A vulnerability in the Linux kernel's Integrity Measurement Architecture (IMA) component causes improper handling of file extended attributes (xattr) during early boot when the filesystem is read-only. Attempts to change xattr on ext4 filesystems trigger a failing ext4 transaction, leading to system warnings and potential instability. The issue is addressed by returning an error early if the file xattr cannot be changed.
A vulnerability in the Linux kernel's 8250 serial driver was addressed by recognizing the UPIO_AU UART type to prevent warnings during driver probe on MIPS Alchemy systems. The fix involves acknowledging this UART type without further action, as parameters are already configured elsewhere. This resolves a warning related to unsupported UART type 4 during initialization.
A vulnerability in the Linux kernel's chips-media wave5 driver could allow invalid memory writes due to lack of range checks on dec_output_info data. This issue was fixed by adding appropriate range checks to prevent buffer overflow conditions.
A vulnerability in the Linux kernel's irqchip/gic-v5 driver causes a delay in priority dropping after interrupt activation, potentially blocking new interrupts and causing a denial of service. This occurs because the priority drop was previously done during interrupt deactivation rather than immediately after acknowledgment. The issue affects certain Linux kernel versions and has been resolved by moving the priority drop to occur immediately after interrupt acknowledgment.
A vulnerability in the Linux kernel's nouveau DRM driver related to the GA100 chip's SEC2 falcon was fixed by adding the SEC2 entry to the chip table. Without this fix, a NULL pointer dereference occurs during the GSP-RM boot process, causing a crash.
CVE-2026-98870 is a use-after-free vulnerability in the Linux kernel's ksmbd component affecting versions from 5.15.222 up to but not including 5.16. The flaw occurs because stale channels are not properly removed from all sessions during connection teardown, leading to dereferencing freed memory and leaking session resources. This vulnerability has been fixed in Linux kernel version 5.16 and later.
A vulnerability in the Cruft library's GitPython integration allows an attacker to execute arbitrary code by planting a malicious Git hook. The create_submodule function clones a submodule into the repository's .git directory before validating the path. Specifically, a path like ".git/hooks" is accepted initially, causing the submodule to be cloned directly into the live hooks directory. This results in an attacker-controlled executable hook file (e.g., post-checkout) being placed and executed on subsequent Git operations. Versions 3.1.x silently allow this, while 3.2.0 and later raise a ValueError after cloning, but do not remove the planted hook, so the risk remains. The vulnerability affects versions from 3.1.59 through 3.2.0 plus subsequent commits. A fix is available in version 2.16.0_17.
## Summary
`TraceState.from_header` splits the inbound W3C `tracestate` header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs O(N²) CPU. A single unauthenticated request with a ~100 KB `tracestate` keeps the handling worker busy for ~6 s (spaces) to ~12 s (tabs); under an asyncio server it blocks every other connection for that time.
## Affected component / version
- Package: `opentelemetry-api` (pip) — `opentelemetry/trace/span.py` (`TraceState.from_header`), reached from `opentelemetry/trace/propagation/tracecontext.py` (`TraceContextTextMapPropagator.extract`).
- Confirmed in `main` (5e8083e8) and in the v1.44.0 and v1.45.0 tags; the same pattern is present back to v1.0.0 (introduced by #1599, March 2021). Not exhaustively verified against every release in between.
- Reachable with the default propagators (`OTEL_PROPAGATORS` defaults to `tracecontext,baggage`) from any server instrumentation that calls `propagate.extract()`, for example `opentelemetry-instrumentation-asgi`.
## Details
1. The header reaches the parser without any length check:
```python
# opentelemetry-api/src/opentelemetry/trace/propagation/tracecontext.py:57
tracestate_headers = getter.get(carrier, self._TRACESTATE_HEADER_NAME) # <-- attacker-controlled request header(s), any size
if tracestate_headers is None:
tracestate = None
else:
tracestate = TraceState.from_header(tracestate_headers) # <-- no length check before parsing (line 61)
```
2. The split pattern and the parser:
```python
# opentelemetry-api/src/opentelemetry/trace/span.py:45
_TRACECONTEXT_MAXIMUM_TRACESTATE_KEYS = 32 # <-- only enforced later, in TraceState.__init__, after the split
_delimiter_pattern = re.compile(r"[ \t]*,[ \t]*") # <-- (line 46) starts with an unbounded [ \t]*
# span.py:382
@classmethod
def from_header(cls, header_list: list[str]) -> TraceState:
pairs = {} # type: dict[str, str]
for header in header_list:
members: list[str] = re.split(_delimiter_pattern, header) # <-- (line 400) VULNERABLE: O(N^2) on "a=b" + " " * N + "x"
for member in members:
if not member:
continue
match = _member_pattern.fullmatch(member)
if not match:
_logger.warning( # <-- also logs the entire malformed member (up to the whole header)
"Member doesn't match the w3c identifiers format %s",
member,
)
return cls()
...
```
`re.split` tries the pattern at every offset. At each offset inside a whitespace run, `[ \t]*` consumes the rest of the run, finds no `,`, backtracks and fails, then the engine moves one character forward and repeats. N characters × up to N steps each = O(N²). The 32-member limit never gets a chance to run because `split` has to finish first.
3. The sibling propagator already has the missing guard:
```python
# baggage/propagation/__init__.py:68
_MAX_HEADER_LENGTH = 8192
...
if len(header.encode()) > self._MAX_HEADER_LENGTH: # <-- (line 93) rejected before any regex runs; tracestate has no equivalent
_logger.warning(...)
return context
```
A 16 KiB header costs ≈ 0.25 s and an 8 KiB header ≈ 0.07 s.
