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-42010" ], "CWE": [ "CWE-170" ], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "gnutls28", "creationTime": "2026-05-02T16:25:59.347787Z", "disclosureTime": "2026-05-07T12:16:17.977000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-02T16:25:59.350754Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T01:31:36.036688Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "luarocks@3.8.0+dfsg1-1", "wget@1.25.0-2", "gnutls28/libgnutls30t64@3.8.9-3+deb13u2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "gnutls28/libgnutls30t64", "version": "3.8.9-3+deb13u2", "nearestFixedInVersion": "3.8.9-3+deb13u4" }, { "id": "SNYK-DEBIAN13-GZIP-17681798", "cpes": [], "title": "Buffer Over-read", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "<1.13-1+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.13-1+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-41992", "title": "https://security-tracker.debian.org/tracker/CVE-2026-41992" }, { "url": "https://cert.pl/en/posts/2026/04/CVE-2026-41991/", "title": "https://cert.pl/en/posts/2026/04/CVE-2026-41991/" }, { "url": "https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681", "title": "https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681" }, { "url": "https://www.gnu.org/software/gzip/", "title": "https://www.gnu.org/software/gzip/" }, { "url": "http://www.openwall.com/lists/oss-security/2026/08/23/1", "title": "http://www.openwall.com/lists/oss-security/2026/08/23/1" }, { "url": "http://www.openwall.com/lists/oss-security/2026/08/25/1", "title": "http://www.openwall.com/lists/oss-security/2026/08/25/1" }, { "url": "http://www.openwall.com/lists/oss-security/2026/08/27/2", "title": "http://www.openwall.com/lists/oss-security/2026/08/27/2" }, { "url": "https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=e7378c2d421be6a286922374425680bbe9ad8b7d", "title": "https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=e7378c2d421be6a286922374425680bbe9ad8b7d" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-24T01:29:36.282455Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L", "cvssV3BaseScore": 3.6, "modificationTime": "2026-09-01T05:36:58.376035Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "cvssV3BaseScore": 6.1, "modificationTime": "2026-08-13T11:02:55.737017Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T01:29:36.282455Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.6, "cvssVersion": "3.1", "modificationTime": "2026-09-01T05:36:58.376035Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 6.1, "cvssVersion": "3.1", "modificationTime": "2026-08-13T11:02:55.737017Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gzip` package and not the `gzip` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nGNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and e7378c2d421be6a286922374425680bbe9ad8b7d.\n## Remediation\nUpgrade `Debian:13` `gzip` to version 1.13-1+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-41992](https://security-tracker.debian.org/tracker/CVE-2026-41992)\n- [https://cert.pl/en/posts/2026/04/CVE-2026-41991/](https://cert.pl/en/posts/2026/04/CVE-2026-41991/)\n- [https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681](https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681)\n- [https://www.gnu.org/software/gzip/](https://www.gnu.org/software/gzip/)\n- [http://www.openwall.com/lists/oss-security/2026/08/23/1](http://www.openwall.com/lists/oss-security/2026/08/23/1)\n- [http://www.openwall.com/lists/oss-security/2026/08/25/1](http://www.openwall.com/lists/oss-security/2026/08/25/1)\n- [http://www.openwall.com/lists/oss-security/2026/08/27/2](http://www.openwall.com/lists/oss-security/2026/08/27/2)\n- [https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=e7378c2d421be6a286922374425680bbe9ad8b7d](https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=e7378c2d421be6a286922374425680bbe9ad8b7d)\n", "epssDetails": { "percentile": "0.48461", "probability": "0.00620", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-41992" ], "CWE": [ "CWE-126" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "gzip", "creationTime": "2026-06-30T01:46:52.922304Z", "disclosureTime": "2026-06-29T12:16:29.940000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T01:46:52.924679Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-14T14:49:08.759465Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "gzip@1.13-1" ], "upgradePath": [ false, "gzip@1.13-1+deb13u1" ], "isUpgradable": true, "isPatchable": false, "name": "gzip", "version": "1.13-1", "nearestFixedInVersion": "1.13-1+deb13u1" }, { "id": "SNYK-DEBIAN13-KRB5-16334232", "cpes": [], "title": "NULL Pointer Dereference", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.21.3-5+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.21.3-5+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-40355", "title": "https://security-tracker.debian.org/tracker/CVE-2026-40355" }, { "url": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f", "title": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f" }, { "url": "https://web.mit.edu/kerberos/advisories/", "title": "https://web.mit.edu/kerberos/advisories/" }, { "url": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html", "title": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-15T13:16:47.962807Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-29T05:36:41.686109Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-02T11:05:46.203469Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T13:16:47.962807Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-29T05:36:41.686109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-02T11:05:46.203469Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIn MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.\n## Remediation\nUpgrade `Debian:13` `krb5` to version 1.21.3-5+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-40355](https://security-tracker.debian.org/tracker/CVE-2026-40355)\n- [https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f](https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f)\n- [https://web.mit.edu/kerberos/advisories/](https://web.mit.edu/kerberos/advisories/)\n- [https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html](https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-019113.html](https://cert-portal.siemens.com/productcert/html/ssa-019113.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-082556.html](https://cert-portal.siemens.com/productcert/html/ssa-082556.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-457936.html](https://cert-portal.siemens.com/productcert/html/ssa-457936.html)\n", "epssDetails": { "percentile": "0.57248", "probability": "0.00847", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-40355" ], "CWE": [ "CWE-476" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "krb5", "creationTime": "2026-05-01T12:00:34.749535Z", "disclosureTime": "2026-04-28T06:16:03.663000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-01T12:00:34.754882Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:02.639771Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "krb5/libgssapi-krb5-2@1.21.3-5", "krb5/libk5crypto3@1.21.3-5" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "krb5/libk5crypto3", "version": "1.21.3-5", "nearestFixedInVersion": "1.21.3-5+deb13u1" }, { "id": "SNYK-DEBIAN13-KRB5-16334232", "cpes": [], "title": "NULL Pointer Dereference", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.21.3-5+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.21.3-5+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-40355", "title": "https://security-tracker.debian.org/tracker/CVE-2026-40355" }, { "url": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f", "title": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f" }, { "url": "https://web.mit.edu/kerberos/advisories/", "title": "https://web.mit.edu/kerberos/advisories/" }, { "url": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html", "title": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-15T13:16:47.962807Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-29T05:36:41.686109Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-02T11:05:46.203469Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T13:16:47.962807Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-29T05:36:41.686109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-02T11:05:46.203469Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIn MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.\n## Remediation\nUpgrade `Debian:13` `krb5` to version 1.21.3-5+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-40355](https://security-tracker.debian.org/tracker/CVE-2026-40355)\n- [https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f](https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f)\n- [https://web.mit.edu/kerberos/advisories/](https://web.mit.edu/kerberos/advisories/)\n- [https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html](https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-019113.html](https://cert-portal.siemens.com/productcert/html/ssa-019113.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-082556.html](https://cert-portal.siemens.com/productcert/html/ssa-082556.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-457936.html](https://cert-portal.siemens.com/productcert/html/ssa-457936.html)\n", "epssDetails": { "percentile": "0.57248", "probability": "0.00847", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-40355" ], "CWE": [ "CWE-476" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "krb5", "creationTime": "2026-05-01T12:00:34.749535Z", "disclosureTime": "2026-04-28T06:16:03.663000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-01T12:00:34.754882Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:02.639771Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "krb5/libgssapi-krb5-2@1.21.3-5", "krb5/libkrb5-3@1.21.3-5", "krb5/libk5crypto3@1.21.3-5" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "krb5/libk5crypto3", "version": "1.21.3-5", "nearestFixedInVersion": "1.21.3-5+deb13u1" }, { "id": "SNYK-DEBIAN13-KRB5-16334232", "cpes": [], "title": "NULL Pointer Dereference", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.21.3-5+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.21.3-5+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-40355", "title": "https://security-tracker.debian.org/tracker/CVE-2026-40355" }, { "url": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f", "title": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f" }, { "url": "https://web.mit.edu/kerberos/advisories/", "title": "https://web.mit.edu/kerberos/advisories/" }, { "url": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html", "title": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-15T13:16:47.962807Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-29T05:36:41.686109Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-02T11:05:46.203469Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T13:16:47.962807Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-29T05:36:41.686109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-02T11:05:46.203469Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIn MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.\n## Remediation\nUpgrade `Debian:13` `krb5` to version 1.21.3-5+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-40355](https://security-tracker.debian.org/tracker/CVE-2026-40355)\n- [https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f](https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f)\n- [https://web.mit.edu/kerberos/advisories/](https://web.mit.edu/kerberos/advisories/)\n- [https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html](https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-019113.html](https://cert-portal.siemens.com/productcert/html/ssa-019113.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-082556.html](https://cert-portal.siemens.com/productcert/html/ssa-082556.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-457936.html](https://cert-portal.siemens.com/productcert/html/ssa-457936.html)\n", "epssDetails": { "percentile": "0.57248", "probability": "0.00847", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-40355" ], "CWE": [ "CWE-476" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "krb5", "creationTime": "2026-05-01T12:00:34.749535Z", "disclosureTime": "2026-04-28T06:16:03.663000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-01T12:00:34.754882Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:02.639771Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "krb5/libgssapi-krb5-2@1.21.3-5", "krb5/libkrb5support0@1.21.3-5" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "krb5/libkrb5support0", "version": "1.21.3-5", "nearestFixedInVersion": "1.21.3-5+deb13u1" }, { "id": "SNYK-DEBIAN13-KRB5-16334232", "cpes": [], "title": "NULL Pointer Dereference", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.21.3-5+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.21.3-5+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-40355", "title": "https://security-tracker.debian.org/tracker/CVE-2026-40355" }, { "url": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f", "title": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f" }, { "url": "https://web.mit.edu/kerberos/advisories/", "title": "https://web.mit.edu/kerberos/advisories/" }, { "url": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html", "title": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-15T13:16:47.962807Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-29T05:36:41.686109Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-02T11:05:46.203469Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T13:16:47.962807Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-29T05:36:41.686109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-02T11:05:46.203469Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIn MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.\n## Remediation\nUpgrade `Debian:13` `krb5` to version 1.21.3-5+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-40355](https://security-tracker.debian.org/tracker/CVE-2026-40355)\n- [https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f](https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f)\n- [https://web.mit.edu/kerberos/advisories/](https://web.mit.edu/kerberos/advisories/)\n- [https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html](https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-019113.html](https://cert-portal.siemens.com/productcert/html/ssa-019113.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-082556.html](https://cert-portal.siemens.com/productcert/html/ssa-082556.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-457936.html](https://cert-portal.siemens.com/productcert/html/ssa-457936.html)\n", "epssDetails": { "percentile": "0.57248", "probability": "0.00847", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-40355" ], "CWE": [ "CWE-476" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "krb5", "creationTime": "2026-05-01T12:00:34.749535Z", "disclosureTime": "2026-04-28T06:16:03.663000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-01T12:00:34.754882Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:02.639771Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "krb5/libgssapi-krb5-2@1.21.3-5", "krb5/libkrb5-3@1.21.3-5", "krb5/libkrb5support0@1.21.3-5" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "krb5/libkrb5support0", "version": "1.21.3-5", "nearestFixedInVersion": "1.21.3-5+deb13u1" }, { "id": "SNYK-DEBIAN13-KRB5-16334232", "cpes": [], "title": "NULL Pointer Dereference", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.21.3-5+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.21.3-5+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-40355", "title": "https://security-tracker.debian.org/tracker/CVE-2026-40355" }, { "url": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f", "title": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f" }, { "url": "https://web.mit.edu/kerberos/advisories/", "title": "https://web.mit.edu/kerberos/advisories/" }, { "url": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html", "title": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-15T13:16:47.962807Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-29T05:36:41.686109Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-02T11:05:46.203469Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T13:16:47.962807Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-29T05:36:41.686109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-02T11:05:46.203469Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIn MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.\n## Remediation\nUpgrade `Debian:13` `krb5` to version 1.21.3-5+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-40355](https://security-tracker.debian.org/tracker/CVE-2026-40355)\n- [https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f](https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f)\n- [https://web.mit.edu/kerberos/advisories/](https://web.mit.edu/kerberos/advisories/)\n- [https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html](https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-019113.html](https://cert-portal.siemens.com/productcert/html/ssa-019113.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-082556.html](https://cert-portal.siemens.com/productcert/html/ssa-082556.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-457936.html](https://cert-portal.siemens.com/productcert/html/ssa-457936.html)\n", "epssDetails": { "percentile": "0.57248", "probability": "0.00847", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-40355" ], "CWE": [ "CWE-476" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "krb5", "creationTime": "2026-05-01T12:00:34.749535Z", "disclosureTime": "2026-04-28T06:16:03.663000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-01T12:00:34.754882Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:02.639771Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "krb5/libgssapi-krb5-2@1.21.3-5", "krb5/libkrb5-3@1.21.3-5", "krb5/libk5crypto3@1.21.3-5", "krb5/libkrb5support0@1.21.3-5" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "krb5/libkrb5support0", "version": "1.21.3-5", "nearestFixedInVersion": "1.21.3-5+deb13u1" }, { "id": "SNYK-DEBIAN13-KRB5-16334232", "cpes": [], "title": "NULL Pointer Dereference", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.21.3-5+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.21.3-5+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-40355", "title": "https://security-tracker.debian.org/tracker/CVE-2026-40355" }, { "url": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f", "title": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f" }, { "url": "https://web.mit.edu/kerberos/advisories/", "title": "https://web.mit.edu/kerberos/advisories/" }, { "url": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html", "title": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-15T13:16:47.962807Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-29T05:36:41.686109Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-02T11:05:46.203469Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T13:16:47.962807Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-29T05:36:41.686109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-02T11:05:46.203469Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIn MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.\n## Remediation\nUpgrade `Debian:13` `krb5` to version 1.21.3-5+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-40355](https://security-tracker.debian.org/tracker/CVE-2026-40355)\n- [https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f](https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f)\n- [https://web.mit.edu/kerberos/advisories/](https://web.mit.edu/kerberos/advisories/)\n- [https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html](https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-019113.html](https://cert-portal.siemens.com/productcert/html/ssa-019113.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-082556.html](https://cert-portal.siemens.com/productcert/html/ssa-082556.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-457936.html](https://cert-portal.siemens.com/productcert/html/ssa-457936.html)\n", "epssDetails": { "percentile": "0.57248", "probability": "0.00847", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-40355" ], "CWE": [ "CWE-476" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "krb5", "creationTime": "2026-05-01T12:00:34.749535Z", "disclosureTime": "2026-04-28T06:16:03.663000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-01T12:00:34.754882Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:02.639771Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "krb5/libgssapi-krb5-2@1.21.3-5", "krb5/libkrb5-3@1.21.3-5" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "krb5/libkrb5-3", "version": "1.21.3-5", "nearestFixedInVersion": "1.21.3-5+deb13u1" }, { "id": "SNYK-DEBIAN13-KRB5-16334232", "cpes": [], "title": "NULL Pointer Dereference", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.21.3-5+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.21.3-5+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-40355", "title": "https://security-tracker.debian.org/tracker/CVE-2026-40355" }, { "url": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f", "title": "https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f" }, { "url": "https://web.mit.edu/kerberos/advisories/", "title": "https://web.mit.edu/kerberos/advisories/" }, { "url": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html", "title": "https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-10-15T13:16:47.962807Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-29T05:36:41.686109Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-02T11:05:46.203469Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-10-15T13:16:47.962807Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-29T05:36:41.686109Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-02T11:05:46.203469Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `krb5` package and not the `krb5` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIn MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.\n## Remediation\nUpgrade `Debian:13` `krb5` to version 1.21.3-5+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-40355](https://security-tracker.debian.org/tracker/CVE-2026-40355)\n- [https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f](https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f)\n- [https://web.mit.edu/kerberos/advisories/](https://web.mit.edu/kerberos/advisories/)\n- [https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html](https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-019113.html](https://cert-portal.siemens.com/productcert/html/ssa-019113.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-082556.html](https://cert-portal.siemens.com/productcert/html/ssa-082556.