The dex package contains multiple critical security vulnerabilities identified under CVE-2026-25680 and related CVEs. These vulnerabilities affect dex versions =1.14.2-r1 and all versions earlier than 2.44.0-r4. The combined CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. The vulnerabilities have been resolved in later releases, with patches provided by vendors including Red Hat and SUSE. Official advisories detail the updates and remediation steps.

Successful exploitation of these vulnerabilities could result in complete compromise of the affected system's confidentiality, integrity, and availability. Given the critical CVSS score of 9.8, attackers could remotely exploit these flaws without authentication or user interaction, potentially leading to full system takeover or denial of service.

Patches are available and should be applied promptly. Users should upgrade dex to versions 2.44.0-r4 or later. Refer to the Red Hat advisory RHSA-2026:23264 and SUSE Product Security Team advisories for detailed update instructions. No additional mitigations are indicated beyond applying the official fixes.