Snyk test report

Out-of-bounds Write

NVD Description

Note: Versions mentioned in the description apply only to the upstream zlib package and not the zlib package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.

Remediation

There is no fixed version for Debian:13 zlib.

References

• https://security-tracker.debian.org/tracker/CVE-2026-85091
• https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490
• https://github.com/madler/zlib
• https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393
• https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate

CVE-2026-42944

NVD Description

Note: Versions mentioned in the description apply only to the upstream unbound package and not the unbound package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a fix to prevent truncation of the EDNS field size calculation.

Remediation

Upgrade Debian:13 unbound to version 1.22.0-2+deb13u3 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-42944
• https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42944.txt
• https://access.redhat.com/errata/RHSA-2026:19752
• https://access.redhat.com/errata/RHSA-2026:23231
• https://access.redhat.com/errata/RHSA-2026:24365
• https://access.redhat.com/errata/RHSA-2026:24369
• https://access.redhat.com/security/cve/CVE-2026-42944
• https://bugzilla.redhat.com/show_bug.cgi?id=2479774
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42944.json

CVE-2026-42959

NVD Description

Note: Versions mentioned in the description apply only to the upstream unbound package and not the unbound package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply messages for validation, the code uses the wrong counter to calculate write offsets for ADDITIONAL section rrsets. DNAME duplication could increase the ANSWER section count and authority filtering could decrease the AUTHORITY section count and create an uninitialized array slot. Combining these two, the validator later dereferences this uninitialized pointer, causing an immediate process crash. An adversary controlling a DNSSEC-signed domain can trigger this bug with a single query by configuring a DNAME chain with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue records. Unbound 1.25.1 contains a patch with a fix to use the proper counters to calculate the write offsets.

Remediation

Upgrade Debian:13 unbound to version 1.22.0-2+deb13u3 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-42959
• https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42959.txt
• https://access.redhat.com/errata/RHSA-2026:19752
• https://access.redhat.com/errata/RHSA-2026:23231
• https://access.redhat.com/errata/RHSA-2026:24365
• https://access.redhat.com/errata/RHSA-2026:24369
• https://access.redhat.com/security/cve/CVE-2026-42959
• https://bugzilla.redhat.com/show_bug.cgi?id=2479806
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42959.json

CVE-2026-41292

NVD Description

Note: Versions mentioned in the description apply only to the upstream unbound package and not the unbound package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they are parsing and creating internal data structures for the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1 contains a patch with a fix to limit acceptable incoming EDNS options (100).

Remediation

Upgrade Debian:13 unbound to version 1.22.0-2+deb13u3 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-41292
• https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-41292.txt
• https://access.redhat.com/errata/RHSA-2026:24013
• https://access.redhat.com/security/cve/CVE-2026-41292
• https://bugzilla.redhat.com/show_bug.cgi?id=2480125
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41292.json
• https://access.redhat.com/errata/RHSA-2026:36320
• https://access.redhat.com/errata/RHSA-2026:36777
• https://access.redhat.com/errata/RHSA-2026:37282
• https://access.redhat.com/errata/RHSA-2026:54769

CVE-2026-40622

NVD Description

Note: Versions mentioned in the description apply only to the upstream unbound package and not the unbound package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.

Remediation

Upgrade Debian:13 unbound to version 1.26.1-0+deb13u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-40622
• https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-40622.txt

CVE-2026-80225

NVD Description

Note: Versions mentioned in the description apply only to the upstream unbound package and not the unbound package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.

Remediation

Upgrade Debian:13 unbound to version 1.26.1-0+deb13u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-80225
• https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-80225.txt

CVE-2026-85501

NVD Description

Note: Versions mentioned in the description apply only to the upstream unbound package and not the unbound package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched under the term 'ReTrap'. These result in degradation of service when malicious zones are used to serve the algorithmic complexity vulnerabilities. NLnet Labs Unbound up to and including 1.26.0 is vulnerable to some of them. TagTrap, where the triple(Zone, Algo, KeyTag) matching mechanism introduces a significant attack vector when resolvers handle malicious responses containing numerous mismatched DNSKEY, RRSIG, and DS record. DelegationTrap, where constructing the chain-of-trust requires iterative validation of DNSKEY and DS records from the root zone downward. For deeply nested domains, this results in significant computational overhead. NsecTrap, where responses with excessive invalid NSEC records compel the resolver to validate each one. AdditionalTrap, where Unbound by default would try to DNSSEC validate the ADDITIONAL section as well. This can be exploited to waste validation resources by malicious users.

Remediation

Upgrade Debian:13 unbound to version 1.26.1-0+deb13u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-85501
• https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-85501.txt

Heap-based Buffer Overflow

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite3 package and not the sqlite3 package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.