Measured cost of `extract()` on one core (valid `traceparent`, `tracestate: "a=b" + N spaces + "x"`): the time quadruples each time N doubles (see the proof of concept). Roughly 0.06 s at 10,000 characters, 1 s at 40,000, 4 s at 80,000, 9 s at 100,000 (tabs are about 1.6× slower).
Whether a server lets such a header through (header-size limits, tested): gunicorn rejects ≥ 8190 bytes (response code 431); `uvicorn --http h11` rejects above 16 KiB (400); waitress accepts up to 256 KiB (200 KB accepted, 300 KB rejected); `uvicorn --http httptools` — the default parser with `uvicorn[standard]` — accepted 300 KB, 1 MB, 5 MB and 20 MB `tracestate` headers.
## Proof of concept
### A. Show the quadratic cost (no server needed)
1. Install the API: `pip install opentelemetry-api` (any version from 1.0 up to the current main is affected).
2. Save as `poc_tracestate.py`:
```python
import logging
import time
from opentelemetry.trace.propagation.tracecontext import TraceContextTextMapPropagator
# The library logs the whole malformed member at WARNING; silence it so the timings stay readable.
logging.disable(logging.CRITICAL)
TRACEPARENT = "00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01"
propagator = TraceContextTextMapPropagator()
previous = None
for n in (10_000, 20_000, 40_000, 80_000):
# N spaces after a valid member, no comma anywhere in the header
carrier = {"traceparent": TRACEPARENT, "tracestate": "a=b" + " " * n + "x"}
start = time.perf_counter()
propagator.extract(carrier)
elapsed = time.perf_counter() - start
growth = f"x{elapsed / previous
OpenStack Ironic versions up to 39.0.1 contain a vulnerability that allows denial of service via a specially crafted configdrive. This configdrive causes a very large amount of uncompressed data to be processed, effectively acting as a gzip bomb. The vulnerability has a CVSS score of 4.3, indicating a medium severity impact focused on availability disruption.
CVE-2026-90458 is a medium severity vulnerability affecting multiple specific versions of the Ironic software package distributed in Ubuntu. The vulnerability has a CVSS 3.1 base score of 5.4, indicating a network attack vector with low complexity and requiring low privileges, resulting in limited confidentiality and integrity impacts without availability impact. No detailed description of the flaw or exploitation method is provided. There are no known exploits in the wild and no vendor patch or remediation information is available in the provided data.
CVE-2026-89419 is a medium severity vulnerability affecting multiple specific Ubuntu package versions of the Ironic project. The vulnerability has a CVSS 3.1 base score of 5.0, indicating a network attack vector with high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No detailed description of the flaw or exploitation method is provided. There are no known exploits in the wild, and no patch or remediation information is available in the provided data.
A vulnerability in the iscsiuio component of open-iscsi allows an attacker on the same network segment to poison the ARP table by sending crafted IPv6 Neighbor Advertisement packets. This occurs because the IPv6 Neighbor Discovery handler accesses link-layer address options without verifying their presence and updates the ARP table unconditionally with attacker-controlled addresses. The impact is limited to traffic redirection within the iSCSI storage network and requires adjacent network access with specific hardware. Mitigations include restricting iscsiuio interfaces to trusted Layer 2 segments and filtering ICMPv6 Neighbor Discovery messages from untrusted sources.
A vulnerability in the iscsiuio component of open-iscsi allows an attacker on the same network segment to cause a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name by sending a crafted DHCPv6 Advertise message. This occurs because the DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, leading to out-of-bounds heap reads and writes. The flaw affects systems with hardware iSCSI offload NICs where iscsiuio is active and configured.
A heap out-of-bounds read vulnerability exists in the iscsiuio component of open-iscsi due to incorrect length calculation in the DHCPv4 option parser. This flaw allows an attacker on the same network segment to send a crafted DHCP response that can crash the iscsiuio daemon or corrupt its network configuration. The vulnerability affects systems using specific iSCSI offload hardware and DHCPv4 for iSCSI boot. Mitigations include restricting untrusted systems from the Layer 2 broadcast domain or using static IP addressing if DHCP is not required.
FreeRDP versions before 3.32.1 on Windows contain a heap out-of-bounds read vulnerability. This flaw can lead to information disclosure and a denial of service condition. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.
A vulnerability in FreeIPA allows an authenticated host to improperly retrieve and revoke digital certificates assigned to other users or services. This occurs because FreeIPA verifies certificate ownership only by matching the host name to the certificate's subject Common Name (CN) without confirming actual ownership in the directory service. As a result, an enrolled host can disrupt services by revoking certificates belonging to other entities. The issue has a medium severity with a CVSS score of 5.4.
A vulnerability in Python 2.7's tarfile module allows crafted tar archives with specially crafted link entries, including symlinks with empty or directory-like names, to bypass the tar_filter protection. This can cause tarfile.extractall() with filter="tar" to write files outside the intended extraction directory, potentially leading to unauthorized file writes depending on the extracting process's permissions. This issue is related to CVE-2026-7774, which affected tarfile.data_filter.
Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the client application.
To remediate this issue, users should upgrade to aws-c-mqtt 0.16.2 or later, or to an AWS Common Runtime or AWS IoT Device SDK release that bundles it.
CFITSIO versions through 4.7.0 have an out-of-bounds write vulnerability in the ffgcls2() function within getcols.c. This flaw arises from trusting attacker-controlled heap descriptor lengths for variable-length string columns, allowing crafted FITS files to overflow a fixed 28,800-byte stack buffer and the caller's string array. The vulnerability can lead to arbitrary code execution.