A concurrency issue in the Linux kernel's cxgb4/ch_ktls component was fixed by disabling softirqs around tid_list erases. The flaw involved improper locking when erasing entries from a shared XArray, which could lead to deadlocks due to softirq interruptions during cleanup. The issue affects specific Linux kernel versions prior to 5.11, between 5.12.9 and 5.13, and version 5.13 itself.
This update for mozilla-nss, MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 153.5.1 ESR (MFSA 2026-112, bsc#1286385):
- CVE-2026-113470: Cryptographic issue in the Security Block-lists, Allow-lists, and other State component
(bsc#1286261).
PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and run_command() do not fail closed. They silently fall back to SubprocessSandbox(self.config). That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite network=False. This issue has been patched in version 4.6.61.
PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.61, PraisonAI recipe execution has a dangerous-tool policy that is supposed to block default-denied tools unless the caller explicitly passes allow_dangerous_tools=True. That policy only checks tools declared in TEMPLATE.yaml requires.tools. For steps-based recipes, the actual execution path loads workflow.yaml with YAMLWorkflowParser. That parser resolves agent-level tools: declarations and preserves top-level approve:. Workflow.start() then installs those YAML-approved tools into the approval context. As a result, an untrusted recipe can omit execute_command from TEMPLATE.yaml requires.tools, declare it in workflow.yaml agents.*.tools, and add top-level approve: [execute_command]. The caller did not set allow_dangerous_tools=True, but the recipe policy allows the recipe and the workflow approval path self-approves the critical shell tool. This issue has been patched in version 4.6.61.
PraisonAI is a multi-agent teams system. From version 0.1.4 to before version 0.1.5 in praisonai-platform, a workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. A single malicious or compromised member account can wipe an entire workspace's content irreversibly. This issue has been patched in version 0.1.5.
PraisonAI is a multi-agent teams system. From version 4.5.126 to before version 4.6.59, PraisonAI's Async Jobs API validates webhook_url when a job request is parsed and again when the internal Job object is constructed. That validation blocks direct loopback/private targets, but it is not bound to the later network request. When a job completes, _send_webhook() passes the original hostname to httpx.AsyncClient.post() with no send-time validation, IP pinning, or guarded transport. An attacker-controlled hostname can therefore resolve to a public IP during Pydantic validation and later resolve to loopback/private/cloud-metadata infrastructure during webhook delivery. This bypasses the intended SSRF guard in current supported releases. This appears to be an incomplete fix / patch bypass for GHSA-8frj-8q3m-xhgm. This issue has been patched in version 4.6.59.
CVE-2026-56836 is an improper authentication vulnerability in MervinPraison PraisonAI affecting versions from 4.5.112 up to but not including 4.6.59. The issue arises because the Recipe HTTP server can be started on a non-localhost interface without authentication, allowing unauthenticated access to the recipe API and potentially the /admin/reload endpoint. This vulnerability has been patched in version 4.6.59.
CVE-2026-98870 is a use-after-free vulnerability in the Linux kernel's ksmbd component affecting versions from 5.15.222 up to but not including 5.16. The flaw occurs because stale channels are not properly removed from all sessions during connection teardown, leading to dereferencing freed memory and leaking session resources. This vulnerability has been fixed in Linux kernel version 5.16 and later.
## Summary
`TraceState.from_header` splits the inbound W3C `tracestate` header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs O(N²) CPU. A single unauthenticated request with a ~100 KB `tracestate` keeps the handling worker busy for ~6 s (spaces) to ~12 s (tabs); under an asyncio server it blocks every other connection for that time.
## Affected component / version
- Package: `opentelemetry-api` (pip) — `opentelemetry/trace/span.py` (`TraceState.from_header`), reached from `opentelemetry/trace/propagation/tracecontext.py` (`TraceContextTextMapPropagator.extract`).
- Confirmed in `main` (5e8083e8) and in the v1.44.0 and v1.45.0 tags; the same pattern is present back to v1.0.0 (introduced by #1599, March 2021). Not exhaustively verified against every release in between.
- Reachable with the default propagators (`OTEL_PROPAGATORS` defaults to `tracecontext,baggage`) from any server instrumentation that calls `propagate.extract()`, for example `opentelemetry-instrumentation-asgi`.
## Details
1. The header reaches the parser without any length check:
```python
# opentelemetry-api/src/opentelemetry/trace/propagation/tracecontext.py:57
tracestate_headers = getter.get(carrier, self._TRACESTATE_HEADER_NAME) # <-- attacker-controlled request header(s), any size
if tracestate_headers is None:
tracestate = None
else:
tracestate = TraceState.from_header(tracestate_headers) # <-- no length check before parsing (line 61)
```
2. The split pattern and the parser:
```python
# opentelemetry-api/src/opentelemetry/trace/span.py:45
_TRACECONTEXT_MAXIMUM_TRACESTATE_KEYS = 32 # <-- only enforced later, in TraceState.__init__, after the split
_delimiter_pattern = re.compile(r"[ \t]*,[ \t]*") # <-- (line 46) starts with an unbounded [ \t]*
# span.py:382
@classmethod
def from_header(cls, header_list: list[str]) -> TraceState:
pairs = {} # type: dict[str, str]
for header in header_list:
members: list[str] = re.split(_delimiter_pattern, header) # <-- (line 400) VULNERABLE: O(N^2) on "a=b" + " " * N + "x"
for member in members:
if not member:
continue
match = _member_pattern.fullmatch(member)
if not match:
_logger.warning( # <-- also logs the entire malformed member (up to the whole header)
"Member doesn't match the w3c identifiers format %s",
member,
)
return cls()
...