Remediation

Upgrade Debian:13 sqlite3 to version 3.46.1-7+deb13u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-11822
• https://sqlite.org/releaselog/3_53_2.html
• https://sqlite.org/src/info/061febcf41ca
• https://sqlite.org/src/info/4a5ad516ea93
• https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension
• https://cert-portal.siemens.com/productcert/html/ssa-765416.html

Heap-based Buffer Overflow

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite3 package and not the sqlite3 package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.

Remediation

Upgrade Debian:13 sqlite3 to version 3.46.1-7+deb13u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-11824
• https://sqlite.org/releaselog/3_53_2.html
• https://sqlite.org/src/info/061febcf41ca
• https://sqlite.org/src/info/4a5ad516ea93
• https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate
• https://cert-portal.siemens.com/productcert/html/ssa-765416.html

CVE-2026-6638

NVD Description

Note: Versions mentioned in the description apply only to the upstream postgresql-17 package and not the postgresql-17 package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within major versions 16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are affected. Versions before PostgreSQL 16 are unaffected.

Remediation

Upgrade Debian:13 postgresql-17 to version 17.10-0+deb13u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-6638
• https://www.postgresql.org/support/security/CVE-2026-6638/

CVE-2026-42497

NVD Description

Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.

_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.

A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.

Remediation

Upgrade Debian:13 perl to version 5.40.1-6+deb13u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-42497
• https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch
• https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes
• https://www.cve.org/CVERecord?id=CVE-2026-42496

CVE-2026-57432

NVD Description

Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.

S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.

A template derived from untrusted input can read heap memory past the buffer and return it to the caller.

Remediation

Upgrade Debian:13 perl to version 5.40.1-6+deb13u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-57432
• https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch
• https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch
• http://www.openwall.com/lists/oss-security/2026/07/13/6

Free of Memory not on the Heap

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcre2 package and not the pcre2 package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.

Remediation

Upgrade Debian:13 pcre2 to version 10.46-1~deb13u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-89161
• https://github.com/PCRE2Project/pcre2/pull/937
• https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48

Integer Overflow or Wraparound

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcre2 package and not the pcre2 package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.

Remediation

Upgrade Debian:13 pcre2 to version 10.46-1~deb13u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-89157
• https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48
• https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9

CVE-2026-28389

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen.

Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service.

When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing.

Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Debian:13 openssl to version 3.5.5-1~deb13u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-28389
• https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5
• https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616
• https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f
• https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a
• https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686
• https://openssl-library.org/news/secadv/20260407.txt
• https://cert-portal.siemens.com/productcert/html/ssa-032379.html
• https://cert-portal.siemens.com/productcert/html/ssa-265688.html

CVE-2026-28387

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side.

Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code.

However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate usage.

By far the most common deployment of DANE is in SMTP MTAs for which RFC7672 recommends that clients treat as 'unusable' any TLSA records that have the PKIX certificate usages. These SMTP (or other similar) clients are not vulnerable to this issue. Conversely, any clients that support only the PKIX usages, and ignore the DANE-TA(2) usage are also not vulnerable.

The client would also need to be communicating with a server that publishes a TLSA RRset with both types of TLSA records.

No FIPS modules are affected by this issue, the problem code is outside the FIPS module boundary.

Remediation

Upgrade Debian:13 openssl to version 3.5.5-1~deb13u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-28387
• https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b
• https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe
• https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3
• https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7
• https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177
• https://openssl-library.org/news/secadv/20260407.txt
• https://cert-portal.siemens.com/productcert/html/ssa-032379.html
• https://cert-portal.siemens.com/productcert/html/ssa-265688.html

CVE-2026-28390

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen.

Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service.

When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing.

Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Debian:13 openssl to version 3.5.5-1~deb13u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-28390
• https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc
• https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6
• https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4
• https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788
• https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75
• https://openssl-library.org/news/secadv/20260407.txt
• https://cert-portal.siemens.com/productcert/html/ssa-032379.html
• https://cert-portal.siemens.com/productcert/html/ssa-265688.html

CVE-2026-28388

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing.

Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application.

When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference.

Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it.

The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Debian:13 openssl to version 3.5.5-1~deb13u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-28388
• https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e
• https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139
• https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3
• https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8
• https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726
• https://openssl-library.org/news/secadv/20260407.txt
• https://cert-portal.siemens.com/productcert/html/ssa-032379.html
• https://cert-portal.siemens.com/productcert/html/ssa-265688.html

OS Command Injection

NVD Description

Note: Versions mentioned in the description apply only to the upstream mariadb package and not the mariadb package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.

Remediation

There is no fixed version for Debian:13 mariadb.