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-457936.html](https://cert-portal.siemens.com/productcert/html/ssa-457936.html)\n", "epssDetails": { "percentile": "0.57248", "probability": "0.00847", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-40355" ], "CWE": [ "CWE-476" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "krb5", "creationTime": "2026-05-01T12:00:34.749535Z", "disclosureTime": "2026-04-28T06:16:03.663000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-01T12:00:34.754882Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:02.639771Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "krb5/libgssapi-krb5-2@1.21.3-5" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "krb5/libgssapi-krb5-2", "version": "1.21.3-5", "nearestFixedInVersion": "1.21.3-5+deb13u1" }, { "id": "SNYK-DEBIAN13-LIBCAP2-15960217", "cpes": [], "title": "Time-of-check Time-of-use (TOCTOU)", "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1:2.75-10+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "1:2.75-10+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-4878", "title": "https://security-tracker.debian.org/tracker/CVE-2026-4878" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/07/14", "title": "http://www.openwall.com/lists/oss-security/2026/04/07/14" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/07/4", "title": "http://www.openwall.com/lists/oss-security/2026/04/07/4" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/08/9", "title": "http://www.openwall.com/lists/oss-security/2026/04/08/9" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/09/5", "title": "http://www.openwall.com/lists/oss-security/2026/04/09/5" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/09/6", "title": "http://www.openwall.com/lists/oss-security/2026/04/09/6" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:72502", "title": "https://access.redhat.com/errata/RHSA-2026:72502" }, { "url": "https://access.redhat.com/errata/RHSA-2026:74674", "title": "https://access.redhat.com/errata/RHSA-2026:74674" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82304", "title": "https://access.redhat.com/errata/RHSA-2026:82304" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82322", "title": "https://access.redhat.com/errata/RHSA-2026:82322" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82347", "title": "https://access.redhat.com/errata/RHSA-2026:82347" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82354", "title": "https://access.redhat.com/errata/RHSA-2026:82354" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82372", "title": "https://access.redhat.com/errata/RHSA-2026:82372" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82857", "title": "https://access.redhat.com/errata/RHSA-2026:82857" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82888", "title": "https://access.redhat.com/errata/RHSA-2026:82888" }, { "url": "https://access.redhat.com/errata/RHSA-2026:12423", "title": "https://access.redhat.com/errata/RHSA-2026:12423" }, { "url": "https://access.redhat.com/errata/RHSA-2026:12441", "title": "https://access.redhat.com/errata/RHSA-2026:12441" }, { "url": "https://access.redhat.com/errata/RHSA-2026:13285", "title": "https://access.redhat.com/errata/RHSA-2026:13285" }, { "url": "https://access.redhat.com/errata/RHSA-2026:14162", "title": "https://access.redhat.com/errata/RHSA-2026:14162" }, { "url": "https://access.redhat.com/errata/RHSA-2026:14937", "title": "https://access.redhat.com/errata/RHSA-2026:14937" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19130", "title": "https://access.redhat.com/errata/RHSA-2026:19130" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19346", "title": "https://access.redhat.com/errata/RHSA-2026:19346" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19456", "title": "https://access.redhat.com/errata/RHSA-2026:19456" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19458", "title": "https://access.redhat.com/errata/RHSA-2026:19458" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20595", "title": "https://access.redhat.com/errata/RHSA-2026:20595" }, { "url": "https://access.redhat.com/errata/RHSA-2026:21254", "title": "https://access.redhat.com/errata/RHSA-2026:21254" }, { "url": "https://access.redhat.com/errata/RHSA-2026:21275", "title": "https://access.redhat.com/errata/RHSA-2026:21275" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22634", "title": "https://access.redhat.com/errata/RHSA-2026:22634" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22957", "title": "https://access.redhat.com/errata/RHSA-2026:22957" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23233", "title": "https://access.redhat.com/errata/RHSA-2026:23233" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23245", "title": "https://access.redhat.com/errata/RHSA-2026:23245" }, { "url": "https://access.redhat.com/errata/RHSA-2026:24346", "title": "https://access.redhat.com/errata/RHSA-2026:24346" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25044", "title": "https://access.redhat.com/errata/RHSA-2026:25044" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25096", "title": "https://access.redhat.com/errata/RHSA-2026:25096" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25181", "title": "https://access.redhat.com/errata/RHSA-2026:25181" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26542", "title": "https://access.redhat.com/errata/RHSA-2026:26542" }, { "url": "https://access.redhat.com/errata/RHSA-2026:27998", "title": "https://access.redhat.com/errata/RHSA-2026:27998" }, { "url": "https://access.redhat.com/errata/RHSA-2026:28887", "title": "https://access.redhat.com/errata/RHSA-2026:28887" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30078", "title": "https://access.redhat.com/errata/RHSA-2026:30078" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30087", "title": "https://access.redhat.com/errata/RHSA-2026:30087" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30088", "title": "https://access.redhat.com/errata/RHSA-2026:30088" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30089", "title": "https://access.redhat.com/errata/RHSA-2026:30089" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34098", "title": "https://access.redhat.com/errata/RHSA-2026:34098" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39981", "title": "https://access.redhat.com/errata/RHSA-2026:39981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:7473", "title": "https://access.redhat.com/errata/RHSA-2026:7473" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-4878", "title": "https://access.redhat.com/security/cve/CVE-2026-4878" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451615", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2451615" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7, "modificationTime": "2026-04-28T01:15:22.493791Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 6.7, "modificationTime": "2026-04-12T16:39:23.746048Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7, "modificationTime": "2026-04-18T11:02:14.005177Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7, "cvssVersion": "3.1", "modificationTime": "2026-04-28T01:15:22.493791Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.7, "cvssVersion": "3.1", "modificationTime": "2026-04-12T16:39:23.746048Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7, "cvssVersion": "3.1", "modificationTime": "2026-04-18T11:02:14.005177Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libcap2` package and not the `libcap2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.\n## Remediation\nUpgrade `Debian:13` `libcap2` to version 1:2.75-10+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-4878](https://security-tracker.debian.org/tracker/CVE-2026-4878)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2447554](https://bugzilla.redhat.com/show_bug.cgi?id=2447554)\n- [http://www.openwall.com/lists/oss-security/2026/04/07/14](http://www.openwall.com/lists/oss-security/2026/04/07/14)\n- [http://www.openwall.com/lists/oss-security/2026/04/07/4](http://www.openwall.com/lists/oss-security/2026/04/07/4)\n- [http://www.openwall.com/lists/oss-security/2026/04/08/9](http://www.openwall.com/lists/oss-security/2026/04/08/9)\n- [http://www.openwall.com/lists/oss-security/2026/04/09/5](http://www.openwall.com/lists/oss-security/2026/04/09/5)\n- [http://www.openwall.com/lists/oss-security/2026/04/09/6](http://www.openwall.com/lists/oss-security/2026/04/09/6)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json)\n- [https://access.redhat.com/errata/RHSA-2026:72502](https://access.redhat.com/errata/RHSA-2026:72502)\n- [https://access.redhat.com/errata/RHSA-2026:74674](https://access.redhat.com/errata/RHSA-2026:74674)\n- [https://access.redhat.com/errata/RHSA-2026:82304](https://access.redhat.com/errata/RHSA-2026:82304)\n- [https://access.redhat.com/errata/RHSA-2026:82322](https://access.redhat.com/errata/RHSA-2026:82322)\n- [https://access.redhat.com/errata/RHSA-2026:82347](https://access.redhat.com/errata/RHSA-2026:82347)\n- [https://access.redhat.com/errata/RHSA-2026:82354](https://access.redhat.com/errata/RHSA-2026:82354)\n- [https://access.redhat.com/errata/RHSA-2026:82372](https://access.redhat.com/errata/RHSA-2026:82372)\n- [https://access.redhat.com/errata/RHSA-2026:82857](https://access.redhat.com/errata/RHSA-2026:82857)\n- [https://access.redhat.com/errata/RHSA-2026:82888](https://access.redhat.com/errata/RHSA-2026:82888)\n- [https://access.redhat.com/errata/RHSA-2026:12423](https://access.redhat.com/errata/RHSA-2026:12423)\n- [https://access.redhat.com/errata/RHSA-2026:12441](https://access.redhat.com/errata/RHSA-2026:12441)\n- [https://access.redhat.com/errata/RHSA-2026:13285](https://access.redhat.com/errata/RHSA-2026:13285)\n- [https://access.redhat.com/errata/RHSA-2026:14162](https://access.redhat.com/errata/RHSA-2026:14162)\n- [https://access.redhat.com/errata/RHSA-2026:14937](https://access.redhat.com/errata/RHSA-2026:14937)\n- [https://access.redhat.com/errata/RHSA-2026:19130](https://access.redhat.com/errata/RHSA-2026:19130)\n- [https://access.redhat.com/errata/RHSA-2026:19346](https://access.redhat.com/errata/RHSA-2026:19346)\n- [https://access.redhat.com/errata/RHSA-2026:19456](https://access.redhat.com/errata/RHSA-2026:19456)\n- [https://access.redhat.com/errata/RHSA-2026:19458](https://access.redhat.com/errata/RHSA-2026:19458)\n- [https://access.redhat.com/errata/RHSA-2026:20595](https://access.redhat.com/errata/RHSA-2026:20595)\n- [https://access.redhat.com/errata/RHSA-2026:21254](https://access.redhat.com/errata/RHSA-2026:21254)\n- [https://access.redhat.com/errata/RHSA-2026:21275](https://access.redhat.com/errata/RHSA-2026:21275)\n- [https://access.redhat.com/errata/RHSA-2026:22634](https://access.redhat.com/errata/RHSA-2026:22634)\n- [https://access.redhat.com/errata/RHSA-2026:22957](https://access.redhat.com/errata/RHSA-2026:22957)\n- [https://access.redhat.com/errata/RHSA-2026:23233](https://access.redhat.com/errata/RHSA-2026:23233)\n- [https://access.redhat.com/errata/RHSA-2026:23245](https://access.redhat.com/errata/RHSA-2026:23245)\n- [https://access.redhat.com/errata/RHSA-2026:24346](https://access.redhat.com/errata/RHSA-2026:24346)\n- [https://access.redhat.com/errata/RHSA-2026:25044](https://access.redhat.com/errata/RHSA-2026:25044)\n- [https://access.redhat.com/errata/RHSA-2026:25096](https://access.redhat.com/errata/RHSA-2026:25096)\n- [https://access.redhat.com/errata/RHSA-2026:25181](https://access.redhat.com/errata/RHSA-2026:25181)\n- [https://access.redhat.com/errata/RHSA-2026:26542](https://access.redhat.com/errata/RHSA-2026:26542)\n- [https://access.redhat.com/errata/RHSA-2026:27998](https://access.redhat.com/errata/RHSA-2026:27998)\n- [https://access.redhat.com/errata/RHSA-2026:28887](https://access.redhat.com/errata/RHSA-2026:28887)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:30078](https://access.redhat.com/errata/RHSA-2026:30078)\n- [https://access.redhat.com/errata/RHSA-2026:30087](https://access.redhat.com/errata/RHSA-2026:30087)\n- [https://access.redhat.com/errata/RHSA-2026:30088](https://access.redhat.com/errata/RHSA-2026:30088)\n- [https://access.redhat.com/errata/RHSA-2026:30089](https://access.redhat.com/errata/RHSA-2026:30089)\n- [https://access.redhat.com/errata/RHSA-2026:34098](https://access.redhat.com/errata/RHSA-2026:34098)\n- [https://access.redhat.com/errata/RHSA-2026:39981](https://access.redhat.com/errata/RHSA-2026:39981)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:7473](https://access.redhat.com/errata/RHSA-2026:7473)\n- [https://access.redhat.com/security/cve/CVE-2026-4878](https://access.redhat.com/security/cve/CVE-2026-4878)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2451615](https://bugzilla.redhat.com/show_bug.cgi?id=2451615)\n", "epssDetails": { "percentile": "0.02814", "probability": "0.00141", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-4878" ], "CWE": [ "CWE-367" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "libcap2", "creationTime": "2026-04-10T02:48:53.969488Z", "disclosureTime": "2026-04-09T16:16:31.987000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T02:48:53.978462Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T01:31:33.690728Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "coreutils@9.7-3", "libcap2/libcap2@1:2.75-10+b8" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "libcap2/libcap2", "version": "1:2.75-10+b8", "nearestFixedInVersion": "1:2.75-10+deb13u1" }, { "id": "SNYK-DEBIAN13-LIBCAP2-15960217", "cpes": [], "title": "Time-of-check Time-of-use (TOCTOU)", "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1:2.75-10+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "1:2.75-10+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-4878", "title": "https://security-tracker.debian.org/tracker/CVE-2026-4878" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/07/14", "title": "http://www.openwall.com/lists/oss-security/2026/04/07/14" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/07/4", "title": "http://www.openwall.com/lists/oss-security/2026/04/07/4" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/08/9", "title": "http://www.openwall.com/lists/oss-security/2026/04/08/9" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/09/5", "title": "http://www.openwall.com/lists/oss-security/2026/04/09/5" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/09/6", "title": "http://www.openwall.com/lists/oss-security/2026/04/09/6" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:72502", "title": "https://access.redhat.com/errata/RHSA-2026:72502" }, { "url": "https://access.redhat.com/errata/RHSA-2026:74674", "title": "https://access.redhat.com/errata/RHSA-2026:74674" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82304", "title": "https://access.redhat.com/errata/RHSA-2026:82304" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82322", "title": "https://access.redhat.com/errata/RHSA-2026:82322" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82347", "title": "https://access.redhat.com/errata/RHSA-2026:82347" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82354", "title": "https://access.redhat.com/errata/RHSA-2026:82354" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82372", "title": "https://access.redhat.com/errata/RHSA-2026:82372" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82857", "title": "https://access.redhat.com/errata/RHSA-2026:82857" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82888", "title": "https://access.redhat.com/errata/RHSA-2026:82888" }, { "url": "https://access.redhat.com/errata/RHSA-2026:12423", "title": "https://access.redhat.com/errata/RHSA-2026:12423" }, { "url": "https://access.redhat.com/errata/RHSA-2026:12441", "title": "https://access.redhat.com/errata/RHSA-2026:12441" }, { "url": "https://access.redhat.com/errata/RHSA-2026:13285", "title": "https://access.redhat.com/errata/RHSA-2026:13285" }, { "url": "https://access.redhat.com/errata/RHSA-2026:14162", "title": "https://access.redhat.com/errata/RHSA-2026:14162" }, { "url": "https://access.redhat.com/errata/RHSA-2026:14937", "title": "https://access.redhat.com/errata/RHSA-2026:14937" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19130", "title": "https://access.redhat.com/errata/RHSA-2026:19130" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19346", "title": "https://access.redhat.com/errata/RHSA-2026:19346" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19456", "title": "https://access.redhat.com/errata/RHSA-2026:19456" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19458", "title": "https://access.redhat.com/errata/RHSA-2026:19458" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20595", "title": "https://access.redhat.com/errata/RHSA-2026:20595" }, { "url": "https://access.redhat.com/errata/RHSA-2026:21254", "title": "https://access.redhat.com/errata/RHSA-2026:21254" }, { "url": "https://access.redhat.com/errata/RHSA-2026:21275", "title": "https://access.redhat.com/errata/RHSA-2026:21275" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22634", "title": "https://access.redhat.com/errata/RHSA-2026:22634" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22957", "title": "https://access.redhat.com/errata/RHSA-2026:22957" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23233", "title": "https://access.redhat.com/errata/RHSA-2026:23233" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23245", "title": "https://access.redhat.com/errata/RHSA-2026:23245" }, { "url": "https://access.redhat.com/errata/RHSA-2026:24346", "title": "https://access.redhat.com/errata/RHSA-2026:24346" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25044", "title": "https://access.redhat.com/errata/RHSA-2026:25044" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25096", "title": "https://access.redhat.com/errata/RHSA-2026:25096" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25181", "title": "https://access.redhat.com/errata/RHSA-2026:25181" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26542", "title": "https://access.redhat.com/errata/RHSA-2026:26542" }, { "url": "https://access.redhat.com/errata/RHSA-2026:27998", "title": "https://access.redhat.com/errata/RHSA-2026:27998" }, { "url": "https://access.redhat.com/errata/RHSA-2026:28887", "title": "https://access.redhat.com/errata/RHSA-2026:28887" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30078", "title": "https://access.redhat.com/errata/RHSA-2026:30078" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30087", "title": "https://access.redhat.com/errata/RHSA-2026:30087" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30088", "title": "https://access.redhat.com/errata/RHSA-2026:30088" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30089", "title": "https://access.redhat.com/errata/RHSA-2026:30089" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34098", "title": "https://access.redhat.com/errata/RHSA-2026:34098" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39981", "title": "https://access.redhat.com/errata/RHSA-2026:39981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:7473", "title": "https://access.redhat.com/errata/RHSA-2026:7473" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-4878", "title": "https://access.redhat.com/security/cve/CVE-2026-4878" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451615", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2451615" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7, "modificationTime": "2026-04-28T01:15:22.493791Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 6.7, "modificationTime": "2026-04-12T16:39:23.746048Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7, "modificationTime": "2026-04-18T11:02:14.005177Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7, "cvssVersion": "3.1", "modificationTime": "2026-04-28T01:15:22.493791Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.7, "cvssVersion": "3.1", "modificationTime": "2026-04-12T16:39:23.746048Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7, "cvssVersion": "3.1", "modificationTime": "2026-04-18T11:02:14.005177Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libcap2` package and not the `libcap2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.\n## Remediation\nUpgrade `Debian:13` `libcap2` to version 1:2.75-10+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-4878](https://security-tracker.debian.org/tracker/CVE-2026-4878)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2447554](https://bugzilla.redhat.com/show_bug.cgi?id=2447554)\n- [http://www.openwall.com/lists/oss-security/2026/04/07/14](http://www.openwall.com/lists/oss-security/2026/04/07/14)\n- [http://www.openwall.com/lists/oss-security/2026/04/07/4](http://www.openwall.com/lists/oss-security/2026/04/07/4)\n- [http://www.openwall.com/lists/oss-security/2026/04/08/9](http://www.openwall.com/lists/oss-security/2026/04/08/9)\n- [http://www.openwall.com/lists/oss-security/2026/04/09/5](http://www.openwall.com/lists/oss-security/2026/04/09/5)\n- [http://www.openwall.com/lists/oss-security/2026/04/09/6](http://www.openwall.com/lists/oss-security/2026/04/09/6)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json)\n- [https://access.redhat.com/errata/RHSA-2026:72502](https://access.redhat.com/errata/RHSA-2026:72502)\n- [https://access.redhat.com/errata/RHSA-2026:74674](https://access.redhat.com/errata/RHSA-2026:74674)\n- [https://access.redhat.com/errata/RHSA-2026:82304](https://access.redhat.com/errata/RHSA-2026:82304)\n- [https://access.redhat.com/errata/RHSA-2026:82322](https://access.redhat.com/errata/RHSA-2026:82322)\n- [https://access.redhat.com/errata/RHSA-2026:82347](https://access.redhat.com/errata/RHSA-2026:82347)\n- [https://access.redhat.com/errata/RHSA-2026:82354](https://access.redhat.com/errata/RHSA-2026:82354)\n- [https://access.redhat.com/errata/RHSA-2026:82372](https://access.redhat.com/errata/RHSA-2026:82372)\n- [https://access.redhat.com/errata/RHSA-2026:82857](https://access.redhat.com/errata/RHSA-2026:82857)\n- [https://access.redhat.com/errata/RHSA-2026:82888](https://access.redhat.com/errata/RHSA-2026:82888)\n- [https://access.redhat.com/errata/RHSA-2026:12423](https://access.redhat.com/errata/RHSA-2026:12423)\n- [https://access.redhat.com/errata/RHSA-2026:12441](https://access.redhat.com/errata/RHSA-2026:12441)\n- [https://access.redhat.com/errata/RHSA-2026:13285](https://access.redhat.com/errata/RHSA-2026:13285)\n- [https://access.redhat.com/errata/RHSA-2026:14162](https://access.redhat.com/errata/RHSA-2026:14162)\n- [https://access.redhat.com/errata/RHSA-2026:14937](https://access.redhat.com/errata/RHSA-2026:14937)\n- [https://access.redhat.com/errata/RHSA-2026:19130](https://access.redhat.com/errata/RHSA-2026:19130)\n- [https://access.redhat.com/errata/RHSA-2026:19346](https://access.redhat.com/errata/RHSA-2026:19346)\n- [https://access.redhat.com/errata/RHSA-2026:19456](https://access.redhat.com/errata/RHSA-2026:19456)\n- [https://access.redhat.com/errata/RHSA-2026:19458](https://access.redhat.com/errata/RHSA-2026:19458)\n- [https://access.redhat.com/errata/RHSA-2026:20595](https://access.redhat.com/errata/RHSA-2026:20595)\n- [https://access.redhat.com/errata/RHSA-2026:21254](https://access.redhat.com/errata/RHSA-2026:21254)\n- [https://access.redhat.com/errata/RHSA-2026:21275](https://access.redhat.com/errata/RHSA-2026:21275)\n- [https://access.redhat.com/errata/RHSA-2026:22634](https://access.redhat.com/errata/RHSA-2026:22634)\n- [https://access.redhat.com/errata/RHSA-2026:22957](https://access.redhat.com/errata/RHSA-2026:22957)\n- [https://access.redhat.com/errata/RHSA-2026:23233](https://access.redhat.com/errata/RHSA-2026:23233)\n- [https://access.redhat.com/errata/RHSA-2026:23245](https://access.redhat.com/errata/RHSA-2026:23245)\n- [https://access.redhat.com/errata/RHSA-2026:24346](https://access.redhat.com/errata/RHSA-2026:24346)\n- [https://access.redhat.com/errata/RHSA-2026:25044](https://access.redhat.com/errata/RHSA-2026:25044)\n- [https://access.redhat.com/errata/RHSA-2026:25096](https://access.redhat.com/errata/RHSA-2026:25096)\n- [https://access.redhat.com/errata/RHSA-2026:25181](https://access.redhat.com/errata/RHSA-2026:25181)\n- [https://access.redhat.com/errata/RHSA-2026:26542](https://access.redhat.com/errata/RHSA-2026:26542)\n- [https://access.redhat.com/errata/RHSA-2026:27998](https://access.redhat.com/errata/RHSA-2026:27998)\n- [https://access.redhat.com/errata/RHSA-2026:28887](https://access.redhat.com/errata/RHSA-2026:28887)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:30078](https://access.redhat.com/errata/RHSA-2026:30078)\n- [https://access.redhat.com/errata/RHSA-2026:30087](https://access.redhat.com/errata/RHSA-2026:30087)\n- [https://access.redhat.com/errata/RHSA-2026:30088](https://access.redhat.com/errata/RHSA-2026:30088)\n- [https://access.redhat.com/errata/RHSA-2026:30089](https://access.redhat.com/errata/RHSA-2026:30089)\n- [https://access.redhat.com/errata/RHSA-2026:34098](https://access.redhat.com/errata/RHSA-2026:34098)\n- [https://access.redhat.com/errata/RHSA-2026:39981](https://access.redhat.com/errata/RHSA-2026:39981)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:7473](https://access.redhat.com/errata/RHSA-2026:7473)\n- [https://access.redhat.com/security/cve/CVE-2026-4878](https://access.redhat.com/security/cve/CVE-2026-4878)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2451615](https://bugzilla.redhat.com/show_bug.cgi?id=2451615)\n", "epssDetails": { "percentile": "0.02814", "probability": "0.00141", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-4878" ], "CWE": [ "CWE-367" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "libcap2", "creationTime": "2026-04-10T02:48:53.969488Z", "disclosureTime": "2026-04-09T16:16:31.987000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T02:48:53.978462Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T01:31:33.690728Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "apt@3.0.3", "apt/libapt-pkg7.0@3.0.3", "systemd/libudev1@257.9-1~deb13u1", "libcap2/libcap2@1:2.75-10+b8" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "libcap2/libcap2", "version": "1:2.75-10+b8", "nearestFixedInVersion": "1:2.75-10+deb13u1" }, { "id": "SNYK-DEBIAN13-LIBCAP2-15960217", "cpes": [], "title": "Time-of-check Time-of-use (TOCTOU)", "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1:2.75-10+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "1:2.75-10+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-4878", "title": "https://security-tracker.debian.org/tracker/CVE-2026-4878" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/07/14", "title": "http://www.openwall.com/lists/oss-security/2026/04/07/14" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/07/4", "title": "http://www.openwall.com/lists/oss-security/2026/04/07/4" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/08/9", "title": "http://www.openwall.com/lists/oss-security/2026/04/08/9" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/09/5", "title": "http://www.openwall.com/lists/oss-security/2026/04/09/5" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/09/6", "title": "http://www.openwall.com/lists/oss-security/2026/04/09/6" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:72502", "title": "https://access.redhat.com/errata/RHSA-2026:72502" }, { "url": "https://access.redhat.com/errata/RHSA-2026:74674", "title": "https://access.redhat.com/errata/RHSA-2026:74674" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82304", "title": "https://access.redhat.com/errata/RHSA-2026:82304" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82322", "title": "https://access.redhat.com/errata/RHSA-2026:82322" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82347", "title": "https://access.redhat.com/errata/RHSA-2026:82347" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82354", "title": "https://access.redhat.com/errata/RHSA-2026:82354" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82372", "title": "https://access.redhat.com/errata/RHSA-2026:82372" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82857", "title": "https://access.redhat.com/errata/RHSA-2026:82857" }, { "url": "https://access.redhat.com/errata/RHSA-2026:82888", "title": "https://access.redhat.com/errata/RHSA-2026:82888" }, { "url": "https://access.redhat.com/errata/RHSA-2026:12423", "title": "https://access.redhat.com/errata/RHSA-2026:12423" }, { "url": "https://access.redhat.com/errata/RHSA-2026:12441", "title": "https://access.redhat.com/errata/RHSA-2026:12441" }, { "url": "https://access.redhat.com/errata/RHSA-2026:13285", "title": "https://access.redhat.com/errata/RHSA-2026:13285" }, { "url": "https://access.redhat.com/errata/RHSA-2026:14162", "title": "https://access.redhat.com/errata/RHSA-2026:14162" }, { "url": "https://access.redhat.com/errata/RHSA-2026:14937", "title": "https://access.redhat.com/errata/RHSA-2026:14937" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19130", "title": "https://access.redhat.com/errata/RHSA-2026:19130" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19346", "title": "https://access.redhat.com/errata/RHSA-2026:19346" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19456", "title": "https://access.redhat.com/errata/RHSA-2026:19456" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19458", "title": "https://access.redhat.com/errata/RHSA-2026:19458" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20595", "title": "https://access.redhat.com/errata/RHSA-2026:20595" }, { "url": "https://access.redhat.com/errata/RHSA-2026:21254", "title": "https://access.redhat.com/errata/RHSA-2026:21254" }, { "url": "https://access.redhat.com/errata/RHSA-2026:21275", "title": "https://access.redhat.com/errata/RHSA-2026:21275" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22634", "title": "https://access.redhat.com/errata/RHSA-2026:22634" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22957", "title": "https://access.redhat.com/errata/RHSA-2026:22957" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23233", "title": "https://access.redhat.com/errata/RHSA-2026:23233" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23245", "title": "https://access.redhat.com/errata/RHSA-2026:23245" }, { "url": "https://access.redhat.com/errata/RHSA-2026:24346", "title": "https://access.redhat.com/errata/RHSA-2026:24346" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25044", "title": "https://access.redhat.com/errata/RHSA-2026:25044" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25096", "title": "https://access.redhat.com/errata/RHSA-2026:25096" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25181", "title": "https://access.redhat.com/errata/RHSA-2026:25181" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26542", "title": "https://access.redhat.com/errata/RHSA-2026:26542" }, { "url": "https://access.redhat.com/errata/RHSA-2026:27998", "title": "https://access.redhat.com/errata/RHSA-2026:27998" }, { "url": "https://access.redhat.com/errata/RHSA-2026:28887", "title": "https://access.redhat.com/errata/RHSA-2026:28887" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30078", "title": "https://access.redhat.com/errata/RHSA-2026:30078" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30087", "title": "https://access.redhat.com/errata/RHSA-2026:30087" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30088", "title": "https://access.redhat.com/errata/RHSA-2026:30088" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30089", "title": "https://access.redhat.com/errata/RHSA-2026:30089" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34098", "title": "https://access.redhat.com/errata/RHSA-2026:34098" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39981", "title": "https://access.redhat.com/errata/RHSA-2026:39981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:7473", "title": "https://access.redhat.com/errata/RHSA-2026:7473" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-4878", "title": "https://access.redhat.com/security/cve/CVE-2026-4878" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451615", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2451615" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7, "modificationTime": "2026-04-28T01:15:22.493791Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 6.7, "modificationTime": "2026-04-12T16:39:23.746048Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7, "modificationTime": "2026-04-18T11:02:14.005177Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7, "cvssVersion": "3.1", "modificationTime": "2026-04-28T01:15:22.493791Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.7, "cvssVersion": "3.1", "modificationTime": "2026-04-12T16:39:23.746048Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7, "cvssVersion": "3.1", "modificationTime": "2026-04-18T11:02:14.005177Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libcap2` package and not the `libcap2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nA flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.\n## Remediation\nUpgrade `Debian:13` `libcap2` to version 1:2.75-10+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-4878](https://security-tracker.debian.org/tracker/CVE-2026-4878)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2447554](https://bugzilla.redhat.com/show_bug.cgi?id=2447554)\n- [http://www.openwall.com/lists/oss-security/2026/04/07/14](http://www.openwall.com/lists/oss-security/2026/04/07/14)\n- [http://www.openwall.com/lists/oss-security/2026/04/07/4](http://www.openwall.com/lists/oss-security/2026/04/07/4)\n- [http://www.openwall.com/lists/oss-security/2026/04/08/9](http://www.openwall.com/lists/oss-security/2026/04/08/9)\n- [http://www.openwall.com/lists/oss-security/2026/04/09/5](http://www.openwall.com/lists/oss-security/2026/04/09/5)\n- [http://www.openwall.com/lists/oss-security/2026/04/09/6](http://www.openwall.com/lists/oss-security/2026/04/09/6)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json)\n- [https://access.redhat.com/errata/RHSA-2026:72502](https://access.redhat.com/errata/RHSA-2026:72502)\n- [https://access.redhat.com/errata/RHSA-2026:74674](https://access.redhat.com/errata/RHSA-2026:74674)\n- [https://access.redhat.com/errata/RHSA-2026:82304](https://access.redhat.com/errata/RHSA-2026:82304)\n- [https://access.redhat.com/errata/RHSA-2026:82322](https://access.redhat.com/errata/RHSA-2026:82322)\n- [https://access.redhat.com/errata/RHSA-2026:82347](https://access.redhat.com/errata/RHSA-2026:82347)\n- [https://access.redhat.com/errata/RHSA-2026:82354](https://access.redhat.com/errata/RHSA-2026:82354)\n- [https://access.redhat.com/errata/RHSA-2026:82372](https://access.redhat.com/errata/RHSA-2026:82372)\n- [https://access.redhat.com/errata/RHSA-2026:82857](https://access.redhat.com/errata/RHSA-2026:82857)\n- [https://access.redhat.com/errata/RHSA-2026:82888](https://access.redhat.com/errata/RHSA-2026:82888)\n- [https://access.redhat.com/errata/RHSA-2026:12423](https://access.redhat.com/errata/RHSA-2026:12423)\n- [https://access.redhat.com/errata/RHSA-2026:12441](https://access.redhat.com/errata/RHSA-2026:12441)\n- [https://access.redhat.com/errata/RHSA-2026:13285](https://access.redhat.com/errata/RHSA-2026:13285)\n- [https://access.redhat.com/errata/RHSA-2026:14162](https://access.redhat.com/errata/RHSA-2026:14162)\n- [https://access.redhat.com/errata/RHSA-2026:14937](https://access.redhat.com/errata/RHSA-2026:14937)\n- [https://access.redhat.com/errata/RHSA-2026:19130](https://access.redhat.com/errata/RHSA-2026:19130)\n- [https://access.redhat.com/errata/RHSA-2026:19346](https://access.redhat.com/errata/RHSA-2026:19346)\n- [https://access.redhat.com/errata/RHSA-2026:19456](https://access.redhat.com/errata/RHSA-2026:19456)\n- [https://access.redhat.com/errata/RHSA-2026:19458](https://access.redhat.com/errata/RHSA-2026:19458)\n- [https://access.redhat.com/errata/RHSA-2026:20595](https://access.redhat.com/errata/RHSA-2026:20595)\n- [https://access.redhat.com/errata/RHSA-2026:21254](https://access.redhat.com/errata/RHSA-2026:21254)\n- [https://access.redhat.com/errata/RHSA-2026:21275](https://access.redhat.com/errata/RHSA-2026:21275)\n- [https://access.redhat.com/errata/RHSA-2026:22634](https://access.redhat.com/errata/RHSA-2026:22634)\n- [https://access.redhat.com/errata/RHSA-2026:22957](https://access.redhat.com/errata/RHSA-2026:22957)\n- [https://access.redhat.com/errata/RHSA-2026:23233](https://access.redhat.com/errata/RHSA-2026:23233)\n- [https://access.redhat.com/errata/RHSA-2026:23245](https://access.redhat.com/errata/RHSA-2026:23245)\n- [https://access.redhat.com/errata/RHSA-2026:24346](https://access.redhat.com/errata/RHSA-2026:24346)\n- [https://access.redhat.com/errata/RHSA-2026:25044](https://access.redhat.com/errata/RHSA-2026:25044)\n- [https://access.redhat.com/errata/RHSA-2026:25096](https://access.redhat.com/errata/RHSA-2026:25096)\n- [https://access.redhat.com/errata/RHSA-2026:25181](https://access.redhat.com/errata/RHSA-2026:25181)\n- [https://access.redhat.com/errata/RHSA-2026:26542](https://access.redhat.com/errata/RHSA-2026:26542)\n- [https://access.redhat.com/errata/RHSA-2026:27998](https://access.redhat.com/errata/RHSA-2026:27998)\n- [https://access.redhat.com/errata/RHSA-2026:28887](https://access.redhat.com/errata/RHSA-2026:28887)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:30078](https://access.redhat.com/errata/RHSA-2026:30078)\n- [https://access.redhat.com/errata/RHSA-2026:30087](https://access.redhat.com/errata/RHSA-2026:30087)\n- [https://access.redhat.com/errata/RHSA-2026:30088](https://access.redhat.com/errata/RHSA-2026:30088)\n- [https://access.redhat.com/errata/RHSA-2026:30089](https://access.redhat.com/errata/RHSA-2026:30089)\n- [https://access.redhat.com/errata/RHSA-2026:34098](https://access.redhat.com/errata/RHSA-2026:34098)\n- [https://access.redhat.com/errata/RHSA-2026:39981](https://access.redhat.com/errata/RHSA-2026:39981)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:7473](https://access.redhat.com/errata/RHSA-2026:7473)\n- [https://access.redhat.com/security/cve/CVE-2026-4878](https://access.redhat.com/security/cve/CVE-2026-4878)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2451615](https://bugzilla.redhat.com/show_bug.cgi?id=2451615)\n", "epssDetails": { "percentile": "0.02814", "probability": "0.00141", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-4878" ], "CWE": [ "CWE-367" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "libcap2", "creationTime": "2026-04-10T02:48:53.969488Z", "disclosureTime": "2026-04-09T16:16:31.987000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T02:48:53.978462Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T01:31:33.690728Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "adduser@3.152", "shadow/passwd@1:4.17.4-2", "pam/libpam-modules@1.7.0-5", "systemd/libsystemd0@257.9-1~deb13u1", "libcap2/libcap2@1:2.75-10+b8" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "libcap2/libcap2", "version": "1:2.75-10+b8", "nearestFixedInVersion": "1:2.75-10+deb13u1" }, { "id": "SNYK-DEBIAN13-MARIADB-17223359", "cpes": [], "title": "OS Command Injection", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-49261", "title": "https://security-tracker.debian.org/tracker/CVE-2026-49261" }, { "url": "https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw", "title": "https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw" }, { "url": "https://jira.mariadb.org/browse/MDEV-39721", "title": "https://jira.mariadb.org/browse/MDEV-39721" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25143", "title": "https://access.redhat.com/errata/RHSA-2026:25143" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25145", "title": "https://access.redhat.com/errata/RHSA-2026:25145" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33093", "title": "https://access.redhat.com/errata/RHSA-2026:33093" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33412", "title": "https://access.redhat.com/errata/RHSA-2026:33412" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33464", "title": "https://access.redhat.com/errata/RHSA-2026:33464" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33481", "title": "https://access.redhat.com/errata/RHSA-2026:33481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33482", "title": "https://access.redhat.com/errata/RHSA-2026:33482" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49522", "title": "https://access.redhat.com/errata/RHSA-2026:49522" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-49261", "title": "https://access.redhat.com/security/cve/CVE-2026-49261" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487957", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2487957" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:52848", "title": "https://access.redhat.com/errata/RHSA-2026:52848" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54142", "title": "https://access.redhat.com/errata/RHSA-2026:54142" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-08-04T01:30:07.365942Z" }, { "assigner": "Red Hat", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 9, "modificationTime": "2026-06-24T05:52:52.382915Z" }, { "assigner": "SUSE", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 9, "modificationTime": "2026-06-06T20:10:47.839480Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-08-04T01:30:07.365942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "critical", "baseScore": 9, "cvssVersion": "3.1", "modificationTime": "2026-06-24T05:52:52.382915Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "assigner": "SUSE", "severity": "critical", "baseScore": 9, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:47.839480Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `mariadb` package and not the `mariadb` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nMariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.\n## Remediation\nThere is no fixed version for `Debian:13` `mariadb`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-49261](https://security-tracker.debian.org/tracker/CVE-2026-49261)\n- [https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw](https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw)\n- [https://jira.mariadb.org/browse/MDEV-39721](https://jira.mariadb.org/browse/MDEV-39721)\n- [https://access.redhat.com/errata/RHSA-2026:25143](https://access.redhat.com/errata/RHSA-2026:25143)\n- [https://access.redhat.com/errata/RHSA-2026:25145](https://access.redhat.com/errata/RHSA-2026:25145)\n- [https://access.redhat.com/errata/RHSA-2026:33093](https://access.redhat.com/errata/RHSA-2026:33093)\n- [https://access.redhat.com/errata/RHSA-2026:33412](https://access.redhat.com/errata/RHSA-2026:33412)\n- [https://access.redhat.com/errata/RHSA-2026:33464](https://access.redhat.com/errata/RHSA-2026:33464)\n- [https://access.redhat.com/errata/RHSA-2026:33481](https://access.redhat.com/errata/RHSA-2026:33481)\n- [https://access.redhat.com/errata/RHSA-2026:33482](https://access.redhat.com/errata/RHSA-2026:33482)\n- [https://access.redhat.com/errata/RHSA-2026:49522](https://access.redhat.com/errata/RHSA-2026:49522)\n- [https://access.redhat.com/security/cve/CVE-2026-49261](https://access.redhat.com/security/cve/CVE-2026-49261)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2487957](https://bugzilla.redhat.com/show_bug.cgi?id=2487957)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json)\n- [https://access.redhat.com/errata/RHSA-2026:52848](https://access.redhat.com/errata/RHSA-2026:52848)\n- [https://access.redhat.com/errata/RHSA-2026:54142](https://access.redhat.com/errata/RHSA-2026:54142)\n", "epssDetails": { "percentile": "0.76077", "probability": "0.01691", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-49261" ], "CWE": [ "CWE-78" ], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "mariadb", "creationTime": "2026-06-07T14:48:14.735286Z", "disclosureTime": "2026-06-11T18:16:26.553000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-07T14:48:14.741565Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:37.008114Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1", "mariadb/mariadb-common@1:11.8.6-0+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "mariadb/mariadb-common", "version": "1:11.8.6-0+deb13u1" }, { "id": "SNYK-DEBIAN13-MARIADB-17223368", "cpes": [], "title": "OS Command Injection", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.2, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-48165", "title": "https://security-tracker.debian.org/tracker/CVE-2026-48165" }, { "url": "https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv", "title": "https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv" }, { "url": "https://jira.mariadb.org/browse/MDEV-39676", "title": "https://jira.mariadb.org/browse/MDEV-39676" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25143", "title": "https://access.redhat.com/errata/RHSA-2026:25143" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25145", "title": "https://access.redhat.com/errata/RHSA-2026:25145" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33093", "title": "https://access.redhat.com/errata/RHSA-2026:33093" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33412", "title": "https://access.redhat.com/errata/RHSA-2026:33412" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33464", "title": "https://access.redhat.com/errata/RHSA-2026:33464" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33481", "title": "https://access.redhat.com/errata/RHSA-2026:33481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33482", "title": "https://access.redhat.com/errata/RHSA-2026:33482" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49522", "title": "https://access.redhat.com/errata/RHSA-2026:49522" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-48165", "title": "https://access.redhat.com/security/cve/CVE-2026-48165" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488458", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2488458" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.2, "modificationTime": "2026-06-17T01:26:46.889589Z" }, { "assigner": "Red Hat", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 9.1, "modificationTime": "2026-06-24T14:06:38.530522Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 8, "modificationTime": "2026-06-06T20:10:48.450307Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.2, "cvssVersion": "3.1", "modificationTime": "2026-06-17T01:26:46.889589Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-06-24T14:06:38.530522Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 8, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:48.450307Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `mariadb` package and not the `mariadb` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nMariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.\n## Remediation\nThere is no fixed version for `Debian:13` `mariadb`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-48165](https://security-tracker.debian.org/tracker/CVE-2026-48165)\n- [https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv](https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv)\n- [https://jira.mariadb.org/browse/MDEV-39676](https://jira.mariadb.org/browse/MDEV-39676)\n- [https://access.redhat.com/errata/RHSA-2026:25143](https://access.redhat.com/errata/RHSA-2026:25143)\n- [https://access.redhat.com/errata/RHSA-2026:25145](https://access.redhat.com/errata/RHSA-2026:25145)\n- [https://access.redhat.com/errata/RHSA-2026:33093](https://access.redhat.com/errata/RHSA-2026:33093)\n- [https://access.redhat.com/errata/RHSA-2026:33412](https://access.redhat.com/errata/RHSA-2026:33412)\n- [https://access.redhat.com/errata/RHSA-2026:33464](https://access.redhat.com/errata/RHSA-2026:33464)\n- [https://access.redhat.com/errata/RHSA-2026:33481](https://access.redhat.com/errata/RHSA-2026:33481)\n- [https://access.redhat.com/errata/RHSA-2026:33482](https://access.redhat.com/errata/RHSA-2026:33482)\n- [https://access.redhat.com/errata/RHSA-2026:49522](https://access.redhat.com/errata/RHSA-2026:49522)\n- [https://access.redhat.com/security/cve/CVE-2026-48165](https://access.redhat.com/security/cve/CVE-2026-48165)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2488458](https://bugzilla.redhat.com/show_bug.cgi?id=2488458)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json)\n", "epssDetails": { "percentile": "0.74755", "probability": "0.01602", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48165" ], "CWE": [ "CWE-78" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "mariadb", "creationTime": "2026-06-07T14:49:05.767786Z", "disclosureTime": "2026-06-12T18:16:35.177000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-07T14:49:05.770362Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:13:59.556690Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1", "mariadb/mariadb-common@1:11.8.6-0+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "mariadb/mariadb-common", "version": "1:11.8.6-0+deb13u1" }, { "id": "SNYK-DEBIAN13-MARIADB-17223377", "cpes": [], "title": "OS Command Injection", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.2, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-48163", "title": "https://security-tracker.debian.org/tracker/CVE-2026-48163" }, { "url": "https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r", "title": "https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r" }, { "url": "https://jira.mariadb.org/browse/MDEV-39648", "title": "https://jira.mariadb.org/browse/MDEV-39648" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25143", "title": "https://access.redhat.com/errata/RHSA-2026:25143" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25145", "title": "https://access.redhat.com/errata/RHSA-2026:25145" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33093", "title": "https://access.redhat.com/errata/RHSA-2026:33093" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33412", "title": "https://access.redhat.com/errata/RHSA-2026:33412" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33464", "title": "https://access.redhat.com/errata/RHSA-2026:33464" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33481", "title": "https://access.redhat.com/errata/RHSA-2026:33481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33482", "title": "https://access.redhat.com/errata/RHSA-2026:33482" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49522", "title": "https://access.redhat.com/errata/RHSA-2026:49522" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-48163", "title": "https://access.redhat.com/security/cve/CVE-2026-48163" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488454", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2488454" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.2, "modificationTime": "2026-06-17T01:26:48.141645Z" }, { "assigner": "Red Hat", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 9.1, "modificationTime": "2026-06-24T14:06:39.873254Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 8, "modificationTime": "2026-06-06T20:10:46.811863Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.2, "cvssVersion": "3.1", "modificationTime": "2026-06-17T01:26:48.141645Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-06-24T14:06:39.873254Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 8, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:46.811863Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `mariadb` package and not the `mariadb` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nMariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.\n## Remediation\nThere is no fixed version for `Debian:13` `mariadb`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-48163](https://security-tracker.debian.org/tracker/CVE-2026-48163)\n- [https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r](https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r)\n- [https://jira.mariadb.org/browse/MDEV-39648](https://jira.mariadb.org/browse/MDEV-39648)\n- [https://access.redhat.com/errata/RHSA-2026:25143](https://access.redhat.com/errata/RHSA-2026:25143)\n- [https://access.redhat.com/errata/RHSA-2026:25145](https://access.redhat.com/errata/RHSA-2026:25145)\n- [https://access.redhat.com/errata/RHSA-2026:33093](https://access.redhat.com/errata/RHSA-2026:33093)\n- [https://access.redhat.com/errata/RHSA-2026:33412](https://access.redhat.com/errata/RHSA-2026:33412)\n- [https://access.redhat.com/errata/RHSA-2026:33464](https://access.redhat.com/errata/RHSA-2026:33464)\n- [https://access.redhat.com/errata/RHSA-2026:33481](https://access.redhat.com/errata/RHSA-2026:33481)\n- [https://access.redhat.com/errata/RHSA-2026:33482](https://access.redhat.com/errata/RHSA-2026:33482)\n- [https://access.redhat.com/errata/RHSA-2026:49522](https://access.redhat.com/errata/RHSA-2026:49522)\n- [https://access.redhat.com/security/cve/CVE-2026-48163](https://access.redhat.com/security/cve/CVE-2026-48163)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2488454](https://bugzilla.redhat.com/show_bug.cgi?id=2488454)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json)\n", "epssDetails": { "percentile": "0.64773", "probability": "0.01123", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48163" ], "CWE": [ "CWE-78" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "mariadb", "creationTime": "2026-06-07T14:49:19.042586Z", "disclosureTime": "2026-06-12T18:16:35.037000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-07T14:49:19.045500Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:00.515409Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1", "mariadb/mariadb-common@1:11.8.6-0+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "mariadb/mariadb-common", "version": "1:11.8.6-0+deb13u1" }, { "id": "SNYK-DEBIAN13-MARIADB-17223387", "cpes": [], "title": "Directory Traversal", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-44171", "title": "https://security-tracker.debian.org/tracker/CVE-2026-44171" }, { "url": "https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9", "title": "https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9" }, { "url": "https://jira.mariadb.org/browse/MDEV-39408", "title": "https://jira.mariadb.org/browse/MDEV-39408" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-06-17T01:26:48.448367Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-06-24T14:06:07.107801Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 6.3, "modificationTime": "2026-06-06T20:10:44.224466Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-06-17T01:26:48.448367Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-06-24T14:06:07.107801Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:44.224466Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `mariadb` package and not the `mariadb` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nMariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.