Threats affecting pkg:generic/kimageformats

A security vulnerability identified as CVE-2026-3446 affects the miniforge3 package. The issue has been resolved in version 25.11.0.1-r6. The vulnerability has a medium severity rating with a CVSS score of 6. No known exploits are reported in the wild.

A security vulnerability was identified in the miniforge3 package and has been addressed in versions 25.11.0.1-r6 and 26.1.1.3-r4. The vulnerability has a low severity rating with a CVSS score of 1. The issue requires local access with high attack complexity and partial privileges, and user interaction is needed for exploitation. No known exploits are reported in the wild.

A security vulnerability has been identified in the miniforge3 package affecting setuptools, a Python package management tool. The flaw impacts versions prior to 25.11.0.1-r6 and has a medium severity rating with a CVSS score of 6.1. The vulnerability allows local attackers with low complexity to potentially cause high confidentiality impact with limited integrity impact, without affecting availability. A patch is available in version 25.11.0.1-r6.

A high-severity security vulnerability exists in the miniforge3 package affecting versions prior to 25.11.0.1-r6. The issue involves the setuptools package, which manages Python package operations such as downloading, building, installing, upgrading, and uninstalling. This vulnerability has a CVSS score of 8.8, indicating critical impact on confidentiality, integrity, and availability. A fix is available in version 25.11.0.1-r6.

A high-severity security vulnerability (CVE-2026-44432) affects the miniforge3 package due to an issue in urllib3, a Python HTTP client library. The vulnerability does not impact confidentiality or integrity but causes a denial of service (availability impact). Fixed versions 25.11.0.1-r6 and 26.3.2.3-r6 address the issue.

A medium severity security vulnerability (CVE-2026-44431) affects the miniforge3 package due to an issue in urllib3, a Python HTTP client library. The vulnerability impacts confidentiality but does not affect integrity or availability. Fixed versions 25.11.0.1-r6 and 26.3.2.3-r6 address the issue.

A high-severity security vulnerability (CVE-2026-97689) affects the miniforge3 package due to an issue in urllib3, a Python HTTP client library. The vulnerability impacts versions of miniforge3 prior to 25.11.0.1-r6 and 26.3.2.3-r6. A fix is available in these versions. No known exploits in the wild have been reported.

A security vulnerability has been identified in the miniforge3 package affecting the urllib3 HTTP client library for Python. The flaw impacts versions prior to 25.11.0.1-r6 and 26.3.2.3-r6. It has a medium severity rating with a CVSS score of 6.9. A patch is available in versions 25.11.0.1-r6 and 26.3.2.3-r6.

A high-severity security vulnerability (CVE-2026-97687) affects the miniforge3 package, specifically the urllib3 HTTP client library for Python. The flaw impacts versions prior to 25.11.0.1-r6 and 26.3.2.3-r6. A fix has been released in these versions to address the issue.

A high-severity security vulnerability affecting the miniforge3 package was identified and fixed in version 25.11.0.1-r6. The vulnerability does not impact confidentiality or integrity but causes a significant availability impact. The issue is resolved in the fixed release 25.11.0.1-r6.

A high-severity security vulnerability (CVE-2026-57585) affects the miniforge3 package, specifically in the MessagePack serializer implementation for Python msgpack. The vulnerability impacts versions prior to 25.11.0.1-r6 and can cause a denial of service (availability impact) without compromising confidentiality or integrity. A patch is available in version 25.11.0.1-r6.

A high-severity security vulnerability (CVE-2026-114613) affects the miniforge3 package, specifically in the MessagePack serializer implementation for Python msgpack. The vulnerability has no impact on confidentiality or integrity but causes high impact on availability. Fixed versions have been released to address this issue.

CVE-2026-113602 is a medium severity security vulnerability affecting the elasticsearch package due to an issue in the json-smart library through version 2. The vulnerability does not impact confidentiality or availability but allows integrity loss. It affects elasticsearch versions prior to 9.2.8-r13. A patch is available in version 9.2.8-r13 to address this issue.

A security vulnerability in Elasticsearch versions prior to 9.2.8-r13 involves the Reactor Netty WebSocket client potentially leaking credentials during WebSocket handshake redirects to a different origin. This issue has been assigned CVE-2026-47848 and carries a medium severity rating with a CVSS score of 6.1. The vulnerability is fixed in version 9.2.8-r13.

A security vulnerability in Elasticsearch affects versions prior to 9.2.8-r13. The issue arises when the Reactor Netty HTTP Server incorrectly evaluates the remote IP address in specific scenarios where the HAProxy Protocol is enabled. This flaw can lead to incorrect handling of client IP information.

A security vulnerability in Elasticsearch affects versions prior to 9.2.8-r13. In specific scenarios where multiple clients have different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver. This can lead to limited impact on integrity without affecting confidentiality or availability. The issue has been fixed in version 9.2.8-r13.

A medium severity vulnerability in Elasticsearch occurs when a client sends HTTP/1 requests. This flaw affects versions prior to 9.2.8-r13 and can cause availability impact without compromising confidentiality or integrity.

A high-severity vulnerability in Elasticsearch affects versions prior to 9.2.8-r13. The issue lies in the Smile parser component of the FasterXML jackson-dataformats-binary library, which fails to invoke StreamReadConstraints. This flaw can lead to denial of service conditions due to the inability to enforce stream read limits.

A security vulnerability in the elasticsearch package involves a CBOR-parsing issue in the jackson-dataformats-binary CBOR module. Specifically, an unbounded run of CBOR tags causes quadratic-time growth in the TagList, leading to CPU and garbage collection exhaustion, resulting in a denial-of-service condition. This vulnerability is confirmed with proof-of-concept. It affects versions prior to 9.2.8-r13 and has a high severity rating with a CVSS score of 7.5. A patch is available in version 9.2.8-r13.

A security vulnerability exists in the Elasticsearch package where the CBOR parser in the FasterXML jackson-dataformats-binary library fails to invoke StreamReadConstraints. This flaw affects versions prior to 9.2.8-r13 and can cause a denial of service condition. The issue has been assigned CVE-2026-68495 and is rated with a high severity score of 7.5. A fix is available in version 9.2.8-r13.