References

• https://security-tracker.debian.org/tracker/CVE-2026-48165
• https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv
• https://jira.mariadb.org/browse/MDEV-39676
• https://access.redhat.com/errata/RHSA-2026:25143
• https://access.redhat.com/errata/RHSA-2026:25145
• https://access.redhat.com/errata/RHSA-2026:33093
• https://access.redhat.com/errata/RHSA-2026:33412
• https://access.redhat.com/errata/RHSA-2026:33464
• https://access.redhat.com/errata/RHSA-2026:33481
• https://access.redhat.com/errata/RHSA-2026:33482
• https://access.redhat.com/errata/RHSA-2026:49522
• https://access.redhat.com/security/cve/CVE-2026-48165
• https://bugzilla.redhat.com/show_bug.cgi?id=2488458
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json

OS Command Injection

NVD Description

Note: Versions mentioned in the description apply only to the upstream mariadb package and not the mariadb package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.

Remediation

There is no fixed version for Debian:13 mariadb.

References

• https://security-tracker.debian.org/tracker/CVE-2026-48163
• https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r
• https://jira.mariadb.org/browse/MDEV-39648
• https://access.redhat.com/errata/RHSA-2026:25143
• https://access.redhat.com/errata/RHSA-2026:25145
• https://access.redhat.com/errata/RHSA-2026:33093
• https://access.redhat.com/errata/RHSA-2026:33412
• https://access.redhat.com/errata/RHSA-2026:33464
• https://access.redhat.com/errata/RHSA-2026:33481
• https://access.redhat.com/errata/RHSA-2026:33482
• https://access.redhat.com/errata/RHSA-2026:49522
• https://access.redhat.com/security/cve/CVE-2026-48163
• https://bugzilla.redhat.com/show_bug.cgi?id=2488454
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json

Directory Traversal

NVD Description

Note: Versions mentioned in the description apply only to the upstream mariadb package and not the mariadb package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.

Remediation

There is no fixed version for Debian:13 mariadb.

References

• https://security-tracker.debian.org/tracker/CVE-2026-44171
• https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9
• https://jira.mariadb.org/browse/MDEV-39408

Time-of-check Time-of-use (TOCTOU)

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcap2 package and not the libcap2 package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the cap_set_file() function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.

Remediation

Upgrade Debian:13 libcap2 to version 1:2.75-10+deb13u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-4878
• https://bugzilla.redhat.com/show_bug.cgi?id=2447554
• http://www.openwall.com/lists/oss-security/2026/04/07/14
• http://www.openwall.com/lists/oss-security/2026/04/07/4
• http://www.openwall.com/lists/oss-security/2026/04/08/9
• http://www.openwall.com/lists/oss-security/2026/04/09/5
• http://www.openwall.com/lists/oss-security/2026/04/09/6
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json
• https://access.redhat.com/errata/RHSA-2026:72502
• https://access.redhat.com/errata/RHSA-2026:74674
• https://access.redhat.com/errata/RHSA-2026:82304
• https://access.redhat.com/errata/RHSA-2026:82322
• https://access.redhat.com/errata/RHSA-2026:82347
• https://access.redhat.com/errata/RHSA-2026:82354
• https://access.redhat.com/errata/RHSA-2026:82372
• https://access.redhat.com/errata/RHSA-2026:82857
• https://access.redhat.com/errata/RHSA-2026:82888
• https://access.redhat.com/errata/RHSA-2026:12423
• https://access.redhat.com/errata/RHSA-2026:12441
• https://access.redhat.com/errata/RHSA-2026:13285
• https://access.redhat.com/errata/RHSA-2026:14162
• https://access.redhat.com/errata/RHSA-2026:14937
• https://access.redhat.com/errata/RHSA-2026:19130
• https://access.redhat.com/errata/RHSA-2026:19346
• https://access.redhat.com/errata/RHSA-2026:19456
• https://access.redhat.com/errata/RHSA-2026:19458
• https://access.redhat.com/errata/RHSA-2026:20595
• https://access.redhat.com/errata/RHSA-2026:21254
• https://access.redhat.com/errata/RHSA-2026:21275
• https://access.redhat.com/errata/RHSA-2026:22634
• https://access.redhat.com/errata/RHSA-2026:22957
• https://access.redhat.com/errata/RHSA-2026:23233
• https://access.redhat.com/errata/RHSA-2026:23245
• https://access.redhat.com/errata/RHSA-2026:24346
• https://access.redhat.com/errata/RHSA-2026:25044
• https://access.redhat.com/errata/RHSA-2026:25096
• https://access.redhat.com/errata/RHSA-2026:25181
• https://access.redhat.com/errata/RHSA-2026:26542
• https://access.redhat.com/errata/RHSA-2026:27998
• https://access.redhat.com/errata/RHSA-2026:28887
• https://access.redhat.com/errata/RHSA-2026:29197
• https://access.redhat.com/errata/RHSA-2026:30078
• https://access.redhat.com/errata/RHSA-2026:30087
• https://access.redhat.com/errata/RHSA-2026:30088
• https://access.redhat.com/errata/RHSA-2026:30089
• https://access.redhat.com/errata/RHSA-2026:34098
• https://access.redhat.com/errata/RHSA-2026:39981
• https://access.redhat.com/errata/RHSA-2026:58981
• https://access.redhat.com/errata/RHSA-2026:59831
• https://access.redhat.com/errata/RHSA-2026:7473
• https://access.redhat.com/security/cve/CVE-2026-4878
• https://bugzilla.redhat.com/show_bug.cgi?id=2451615