\n## Remediation\nThere is no fixed version for `Debian:13` `mariadb`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-44171](https://security-tracker.debian.org/tracker/CVE-2026-44171)\n- [https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9](https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9)\n- [https://jira.mariadb.org/browse/MDEV-39408](https://jira.mariadb.org/browse/MDEV-39408)\n", "epssDetails": { "percentile": "0.07692", "probability": "0.00186", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-44171" ], "CWE": [ "CWE-22" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "mariadb", "creationTime": "2026-06-07T14:50:40.071665Z", "disclosureTime": "2026-06-12T18:16:33.983000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-07T14:50:40.074312Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:01.962867Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1", "mariadb/mariadb-common@1:11.8.6-0+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "mariadb/mariadb-common", "version": "1:11.8.6-0+deb13u1" }, { "id": "SNYK-DEBIAN13-MARIADB-17223389", "cpes": [], "title": "SQL Injection", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-44172", "title": "https://security-tracker.debian.org/tracker/CVE-2026-44172" }, { "url": "https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm", "title": "https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm" }, { "url": "https://jira.mariadb.org/browse/CONC-819", "title": "https://jira.mariadb.org/browse/CONC-819" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30135", "title": "https://access.redhat.com/errata/RHSA-2026:30135" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43505", "title": "https://access.redhat.com/errata/RHSA-2026:43505" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-44172", "title": "https://access.redhat.com/security/cve/CVE-2026-44172" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488459", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2488459" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47772", "title": "https://access.redhat.com/errata/RHSA-2026:47772" }, { "url": "https://access.redhat.com/errata/RHSA-2026:68567", "title": "https://access.redhat.com/errata/RHSA-2026:68567" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 9.1, "modificationTime": "2026-07-23T13:29:10.422124Z" }, { "assigner": "Red Hat", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 9.1, "modificationTime": "2026-06-24T14:06:10.303904Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.4, "modificationTime": "2026-06-06T20:10:45.447528Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-07-23T13:29:10.422124Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-06-24T14:06:10.303904Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:45.447528Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `mariadb` package and not the `mariadb` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nMariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.\n## Remediation\nThere is no fixed version for `Debian:13` `mariadb`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-44172](https://security-tracker.debian.org/tracker/CVE-2026-44172)\n- [https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm](https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm)\n- [https://jira.mariadb.org/browse/CONC-819](https://jira.mariadb.org/browse/CONC-819)\n- [https://access.redhat.com/errata/RHSA-2026:30135](https://access.redhat.com/errata/RHSA-2026:30135)\n- [https://access.redhat.com/errata/RHSA-2026:43505](https://access.redhat.com/errata/RHSA-2026:43505)\n- [https://access.redhat.com/security/cve/CVE-2026-44172](https://access.redhat.com/security/cve/CVE-2026-44172)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2488459](https://bugzilla.redhat.com/show_bug.cgi?id=2488459)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json)\n- [https://access.redhat.com/errata/RHSA-2026:47772](https://access.redhat.com/errata/RHSA-2026:47772)\n- [https://access.redhat.com/errata/RHSA-2026:68567](https://access.redhat.com/errata/RHSA-2026:68567)\n", "epssDetails": { "percentile": "0.62861", "probability": "0.01041", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-44172" ], "CWE": [ "CWE-89" ], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "mariadb", "creationTime": "2026-06-07T14:50:44.036819Z", "disclosureTime": "2026-06-12T18:16:34.123000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-07T14:50:44.039769Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-06T14:03:32.887361Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1", "mariadb/mariadb-common@1:11.8.6-0+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "mariadb/mariadb-common", "version": "1:11.8.6-0+deb13u1" }, { "id": "SNYK-DEBIAN13-MARIADB-17223359", "cpes": [], "title": "OS Command Injection", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-49261", "title": "https://security-tracker.debian.org/tracker/CVE-2026-49261" }, { "url": "https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw", "title": "https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw" }, { "url": "https://jira.mariadb.org/browse/MDEV-39721", "title": "https://jira.mariadb.org/browse/MDEV-39721" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25143", "title": "https://access.redhat.com/errata/RHSA-2026:25143" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25145", "title": "https://access.redhat.com/errata/RHSA-2026:25145" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33093", "title": "https://access.redhat.com/errata/RHSA-2026:33093" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33412", "title": "https://access.redhat.com/errata/RHSA-2026:33412" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33464", "title": "https://access.redhat.com/errata/RHSA-2026:33464" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33481", "title": "https://access.redhat.com/errata/RHSA-2026:33481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33482", "title": "https://access.redhat.com/errata/RHSA-2026:33482" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49522", "title": "https://access.redhat.com/errata/RHSA-2026:49522" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-49261", "title": "https://access.redhat.com/security/cve/CVE-2026-49261" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487957", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2487957" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:52848", "title": "https://access.redhat.com/errata/RHSA-2026:52848" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54142", "title": "https://access.redhat.com/errata/RHSA-2026:54142" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-08-04T01:30:07.365942Z" }, { "assigner": "Red Hat", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 9, "modificationTime": "2026-06-24T05:52:52.382915Z" }, { "assigner": "SUSE", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 9, "modificationTime": "2026-06-06T20:10:47.839480Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-08-04T01:30:07.365942Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "critical", "baseScore": 9, "cvssVersion": "3.1", "modificationTime": "2026-06-24T05:52:52.382915Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "assigner": "SUSE", "severity": "critical", "baseScore": 9, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:47.839480Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `mariadb` package and not the `mariadb` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nMariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.\n## Remediation\nThere is no fixed version for `Debian:13` `mariadb`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-49261](https://security-tracker.debian.org/tracker/CVE-2026-49261)\n- [https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw](https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw)\n- [https://jira.mariadb.org/browse/MDEV-39721](https://jira.mariadb.org/browse/MDEV-39721)\n- [https://access.redhat.com/errata/RHSA-2026:25143](https://access.redhat.com/errata/RHSA-2026:25143)\n- [https://access.redhat.com/errata/RHSA-2026:25145](https://access.redhat.com/errata/RHSA-2026:25145)\n- [https://access.redhat.com/errata/RHSA-2026:33093](https://access.redhat.com/errata/RHSA-2026:33093)\n- [https://access.redhat.com/errata/RHSA-2026:33412](https://access.redhat.com/errata/RHSA-2026:33412)\n- [https://access.redhat.com/errata/RHSA-2026:33464](https://access.redhat.com/errata/RHSA-2026:33464)\n- [https://access.redhat.com/errata/RHSA-2026:33481](https://access.redhat.com/errata/RHSA-2026:33481)\n- [https://access.redhat.com/errata/RHSA-2026:33482](https://access.redhat.com/errata/RHSA-2026:33482)\n- [https://access.redhat.com/errata/RHSA-2026:49522](https://access.redhat.com/errata/RHSA-2026:49522)\n- [https://access.redhat.com/security/cve/CVE-2026-49261](https://access.redhat.com/security/cve/CVE-2026-49261)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2487957](https://bugzilla.redhat.com/show_bug.cgi?id=2487957)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json)\n- [https://access.redhat.com/errata/RHSA-2026:52848](https://access.redhat.com/errata/RHSA-2026:52848)\n- [https://access.redhat.com/errata/RHSA-2026:54142](https://access.redhat.com/errata/RHSA-2026:54142)\n", "epssDetails": { "percentile": "0.76077", "probability": "0.01691", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-49261" ], "CWE": [ "CWE-78" ], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "mariadb", "creationTime": "2026-06-07T14:48:14.735286Z", "disclosureTime": "2026-06-11T18:16:26.553000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-07T14:48:14.741565Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:37.008114Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "mariadb/libmariadb3", "version": "1:11.8.6-0+deb13u1" }, { "id": "SNYK-DEBIAN13-MARIADB-17223368", "cpes": [], "title": "OS Command Injection", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.2, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-48165", "title": "https://security-tracker.debian.org/tracker/CVE-2026-48165" }, { "url": "https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv", "title": "https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv" }, { "url": "https://jira.mariadb.org/browse/MDEV-39676", "title": "https://jira.mariadb.org/browse/MDEV-39676" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25143", "title": "https://access.redhat.com/errata/RHSA-2026:25143" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25145", "title": "https://access.redhat.com/errata/RHSA-2026:25145" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33093", "title": "https://access.redhat.com/errata/RHSA-2026:33093" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33412", "title": "https://access.redhat.com/errata/RHSA-2026:33412" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33464", "title": "https://access.redhat.com/errata/RHSA-2026:33464" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33481", "title": "https://access.redhat.com/errata/RHSA-2026:33481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33482", "title": "https://access.redhat.com/errata/RHSA-2026:33482" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49522", "title": "https://access.redhat.com/errata/RHSA-2026:49522" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-48165", "title": "https://access.redhat.com/security/cve/CVE-2026-48165" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488458", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2488458" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.2, "modificationTime": "2026-06-17T01:26:46.889589Z" }, { "assigner": "Red Hat", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 9.1, "modificationTime": "2026-06-24T14:06:38.530522Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 8, "modificationTime": "2026-06-06T20:10:48.450307Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.2, "cvssVersion": "3.1", "modificationTime": "2026-06-17T01:26:46.889589Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-06-24T14:06:38.530522Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 8, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:48.450307Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `mariadb` package and not the `mariadb` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nMariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.\n## Remediation\nThere is no fixed version for `Debian:13` `mariadb`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-48165](https://security-tracker.debian.org/tracker/CVE-2026-48165)\n- [https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv](https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv)\n- [https://jira.mariadb.org/browse/MDEV-39676](https://jira.mariadb.org/browse/MDEV-39676)\n- [https://access.redhat.com/errata/RHSA-2026:25143](https://access.redhat.com/errata/RHSA-2026:25143)\n- [https://access.redhat.com/errata/RHSA-2026:25145](https://access.redhat.com/errata/RHSA-2026:25145)\n- [https://access.redhat.com/errata/RHSA-2026:33093](https://access.redhat.com/errata/RHSA-2026:33093)\n- [https://access.redhat.com/errata/RHSA-2026:33412](https://access.redhat.com/errata/RHSA-2026:33412)\n- [https://access.redhat.com/errata/RHSA-2026:33464](https://access.redhat.com/errata/RHSA-2026:33464)\n- [https://access.redhat.com/errata/RHSA-2026:33481](https://access.redhat.com/errata/RHSA-2026:33481)\n- [https://access.redhat.com/errata/RHSA-2026:33482](https://access.redhat.com/errata/RHSA-2026:33482)\n- [https://access.redhat.com/errata/RHSA-2026:49522](https://access.redhat.com/errata/RHSA-2026:49522)\n- [https://access.redhat.com/security/cve/CVE-2026-48165](https://access.redhat.com/security/cve/CVE-2026-48165)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2488458](https://bugzilla.redhat.com/show_bug.cgi?id=2488458)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json)\n", "epssDetails": { "percentile": "0.74755", "probability": "0.01602", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48165" ], "CWE": [ "CWE-78" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "mariadb", "creationTime": "2026-06-07T14:49:05.767786Z", "disclosureTime": "2026-06-12T18:16:35.177000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-07T14:49:05.770362Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:13:59.556690Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "mariadb/libmariadb3", "version": "1:11.8.6-0+deb13u1" }, { "id": "SNYK-DEBIAN13-MARIADB-17223377", "cpes": [], "title": "OS Command Injection", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.2, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-48163", "title": "https://security-tracker.debian.org/tracker/CVE-2026-48163" }, { "url": "https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r", "title": "https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r" }, { "url": "https://jira.mariadb.org/browse/MDEV-39648", "title": "https://jira.mariadb.org/browse/MDEV-39648" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25143", "title": "https://access.redhat.com/errata/RHSA-2026:25143" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25145", "title": "https://access.redhat.com/errata/RHSA-2026:25145" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33093", "title": "https://access.redhat.com/errata/RHSA-2026:33093" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33412", "title": "https://access.redhat.com/errata/RHSA-2026:33412" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33464", "title": "https://access.redhat.com/errata/RHSA-2026:33464" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33481", "title": "https://access.redhat.com/errata/RHSA-2026:33481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33482", "title": "https://access.redhat.com/errata/RHSA-2026:33482" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49522", "title": "https://access.redhat.com/errata/RHSA-2026:49522" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-48163", "title": "https://access.redhat.com/security/cve/CVE-2026-48163" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488454", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2488454" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.2, "modificationTime": "2026-06-17T01:26:48.141645Z" }, { "assigner": "Red Hat", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 9.1, "modificationTime": "2026-06-24T14:06:39.873254Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 8, "modificationTime": "2026-06-06T20:10:46.811863Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.2, "cvssVersion": "3.1", "modificationTime": "2026-06-17T01:26:48.141645Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-06-24T14:06:39.873254Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 8, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:46.811863Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `mariadb` package and not the `mariadb` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nMariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.\n## Remediation\nThere is no fixed version for `Debian:13` `mariadb`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-48163](https://security-tracker.debian.org/tracker/CVE-2026-48163)\n- [https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r](https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r)\n- [https://jira.mariadb.org/browse/MDEV-39648](https://jira.mariadb.org/browse/MDEV-39648)\n- [https://access.redhat.com/errata/RHSA-2026:25143](https://access.redhat.com/errata/RHSA-2026:25143)\n- [https://access.redhat.com/errata/RHSA-2026:25145](https://access.redhat.com/errata/RHSA-2026:25145)\n- [https://access.redhat.com/errata/RHSA-2026:33093](https://access.redhat.com/errata/RHSA-2026:33093)\n- [https://access.redhat.com/errata/RHSA-2026:33412](https://access.redhat.com/errata/RHSA-2026:33412)\n- [https://access.redhat.com/errata/RHSA-2026:33464](https://access.redhat.com/errata/RHSA-2026:33464)\n- [https://access.redhat.com/errata/RHSA-2026:33481](https://access.redhat.com/errata/RHSA-2026:33481)\n- [https://access.redhat.com/errata/RHSA-2026:33482](https://access.redhat.com/errata/RHSA-2026:33482)\n- [https://access.redhat.com/errata/RHSA-2026:49522](https://access.redhat.com/errata/RHSA-2026:49522)\n- [https://access.redhat.com/security/cve/CVE-2026-48163](https://access.redhat.com/security/cve/CVE-2026-48163)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2488454](https://bugzilla.redhat.com/show_bug.cgi?id=2488454)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json)\n", "epssDetails": { "percentile": "0.64773", "probability": "0.01123", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-48163" ], "CWE": [ "CWE-78" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "mariadb", "creationTime": "2026-06-07T14:49:19.042586Z", "disclosureTime": "2026-06-12T18:16:35.037000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-07T14:49:19.045500Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:14:00.515409Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "mariadb/libmariadb3", "version": "1:11.8.6-0+deb13u1" }, { "id": "SNYK-DEBIAN13-MARIADB-17223387", "cpes": [], "title": "Directory Traversal", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-44171", "title": "https://security-tracker.debian.org/tracker/CVE-2026-44171" }, { "url": "https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9", "title": "https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9" }, { "url": "https://jira.mariadb.org/browse/MDEV-39408", "title": "https://jira.mariadb.org/browse/MDEV-39408" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-06-17T01:26:48.448367Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-06-24T14:06:07.107801Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 6.3, "modificationTime": "2026-06-06T20:10:44.224466Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-06-17T01:26:48.448367Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-06-24T14:06:07.107801Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:44.224466Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `mariadb` package and not the `mariadb` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nMariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.\n## Remediation\nThere is no fixed version for `Debian:13` `mariadb`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-44171](https://security-tracker.debian.org/tracker/CVE-2026-44171)\n- [https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9](https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9)\n- [https://jira.mariadb.org/browse/MDEV-39408](https://jira.mariadb.org/browse/MDEV-39408)\n", "epssDetails": { "percentile": "0.07692", "probability": "0.00186", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-44171" ], "CWE": [ "CWE-22" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "mariadb", "creationTime": "2026-06-07T14:50:40.071665Z", "disclosureTime": "2026-06-12T18:16:33.983000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-07T14:50:40.074312Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T14:05:01.962867Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "mariadb/libmariadb3", "version": "1:11.8.6-0+deb13u1" }, { "id": "SNYK-DEBIAN13-MARIADB-17223389", "cpes": [], "title": "SQL Injection", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-44172", "title": "https://security-tracker.debian.org/tracker/CVE-2026-44172" }, { "url": "https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm", "title": "https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm" }, { "url": "https://jira.mariadb.org/browse/CONC-819", "title": "https://jira.mariadb.org/browse/CONC-819" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30135", "title": "https://access.redhat.com/errata/RHSA-2026:30135" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43505", "title": "https://access.redhat.com/errata/RHSA-2026:43505" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-44172", "title": "https://access.redhat.com/security/cve/CVE-2026-44172" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488459", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2488459" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47772", "title": "https://access.redhat.com/errata/RHSA-2026:47772" }, { "url": "https://access.redhat.com/errata/RHSA-2026:68567", "title": "https://access.redhat.com/errata/RHSA-2026:68567" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 9.1, "modificationTime": "2026-07-23T13:29:10.422124Z" }, { "assigner": "Red Hat", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 9.1, "modificationTime": "2026-06-24T14:06:10.303904Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.4, "modificationTime": "2026-06-06T20:10:45.447528Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-07-23T13:29:10.422124Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-06-24T14:06:10.303904Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:45.447528Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `mariadb` package and not the `mariadb` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nMariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.