```
`re.split` tries the pattern at every offset. At each offset inside a whitespace run, `[ \t]*` consumes the rest of the run, finds no `,`, backtracks and fails, then the engine moves one character forward and repeats. N characters × up to N steps each = O(N²). The 32-member limit never gets a chance to run because `split` has to finish first.
3. The sibling propagator already has the missing guard:
```python
# baggage/propagation/__init__.py:68
_MAX_HEADER_LENGTH = 8192
...
if len(header.encode()) > self._MAX_HEADER_LENGTH: # <-- (line 93) rejected before any regex runs; tracestate has no equivalent
_logger.warning(...)
return context
```
A 16 KiB header costs ≈ 0.25 s and an 8 KiB header ≈ 0.07 s.
Measured cost of `extract()` on one core (valid `traceparent`, `tracestate: "a=b" + N spaces + "x"`): the time quadruples each time N doubles (see the proof of concept). Roughly 0.06 s at 10,000 characters, 1 s at 40,000, 4 s at 80,000, 9 s at 100,000 (tabs are about 1.6× slower).
Whether a server lets such a header through (header-size limits, tested): gunicorn rejects ≥ 8190 bytes (response code 431); `uvicorn --http h11` rejects above 16 KiB (400); waitress accepts up to 256 KiB (200 KB accepted, 300 KB rejected); `uvicorn --http httptools` — the default parser with `uvicorn[standard]` — accepted 300 KB, 1 MB, 5 MB and 20 MB `tracestate` headers.
## Proof of concept
### A. Show the quadratic cost (no server needed)
1. Install the API: `pip install opentelemetry-api` (any version from 1.0 up to the current main is affected).
2. Save as `poc_tracestate.py`:
```python
import logging
import time
from opentelemetry.trace.propagation.tracecontext import TraceContextTextMapPropagator
# The library logs the whole malformed member at WARNING; silence it so the timings stay readable.
logging.disable(logging.CRITICAL)
TRACEPARENT = "00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01"
propagator = TraceContextTextMapPropagator()
previous = None
for n in (10_000, 20_000, 40_000, 80_000):
# N spaces after a valid member, no comma anywhere in the header
carrier = {"traceparent": TRACEPARENT, "tracestate": "a=b" + " " * n + "x"}
start = time.perf_counter()
propagator.extract(carrier)
elapsed = time.perf_counter() - start
growth = f"x{elapsed / previous
CVE-2026-25784 is a critical vulnerability in Hallo Welt! GmbH BlueSpice container images (versions 5.2.3 up to but not including 5.2.7). It arises from an insecure default initialization of the $mwsgTokenAuthenticatorServiceCIDR setting, which disables IP restrictions on internal service authentication if the related environment variable is unset. This allows any user with read access, including anonymous users on public wikis, to obtain an application token via the REST API and escalate privileges to sysop level.
Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete call UserManager::blockUser() and UserManager::unblockUser(), which do not verify the permissions of the acting user. This allows locking out all administrators (denial of service) and lifting blocks imposed by administrators.
This issue affects BlueSpice: from 5.0.0 before 5.1.11, from 5.2.0 before 5.2.7.
When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup. An attacker with access to log files can steal the credentials and use the proxy as the user who configured the proxy settings. The issue has been fixed in LTS versions 5.8.4 and 5.12.0 and later.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign Participants Database participants-database allows Blind SQL Injection.This issue affects Participants Database: from n/a through 2.7.8.5.
Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5.
The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option change to the whole multisite network, nor restrict which option may be changed, allowing a site administrator who is not a Super Admin to create or overwrite network-wide options.
The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages, which could allow high-privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).
A vulnerability in @rog0x/mcp-docker-tools version 1.0.1 allows remote attackers to execute arbitrary code via the handleImageList function. This issue has a high severity with a CVSS score of 7.5. The vulnerability requires user interaction and has a high attack complexity. No affected versions beyond 1.0.1 are explicitly stated, and no patch or remediation information is provided.
Incus versions before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contain an arbitrary file write vulnerability in the sftpRecursivePullFile function. This flaw allows a malicious incus-agent with root privileges inside a virtual machine to escape the intended target directory during recursive file pulls, potentially writing attacker-controlled files such as /etc/shadow on the host system.
Mistune versions before 3.3.0 have a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by using ../ sequences in include paths. Additionally, attackers can inject HTML through unescaped error messages and included file contents, enabling cross-site scripting (XSS) even when escape=True is set. This vulnerability has a high severity with a CVSS score of 7.5.
Mistune versions from 3.0.0 up to but not including 3.3.0 contain an algorithmic complexity vulnerability in the inline link parser's parse_link_text function. This flaw allows unauthenticated attackers to cause high CPU usage by submitting Markdown with many unbalanced '[' or '![' characters, resulting in repeated unbounded forward scans that can tie up worker processes for minutes. The vulnerability has a high severity with a CVSS score of 7.5.