NULL Pointer Dereference

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5 package and not the krb5 package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.

Remediation

Upgrade Debian:13 krb5 to version 1.21.3-5+deb13u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-40355
• https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f
• https://web.mit.edu/kerberos/advisories/
• https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html
• https://cert-portal.siemens.com/productcert/html/ssa-019113.html
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html
• https://cert-portal.siemens.com/productcert/html/ssa-457936.html

Buffer Over-read

NVD Description

Note: Versions mentioned in the description apply only to the upstream gzip package and not the gzip package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation. By decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.

This issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and e7378c2d421be6a286922374425680bbe9ad8b7d.

Remediation

Upgrade Debian:13 gzip to version 1.13-1+deb13u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-41992
• https://cert.pl/en/posts/2026/04/CVE-2026-41991/
• https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681
• https://www.gnu.org/software/gzip/
• http://www.openwall.com/lists/oss-security/2026/08/23/1
• http://www.openwall.com/lists/oss-security/2026/08/25/1
• http://www.openwall.com/lists/oss-security/2026/08/27/2
• https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=e7378c2d421be6a286922374425680bbe9ad8b7d

Improper Validation of Specified Quantity in Input

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.

Remediation

Upgrade Debian:13 gnutls28 to version 3.8.9-3+deb13u4 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-42013
• https://access.redhat.com/security/cve/CVE-2026-42013
• https://bugzilla.redhat.com/show_bug.cgi?id=2467448
• https://access.redhat.com/errata/RHSA-2026:20611
• https://access.redhat.com/errata/RHSA-2026:20613
• https://access.redhat.com/errata/RHSA-2026:20612
• https://access.redhat.com/errata/RHSA-2026:13274
• https://access.redhat.com/errata/RHSA-2026:26319
• https://access.redhat.com/errata/RHSA-2026:26409
• https://access.redhat.com/errata/RHSA-2026:29197
• https://access.redhat.com/errata/RHSA-2026:30004
• https://access.redhat.com/errata/RHSA-2026:30849
• https://access.redhat.com/errata/RHSA-2026:30850
• https://access.redhat.com/errata/RHSA-2026:32962
• https://access.redhat.com/errata/RHSA-2026:33125
• https://access.redhat.com/errata/RHSA-2026:40762
• https://access.redhat.com/errata/RHSA-2026:41921
• https://access.redhat.com/errata/RHSA-2026:43575
• https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-8
• https://access.redhat.com/errata/RHSA-2026:58981
• https://access.redhat.com/errata/RHSA-2026:57483
• https://access.redhat.com/errata/RHSA-2026:56853
• https://access.redhat.com/errata/RHSA-2026:59831
• https://access.redhat.com/errata/RHSA-2026:60019
• https://access.redhat.com/errata/RHSA-2026:72502
• https://access.redhat.com/errata/RHSA-2026:74674
• https://access.redhat.com/errata/RHSA-2026:82304
• https://access.redhat.com/errata/RHSA-2026:82322
• https://access.redhat.com/errata/RHSA-2026:82347
• https://access.redhat.com/errata/RHSA-2026:82354
• https://access.redhat.com/errata/RHSA-2026:82372
• https://access.redhat.com/errata/RHSA-2026:82857
• https://access.redhat.com/errata/RHSA-2026:82888

Improper Handling of Length Parameter Inconsistency

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.

