Search: 13.3-13

CVE-2026-76933 is a critical heap-based buffer overflow vulnerability in Hitachi JP1/Automatic Job Management System 3 - Manager and Agent components. It affects versions from 10-00 up to but not including 13-50-31. The flaw allows remote attackers to execute code or cause denial of service without requiring privileges or user interaction. A fix is available in version 13-50-31.

CVE-2026-86577 is a critical out-of-bounds write vulnerability affecting multiple Hitachi JP1 products, including JP1/Integrated Management 3 - Manager and JP1/Automatic Job Management System 3 components. The flaw exists in versions from 13-00 up to but not including 13-50-31 for Integrated Management and Automatic Job Management System 3, and from 11-00 up to but not including 12-50-54 for JP1/Base. This vulnerability can lead to high confidentiality and integrity impact, with some availability impact. Fixed versions are available.

CVE-2026-86576 is a critical heap-based buffer overflow vulnerability affecting multiple Hitachi JP1 products, including JP1/Integrated Management 3 - Manager and JP1/Automatic Job Management System 3 components. The flaw exists in versions from 13-00 up to but not including 13-50-31 for Integrated Management and Automatic Job Management System Managers and Agents, and from 11-00 up to but not including 12-50-54 for JP1/Base. This vulnerability allows an unauthenticated remote attacker to execute arbitrary code with high impact on confidentiality and integrity, and a low impact on availability. Fixed versions are available for all affected products.

CVE-2026-86575 is a critical stack-based buffer overflow vulnerability affecting multiple Hitachi JP1 products, including JP1/Integrated Management 3 - Manager and JP1/Automatic Job Management System 3 components. The flaw exists in versions from 13-00 up to but not including 13-50-31 for Integrated Management and Automatic Job Management System, and from 11-00 up to but not including 12-50-54 for JP1/Base. This vulnerability allows an unauthenticated attacker to execute arbitrary code with high impact on confidentiality and integrity, and a low impact on availability. Fixed versions are available for all affected products.

### Summary `qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains `&` (or the configured `delimiter`), `=`, or `#` therefore becomes query string syntax instead of data, so a caller-supplied key name can add parameters to the serialized query string, or cut it short. ### Details In `lib/stringify.js`, the `allowEmptyArrays` branch returns `adjustedPrefix + '[]'` early, before the code that passes every other key through `encoder` and `formatter`. So `{ "x&k=v": ["1"] }` serializes as `x%26k%3Dv%5B0%5D=1`, but `{ "x&k=v": [] }` serializes as `x&k=v[]`. The early return applies at any depth (`{ "a": { "b&k=v": [] } }` gives `a[b&k=v][]`), under every `arrayFormat`, with `allowDots`, and with a custom `encoder`, which is never called for that key. With `encode: false` or `encodeValuesOnly: true`, keys are intentionally left unencoded on every path; those configurations are not affected. #### PoC ```js var qs = require("qs"); var query = qs.stringify({ q: "hi", "x&apiKey=evil&y": [] }, { allowEmptyArrays: true }); // "q=hi&x&apiKey=evil&y[]" qs.parse(query); // { q: "hi", x: "", apiKey: "evil", y: [""] } qs.stringify({ "x#": [], z: "1" }, { allowEmptyArrays: true }); // "x#[]&z=1": in a URL, everything after "#" becomes the fragment ``` #### Fix Applied in 234d505 on `main` and released as v6.17.0, and backported to v6.16.2, v6.15.4, v6.14.3, v6.13.4, and v6.12.6: the key of an empty array goes through `encoder` and `formatter` exactly as the key of any other value does, so `{ "x&apiKey=evil&y": [] }` now serializes as `x%26apiKey%3Devil%26y[]`. Keys that need no encoding serialize as before, with two exceptions that match every other path: the brackets of a nested key are now encoded (`a[b][]` becomes `a%5Bb%5D[]`, which `qs.parse` reads identically), and with `encodeDotInKeys`, a dot in the key becomes `%252E` instead of `%2E` (which `decodeDotInKeys` previously misread as nesting). ### Affected versions - `>=6.12.0 <6.12.6`, fixed in v6.12.6 - `>=6.13.0 <6.13.4`, fixed in v6.13.4 - `>=6.14.0 <6.14.3`, fixed in v6.14.3 - `>=6.15.0 <6.15.4`, fixed in v6.15.4 - `>=6.16.0 <6.16.2`, fixed in v6.16.2 v6.17.0 and later are not affected. `allowEmptyArrays` was introduced in f22b2bc and first shipped in v6.12.0, with this early return. Earlier versions have no `allowEmptyArrays` option and are not affected. ### Impact An application that passes an object whose key names come from untrusted input to `qs.stringify` with `allowEmptyArrays: true` (for example, to forward a parsed JSON body or user-selected fields to an upstream service) can have parameters injected into the resulting query string. The injected parameters are not keys of the object, so deleting or overwriting a key on the object (such as setting a trusted `apiKey` after copying the user's fields) does not remove them; whether the attacker's value or the application's wins depends on how the receiving side handles a duplicate parameter. A `#` in such a key ends the query string early when the result is placed in a URL. `allowEmptyArrays` is off by default, and only keys whose value (after any `filter`) is an empty array are affected.

