CVE-2026-25800VulnerabilityPublished 16 Sep 2026Updated 10 Nov 2026

SUSE · Security update for openai-codex

Affects SUSESource GCVE Database

Compare

Authoritative record:CVE-2026-25800· High 7.5

Not known to be exploited · CVSS 7.5 High : upgrade SUSE quinn to 0.11.15 soon.

Data as of 10 Nov 2026, 20:06 UTC

CVSS 3.1 base score

7.5High

How severe the flaw is on the 0–10 CVSS scale.

Patch: Available – fixed in 0.11.15

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 23 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 10 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade quinn and quinn-rs/quinn to 0.11.15.

Affected software

Product	Affected	Fixed in
quinn-rsquinn	Affected >=0.1.0 <0.11.15	Fixed in 0.11.15
crates.ioquinn-rs/quinn`pkg:cargo/quinn-rs/quinn`Other threats	Affected <0.11.15 >=0.1.0	Fixed in 0.11.15

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

This update for openai-codex fixes the following issues: Changes in openai-codex: Update to version 0.154.0: * Experimental worktree support for isolated checkouts of new or forked sessions, with browse and resume * Answer questions inline while Codex keeps working, keeping the main draft * Vim R replace mode with undo and dot-repeat; /copy keeps formatting and covers status and session fields * Plugin tools refresh after external upgrades, MCP OAuth refresh is coordinated, helpers no longer run before trust is established; resume and fork keep saved permissions * Drop the deprecated codex mcp-server entry point, now codex mcp - Regenerate vendor.tar.zst: rmcp 3.1.3 -> 3.2.0 plus routine bumps; webrtc/gstreamer/cpal stay out of the codex-cli link graph, so the License tag is unchanged - Legal-Review-Notice: linked-crate count 876/878 -> 880/882 on aarch64/x86_64; the vendored dependency licence set is unchanged - cargo-audit reports the same five advisories as 0.151.0, none new and none fixable by re-vendoring Update to version 0.153.4: * GPT-6-Astra is listed in the bundled model picker and is the bundled default when no model is configured * Astra's async-question guidance now applies only when request_user_input_async is available in the session Update to version 0.153.3: * GPT-6-Astra is available in the Amazon Bedrock model picker for Mantle and Runtime global/US routes * Astra's async-question guidance now names request_user_input_async and notes that it accepts text only - Keep vendor.tar.zst: 0.153.4 has the same Cargo.lock as 0.153.2, so the linked crate set, the License tag and the Legal-Review-Notice counts are unchanged - Update to version 0.153.2: * Correct the GPT-6-Astra Fast tier description to "2x speed" instead of "1.5x"; display text only, request handling is unchanged - Update to version 0.153.1: * GPT-6-Astra can be configured through the API without changing the default model or listing it in the model picker - Build against the system bzip2, libzstd, oniguruma and sqlite instead of the copies bzip2-sys, zstd-sys, onig_sys and libsqlite3-sys otherwise compile in; drop their bundled() Provides and add pkgconfig(bzip2), pkgconfig(libzstd), pkgconfig(oniguruma) >= 6.9.3 and pkgconfig(sqlite3) >= 3.34.1 * oniguruma and sqlite have no usable manifest switch, so %build and %check export RUSTONIG_SYSTEM_LIBONIG and LIBSQLITE3_SYS_USE_PKG_CONFIG instead, and %install now fails the build unless all four are DT_NEEDED of codex * aws-lc stays bundled: aws-lc-sys has no system-library mode - Keep vendor.tar.zst: 0.153.2 has the same Cargo.lock as 0.153.0, so the linked crate set, the License tag and the Legal-Review-Notice counts are unchanged - Update to version 0.153.0: * Vim mode gains undo (u) and redo (Ctrl+R), preserving whole drafts including pasted content and attachments * The plugin CLI lists, installs and removes plugins from remote marketplaces * tui.auto_recap = false turns off automatic recaps while keeping /recap available * TUI history shows complete patches, input sent to background terminals and individual completed commands * TUI sessions reconnect after an app-server connection drops, keeping drafts and holding queued submissions for review * Guardian review history survives compaction, restarts and forks; Full Access skips Guardian review for confirmation-only actions * Remembered MCP tool approvals are scoped to the selected app account * tui.disable_paste_burst replaces the top-level setting, which stays supported as a fallback * New disabled-by-default features.context_management.experimental_mode - Regenerate vendor.tar.zst: the 14 crates 0.153.0 adds to the lockfile are all Windows-only, so the linked third-party set, the License tag and the bundled() versions are unchanged; the Legal-Review-Notice counts move only by one added first-party workspace member - Update to version 0.152.1: * Guardian approval review honours Node REPL policies supplied through model metadata; the bundled policy is now only the fallback * Switching models mid-session is refused when the destination changes the Guardian parent-fallback node REPL policy - Update to version 0.152.0: * Vim mode gains "/" and "?" search within drafts, with match highlighting and n/N repeat navigation * Rate-limit banners offer actions for checking usage, managing credits, resetting limits and managing plans * TUI and "codex exec" show credential-refresh progress, including Amazon Bedrock reauthentication * MCP server names may contain ":", "@", "/" and "." * Individual MCP tools honour an output_token_limit setting * App-server clients can configure thread/shellCommand timeouts longer than one hour * Cloud task requests reject untrusted backend URLs and refuse

References

Community reviews

Loading reviews…