Remediation

Upgrade Debian:13 gnutls28 to version 3.8.9-3+deb13u4 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-33846
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33846.json
• https://access.redhat.com/errata/RHSA-2026:72502
• https://access.redhat.com/errata/RHSA-2026:74674
• https://access.redhat.com/errata/RHSA-2026:82304
• https://access.redhat.com/errata/RHSA-2026:82322
• https://access.redhat.com/errata/RHSA-2026:82347
• https://access.redhat.com/errata/RHSA-2026:82354
• https://access.redhat.com/errata/RHSA-2026:82372
• https://access.redhat.com/errata/RHSA-2026:82857
• https://access.redhat.com/errata/RHSA-2026:82888
• https://access.redhat.com/errata/RHSA-2026:13274
• https://access.redhat.com/errata/RHSA-2026:20611
• https://access.redhat.com/errata/RHSA-2026:20612
• https://access.redhat.com/errata/RHSA-2026:20613
• https://access.redhat.com/errata/RHSA-2026:26319
• https://access.redhat.com/errata/RHSA-2026:26409
• https://access.redhat.com/errata/RHSA-2026:29197
• https://access.redhat.com/errata/RHSA-2026:30004
• https://access.redhat.com/errata/RHSA-2026:30849
• https://access.redhat.com/errata/RHSA-2026:30850
• https://access.redhat.com/errata/RHSA-2026:32962
• https://access.redhat.com/errata/RHSA-2026:33125
• https://access.redhat.com/errata/RHSA-2026:34372
• https://access.redhat.com/errata/RHSA-2026:36004
• https://access.redhat.com/errata/RHSA-2026:36005
• https://access.redhat.com/errata/RHSA-2026:36006
• https://access.redhat.com/errata/RHSA-2026:41921
• https://access.redhat.com/errata/RHSA-2026:56786
• https://access.redhat.com/errata/RHSA-2026:56853
• https://access.redhat.com/errata/RHSA-2026:56911
• https://access.redhat.com/errata/RHSA-2026:57402
• https://access.redhat.com/errata/RHSA-2026:57483
• https://access.redhat.com/errata/RHSA-2026:58981
• https://access.redhat.com/errata/RHSA-2026:59831
• https://access.redhat.com/errata/RHSA-2026:60019
• https://access.redhat.com/errata/RHSA-2026:65839
• https://access.redhat.com/security/cve/CVE-2026-33846
• https://bugzilla.redhat.com/show_bug.cgi?id=2450625

Undefined Behavior for Input to API

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.

Remediation

Upgrade Debian:13 gnutls28 to version 3.8.9-3+deb13u4 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-42009
• https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-2
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42009.json
• https://access.redhat.com/errata/RHSA-2026:72502
• https://access.redhat.com/errata/RHSA-2026:74674
• https://access.redhat.com/errata/RHSA-2026:82304
• https://access.redhat.com/errata/RHSA-2026:82322
• https://access.redhat.com/errata/RHSA-2026:82347
• https://access.redhat.com/errata/RHSA-2026:82354
• https://access.redhat.com/errata/RHSA-2026:82372
• https://access.redhat.com/errata/RHSA-2026:82857
• https://access.redhat.com/errata/RHSA-2026:82888
• https://access.redhat.com/errata/RHSA-2026:13274
• https://access.redhat.com/errata/RHSA-2026:20611
• https://access.redhat.com/errata/RHSA-2026:20612
• https://access.redhat.com/errata/RHSA-2026:20613
• https://access.redhat.com/errata/RHSA-2026:26319
• https://access.redhat.com/errata/RHSA-2026:26409
• https://access.redhat.com/errata/RHSA-2026:29197
• https://access.redhat.com/errata/RHSA-2026:29794
• https://access.redhat.com/errata/RHSA-2026:30004
• https://access.redhat.com/errata/RHSA-2026:30849
• https://access.redhat.com/errata/RHSA-2026:30850
• https://access.redhat.com/errata/RHSA-2026:32962
• https://access.redhat.com/errata/RHSA-2026:33125
• https://access.redhat.com/errata/RHSA-2026:34372
• https://access.redhat.com/errata/RHSA-2026:34764
• https://access.redhat.com/errata/RHSA-2026:34788
• https://access.redhat.com/errata/RHSA-2026:36004
• https://access.redhat.com/errata/RHSA-2026:36005
• https://access.redhat.com/errata/RHSA-2026:36006
• https://access.redhat.com/errata/RHSA-2026:40762
• https://access.redhat.com/errata/RHSA-2026:41921
• https://access.redhat.com/errata/RHSA-2026:56786
• https://access.redhat.com/errata/RHSA-2026:56853
• https://access.redhat.com/errata/RHSA-2026:56911
• https://access.redhat.com/errata/RHSA-2026:57483
• https://access.redhat.com/errata/RHSA-2026:58981
• https://access.redhat.com/errata/RHSA-2026:59831
• https://access.redhat.com/errata/RHSA-2026:60019
• https://access.redhat.com/errata/RHSA-2026:65839
• https://access.redhat.com/security/cve/CVE-2026-42009
• https://bugzilla.redhat.com/show_bug.cgi?id=2467279

Improper Certificate Validation

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or intercept sensitive information.

