Search: 10.4-5

The golang packages provide the Go programming language compiler. Security Fix(es): * golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.10+1 [rhel-9.4.z] (JIRA:RHEL-287196) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2026-109619 is a high-severity vulnerability in PHP where internal request state can persist after its backing memory has been freed. This stale state may be used by a later request handled by the same worker before it is properly reinitialized, potentially allowing remote code execution. The issue affects multiple PHP versions across various Ubuntu releases. Official patches are available and should be applied to mitigate the risk.

A critical vulnerability in PHP (CVE-2026-109618) involves improper handling of out-of-memory conditions during request processing, which can cause PHP to crash or execute arbitrary code. This occurs because internal request data may be only partially initialized when interrupted, leading to invalid data being treated as valid during cleanup. The issue affects multiple PHP versions across various Ubuntu releases. Fixes are available and should be applied via standard system updates.

A high-severity vulnerability (CVE-2026-97313) affecting specific versions of Bind9 has been published. The vulnerability has a CVSS 3.1 score of 7.5, indicating a network attack vector with low complexity and no privileges or user interaction required, resulting in high impact on availability but no impact on confidentiality or integrity. A security update addressing this vulnerability is available for the affected Bind9 versions.

A high severity vulnerability (CVE-2026-96888) affecting multiple specific versions of Bind9 has been published. The vulnerability has a CVSS 3.1 score of 7.5, indicating a network exploitable issue with no required privileges or user interaction, causing a high impact on availability. This security update addresses the flaw in the affected Bind9 versions.

A high severity vulnerability (CVE-2026-19630) affecting specific versions of Bind9 has been published. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a network attack vector with low complexity and no privileges or user interaction required. The impact is limited to availability, with no confidentiality or integrity impact reported. Multiple specific Ubuntu package versions of Bind9 are affected.

The pure Python HTTP parser used in AIOHTTP versions 3.4.2 up to but not including 3.10.0 is vulnerable to HTTP request smuggling attacks. This vulnerability affects applications using the Python parser, typically when the environment variable AIOHTTP_NO_EXTENSIONS is set or when a non-standard wheel is installed. The issue is resolved in version 3.10.0 by switching to the default C parser.

Multiple vulnerabilities in aiohttp versions 3.4.2 up to but not including 3.10.0 allow an attacker to cause excessive or unbounded memory and CPU usage via specially crafted requests, leading to resource exhaustion.

AIOHTTP versions from 3.4.2 up to but not including 3.10.0 contain a vulnerability where an overflow in Max-Age processing can cause connections to remain open, leading to temporary exhaustion of the connection pool. This issue is fixed in version 3.10.0.

CVE-2026-105923 is a vulnerability in the qtbase-opensource-src-gles component where a malicious SVG file can trigger an integer overflow, leading to a null-pointer dereference in the VectorImage QML Type. This flaw has a medium severity score of 6.7 and affects multiple specific versions of the qtbase-opensource-src-gles package. The vulnerability requires local access to exploit and involves user interaction. No known exploits are reported in the wild.

NLnet Labs Unbound up to and including version 1.26.1 contains a vulnerability identified as CVE-2026-109125. The vulnerability has a medium severity with a CVSS score of 5.3. It involves an observable issue that impacts the integrity of the system but does not affect confidentiality or availability. The affected versions include multiple specific builds primarily related to Ubuntu distributions. No public exploit code or known exploitation in the wild has been reported.

NLnet Labs Unbound versions from 1.22.0 up to and including 1.26.1 contain a vulnerability identified as CVE-2026-97206. This vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, and affects multiple Ubuntu package versions. The flaw does not impact confidentiality or integrity but results in a high impact on availability.

CVE-2026-96405 is a medium severity vulnerability affecting NLnet Labs Unbound versions up to and including 1.26.1. The vulnerability relates to limitations in compression handling, causing an availability impact without compromising confidentiality or integrity. No known exploits are reported in the wild. The affected versions include specific Ubuntu package versions of Unbound. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a moderate risk primarily due to potential denial of service.

A vulnerability exists in NLnet Labs Unbound up to and including version 1.26.1, affecting specific Ubuntu package versions. The flaw has a CVSS 3.1 base score of 6.5, indicating medium severity. It does not impact confidentiality but can cause integrity loss and high availability impact. No public exploits or known active exploitation are reported. The exact technical details of the vulnerability are not provided in the available data.

A low-severity vulnerability identified as CVE-2026-35501 affects NLnet Labs Unbound versions from 1.0.1 up to and including 1.26.1. The vulnerability has a CVSS score of 3.7, indicating low impact, with no confidentiality or availability impact but limited integrity impact. The affected versions include specific Ubuntu package versions of Unbound. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in geekontheroad Live Summary for Gravity Forms live-summary-for-gravity-forms allows Reflected XSS.This issue affects Live Summary for Gravity Forms: from n/a through 1.2.10.

Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and calls execl("/vendor/bin/sh", "sh", "-c", cmd, NULL) with a caller-supplied command string. The only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribute, any uid-0 process in any of those domains (including dumpstate, which is reachable from an unprivileged app via Vulnerability 1) obtains arbitrary command execution. The spawned shell lands in u:r:vendor_qti_init_shell:s0 SELinux context via a policy type_transition, a domain holding all Linux capabilities. This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.