\n## Remediation\nThere is no fixed version for `Debian:13` `mariadb`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-44172](https://security-tracker.debian.org/tracker/CVE-2026-44172)\n- [https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm](https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm)\n- [https://jira.mariadb.org/browse/CONC-819](https://jira.mariadb.org/browse/CONC-819)\n- [https://access.redhat.com/errata/RHSA-2026:30135](https://access.redhat.com/errata/RHSA-2026:30135)\n- [https://access.redhat.com/errata/RHSA-2026:43505](https://access.redhat.com/errata/RHSA-2026:43505)\n- [https://access.redhat.com/security/cve/CVE-2026-44172](https://access.redhat.com/security/cve/CVE-2026-44172)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2488459](https://bugzilla.redhat.com/show_bug.cgi?id=2488459)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json)\n- [https://access.redhat.com/errata/RHSA-2026:47772](https://access.redhat.com/errata/RHSA-2026:47772)\n- [https://access.redhat.com/errata/RHSA-2026:68567](https://access.redhat.com/errata/RHSA-2026:68567)\n", "epssDetails": { "percentile": "0.62861", "probability": "0.01041", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-44172" ], "CWE": [ "CWE-89" ], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "mariadb", "creationTime": "2026-06-07T14:50:44.036819Z", "disclosureTime": "2026-06-12T18:16:34.123000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-07T14:50:44.039769Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-06T14:03:32.887361Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "mariadb/libmariadb3", "version": "1:11.8.6-0+deb13u1" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.14271", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:01:08.335059Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "apt@3.0.3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.55469", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:06.991583Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "apt@3.0.3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.50549", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.055725Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "apt@3.0.3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.54987", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-26T14:06:08.293919Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "apt@3.0.3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.58023", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.026464Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "apt@3.0.3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.14271", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:01:08.335059Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "coreutils@9.7-3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.55469", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:06.991583Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "coreutils@9.7-3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.50549", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.055725Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "coreutils@9.7-3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.54987", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-26T14:06:08.293919Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "coreutils@9.7-3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.58023", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.026464Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "coreutils@9.7-3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.14271", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:01:08.335059Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-sec/lua-sec@1.3.2-2+b2", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.55469", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:06.991583Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-sec/lua-sec@1.3.2-2+b2", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.50549", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.055725Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-sec/lua-sec@1.3.2-2+b2", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.54987", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-26T14:06:08.293919Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-sec/lua-sec@1.3.2-2+b2", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.58023", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.026464Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-sec/lua-sec@1.3.2-2+b2", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.14271", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:01:08.335059Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.55469", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:06.991583Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.50549", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.055725Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.54987", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-26T14:06:08.293919Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.58023", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.026464Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.14271", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:01:08.335059Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "apt@3.0.3", "apt/libapt-pkg7.0@3.0.3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.55469", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:06.991583Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "apt@3.0.3", "apt/libapt-pkg7.0@3.0.3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.50549", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.055725Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "apt@3.0.3", "apt/libapt-pkg7.0@3.0.3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.54987", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-26T14:06:08.293919Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "apt@3.0.3", "apt/libapt-pkg7.0@3.0.3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.58023", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.026464Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "apt@3.0.3", "apt/libapt-pkg7.0@3.0.3", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.14271", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:01:08.335059Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.55469", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:06.991583Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.50549", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.055725Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.54987", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-26T14:06:08.293919Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.58023", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.026464Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.14271", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:01:08.335059Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.55469", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:06.991583Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.50549", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.055725Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.54987", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-26T14:06:08.293919Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.58023", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.026464Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.14271", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:01:08.335059Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.55469", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:06.991583Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.50549", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.055725Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.54987", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-26T14:06:08.293919Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.58023", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.026464Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.14271", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:01:08.335059Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.55469", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:06.991583Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.50549", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.055725Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.54987", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-26T14:06:08.293919Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.58023", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.026464Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.14271", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:01:08.335059Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openldap/libldap2@2.6.10+dfsg-1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.55469", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:06.991583Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openldap/libldap2@2.6.10+dfsg-1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.50549", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.055725Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openldap/libldap2@2.6.10+dfsg-1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.54987", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-26T14:06:08.293919Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openldap/libldap2@2.6.10+dfsg-1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.58023", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.026464Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openldap/libldap2@2.6.10+dfsg-1", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.14271", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:01:08.335059Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "krb5/libgssapi-krb5-2@1.21.3-5", "krb5/libkrb5-3@1.21.3-5", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.55469", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:06.991583Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "krb5/libgssapi-krb5-2@1.21.3-5", "krb5/libkrb5-3@1.21.3-5", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.50549", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.055725Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "krb5/libgssapi-krb5-2@1.21.3-5", "krb5/libkrb5-3@1.21.3-5", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.54987", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-26T14:06:08.293919Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "krb5/libgssapi-krb5-2@1.21.3-5", "krb5/libkrb5-3@1.21.3-5", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.58023", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.026464Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "krb5/libgssapi-krb5-2@1.21.3-5", "krb5/libkrb5-3@1.21.3-5", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.14271", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:01:08.335059Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openldap/libldap2@2.6.10+dfsg-1", "cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.55469", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:06.991583Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openldap/libldap2@2.6.10+dfsg-1", "cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.50549", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.055725Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openldap/libldap2@2.6.10+dfsg-1", "cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.54987", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-26T14:06:08.293919Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openldap/libldap2@2.6.10+dfsg-1", "cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.58023", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.026464Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1", "openldap/libldap2@2.6.10+dfsg-1", "cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9", "openssl/libssl3t64@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl3t64", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.14271", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:01:08.335059Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1", "openssl/openssl-provider-legacy@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/openssl-provider-legacy", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.55469", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:06.991583Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1", "openssl/openssl-provider-legacy@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/openssl-provider-legacy", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.50549", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.055725Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1", "openssl/openssl-provider-legacy@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/openssl-provider-legacy", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.54987", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-26T14:06:08.293919Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1", "openssl/openssl-provider-legacy@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/openssl-provider-legacy", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.58023", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.026464Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1", "openssl/openssl-provider-legacy@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/openssl-provider-legacy", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.14271", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:01:08.335059Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.55469", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:06.991583Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.50549", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.055725Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.54987", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-26T14:06:08.293919Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.58023", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.026464Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.14271", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:01:08.335059Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.55469", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:06.991583Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.50549", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.055725Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.54987", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-26T14:06:08.293919Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.58023", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.026464Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969301", "cpes": [], "title": "CVE-2026-31789", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-31789", "title": "https://security-tracker.debian.org/tracker/CVE-2026-31789" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "title": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "title": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "title": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "title": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "title": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 5.8, "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "cvssV3BaseScore": 7.3, "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.322162Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.8, "cvssVersion": "3.1", "modificationTime": "2026-04-15T00:23:01.358492Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "assigner": "SUSE", "severity": "high", "baseScore": 7.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:54.650024Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-31789](https://security-tracker.debian.org/tracker/CVE-2026-31789)\n- [https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde](https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde)\n- [https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf](https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf)\n- [https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49](https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49)\n- [https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9](https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9)\n- [https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521](https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n", "epssDetails": { "percentile": "0.14271", "probability": "0.00243", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-31789" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "openssl", "creationTime": "2026-04-10T21:36:30.839966Z", "disclosureTime": "2026-04-07T22:16:21.617000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:36:30.845028Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:01:08.335059Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "ssl-cert@1.1.3", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969306", "cpes": [], "title": "CVE-2026-28389", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28389", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28389" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "title": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "title": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "title": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "title": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "title": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.297059Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:46.745668Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:29.756813Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28389](https://security-tracker.debian.org/tracker/CVE-2026-28389)\n- [https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5](https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5)\n- [https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616](https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616)\n- [https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f](https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f)\n- [https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a](https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a)\n- [https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686](https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.55469", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28389" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:02.377588Z", "disclosureTime": "2026-04-07T22:16:21.030000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:02.380861Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:06.991583Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "ssl-cert@1.1.3", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969307", "cpes": [], "title": "CVE-2026-28387", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28387", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28387" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "title": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "title": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "title": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "title": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "title": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 3.7, "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "cvssV3BaseScore": 6.5, "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.574331Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:46:44.895108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-04-12T03:29:17.808435Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28387](https://security-tracker.debian.org/tracker/CVE-2026-28387)\n- [https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b](https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b)\n- [https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe](https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe)\n- [https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3](https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3)\n- [https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7](https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7)\n- [https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177](https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.50549", "probability": "0.00671", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28387" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:37:05.297314Z", "disclosureTime": "2026-04-07T22:16:20.700000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:37:05.300581Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.055725Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "ssl-cert@1.1.3", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969309", "cpes": [], "title": "CVE-2026-28390", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28390", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28390" }, { "url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "title": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "title": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "title": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "title": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "title": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:53.199622Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-11T04:37:15.181387Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-17T11:12:03.567644Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28390](https://security-tracker.debian.org/tracker/CVE-2026-28390)\n- [https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc](https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc)\n- [https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6](https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6)\n- [https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4](https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4)\n- [https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788](https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788)\n- [https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75](https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.54987", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28390" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:39:39.127754Z", "disclosureTime": "2026-04-07T22:16:21.190000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:39:39.131552Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-26T14:06:08.293919Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "ssl-cert@1.1.3", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-OPENSSL-15969320", "cpes": [], "title": "CVE-2026-28388", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.5.5-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.5.5-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-28388", "title": "https://security-tracker.debian.org/tracker/CVE-2026-28388" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "title": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "title": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "title": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "title": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "title": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt", "title": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-04-24T02:21:52.097816Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-04-13T00:47:01.842319Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-07-05T23:07:34.759996Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Debian:13` `openssl` to version 3.5.5-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-28388](https://security-tracker.debian.org/tracker/CVE-2026-28388)\n- [https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e](https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e)\n- [https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139](https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139)\n- [https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3](https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3)\n- [https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8](https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8)\n- [https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726](https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726)\n- [https://openssl-library.org/news/secadv/20260407.txt](https://openssl-library.org/news/secadv/20260407.txt)\n- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)\n", "epssDetails": { "percentile": "0.58023", "probability": "0.00885", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-28388" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "openssl", "creationTime": "2026-04-10T21:43:37.142636Z", "disclosureTime": "2026-04-07T22:16:20.863000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-04-10T21:43:37.145994Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:07.026464Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "ssl-cert@1.1.3", "openssl@3.5.5-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "3.5.5-1~deb13u1", "nearestFixedInVersion": "3.5.5-1~deb13u2", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-PCRE2-19685515", "cpes": [], "title": "Free of Memory not on the Heap", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<10.46-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "10.46-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-89161", "title": "https://security-tracker.debian.org/tracker/CVE-2026-89161" }, { "url": "https://github.com/PCRE2Project/pcre2/pull/937", "title": "https://github.com/PCRE2Project/pcre2/pull/937" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-09-17T01:30:42.876297Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-12T06:07:51.962108Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-18T11:06:26.133426Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-09-17T01:30:42.876297Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-12T06:07:51.962108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-18T11:06:26.133426Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIn PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.\n## Remediation\nUpgrade `Debian:13` `pcre2` to version 10.46-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-89161](https://security-tracker.debian.org/tracker/CVE-2026-89161)\n- [https://github.com/PCRE2Project/pcre2/pull/937](https://github.com/PCRE2Project/pcre2/pull/937)\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n", "epssDetails": { "percentile": "0.01943", "probability": "0.00126", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-89161" ], "CWE": [ "CWE-590" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "pcre2", "creationTime": "2026-09-11T15:34:20.037738Z", "disclosureTime": "2026-09-11T04:18:04.470000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-11T15:34:20.044015Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:46:05.660988Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "grep@3.11-4", "pcre2/libpcre2-8-0@10.46-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "pcre2/libpcre2-8-0", "version": "10.46-1~deb13u1", "nearestFixedInVersion": "10.46-1~deb13u2" }, { "id": "SNYK-DEBIAN13-PCRE2-19685522", "cpes": [], "title": "Integer Overflow or Wraparound", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<10.46-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "10.46-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-89157", "title": "https://security-tracker.debian.org/tracker/CVE-2026-89157" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9", "title": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-17T01:30:43.018395Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "cvssV3BaseScore": 5.7, "modificationTime": "2026-09-12T06:07:46.857038Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-09-18T11:06:09.698583Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-17T01:30:43.018395Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.7, "cvssVersion": "3.1", "modificationTime": "2026-09-12T06:07:46.857038Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-09-18T11:06:09.698583Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nPCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.