Remediation

Upgrade Debian:13 gnutls28 to version 3.8.9-3+deb13u4 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-42012
• https://access.redhat.com/security/cve/CVE-2026-42012
• https://bugzilla.redhat.com/show_bug.cgi?id=2467441
• https://access.redhat.com/errata/RHSA-2026:20611
• https://access.redhat.com/errata/RHSA-2026:20613
• https://access.redhat.com/errata/RHSA-2026:20612
• https://access.redhat.com/errata/RHSA-2026:13274
• https://access.redhat.com/errata/RHSA-2026:26319
• https://access.redhat.com/errata/RHSA-2026:26409
• https://access.redhat.com/errata/RHSA-2026:29197
• https://access.redhat.com/errata/RHSA-2026:30004
• https://access.redhat.com/errata/RHSA-2026:30849
• https://access.redhat.com/errata/RHSA-2026:30850
• https://access.redhat.com/errata/RHSA-2026:32962
• https://access.redhat.com/errata/RHSA-2026:33125
• https://access.redhat.com/errata/RHSA-2026:41921
• https://access.redhat.com/errata/RHSA-2026:43575
• https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-7
• https://access.redhat.com/errata/RHSA-2026:58981
• https://access.redhat.com/errata/RHSA-2026:72502
• https://access.redhat.com/errata/RHSA-2026:74674
• https://access.redhat.com/errata/RHSA-2026:82304
• https://access.redhat.com/errata/RHSA-2026:82322
• https://access.redhat.com/errata/RHSA-2026:82347
• https://access.redhat.com/errata/RHSA-2026:82354
• https://access.redhat.com/errata/RHSA-2026:82372
• https://access.redhat.com/errata/RHSA-2026:82857
• https://access.redhat.com/errata/RHSA-2026:82888

Improper Handling of Case Sensitivity

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels, specifically for dNSName (DNS) or rfc822Name (email) constraints within excludedSubtrees or permittedSubtrees. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.

Remediation

Upgrade Debian:13 gnutls28 to version 3.8.9-3+deb13u4 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-3833
• https://access.redhat.com/errata/RHSA-2026:13274
• https://access.redhat.com/security/cve/CVE-2026-3833
• https://bugzilla.redhat.com/show_bug.cgi?id=2445763
• https://access.redhat.com/errata/RHSA-2026:20611
• https://access.redhat.com/errata/RHSA-2026:20613
• https://access.redhat.com/errata/RHSA-2026:20612
• https://access.redhat.com/errata/RHSA-2026:26319
• https://access.redhat.com/errata/RHSA-2026:26409
• https://access.redhat.com/errata/RHSA-2026:29197
• https://access.redhat.com/errata/RHSA-2026:30004
• https://access.redhat.com/errata/RHSA-2026:30849
• https://access.redhat.com/errata/RHSA-2026:30850
• https://access.redhat.com/errata/RHSA-2026:32962
• https://access.redhat.com/errata/RHSA-2026:33125
• https://access.redhat.com/errata/RHSA-2026:41921
• https://access.redhat.com/errata/RHSA-2026:43575
• https://access.redhat.com/errata/RHSA-2026:58981
• https://access.redhat.com/errata/RHSA-2026:57402
• https://access.redhat.com/errata/RHSA-2026:59831
• https://access.redhat.com/errata/RHSA-2026:60019
• https://access.redhat.com/errata/RHSA-2026:62549
• https://access.redhat.com/errata/RHSA-2026:62409
• https://access.redhat.com/errata/RHSA-2026:65851
• https://access.redhat.com/errata/RHSA-2026:65839
• https://access.redhat.com/errata/RHSA-2026:67857
• https://access.redhat.com/errata/RHSA-2026:72502
• https://access.redhat.com/errata/RHSA-2026:74674
• https://access.redhat.com/errata/RHSA-2026:82304
• https://access.redhat.com/errata/RHSA-2026:82322
• https://access.redhat.com/errata/RHSA-2026:82347
• https://access.redhat.com/errata/RHSA-2026:82354
• https://access.redhat.com/errata/RHSA-2026:82372
• https://access.redhat.com/errata/RHSA-2026:82857
• https://access.redhat.com/errata/RHSA-2026:82888
• https://gitlab.com/gnutls/gnutls/-/issues/1803

Improper Validation of Specified Quantity in Input

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.

