A critical vulnerability (CVE-2026-78676) in GitPython's GitConfigParser allows dormant multi-line git-config values to be corrupted into live injected directives upon any unrelated config write. This occurs because the parser's re-serialization logic mishandles multi-line values, causing injected directives like core.hooksPath to be interpreted by Git, enabling remote code execution (RCE). The issue affects GitPython version 3.1.58 at HEAD and specific kimi-cli versions. A patch is available.
A high-severity vulnerability in GitPython (CVE-2026-78675) allows arbitrary local file content disclosure via the [include] directive in an untrusted .gitmodules file. The SubmoduleConfigParser does not disable merge_includes, enabling an attacker to craft a malicious .gitmodules file that causes the parser to include and read arbitrary files on the victim's system. When the parser encounters a non-gitconfig file, it raises an exception that leaks the first line of the included file in the error message. This disclosure occurs during common read-only operations such as enumerating submodules, without requiring repository updates or checkouts. A fix is available for this vulnerability.
GitPython's Repo.blame() and Repo.blame_incremental() methods have an incomplete denylist for unsafe git revision options, omitting the --contents and -S options. This omission allows an attacker to cause arbitrary local file reads by passing these options, which echo file contents into the blame result. The vulnerability affects GitPython versions up to 3.1.58. A patch is available to address this issue by expanding the denylist to include these options.
The fast-uri library used by node-ajv has a vulnerability where it accepts hosts containing unbalanced or misplaced authority brackets without reporting an error. This parsing discrepancy can lead to host confusion between fast-uri and Node.js URL clients. Applications relying on fast-uri's parse().host for security decisions such as SSRF denylisting or redirect allowlisting may be affected. The issue is patched in fast-uri versions 4.1.4, 3.1.7, and 2.4.6.
A security update for the lkl component has been released by SUSE Product Security Team. The update aligns lkl with the current kernel version, addressing unspecified security issues. No specific affected versions or detailed vulnerability information are provided.
A vulnerability in the Erlang/OTP inets httpd server allows unauthenticated remote attackers to cause denial of service by opening and holding a large number of simultaneous connections. The issue arises because the server does not enforce the documented default limit of 150 max_clients unless explicitly configured, allowing unlimited connections that exhaust system resources. This affects multiple Erlang/OTP versions prior to specific patched releases. A fix is available and should be applied to mitigate the risk.
A vulnerability in the Erlang/OTP inets httpd component allows unauthenticated remote attackers to cause a denial of service by sending valid HTTP headers with a large Content-Length and then stalling before the body is complete. This causes worker processes to wait indefinitely, exhausting available workers and denying service to legitimate clients. The issue affects multiple Erlang/OTP versions prior to fixed releases. Official patches are available from the vendor.
A vulnerability in Erlang/OTP inets httpd allows remote unauthenticated attackers to bypass authentication and read files inside mod_auth protected directories on case-insensitive filesystems by exploiting improper handling of case sensitivity in request paths. This affects multiple versions of Erlang/OTP from 17.0 up to but not including patched versions 27.3.4.17, 28.5.0.6, and 29.0.6. The issue arises because the authentication check does not consider case-insensitive matches, while the filesystem resolves paths case-insensitively, allowing unauthorized access. A fix is available and has been released by Ubuntu in security updates.
A vulnerability in Erlang's inet driver when using {packet,4} mode allows an attacker connecting to an open TCP port to cause a signed overflow in packet length calculation. This overflow can corrupt the receive buffer and allocator metadata, likely causing the BEAM VM to crash. Exploitation for remote code execution is considered extremely unlikely. The issue affects multiple OTP and erts versions prior to specific fixed releases. Patches are available and have been released by Ubuntu.
An update to wicked2nm (v1.5.2) addresses a security issue in the serde_with library where KeyValueMap serialization could panic on empty sequences or map entries. This update also includes other bug fixes and dependency bumps.
This security update provides a functional equivalent of RHSA-2026:62144.
The original Red Hat(R) advisory is available from the Red Hat web site at
https://access.redhat.com/errata/RHSA-2026:62144.
A security update for libgpg-error addresses an out-of-bounds read vulnerability in the _gpgrt_vfnameconcat function within stringutils.c when the GPGRT_FCONCAT_SYSCONF flag is used. This issue could potentially lead to memory safety problems. The vulnerability is rated medium severity. No specific affected versions or patch details are provided in the available data.
This security update for suseconnect-ng upgrades the software to version 1.23.0, addressing multiple issues including improved product migration handling, updating the default Go version for building the package, fixing flag parsing errors, ensuring consistent interactive/noninteractive behavior during release package installation, adding an optional collector for installed SUSE RPM packages, and allowing deregistration when a subscribed registration code has expired.
GitPython versions up to 3.1.57 contain a vulnerability where the guard against unsafe git options can be bypassed by using the 'split_single_char_options=False' flag combined with a single-character keyword argument. This allows an attacker to smuggle a short option token that Git interprets as a command, leading to arbitrary OS command execution. The vulnerability is due to an incomplete fix of a previous issue and affects all guarded methods forwarding keyword arguments. A patch is available to address this issue.
A vulnerability in GitPython versions before 3.1.58 allows improper validation of options passed to git rm and git checkout commands via the IndexFile.remove() and Head.checkout() methods. This flaw causes Git to treat the entire contents of a user-chosen file as a single pathspec when used with --pathspec-from-file and --pathspec-file-nul options, potentially leaking file contents in error messages. The issue has a medium severity with a CVSS score of 6.5. A patch is available to address this vulnerability.
GitPython versions up to 3.1.57 contain a remote code execution vulnerability in the Repo.init method. This method forwards unsafe git options without validation, allowing an attacker to specify a malicious --template directory with executable git hooks. When Repo.init is called with such a crafted template path, git copies attacker-controlled hooks into the new repository, leading to arbitrary code execution during subsequent git operations. A patch is available that adds validation to prevent unsafe options.
GitPython versions before 3.1.58 contain a vulnerability in the IndexFile.from_tree, reset, and merge_tree methods. These methods forward git read-tree options without proper safety checks, allowing an attacker to inject the --index-output option and overwrite arbitrary files with a valid git-index blob. This can lead to arbitrary file overwrite or destruction with the privileges of the host process. A patch is available to address this issue by adding safety checks and separators to prevent unsafe option forwarding.
GitPython versions up to 3.1.57 contain a vulnerability in the config-name validator that allows injection of arbitrary git configuration directives via crafted option names. This flaw enables attackers to forge directives such as core.sshCommand or core.hooksPath, potentially leading to remote code execution during subsequent git operations. The issue stems from insufficient validation that fails to reject characters like '=', '#', or whitespace in option names. A fix is available that applies stricter validation to option names.
GitPython versions prior to 3.1.58 contain a vulnerability where submodule names from .gitmodules files are not validated. This allows an attacker controlling a cloned repository's .gitmodules to specify path traversal strings, causing GitPython to create Git repositories outside the intended directory during submodule initialization. The issue is similar to a previously fixed Git vulnerability but remains unpatched in GitPython until fixed.
CVE-2026-16440 is a medium severity vulnerability in Eclipse OpenJ9, part of IBM Java SE version 8, that allows denial of service via a crafted .class file causing uncontrolled recursion. It is addressed in the Red Hat security update for java-1.8.0-ibm. The vulnerability has a CVSS score of 5.7 and affects specific versions of the IBM Java runtime. Red Hat has released patches to fix this issue as part of their August 2026 security update.