Multiple security issues were addressed in the python313-uv-0.13.6-1.1 package on the GA media of openSUSE Tumbleweed. These fixes resolve vulnerabilities present in prior versions of the package.

Multiple security issues were addressed in the libyang-devel-3.13.6-4.1 package for openSUSE Tumbleweed. These fixes resolve vulnerabilities present in earlier versions of the libyang-devel package. No specific details about the nature of the vulnerabilities or their impact are provided.

Multiple security issues were addressed in the k3sup-0.13.14-1.1 package distributed on the GA media of openSUSE Tumbleweed. The update resolves these vulnerabilities to improve the security posture of the affected software.

CVE-2026-116589 is a high-severity vulnerability in DataDog's Python APM client dd-trace-py affecting versions from 3.13.0 up to but not including 4.15.5. The issue arises from improper handling of certain internal errors in the IAST string-processing instrumentation when old-style % string formatting processes attacker-controlled input. This can cause an unhandled exception that terminates the Python process, disrupting application operation. Exploitation requires IAST to be enabled, which is not the default setting, and the application to apply the vulnerable formatting to attacker-controlled input. The vulnerability is fixed in version 4.15.5.

The jose_jwk:shared_secret/2 function in the jose library derives an ECDH shared secret from two JSON Web Keys (JWKs). A flaw in its implementation causes an unbounded tail-recursive loop when the two JWKs have differing key types, such as an EC key and an RSA key. This loop consumes 100% CPU on an Erlang scheduler, leading to denial of service when exploited repeatedly. The vulnerability affects jose versions from 1.5.0 before 1.11.13.

A vulnerability in the potatosalad jose (erlang-jose) library allows remote attackers to exhaust a node's memory by sending a crafted JWE token with highly compressed data. The decompression function does not limit output size, enabling data amplification that can crash the BEAM runtime and cause denial of service. This affects versions from 1.0.0 before 1.11.13.

A Bleichenbacher padding oracle vulnerability exists in the pure-Erlang RSAES-PKCS1-v1_5 decryption implementation in the jose_jwa_pkcs1 module. The vulnerability allows an unauthenticated attacker with access to a decryption endpoint using RSA1_5 padding to recover plaintext or forge signatures through adaptive chosen-ciphertext queries. This affects jose versions from 1.3.0 before 1.11.13.

The jose library's pure-Erlang AES-GCM fallback implementation in jose_jwa_aes improperly derives the number of verified authentication tag bits from the attacker-supplied tag without validating its length. This allows an attacker controlling a JWE token to truncate the authentication tag to as few as 8 bits, drastically reducing forgery resistance and enabling reliable forgery within 256 attempts. Supplying an overly long tag causes a crash. This vulnerability affects versions from 1.2.0 before 1.11.13.

CVE-2026-65630 is a timing side-channel vulnerability in the potatosalad jose library's pure-Erlang X25519 implementation. The vulnerability allows an attacker to recover a long-term X25519 private key by measuring decryption timing variations during scalar multiplication. This affects versions from 1.10.0 up to but not including 1.11.13. The issue is fixed in version 1.11.13.

The jose library versions from 1.0.0 up to but not including 1.11.13 improperly verify ECDSA JWS signatures by accepting signatures of non-canonical length. This signature malleability allows multiple distinct signature byte strings to verify as valid for the same token, defeating security controls that rely on signature uniqueness such as token revocation by hash, replay caches, and deduplication. The underlying cryptographic signature values (r, s) remain unchanged, so forging new payloads or impersonating signers is not possible. A fix is available in version 1.11.13.

CVE-2026-65631 is an inefficient algorithmic complexity vulnerability in the potatosalad jose library versions from 1.7.7 up to but not including 1.11.13. It allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting a crafted RSA JSON Web Key that triggers expensive factoring operations. The issue is fixed in version 1.11.13.