Libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser that can be exploited remotely to cause a denial of service (CVE-2026-95114). This vulnerability is addressed in version 4.3.3-9.oe2403sp4. The issue has a high severity rating with a CVSS score of 7.5, indicating a significant impact on availability but no impact on confidentiality or integrity.
A high-severity denial of service vulnerability exists in the Qt XML module (QtXml, qtbase) affecting versions prior to 6.5.2-16.oe2403sp1. The flaw is due to uncontrolled recursion in the QDomDocument/QDomNode serialization path, where deeply nested XML elements cause stack exhaustion and process termination. This issue affects functions such as QDomDocument::toByteArray(), toString(), toCString(), QDomNode::save(), and the QTextStream operator for QDomNode. No code execution or memory disclosure is possible. A fix is available in version 6.5.2-16.oe2403sp1.
CVE-2026-109089 is a high-severity vulnerability affecting libXi, the client-side library for the X Input Extension. Multiple security issues were identified in the X.Org client library implementations, prompting security fixes. The vulnerability impacts versions of libXi prior to 1.8.1-6.oe2403sp1. The CVSS 3.1 score is 7.5, indicating high impact on confidentiality, integrity, and availability. A patch is available in version 1.8.1-6.oe2403sp1.
A vulnerability in BIND DNS server allows a validly signed NSEC3 record from an unrelated sibling zone to be accepted as proof of insecurity. This can downgrade a secure delegation and permit a forged unsigned DNS answer. The issue affects multiple BIND 9 versions and has been fixed in version 9.18.21-15.oe2403sp1.
Multiple denial of service vulnerabilities exist in HDF5 before version 2.3.0, including untrusted pointer dereference, NULL pointer dereference, out-of-bounds heap read, and size underflow issues. These flaws affect various components such as the h5dump tool, fill value handling, N-Bit filter processing, and Fletcher32 checksum calculation. The vulnerabilities can be triggered by crafted HDF5 files and may cause application crashes or memory disclosure in constrained cases. A security update fixing these issues is available in version 1.14.5-8.oe2403sp4.
A critical buffer overflow vulnerability exists in the Brotli decoder used by python-brotlicffi versions prior to 1.1.0.0-2.oe2403sp4. This flaw allows a remote unauthenticated attacker to corrupt memory, potentially leading to sensitive data disclosure, denial of service, or arbitrary code execution via a crafted Brotli-compressed stream. Users should update to fixed versions 1.1.0.0-2.oe2403sp4 or later to mitigate the risk.
A type confusion vulnerability in perl-DBI versions before 1.643-13.oe2203sp4 can cause a crash (SIGSEGV) when a database handle is destroyed under a Profile Path containing an {attr} element. This occurs because the dbi_profile function dereferences an invalid pointer during attribute lookup on the handle's inner hash. The vulnerability can be triggered by setting the DBI_PROFILE environment variable, potentially crashing unmodified programs.
MariaDB versions prior to 10.5.29-3.oe2203sp4 and certain other branches created a mysql service account with the database data directory as its home. A database user with FILE privilege could write startup dot-files like .bash_profile into this home directory, which could execute when an administrator logged into the mysql account. Debian packages are not affected due to using a non-existent home directory. This issue is fixed in multiple MariaDB versions including 10.5.29-3.oe2203sp4.