Remediation

Upgrade Debian:13 gnutls28 to version 3.8.9-3+deb13u4 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-5260
• https://access.redhat.com/security/cve/CVE-2026-5260
• https://bugzilla.redhat.com/show_bug.cgi?id=2467450
• https://access.redhat.com/errata/RHSA-2026:20611
• https://access.redhat.com/errata/RHSA-2026:20613
• https://access.redhat.com/errata/RHSA-2026:20612
• https://access.redhat.com/errata/RHSA-2026:13274
• https://access.redhat.com/errata/RHSA-2026:26319
• https://access.redhat.com/errata/RHSA-2026:26409
• https://access.redhat.com/errata/RHSA-2026:29197
• https://access.redhat.com/errata/RHSA-2026:30004
• https://access.redhat.com/errata/RHSA-2026:30849
• https://access.redhat.com/errata/RHSA-2026:30850
• https://access.redhat.com/errata/RHSA-2026:32962
• https://access.redhat.com/errata/RHSA-2026:33125
• https://access.redhat.com/errata/RHSA-2026:40762
• https://access.redhat.com/errata/RHSA-2026:41921
• https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-10
• https://access.redhat.com/errata/RHSA-2026:58981
• https://access.redhat.com/errata/RHSA-2026:57483
• https://access.redhat.com/errata/RHSA-2026:56853
• https://access.redhat.com/errata/RHSA-2026:59831
• https://access.redhat.com/errata/RHSA-2026:60019
• https://access.redhat.com/errata/RHSA-2026:67837
• https://access.redhat.com/errata/RHSA-2026:72502
• https://access.redhat.com/errata/RHSA-2026:74674
• https://access.redhat.com/errata/RHSA-2026:82304
• https://access.redhat.com/errata/RHSA-2026:82322
• https://access.redhat.com/errata/RHSA-2026:82347
• https://access.redhat.com/errata/RHSA-2026:82354
• https://access.redhat.com/errata/RHSA-2026:82372
• https://access.redhat.com/errata/RHSA-2026:82857
• https://access.redhat.com/errata/RHSA-2026:82888
• https://access.redhat.com/errata/RHSA-2026:77320

Improper Certificate Validation

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.

Remediation

Upgrade Debian:13 gnutls28 to version 3.8.9-3+deb13u4 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-42011
• https://access.redhat.com/security/cve/CVE-2026-42011
• https://bugzilla.redhat.com/show_bug.cgi?id=2467437
• https://access.redhat.com/errata/RHSA-2026:13274
• https://access.redhat.com/errata/RHSA-2026:20611
• https://access.redhat.com/errata/RHSA-2026:20613
• https://access.redhat.com/errata/RHSA-2026:20612
• https://access.redhat.com/errata/RHSA-2026:26319
• https://access.redhat.com/errata/RHSA-2026:26409
• https://access.redhat.com/errata/RHSA-2026:29197
• https://access.redhat.com/errata/RHSA-2026:30004
• https://access.redhat.com/errata/RHSA-2026:30849
• https://access.redhat.com/errata/RHSA-2026:30850
• https://access.redhat.com/errata/RHSA-2026:32962
• https://access.redhat.com/errata/RHSA-2026:33125
• https://access.redhat.com/errata/RHSA-2026:40762
• https://access.redhat.com/errata/RHSA-2026:41921
• https://access.redhat.com/errata/RHSA-2026:43575
• https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-6
• https://access.redhat.com/errata/RHSA-2026:58981
• https://access.redhat.com/errata/RHSA-2026:57483
• https://access.redhat.com/errata/RHSA-2026:56853
• https://access.redhat.com/errata/RHSA-2026:59831
• https://access.redhat.com/errata/RHSA-2026:60019
• https://access.redhat.com/errata/RHSA-2026:72502
• https://access.redhat.com/errata/RHSA-2026:74674
• https://access.redhat.com/errata/RHSA-2026:82304
• https://access.redhat.com/errata/RHSA-2026:82322
• https://access.redhat.com/errata/RHSA-2026:82347
• https://access.redhat.com/errata/RHSA-2026:82354
• https://access.redhat.com/errata/RHSA-2026:82372
• https://access.redhat.com/errata/RHSA-2026:82857
• https://access.redhat.com/errata/RHSA-2026:82888

Integer Overflow or Wraparound

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.

Remediation

Upgrade Debian:13 expat to version 2.8.2-1~deb13u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-25210
• https://github.com/libexpat/libexpat/pull/1075
• https://github.com/libexpat/libexpat/pull/1075/commits/9c2d990389e6abe2e44527eeaa8b39f16fe859c7
• https://cert-portal.siemens.com/productcert/html/ssa-253495.html

Algorithmic Complexity

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Remediation

Upgrade Debian:13 expat to version 2.8.2-1~deb13u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-45186
• https://github.com/libexpat/libexpat/pull/1216
• http://www.openwall.com/lists/oss-security/2026/05/11/16
• https://access.redhat.com/errata/RHSA-2026:22715
• https://access.redhat.com/errata/RHSA-2026:22721
• https://access.redhat.com/errata/RHSA-2026:23230
• https://access.redhat.com/errata/RHSA-2026:26319
• https://access.redhat.com/errata/RHSA-2026:27201
• https://access.redhat.com/errata/RHSA-2026:29197
• https://access.redhat.com/security/cve/CVE-2026-45186
• https://bugzilla.redhat.com/show_bug.cgi?id=2468575
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45186.json
• https://access.redhat.com/errata/RHSA-2026:58981

Algorithmic Complexity

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.