\n## Remediation\nUpgrade `Debian:13` `pcre2` to version 10.46-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-89157](https://security-tracker.debian.org/tracker/CVE-2026-89157)\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n- [https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9](https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9)\n", "epssDetails": { "percentile": "0.18076", "probability": "0.00278", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-89157" ], "CWE": [ "CWE-190" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "pcre2", "creationTime": "2026-09-11T15:34:24.796009Z", "disclosureTime": "2026-09-11T04:18:03.753000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-11T15:34:24.800041Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:46:05.406749Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "grep@3.11-4", "pcre2/libpcre2-8-0@10.46-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "pcre2/libpcre2-8-0", "version": "10.46-1~deb13u1", "nearestFixedInVersion": "10.46-1~deb13u2" }, { "id": "SNYK-DEBIAN13-PCRE2-19685515", "cpes": [], "title": "Free of Memory not on the Heap", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<10.46-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "10.46-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-89161", "title": "https://security-tracker.debian.org/tracker/CVE-2026-89161" }, { "url": "https://github.com/PCRE2Project/pcre2/pull/937", "title": "https://github.com/PCRE2Project/pcre2/pull/937" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-09-17T01:30:42.876297Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-12T06:07:51.962108Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-18T11:06:26.133426Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-09-17T01:30:42.876297Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-12T06:07:51.962108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-18T11:06:26.133426Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIn PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.\n## Remediation\nUpgrade `Debian:13` `pcre2` to version 10.46-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-89161](https://security-tracker.debian.org/tracker/CVE-2026-89161)\n- [https://github.com/PCRE2Project/pcre2/pull/937](https://github.com/PCRE2Project/pcre2/pull/937)\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n", "epssDetails": { "percentile": "0.01943", "probability": "0.00126", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-89161" ], "CWE": [ "CWE-590" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "pcre2", "creationTime": "2026-09-11T15:34:20.037738Z", "disclosureTime": "2026-09-11T04:18:04.470000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-11T15:34:20.044015Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:46:05.660988Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "luarocks@3.8.0+dfsg1-1", "wget@1.25.0-2", "pcre2/libpcre2-8-0@10.46-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "pcre2/libpcre2-8-0", "version": "10.46-1~deb13u1", "nearestFixedInVersion": "10.46-1~deb13u2" }, { "id": "SNYK-DEBIAN13-PCRE2-19685522", "cpes": [], "title": "Integer Overflow or Wraparound", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<10.46-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "10.46-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-89157", "title": "https://security-tracker.debian.org/tracker/CVE-2026-89157" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9", "title": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-17T01:30:43.018395Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "cvssV3BaseScore": 5.7, "modificationTime": "2026-09-12T06:07:46.857038Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-09-18T11:06:09.698583Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-17T01:30:43.018395Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.7, "cvssVersion": "3.1", "modificationTime": "2026-09-12T06:07:46.857038Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-09-18T11:06:09.698583Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nPCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.\n## Remediation\nUpgrade `Debian:13` `pcre2` to version 10.46-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-89157](https://security-tracker.debian.org/tracker/CVE-2026-89157)\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n- [https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9](https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9)\n", "epssDetails": { "percentile": "0.18076", "probability": "0.00278", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-89157" ], "CWE": [ "CWE-190" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "pcre2", "creationTime": "2026-09-11T15:34:24.796009Z", "disclosureTime": "2026-09-11T04:18:03.753000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-11T15:34:24.800041Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:46:05.406749Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "luarocks@3.8.0+dfsg1-1", "wget@1.25.0-2", "pcre2/libpcre2-8-0@10.46-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "pcre2/libpcre2-8-0", "version": "10.46-1~deb13u1", "nearestFixedInVersion": "10.46-1~deb13u2" }, { "id": "SNYK-DEBIAN13-PCRE2-19685515", "cpes": [], "title": "Free of Memory not on the Heap", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<10.46-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "10.46-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-89161", "title": "https://security-tracker.debian.org/tracker/CVE-2026-89161" }, { "url": "https://github.com/PCRE2Project/pcre2/pull/937", "title": "https://github.com/PCRE2Project/pcre2/pull/937" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-09-17T01:30:42.876297Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-12T06:07:51.962108Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-18T11:06:26.133426Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-09-17T01:30:42.876297Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-12T06:07:51.962108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-18T11:06:26.133426Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIn PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.\n## Remediation\nUpgrade `Debian:13` `pcre2` to version 10.46-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-89161](https://security-tracker.debian.org/tracker/CVE-2026-89161)\n- [https://github.com/PCRE2Project/pcre2/pull/937](https://github.com/PCRE2Project/pcre2/pull/937)\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n", "epssDetails": { "percentile": "0.01943", "probability": "0.00126", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-89161" ], "CWE": [ "CWE-590" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "pcre2", "creationTime": "2026-09-11T15:34:20.037738Z", "disclosureTime": "2026-09-11T04:18:04.470000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-11T15:34:20.044015Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:46:05.660988Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "adduser@3.152", "shadow/passwd@1:4.17.4-2", "base-passwd@3.6.7", "libselinux/libselinux1@3.8.1-1", "pcre2/libpcre2-8-0@10.46-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "pcre2/libpcre2-8-0", "version": "10.46-1~deb13u1", "nearestFixedInVersion": "10.46-1~deb13u2" }, { "id": "SNYK-DEBIAN13-PCRE2-19685522", "cpes": [], "title": "Integer Overflow or Wraparound", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<10.46-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "10.46-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-89157", "title": "https://security-tracker.debian.org/tracker/CVE-2026-89157" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9", "title": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-17T01:30:43.018395Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "cvssV3BaseScore": 5.7, "modificationTime": "2026-09-12T06:07:46.857038Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-09-18T11:06:09.698583Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-17T01:30:43.018395Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.7, "cvssVersion": "3.1", "modificationTime": "2026-09-12T06:07:46.857038Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-09-18T11:06:09.698583Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nPCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.\n## Remediation\nUpgrade `Debian:13` `pcre2` to version 10.46-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-89157](https://security-tracker.debian.org/tracker/CVE-2026-89157)\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n- [https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9](https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9)\n", "epssDetails": { "percentile": "0.18076", "probability": "0.00278", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-89157" ], "CWE": [ "CWE-190" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "pcre2", "creationTime": "2026-09-11T15:34:24.796009Z", "disclosureTime": "2026-09-11T04:18:03.753000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-11T15:34:24.800041Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:46:05.406749Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "prosody-13.0@1nightly85-1~trixie", "adduser@3.152", "shadow/passwd@1:4.17.4-2", "base-passwd@3.6.7", "libselinux/libselinux1@3.8.1-1", "pcre2/libpcre2-8-0@10.46-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "pcre2/libpcre2-8-0", "version": "10.46-1~deb13u1", "nearestFixedInVersion": "10.46-1~deb13u2" }, { "id": "SNYK-DEBIAN13-PERL-16896261", "cpes": [], "title": "CVE-2026-8376", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<5.40.1-6+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "5.40.1-6+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-8376", "title": "https://security-tracker.debian.org/tracker/CVE-2026-8376" }, { "url": "https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch", "title": "https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch" }, { "url": "http://www.openwall.com/lists/oss-security/2026/05/26/1", "title": "http://www.openwall.com/lists/oss-security/2026/05/26/1" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-05-28T01:14:54.805456Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "cvssV3BaseScore": 5.7, "modificationTime": "2026-07-02T07:47:08.536732Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "cvssV3BaseScore": 5.7, "modificationTime": "2026-07-28T11:06:58.531635Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-05-28T01:14:54.805456Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.7, "cvssVersion": "3.1", "modificationTime": "2026-07-02T07:47:08.536732Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.7, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:06:58.531635Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `perl` package and not the `perl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nPerl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.\n## Remediation\nUpgrade `Debian:13` `perl` to version 5.40.1-6+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-8376](https://security-tracker.debian.org/tracker/CVE-2026-8376)\n- [https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch](https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch)\n- [http://www.openwall.com/lists/oss-security/2026/05/26/1](http://www.openwall.com/lists/oss-security/2026/05/26/1)\n", "epssDetails": { "percentile": "0.38801", "probability": "0.00481", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-8376" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "perl", "creationTime": "2026-05-27T18:27:19.013975Z", "disclosureTime": "2026-05-26T00:16:57.150000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-27T18:27:19.018190Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:22:36.162994Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "perl/perl-base@5.40.1-6" ], "upgradePath": [ false, "perl/perl-base@5.40.1-6+deb13u1" ], "isUpgradable": true, "isPatchable": false, "name": "perl/perl-base", "version": "5.40.1-6", "nearestFixedInVersion": "5.40.1-6+deb13u1" }, { "id": "SNYK-DEBIAN13-PERL-17037371", "cpes": [], "title": "CVE-2026-42497", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "<5.40.1-6+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "5.40.1-6+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-42497", "title": "https://security-tracker.debian.org/tracker/CVE-2026-42497" }, { "url": "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "title": "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch" }, { "url": "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "title": "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-42496", "title": "https://www.cve.org/CVERecord?id=CVE-2026-42496" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-28T01:14:58.033365Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H", "cvssV3BaseScore": 6.8, "modificationTime": "2026-06-18T05:36:36.076537Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-28T01:14:58.033365Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.8, "cvssVersion": "3.1", "modificationTime": "2026-06-18T05:36:36.076537Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `perl` package and not the `perl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nArchive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.\n## Remediation\nUpgrade `Debian:13` `perl` to version 5.40.1-6+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-42497](https://security-tracker.debian.org/tracker/CVE-2026-42497)\n- [https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch](https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch)\n- [https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes](https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes)\n- [https://www.cve.org/CVERecord?id=CVE-2026-42496](https://www.cve.org/CVERecord?id=CVE-2026-42496)\n", "epssDetails": { "percentile": "0.38002", "probability": "0.00471", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-42497" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "perl", "creationTime": "2026-05-29T03:54:32.389334Z", "disclosureTime": "2026-05-26T02:16:40.250000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-29T03:54:32.395259Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:15:05.396422Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "perl/perl-base@5.40.1-6" ], "upgradePath": [ false, "perl/perl-base@5.40.1-6+deb13u1" ], "isUpgradable": true, "isPatchable": false, "name": "perl/perl-base", "version": "5.40.1-6", "nearestFixedInVersion": "5.40.1-6+deb13u1" }, { "id": "SNYK-DEBIAN13-PERL-17037434", "cpes": [], "title": "CVE-2026-42496", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "<5.40.1-6+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "5.40.1-6+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-42496", "title": "https://security-tracker.debian.org/tracker/CVE-2026-42496" }, { "url": "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "title": "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch" }, { "url": "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "title": "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-42497", "title": "https://www.cve.org/CVERecord?id=CVE-2026-42497" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30851", "title": "https://access.redhat.com/errata/RHSA-2026:30851" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30852", "title": "https://access.redhat.com/errata/RHSA-2026:30852" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30856", "title": "https://access.redhat.com/errata/RHSA-2026:30856" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30857", "title": "https://access.redhat.com/errata/RHSA-2026:30857" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-42496", "title": "https://access.redhat.com/security/cve/CVE-2026-42496" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481314", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2481314" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 9.1, "modificationTime": "2026-05-28T01:14:55.022369Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 8.2, "modificationTime": "2026-06-03T14:06:17.624574Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-05-28T01:14:55.022369Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 8.2, "cvssVersion": "3.1", "modificationTime": "2026-06-03T14:06:17.624574Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `perl` package and not the `perl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nArchive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path.\n## Remediation\nUpgrade `Debian:13` `perl` to version 5.40.1-6+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-42496](https://security-tracker.debian.org/tracker/CVE-2026-42496)\n- [https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch](https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch)\n- [https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes](https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes)\n- [https://www.cve.org/CVERecord?id=CVE-2026-42497](https://www.cve.org/CVERecord?id=CVE-2026-42497)\n- [https://access.redhat.com/errata/RHSA-2026:30851](https://access.redhat.com/errata/RHSA-2026:30851)\n- [https://access.redhat.com/errata/RHSA-2026:30852](https://access.redhat.com/errata/RHSA-2026:30852)\n- [https://access.redhat.com/errata/RHSA-2026:30856](https://access.redhat.com/errata/RHSA-2026:30856)\n- [https://access.redhat.com/errata/RHSA-2026:30857](https://access.redhat.com/errata/RHSA-2026:30857)\n- [https://access.redhat.com/security/cve/CVE-2026-42496](https://access.redhat.com/security/cve/CVE-2026-42496)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2481314](https://bugzilla.redhat.com/show_bug.cgi?id=2481314)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json)\n", "epssDetails": { "percentile": "0.34984", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-42496" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "perl", "creationTime": "2026-05-29T04:11:54.743735Z", "disclosureTime": "2026-05-26T02:16:40.130000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-29T04:11:54.747530Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-02T14:04:14.820656Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "perl/perl-base@5.40.1-6" ], "upgradePath": [ false, "perl/perl-base@5.40.1-6+deb13u1" ], "isUpgradable": true, "isPatchable": false, "name": "perl/perl-base", "version": "5.40.1-6", "nearestFixedInVersion": "5.40.1-6+deb13u1" }, { "id": "SNYK-DEBIAN13-PERL-17960057", "cpes": [], "title": "CVE-2026-13221", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<5.40.1-6+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "5.40.1-6+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-13221", "title": "https://security-tracker.debian.org/tracker/CVE-2026-13221" }, { "url": "https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch", "title": "https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch" }, { "url": "https://github.com/Perl/perl5/issues/23388", "title": "https://github.com/Perl/perl5/issues/23388" }, { "url": "http://www.openwall.com/lists/oss-security/2026/07/13/5", "title": "http://www.openwall.com/lists/oss-security/2026/07/13/5" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 9.1, "modificationTime": "2026-09-09T01:20:11.955037Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-08-19T05:43:37.782483Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:01.362674Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-09-09T01:20:11.955037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-08-19T05:43:37.782483Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:01.362674Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `perl` package and not the `perl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nPerl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.\n## Remediation\nUpgrade `Debian:13` `perl` to version 5.40.1-6+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-13221](https://security-tracker.debian.org/tracker/CVE-2026-13221)\n- [https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch](https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch)\n- [https://github.com/Perl/perl5/issues/23388](https://github.com/Perl/perl5/issues/23388)\n- [http://www.openwall.com/lists/oss-security/2026/07/13/5](http://www.openwall.com/lists/oss-security/2026/07/13/5)\n", "epssDetails": { "percentile": "0.35340", "probability": "0.00432", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13221" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "perl", "creationTime": "2026-07-14T05:03:12.495412Z", "disclosureTime": "2026-07-13T17:16:48.923000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-07-14T05:03:12.500368Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-12T15:21:41.336025Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "perl/perl-base@5.40.1-6" ], "upgradePath": [ false, "perl/perl-base@5.40.1-6+deb13u1" ], "isUpgradable": true, "isPatchable": false, "name": "perl/perl-base", "version": "5.40.1-6", "nearestFixedInVersion": "5.40.1-6+deb13u1" }, { "id": "SNYK-DEBIAN13-PERL-17960058", "cpes": [], "title": "CVE-2026-57432", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<5.40.1-6+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "5.40.1-6+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-57432", "title": "https://security-tracker.debian.org/tracker/CVE-2026-57432" }, { "url": "https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch", "title": "https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch" }, { "url": "https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch", "title": "https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch" }, { "url": "http://www.openwall.com/lists/oss-security/2026/07/13/6", "title": "http://www.openwall.com/lists/oss-security/2026/07/13/6" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.4, "modificationTime": "2026-09-09T01:20:11.773900Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5, "modificationTime": "2026-08-04T05:26:17.222570Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:15.786140Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.4, "cvssVersion": "3.1", "modificationTime": "2026-09-09T01:20:11.773900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:17.222570Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:15.786140Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `perl` package and not the `perl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nPerl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller.\n## Remediation\nUpgrade `Debian:13` `perl` to version 5.40.1-6+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-57432](https://security-tracker.debian.org/tracker/CVE-2026-57432)\n- [https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch](https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch)\n- [https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch](https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch)\n- [http://www.openwall.com/lists/oss-security/2026/07/13/6](http://www.openwall.com/lists/oss-security/2026/07/13/6)\n", "epssDetails": { "percentile": "0.10283", "probability": "0.00211", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-57432" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "perl", "creationTime": "2026-07-14T05:03:48.770266Z", "disclosureTime": "2026-07-13T17:17:55.670000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-07-14T05:03:48.773232Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-02T14:02:48.233225Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "perl/perl-base@5.40.1-6" ], "upgradePath": [ false, "perl/perl-base@5.40.1-6+deb13u1" ], "isUpgradable": true, "isPatchable": false, "name": "perl/perl-base", "version": "5.40.1-6", "nearestFixedInVersion": "5.40.1-6+deb13u1" }, { "id": "SNYK-DEBIAN13-POSTGRESQL17-16748490", "cpes": [], "title": "CVE-2026-6638", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<17.10-0+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "17.10-0+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-6638", "title": "https://security-tracker.debian.org/tracker/CVE-2026-6638" }, { "url": "https://www.postgresql.org/support/security/CVE-2026-6638/", "title": "https://www.postgresql.org/support/security/CVE-2026-6638/" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.8, "modificationTime": "2026-05-19T01:29:30.418642Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "cvssV3BaseScore": 3.7, "modificationTime": "2026-07-15T05:27:46.820340Z" }, { "assigner": "SUSE", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "cvssV3BaseScore": 3.7, "modificationTime": "2026-05-19T11:05:18.140263Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.8, "cvssVersion": "3.1", "modificationTime": "2026-05-19T01:29:30.418642Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "assigner": "Red Hat", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-07-15T05:27:46.820340Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "assigner": "SUSE", "severity": "low", "baseScore": 3.7, "cvssVersion": "3.1", "modificationTime": "2026-05-19T11:05:18.140263Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `postgresql-17` package and not the `postgresql-17` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nSQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within major versions 16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are affected. Versions before PostgreSQL 16 are unaffected.