Threats Tagged 'cve-2026-34040'

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186) * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Melange version 0.56.1-r1 addresses 22 security vulnerabilities including CVE-2026-34040. This release provides important security fixes to mitigate these issues. No CVSS score is available for CVE-2026-34040 or the other vulnerabilities fixed in this version. There are no known exploits in the wild for these vulnerabilities at this time.

The spire-server-fips package version 1.15.1-r1 addresses nine security vulnerabilities including CVE-2026-34040. This release provides security fixes to mitigate these issues. No CVSS score or detailed technical impact is provided for CVE-2026-34040 specifically. There are no known exploits in the wild for this vulnerability. The affected version is exactly 1.15.1-r1.

This security update for docker-stable addresses four vulnerabilities affecting the BuildKit component and plugin privilege validation. The issues include the ability for malicious frontends to write files outside the BuildKit state directory, insufficient validation of Git URL fragments allowing access to files outside the checked-out repository, privilege validation bypass during plugin operations, and an authorization regression related to zero-length checks. These vulnerabilities are rated high severity by the SUSE Product Security Team.

Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.

Multiple security vulnerabilities affect the Pulumi package, impacting versions up to but not including 3.299.0-r0. These issues have been addressed in version 3.299.0-r0 and later releases. The vulnerabilities are rated with medium severity. No known exploits are reported in the wild. The affected package is distributed in the Alpine ecosystem.