Remediation

Upgrade Debian:13 expat to version 2.9.0-1~deb13u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-66046
• https://github.com/libexpat/libexpat/pull/1321
• https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity

Use After Free

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.

Remediation

Upgrade Debian:13 expat to version 2.9.0-1~deb13u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-76957
• https://github.com/libexpat/libexpat/pull/1322
• https://github.com/libexpat/libexpat/pull/1329

Unexpected Status Code or Return Value

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.

Remediation

Upgrade Debian:13 expat to version 2.9.0-1~deb13u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-76956
• https://github.com/libexpat/libexpat/pull/1326
• https://github.com/libexpat/libexpat/pull/1329

Improper Handling of Unicode Encoding

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.

Remediation

Upgrade Debian:13 expat to version 2.9.0-1~deb13u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-93990
• https://github.com/libexpat/libexpat
• https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a
• https://github.com/libexpat/libexpat/pull/1282
• https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate
• https://blog.hartwork.org/posts/expat-2-8-5-released/
• https://github.com/libexpat/libexpat/releases/tag/R_2_8_5

Out-of-bounds Read

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.

Remediation

Upgrade Debian:13 expat to version 2.9.0-1~deb13u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-77214
• https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0
• https://github.com/libexpat/libexpat/pull/1393
• https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer

Heap-based Buffer Overflow

NVD Description

Note: Versions mentioned in the description apply only to the upstream cyrus-sasl2 package and not the cyrus-sasl2 package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application.

Remediation

There is no fixed version for Debian:13 cyrus-sasl2.

References

• https://security-tracker.debian.org/tracker/CVE-2026-107161
• https://access.redhat.com/security/cve/CVE-2026-107161
• https://bugzilla.redhat.com/show_bug.cgi?id=2460420
• http://www.openwall.com/lists/oss-security/2026/10/09/20

Link Following

NVD Description

Note: Versions mentioned in the description apply only to the upstream attr package and not the attr package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.

Remediation

There is no fixed version for Debian:13 attr.

References

• https://security-tracker.debian.org/tracker/CVE-2026-54371
• https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f
• https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b
• https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr
• https://access.redhat.com/security/cve/CVE-2026-54371
• https://bugzilla.redhat.com/show_bug.cgi?id=2490283
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json
• https://access.redhat.com/errata/RHSA-2026:34889
• https://access.redhat.com/errata/RHSA-2026:56133
• https://access.redhat.com/errata/RHSA-2026:59380
• https://access.redhat.com/errata/RHSA-2026:60226
• https://access.redhat.com/errata/RHSA-2026:61783
• https://access.redhat.com/errata/RHSA-2026:63135
• https://access.redhat.com/errata/RHSA-2026:63138
• https://access.redhat.com/errata/RHSA-2026:66018

Link Following

NVD Description

Note: Versions mentioned in the description apply only to the upstream acl package and not the acl package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.

Remediation

There is no fixed version for Debian:13 acl.

References

• https://security-tracker.debian.org/tracker/CVE-2026-54369
• https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5
• https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1
• https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions
• https://access.redhat.com/errata/RHSA-2026:34351
• https://access.redhat.com/errata/RHSA-2026:42736
• https://access.redhat.com/errata/RHSA-2026:42739
• https://access.redhat.com/errata/RHSA-2026:43420
• https://access.redhat.com/security/cve/CVE-2026-54369
• https://bugzilla.redhat.com/show_bug.cgi?id=2490277
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json
• https://access.redhat.com/errata/RHSA-2026:44481
• https://access.redhat.com/errata/RHSA-2026:46836
• https://access.redhat.com/errata/RHSA-2026:50205
• https://access.redhat.com/errata/RHSA-2026:53371
• https://access.redhat.com/errata/RHSA-2026:54769
• https://access.redhat.com/errata/RHSA-2026:58981
• https://access.redhat.com/errata/RHSA-2026:64805
• https://access.redhat.com/errata/RHSA-2026:67140
• https://access.redhat.com/errata/RHSA-2026:67142
• https://access.redhat.com/errata/RHSA-2026:67144