\n## Remediation\nUpgrade `Debian:13` `postgresql-17` to version 17.10-0+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-6638](https://security-tracker.debian.org/tracker/CVE-2026-6638)\n- [https://www.postgresql.org/support/security/CVE-2026-6638/](https://www.postgresql.org/support/security/CVE-2026-6638/)\n", "epssDetails": { "percentile": "0.07111", "probability": "0.00180", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-6638" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "postgresql-17", "creationTime": "2026-05-18T13:35:03.030753Z", "disclosureTime": "2026-05-14T14:16:25.937000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-18T13:35:03.033850Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-16T14:06:17.074540Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-postgresql@0.7.4-1", "postgresql-17/libpq5@17.9-0+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "postgresql-17/libpq5", "version": "17.9-0+deb13u1", "nearestFixedInVersion": "17.10-0+deb13u1" }, { "id": "SNYK-DEBIAN13-SQLITE3-17334397", "cpes": [], "title": "Heap-based Buffer Overflow", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.46.1-7+deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.46.1-7+deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-11822", "title": "https://security-tracker.debian.org/tracker/CVE-2026-11822" }, { "url": "https://sqlite.org/releaselog/3_53_2.html", "title": "https://sqlite.org/releaselog/3_53_2.html" }, { "url": "https://sqlite.org/src/info/061febcf41ca", "title": "https://sqlite.org/src/info/061febcf41ca" }, { "url": "https://sqlite.org/src/info/4a5ad516ea93", "title": "https://sqlite.org/src/info/4a5ad516ea93" }, { "url": "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension", "title": "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-765416.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-06-10T01:21:19.544883Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-08-26T06:08:27.224821Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-06-24T11:09:51.303060Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-06-10T01:21:19.544883Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-08-26T06:08:27.224821Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-06-24T11:09:51.303060Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `sqlite3` package and not the `sqlite3` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nSQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.\n## Remediation\nUpgrade `Debian:13` `sqlite3` to version 3.46.1-7+deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-11822](https://security-tracker.debian.org/tracker/CVE-2026-11822)\n- [https://sqlite.org/releaselog/3_53_2.html](https://sqlite.org/releaselog/3_53_2.html)\n- [https://sqlite.org/src/info/061febcf41ca](https://sqlite.org/src/info/061febcf41ca)\n- [https://sqlite.org/src/info/4a5ad516ea93](https://sqlite.org/src/info/4a5ad516ea93)\n- [https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension](https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension)\n- [https://cert-portal.siemens.com/productcert/html/ssa-765416.html](https://cert-portal.siemens.com/productcert/html/ssa-765416.html)\n", "epssDetails": { "percentile": "0.20341", "probability": "0.00295", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-11822" ], "CWE": [ "CWE-122" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "sqlite3", "creationTime": "2026-06-14T04:49:26.750605Z", "disclosureTime": "2026-06-09T20:16:32.150000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-14T04:49:26.756974Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T13:18:54.647480Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-sqlite3@0.7.4-1", "sqlite3/libsqlite3-0@3.46.1-7+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "sqlite3/libsqlite3-0", "version": "3.46.1-7+deb13u1", "nearestFixedInVersion": "3.46.1-7+deb13u2" }, { "id": "SNYK-DEBIAN13-SQLITE3-17334400", "cpes": [], "title": "Heap-based Buffer Overflow", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.46.1-7+deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.46.1-7+deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-11824", "title": "https://security-tracker.debian.org/tracker/CVE-2026-11824" }, { "url": "https://sqlite.org/releaselog/3_53_2.html", "title": "https://sqlite.org/releaselog/3_53_2.html" }, { "url": "https://sqlite.org/src/info/061febcf41ca", "title": "https://sqlite.org/src/info/061febcf41ca" }, { "url": "https://sqlite.org/src/info/4a5ad516ea93", "title": "https://sqlite.org/src/info/4a5ad516ea93" }, { "url": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate", "title": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-765416.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-06-10T01:21:19.707164Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-08-26T06:09:03.239253Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-06-24T11:09:56.278893Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-06-10T01:21:19.707164Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-08-26T06:09:03.239253Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-06-24T11:09:56.278893Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `sqlite3` package and not the `sqlite3` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nSQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.\n## Remediation\nUpgrade `Debian:13` `sqlite3` to version 3.46.1-7+deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-11824](https://security-tracker.debian.org/tracker/CVE-2026-11824)\n- [https://sqlite.org/releaselog/3_53_2.html](https://sqlite.org/releaselog/3_53_2.html)\n- [https://sqlite.org/src/info/061febcf41ca](https://sqlite.org/src/info/061febcf41ca)\n- [https://sqlite.org/src/info/4a5ad516ea93](https://sqlite.org/src/info/4a5ad516ea93)\n- [https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate](https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate)\n- [https://cert-portal.siemens.com/productcert/html/ssa-765416.html](https://cert-portal.siemens.com/productcert/html/ssa-765416.html)\n", "epssDetails": { "percentile": "0.06581", "probability": "0.00176", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-11824" ], "CWE": [ "CWE-122" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "sqlite3", "creationTime": "2026-06-14T04:50:32.196166Z", "disclosureTime": "2026-06-09T20:16:32.300000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-14T04:50:32.199279Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T13:18:43.795465Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-sqlite3@0.7.4-1", "sqlite3/libsqlite3-0@3.46.1-7+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "sqlite3/libsqlite3-0", "version": "3.46.1-7+deb13u1", "nearestFixedInVersion": "3.46.1-7+deb13u2" }, { "id": "SNYK-DEBIAN13-SQLITE3-17334397", "cpes": [], "title": "Heap-based Buffer Overflow", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.46.1-7+deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.46.1-7+deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-11822", "title": "https://security-tracker.debian.org/tracker/CVE-2026-11822" }, { "url": "https://sqlite.org/releaselog/3_53_2.html", "title": "https://sqlite.org/releaselog/3_53_2.html" }, { "url": "https://sqlite.org/src/info/061febcf41ca", "title": "https://sqlite.org/src/info/061febcf41ca" }, { "url": "https://sqlite.org/src/info/4a5ad516ea93", "title": "https://sqlite.org/src/info/4a5ad516ea93" }, { "url": "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension", "title": "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-765416.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-06-10T01:21:19.544883Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-08-26T06:08:27.224821Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-06-24T11:09:51.303060Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-06-10T01:21:19.544883Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-08-26T06:08:27.224821Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-06-24T11:09:51.303060Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `sqlite3` package and not the `sqlite3` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nSQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.\n## Remediation\nUpgrade `Debian:13` `sqlite3` to version 3.46.1-7+deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-11822](https://security-tracker.debian.org/tracker/CVE-2026-11822)\n- [https://sqlite.org/releaselog/3_53_2.html](https://sqlite.org/releaselog/3_53_2.html)\n- [https://sqlite.org/src/info/061febcf41ca](https://sqlite.org/src/info/061febcf41ca)\n- [https://sqlite.org/src/info/4a5ad516ea93](https://sqlite.org/src/info/4a5ad516ea93)\n- [https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension](https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension)\n- [https://cert-portal.siemens.com/productcert/html/ssa-765416.html](https://cert-portal.siemens.com/productcert/html/ssa-765416.html)\n", "epssDetails": { "percentile": "0.20341", "probability": "0.00295", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-11822" ], "CWE": [ "CWE-122" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "sqlite3", "creationTime": "2026-06-14T04:49:26.750605Z", "disclosureTime": "2026-06-09T20:16:32.150000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-14T04:49:26.756974Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T13:18:54.647480Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "util-linux/liblastlog2-2@2.41-5", "sqlite3/libsqlite3-0@3.46.1-7+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "sqlite3/libsqlite3-0", "version": "3.46.1-7+deb13u1", "nearestFixedInVersion": "3.46.1-7+deb13u2" }, { "id": "SNYK-DEBIAN13-SQLITE3-17334400", "cpes": [], "title": "Heap-based Buffer Overflow", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.46.1-7+deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.46.1-7+deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-11824", "title": "https://security-tracker.debian.org/tracker/CVE-2026-11824" }, { "url": "https://sqlite.org/releaselog/3_53_2.html", "title": "https://sqlite.org/releaselog/3_53_2.html" }, { "url": "https://sqlite.org/src/info/061febcf41ca", "title": "https://sqlite.org/src/info/061febcf41ca" }, { "url": "https://sqlite.org/src/info/4a5ad516ea93", "title": "https://sqlite.org/src/info/4a5ad516ea93" }, { "url": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate", "title": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-765416.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-06-10T01:21:19.707164Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-08-26T06:09:03.239253Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-06-24T11:09:56.278893Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-06-10T01:21:19.707164Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-08-26T06:09:03.239253Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-06-24T11:09:56.278893Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `sqlite3` package and not the `sqlite3` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nSQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.\n## Remediation\nUpgrade `Debian:13` `sqlite3` to version 3.46.1-7+deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-11824](https://security-tracker.debian.org/tracker/CVE-2026-11824)\n- [https://sqlite.org/releaselog/3_53_2.html](https://sqlite.org/releaselog/3_53_2.html)\n- [https://sqlite.org/src/info/061febcf41ca](https://sqlite.org/src/info/061febcf41ca)\n- [https://sqlite.org/src/info/4a5ad516ea93](https://sqlite.org/src/info/4a5ad516ea93)\n- [https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate](https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate)\n- [https://cert-portal.siemens.com/productcert/html/ssa-765416.html](https://cert-portal.siemens.com/productcert/html/ssa-765416.html)\n", "epssDetails": { "percentile": "0.06581", "probability": "0.00176", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-11824" ], "CWE": [ "CWE-122" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "sqlite3", "creationTime": "2026-06-14T04:50:32.196166Z", "disclosureTime": "2026-06-09T20:16:32.300000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-14T04:50:32.199279Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T13:18:43.795465Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "util-linux/liblastlog2-2@2.41-5", "sqlite3/libsqlite3-0@3.46.1-7+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "sqlite3/libsqlite3-0", "version": "3.46.1-7+deb13u1", "nearestFixedInVersion": "3.46.1-7+deb13u2" }, { "id": "SNYK-DEBIAN13-UNBOUND-16779408", "cpes": [], "title": "CVE-2026-42960", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.22.0-2+deb13u3" ] }, "exploit": "Not Defined", "fixedIn": [ "1.22.0-2+deb13u3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 10, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-42960", "title": "https://security-tracker.debian.org/tracker/CVE-2026-42960" }, { "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42960.txt", "title": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42960.txt" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H", "cvssV3BaseScore": 10, "modificationTime": "2026-05-21T01:25:21.659062Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-05-27T05:26:34.014452Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-06-06T20:10:57.331482Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 10, "cvssVersion": "3.1", "modificationTime": "2026-05-21T01:25:21.659062Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-05-27T05:26:34.014452Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:57.331482Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `unbound` package and not the `unbound` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nNLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be used to trick Unbound to cache such records. If an adversary is able to attach such records in a reply (i.e., spoofed packet, fragmentation attack) he would be able to poison Unbound's cache. A malicious actor can exploit the possible poisonous effect by injecting RRSets other than NS that are also accompanied by address records in a reply, for example MX. This could be achieved by trying to spoof a reply packet or fragmentation attacks. Unbound would then accept the relative address records in the additional section and cache them if the authority RRSet has enough trust at this point, i.e., in-zone data for the delegation point. Unbound 1.25.1 contains a patch with a fix that disregards address records from the additional section if they are not explicitly relevant only to authority NS records, mitigating the possible poison effect. This is a complement fix to CVE-2025-11411.\n## Remediation\nUpgrade `Debian:13` `unbound` to version 1.22.0-2+deb13u3 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-42960](https://security-tracker.debian.org/tracker/CVE-2026-42960)\n- [https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42960.txt](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42960.txt)\n", "epssDetails": { "percentile": "0.16739", "probability": "0.00267", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-42960" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "unbound", "creationTime": "2026-05-20T16:49:23.200531Z", "disclosureTime": "2026-05-20T10:16:28.037000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-20T16:49:23.206095Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:09:56.530359Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "unbound/libunbound8", "version": "1.22.0-2+deb13u1", "nearestFixedInVersion": "1.22.0-2+deb13u3" }, { "id": "SNYK-DEBIAN13-UNBOUND-16779411", "cpes": [], "title": "CVE-2026-33278", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.22.0-2+deb13u3" ] }, "exploit": "Not Defined", "fixedIn": [ "1.22.0-2+deb13u3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-33278", "title": "https://security-tracker.debian.org/tracker/CVE-2026-33278" }, { "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-33278.txt", "title": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-33278.txt" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19752", "title": "https://access.redhat.com/errata/RHSA-2026:19752" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23231", "title": "https://access.redhat.com/errata/RHSA-2026:23231" }, { "url": "https://access.redhat.com/errata/RHSA-2026:24369", "title": "https://access.redhat.com/errata/RHSA-2026:24369" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-33278", "title": "https://access.redhat.com/security/cve/CVE-2026-33278" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479808", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2479808" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33278.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33278.json" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-05-21T01:25:22.210241Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-05-20T14:02:19.835259Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "cvssV3BaseScore": 8.6, "modificationTime": "2026-06-06T20:10:50.243871Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-05-21T01:25:22.210241Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-05-20T14:02:19.835259Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 8.6, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:50.243871Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `unbound` package and not the `unbound` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nNLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-copies response messages to preserve them across memory region teardown. A struct-assignment bug overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep copying the data structure.\n## Remediation\nUpgrade `Debian:13` `unbound` to version 1.22.0-2+deb13u3 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-33278](https://security-tracker.debian.org/tracker/CVE-2026-33278)\n- [https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-33278.txt](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-33278.txt)\n- [https://access.redhat.com/errata/RHSA-2026:19752](https://access.redhat.com/errata/RHSA-2026:19752)\n- [https://access.redhat.com/errata/RHSA-2026:23231](https://access.redhat.com/errata/RHSA-2026:23231)\n- [https://access.redhat.com/errata/RHSA-2026:24369](https://access.redhat.com/errata/RHSA-2026:24369)\n- [https://access.redhat.com/security/cve/CVE-2026-33278](https://access.redhat.com/security/cve/CVE-2026-33278)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2479808](https://bugzilla.redhat.com/show_bug.cgi?id=2479808)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33278.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33278.json)\n", "epssDetails": { "percentile": "0.65013", "probability": "0.01133", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-33278" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "unbound", "creationTime": "2026-05-20T16:50:14.317236Z", "disclosureTime": "2026-05-20T10:16:26.530000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-20T16:50:14.320012Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:08:56.890698Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "unbound/libunbound8", "version": "1.22.0-2+deb13u1", "nearestFixedInVersion": "1.22.0-2+deb13u3" }, { "id": "SNYK-DEBIAN13-UNBOUND-16779419", "cpes": [], "title": "CVE-2026-42944", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.22.0-2+deb13u3" ] }, "exploit": "Not Defined", "fixedIn": [ "1.22.0-2+deb13u3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-42944", "title": "https://security-tracker.debian.org/tracker/CVE-2026-42944" }, { "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42944.txt", "title": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42944.txt" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19752", "title": "https://access.redhat.com/errata/RHSA-2026:19752" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23231", "title": "https://access.redhat.com/errata/RHSA-2026:23231" }, { "url": "https://access.redhat.com/errata/RHSA-2026:24365", "title": "https://access.redhat.com/errata/RHSA-2026:24365" }, { "url": "https://access.redhat.com/errata/RHSA-2026:24369", "title": "https://access.redhat.com/errata/RHSA-2026:24369" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-42944", "title": "https://access.redhat.com/security/cve/CVE-2026-42944" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479774", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2479774" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42944.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42944.json" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-21T01:25:21.585601Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-20T14:03:25.229700Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-06T20:10:55.640752Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-21T01:25:21.585601Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-20T14:03:25.229700Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:55.640752Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `unbound` package and not the `unbound` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nNLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a fix to prevent truncation of the EDNS field size calculation.\n## Remediation\nUpgrade `Debian:13` `unbound` to version 1.22.0-2+deb13u3 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-42944](https://security-tracker.debian.org/tracker/CVE-2026-42944)\n- [https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42944.txt](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42944.txt)\n- [https://access.redhat.com/errata/RHSA-2026:19752](https://access.redhat.com/errata/RHSA-2026:19752)\n- [https://access.redhat.com/errata/RHSA-2026:23231](https://access.redhat.com/errata/RHSA-2026:23231)\n- [https://access.redhat.com/errata/RHSA-2026:24365](https://access.redhat.com/errata/RHSA-2026:24365)\n- [https://access.redhat.com/errata/RHSA-2026:24369](https://access.redhat.com/errata/RHSA-2026:24369)\n- [https://access.redhat.com/security/cve/CVE-2026-42944](https://access.redhat.com/security/cve/CVE-2026-42944)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2479774](https://bugzilla.redhat.com/show_bug.cgi?id=2479774)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42944.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42944.json)\n", "epssDetails": { "percentile": "0.53813", "probability": "0.00775", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-42944" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "unbound", "creationTime": "2026-05-20T16:50:25.135124Z", "disclosureTime": "2026-05-20T10:16:27.760000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-20T16:50:25.137925Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:09:57.724896Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "unbound/libunbound8", "version": "1.22.0-2+deb13u1", "nearestFixedInVersion": "1.22.0-2+deb13u3" }, { "id": "SNYK-DEBIAN13-UNBOUND-16779439", "cpes": [], "title": "CVE-2026-42959", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.22.0-2+deb13u3" ] }, "exploit": "Not Defined", "fixedIn": [ "1.22.0-2+deb13u3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-42959", "title": "https://security-tracker.debian.org/tracker/CVE-2026-42959" }, { "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42959.txt", "title": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42959.txt" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19752", "title": "https://access.redhat.com/errata/RHSA-2026:19752" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23231", "title": "https://access.redhat.com/errata/RHSA-2026:23231" }, { "url": "https://access.redhat.com/errata/RHSA-2026:24365", "title": "https://access.redhat.com/errata/RHSA-2026:24365" }, { "url": "https://access.redhat.com/errata/RHSA-2026:24369", "title": "https://access.redhat.com/errata/RHSA-2026:24369" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-42959", "title": "https://access.redhat.com/security/cve/CVE-2026-42959" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479806", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2479806" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42959.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42959.json" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-21T01:25:21.729814Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-20T14:03:32.866594Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-06T20:10:59.198852Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-21T01:25:21.729814Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-20T14:03:32.866594Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:59.198852Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `unbound` package and not the `unbound` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nNLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply messages for validation, the code uses the wrong counter to calculate write offsets for ADDITIONAL section rrsets. DNAME duplication could increase the ANSWER section count and authority filtering could decrease the AUTHORITY section count and create an uninitialized array slot. Combining these two, the validator later dereferences this uninitialized pointer, causing an immediate process crash. An adversary controlling a DNSSEC-signed domain can trigger this bug with a single query by configuring a DNAME chain with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue records. Unbound 1.25.1 contains a patch with a fix to use the proper counters to calculate the write offsets.\n## Remediation\nUpgrade `Debian:13` `unbound` to version 1.22.0-2+deb13u3 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-42959](https://security-tracker.debian.org/tracker/CVE-2026-42959)\n- [https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42959.txt](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42959.txt)\n- [https://access.redhat.com/errata/RHSA-2026:19752](https://access.redhat.com/errata/RHSA-2026:19752)\n- [https://access.redhat.com/errata/RHSA-2026:23231](https://access.redhat.com/errata/RHSA-2026:23231)\n- [https://access.redhat.com/errata/RHSA-2026:24365](https://access.redhat.com/errata/RHSA-2026:24365)\n- [https://access.redhat.com/errata/RHSA-2026:24369](https://access.redhat.com/errata/RHSA-2026:24369)\n- [https://access.redhat.com/security/cve/CVE-2026-42959](https://access.redhat.com/security/cve/CVE-2026-42959)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2479806](https://bugzilla.redhat.com/show_bug.cgi?id=2479806)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42959.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42959.json)\n", "epssDetails": { "percentile": "0.51711", "probability": "0.00716", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-42959" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "unbound", "creationTime": "2026-05-20T16:51:38.274591Z", "disclosureTime": "2026-05-20T10:16:27.903000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-20T16:51:38.278669Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:09:58.128914Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "unbound/libunbound8", "version": "1.22.0-2+deb13u1", "nearestFixedInVersion": "1.22.0-2+deb13u3" }, { "id": "SNYK-DEBIAN13-UNBOUND-16779440", "cpes": [], "title": "CVE-2026-41292", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.22.0-2+deb13u3" ] }, "exploit": "Not Defined", "fixedIn": [ "1.22.0-2+deb13u3" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-41292", "title": "https://security-tracker.debian.org/tracker/CVE-2026-41292" }, { "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt", "title": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt" }, { "url": "https://access.redhat.com/errata/RHSA-2026:24013", "title": "https://access.redhat.com/errata/RHSA-2026:24013" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-41292", "title": "https://access.redhat.com/security/cve/CVE-2026-41292" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480125", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2480125" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41292.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41292.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36320", "title": "https://access.redhat.com/errata/RHSA-2026:36320" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36777", "title": "https://access.redhat.com/errata/RHSA-2026:36777" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37282", "title": "https://access.redhat.com/errata/RHSA-2026:37282" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54769", "title": "https://access.redhat.com/errata/RHSA-2026:54769" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-21T01:25:21.897076Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-24T05:50:13.101772Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 5.9, "modificationTime": "2026-06-06T20:10:51.362862Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-21T01:25:21.897076Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-24T05:50:13.101772Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:51.362862Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `unbound` package and not the `unbound` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nNLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they are parsing and creating internal data structures for the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1 contains a patch with a fix to limit acceptable incoming EDNS options (100).\n## Remediation\nUpgrade `Debian:13` `unbound` to version 1.22.0-2+deb13u3 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-41292](https://security-tracker.debian.org/tracker/CVE-2026-41292)\n- [https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt)\n- [https://access.redhat.com/errata/RHSA-2026:24013](https://access.redhat.com/errata/RHSA-2026:24013)\n- [https://access.redhat.com/security/cve/CVE-2026-41292](https://access.redhat.com/security/cve/CVE-2026-41292)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2480125](https://bugzilla.redhat.com/show_bug.cgi?id=2480125)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41292.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41292.json)\n- [https://access.redhat.com/errata/RHSA-2026:36320](https://access.redhat.com/errata/RHSA-2026:36320)\n- [https://access.redhat.com/errata/RHSA-2026:36777](https://access.redhat.com/errata/RHSA-2026:36777)\n- [https://access.redhat.com/errata/RHSA-2026:37282](https://access.redhat.com/errata/RHSA-2026:37282)\n- [https://access.redhat.com/errata/RHSA-2026:54769](https://access.redhat.com/errata/RHSA-2026:54769)\n", "epssDetails": { "percentile": "0.55586", "probability": "0.00827", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-41292" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "unbound", "creationTime": "2026-05-20T16:51:38.303531Z", "disclosureTime": "2026-05-20T10:16:27.327000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-20T16:51:38.306725Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:12:59.941656Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "unbound/libunbound8", "version": "1.22.0-2+deb13u1", "nearestFixedInVersion": "1.22.0-2+deb13u3" }, { "id": "SNYK-DEBIAN13-UNBOUND-16779451", "cpes": [], "title": "CVE-2026-40622", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "<1.26.1-0+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.26.1-0+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-40622", "title": "https://security-tracker.debian.org/tracker/CVE-2026-40622" }, { "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-40622.txt", "title": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-40622.txt" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-27T01:20:04.603306Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-29T06:19:37.617042Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-06-06T20:10:51.125497Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-27T01:20:04.603306Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-29T06:19:37.617042Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-06-06T20:10:51.125497Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `unbound` package and not the `unbound` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nNLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.\n## Remediation\nUpgrade `Debian:13` `unbound` to version 1.26.1-0+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-40622](https://security-tracker.debian.org/tracker/CVE-2026-40622)\n- [https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-40622.txt](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-40622.txt)\n", "epssDetails": { "percentile": "0.02514", "probability": "0.00136", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-40622" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "unbound", "creationTime": "2026-05-20T16:52:27.441075Z", "disclosureTime": "2026-05-20T10:16:26.850000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-20T16:52:27.444056Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-02T14:04:16.917705Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "unbound/libunbound8", "version": "1.22.0-2+deb13u1", "nearestFixedInVersion": "1.26.1-0+deb13u1" }, { "id": "SNYK-DEBIAN13-UNBOUND-18228262", "cpes": [], "title": "CVE-2026-50252", "CVSSv3": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.26.1-0+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.26.1-0+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.3, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-50252", "title": "https://security-tracker.debian.org/tracker/CVE-2026-50252" }, { "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50252.txt", "title": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50252.txt" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H", "cvssV3BaseScore": 9.3, "modificationTime": "2026-07-25T01:29:27.548619Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 6.5, "modificationTime": "2026-08-19T05:38:37.624549Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-08-27T11:12:36.034907Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.3, "cvssVersion": "3.1", "modificationTime": "2026-07-25T01:29:27.548619Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.5, "cvssVersion": "3.1", "modificationTime": "2026-08-19T05:38:37.624549Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "SUSE", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-08-27T11:12:36.034907Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `unbound` package and not the `unbound` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIn NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming source UDP port and IP address while heavily depending on the incoming source UDP port as a randomization source. When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in Unbound (by default), it meets these conditions, making it vulnerable for DNS cache poisoning attacks. Upon startup, Unbound randomly partitions the available UDP source port space into disjoint subsets of (almost) equal size, assigning each subset to a specific worker thread. When an incoming DNS query is received, the kernel’s SO_REUSEPORT load balancing mechanism deterministically assigns the query to a socket associated with a particular thread. All outgoing DNS queries generated during the resolution of that request use source ports selected exclusively from the port subset assigned to the corresponding thread. Since these port subsets are disjoint across threads, the source port observed in a resolver’s outgoing query to an authoritative name server serves as a reliable indicator of the worker thread that processed the original client query. A malicious actor can acquire the mapping between incoming UDP source ports (for a given fixed source IP address) and Unbound worker threads and leverage it to conduct DNS cache poisoning attacks by effectively lowering the random port population per thread.\n## Remediation\nUpgrade `Debian:13` `unbound` to version 1.26.1-0+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-50252](https://security-tracker.debian.org/tracker/CVE-2026-50252)\n- [https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50252.txt](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50252.txt)\n", "epssDetails": { "percentile": "0.05709", "probability": "0.00163", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-50252" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "unbound", "creationTime": "2026-07-23T08:28:46.853168Z", "disclosureTime": "2026-07-22T14:17:20.627000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-07-23T08:28:46.857692Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-20T04:52:04.816898Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "unbound/libunbound8", "version": "1.22.0-2+deb13u1", "nearestFixedInVersion": "1.26.1-0+deb13u1" }, { "id": "SNYK-DEBIAN13-UNBOUND-19872475", "cpes": [], "title": "CVE-2026-81642", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.26.1-0+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.26.1-0+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-81642", "title": "https://security-tracker.debian.org/tracker/CVE-2026-81642" }, { "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt", "title": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-09-23T01:15:15.998592Z" }, { "assigner": "Red Hat", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-09-18T05:39:34.269365Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-10-13T11:03:50.727451Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-09-23T01:15:15.998592Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-09-18T05:39:34.269365Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-10-13T11:03:50.727451Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `unbound` package and not the `unbound` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIn NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. A DNSKEY with an owner compression pointer to its own RDATA can overflow the digest buffer. Remote code execution is possible through attacker controlled data. An adversary can exploit the vulnerability by controlling a malicious zone and querying a vulnerable Unbound.\n## Remediation\nUpgrade `Debian:13` `unbound` to version 1.26.1-0+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-81642](https://security-tracker.debian.org/tracker/CVE-2026-81642)\n- [https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-81642.txt)\n", "epssDetails": { "percentile": "0.60030", "probability": "0.00962", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-81642" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "unbound", "creationTime": "2026-09-17T04:57:15.453317Z", "disclosureTime": "2026-09-16T09:17:06.320000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-17T04:57:15.455870Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T11:03:51.281868Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "unbound/libunbound8", "version": "1.22.0-2+deb13u1", "nearestFixedInVersion": "1.26.1-0+deb13u1" }, { "id": "SNYK-DEBIAN13-UNBOUND-19872476", "cpes": [], "title": "CVE-2026-80225", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.26.1-0+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.26.1-0+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-80225", "title": "https://security-tracker.debian.org/tracker/CVE-2026-80225" }, { "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt", "title": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-24T01:30:45.283397Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-09-17T05:42:36.775266Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-10-13T11:03:55.619978Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T01:30:45.283397Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-09-17T05:42:36.775266Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-10-13T11:03:55.619978Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `unbound` package and not the `unbound` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIn NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.\n## Remediation\nUpgrade `Debian:13` `unbound` to version 1.26.1-0+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-80225](https://security-tracker.debian.org/tracker/CVE-2026-80225)\n- [https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt)\n", "epssDetails": { "percentile": "0.38888", "probability": "0.00482", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-80225" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "unbound", "creationTime": "2026-09-17T04:57:15.665431Z", "disclosureTime": "2026-09-16T09:17:06.100000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-17T04:57:15.668412Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T11:03:56.111865Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "unbound/libunbound8", "version": "1.22.0-2+deb13u1", "nearestFixedInVersion": "1.26.1-0+deb13u1" }, { "id": "SNYK-DEBIAN13-UNBOUND-19872484", "cpes": [], "title": "CVE-2026-82717", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.26.1-0+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.26.1-0+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-82717", "title": "https://security-tracker.debian.org/tracker/CVE-2026-82717" }, { "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82717.txt", "title": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82717.txt" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-09-24T01:30:45.052987Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-09-17T05:42:30.357807Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-10-13T11:03:58.943760Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-09-24T01:30:45.052987Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-09-17T05:42:30.357807Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-10-13T11:03:58.943760Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `unbound` package and not the `unbound` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIn NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce(rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow. Since this is heavily reliant on heap memory layout, results are memory corruption that eventually leads to a crash and under specific systems and compilation options remote code execution.\n## Remediation\nUpgrade `Debian:13` `unbound` to version 1.26.1-0+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-82717](https://security-tracker.debian.org/tracker/CVE-2026-82717)\n- [https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82717.txt](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-82717.txt)\n", "epssDetails": { "percentile": "0.54046", "probability": "0.00782", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-82717" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "unbound", "creationTime": "2026-09-17T04:57:29.514649Z", "disclosureTime": "2026-09-16T09:17:06.550000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-17T04:57:29.519034Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T11:03:59.493673Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "unbound/libunbound8", "version": "1.22.0-2+deb13u1", "nearestFixedInVersion": "1.26.1-0+deb13u1" }, { "id": "SNYK-DEBIAN13-UNBOUND-19872486", "cpes": [], "title": "CVE-2026-85501", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.26.1-0+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.26.1-0+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-85501", "title": "https://security-tracker.debian.org/tracker/CVE-2026-85501" }, { "url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-85501.txt", "title": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-85501.txt" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-24T01:30:44.899893Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-09-17T05:42:27.736524Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "cvssV3BaseScore": 5.3, "modificationTime": "2026-10-13T11:04:05.377698Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-24T01:30:44.899893Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-09-17T05:42:27.736524Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "assigner": "SUSE", "severity": "medium", "baseScore": 5.3, "cvssVersion": "3.1", "modificationTime": "2026-10-13T11:04:05.377698Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `unbound` package and not the `unbound` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nNovel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.\n## Remediation\nUpgrade `Debian:13` `unbound` to version 1.26.1-0+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-85501](https://security-tracker.debian.org/tracker/CVE-2026-85501)\n- [https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-85501.txt](https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-85501.txt)\n", "epssDetails": { "percentile": "0.38888", "probability": "0.00482", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85501" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "unbound", "creationTime": "2026-09-17T04:57:55.062078Z", "disclosureTime": "2026-09-16T09:17:06.783000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-17T04:57:55.065022Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-13T11:04:05.563960Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-unbound/lua-unbound@1.0.0-2+b2", "unbound/libunbound8@1.22.0-2+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "unbound/libunbound8", "version": "1.22.0-2+deb13u1", "nearestFixedInVersion": "1.26.1-0+deb13u1" }, { "id": "SNYK-DEBIAN13-ZLIB-19520500", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-85091", "title": "https://security-tracker.debian.org/tracker/CVE-2026-85091" }, { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nThere is no fixed version for `Debian:13` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-85091](https://security-tracker.debian.org/tracker/CVE-2026-85091)\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.27225", "probability": "0.00356", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-09-04T04:43:41.644434Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-04T04:43:41.651764Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T15:12:01.975922Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "dpkg@1.22.22", "zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib1g", "version": "1:1.3.dfsg+really1.3.1-1+b1", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-ZLIB-19520500", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-85091", "title": "https://security-tracker.debian.org/tracker/CVE-2026-85091" }, { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nThere is no fixed version for `Debian:13` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-85091](https://security-tracker.debian.org/tracker/CVE-2026-85091)\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.27225", "probability": "0.00356", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-09-04T04:43:41.644434Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-04T04:43:41.651764Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T15:12:01.975922Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "apt@3.0.3", "apt/libapt-pkg7.0@3.0.3", "zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib1g", "version": "1:1.3.dfsg+really1.3.1-1+b1", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-ZLIB-19520500", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-85091", "title": "https://security-tracker.debian.org/tracker/CVE-2026-85091" }, { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nThere is no fixed version for `Debian:13` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-85091](https://security-tracker.debian.org/tracker/CVE-2026-85091)\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.27225", "probability": "0.00356", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-09-04T04:43:41.644434Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-04T04:43:41.651764Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T15:12:01.975922Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "lua-dbi/lua-dbi-mysql@0.7.4-1", "mariadb/libmariadb3@1:11.8.6-0+deb13u1", "zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib1g", "version": "1:1.3.dfsg+really1.3.1-1+b1", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-ZLIB-19520500", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-85091", "title": "https://security-tracker.debian.org/tracker/CVE-2026-85091" }, { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nThere is no fixed version for `Debian:13` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-85091](https://security-tracker.debian.org/tracker/CVE-2026-85091)\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.27225", "probability": "0.00356", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-09-04T04:43:41.644434Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-04T04:43:41.651764Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T15:12:01.975922Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "luarocks@3.8.0+dfsg1-1", "wget@1.25.0-2", "zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib1g", "version": "1:1.3.dfsg+really1.3.1-1+b1", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" }, { "id": "SNYK-DEBIAN13-ZLIB-19520500", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-85091", "title": "https://security-tracker.debian.org/tracker/CVE-2026-85091" }, { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nThere is no fixed version for `Debian:13` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-85091](https://security-tracker.debian.org/tracker/CVE-2026-85091)\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.27225", "probability": "0.00356", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-09-04T04:43:41.644434Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-04T04:43:41.651764Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T15:12:01.975922Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-xmpp-server@c1a6e0c.develop.21", "ca-certificates@20250419", "openssl@3.5.5-1~deb13u1", "openssl/libssl3t64@3.5.5-1~deb13u1", "zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib1g", "version": "1:1.3.dfsg+really1.3.1-1+b1", "dockerfileInstruction": "apt-get install -y --no-install-recommends lua-cjson ca-certificates >/dev/null" } ], "ok": false, "dependencyCount": 148, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "deb", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": { "os": { "prettyName": "Debian GNU/Linux 13 (trixie)" } }, "summary": "157 high or critical severity vulnerable dependency paths", "severityThreshold": "high", "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 54, "projectName": "docker-image|docker.io/scopear/docker-xmpp-server", "platform": "linux/amd64", "hasUnknownVersions": false, "path": "docker.io/scopear/docker-xmpp-server:c1a6e0c.develop.21/scopear/docker-xmpp-server", "applications": [ { "vulnerabilities": [], "ok": true, "dependencyCount": 1, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "npm", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "No high or critical severity vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "targetFile": "/usr/share/nodejs/popper.js/package.json", "projectName": "popper.js", "displayTargetFile": "/usr/share/nodejs/popper.js/package.json", "hasUnknownVersions": false, "path": "docker.io/scopear/docker-xmpp-server:c1a6e0c.develop.21" } ] }