389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration.
Security Fix(es):
A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure.(CVE-2026-11788)
A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI (Access Control Instruction) string can trigger heap-buffer-overflow writes and reads during ACI parsing. The function fails to validate that the ACI keyword has sufficient length after whitespace stripping, leading to a 1-byte out-of-bounds write and subsequent out-of-bounds reads. An authenticated user with write access to the aci attribute could send a crafted ACI value to silently corrupt heap memory in the directory server process.(CVE-2026-12528)
ImageMagick versions before 7.1.2-31 and 6.9.13-56 contain a use-after-free vulnerability in the ImagesToBlob method due to improper pointer handling. This vulnerability can cause a denial of service by crashing the affected process. The issue is fixed in versions 7.1.2-31 and 6.9.13-56. Ubuntu security advisories confirm fixes are available for affected Ubuntu LTS releases, with updates provided through standard system updates or Ubuntu Pro Extended Security Maintenance (ESM).
CVE-2026-8674 is a reachable assertion vulnerability in the GNU C Library (glibc) affecting versions 2.26 through 2.44. It occurs when the DNS stub resolver initializes from an /etc/resolv.conf file or LOCALDOMAIN environment variable with a search list containing a domain roughly 200 characters or longer. This triggers an assertion failure that aborts the process. The flaw arises because the resolver truncates the search list into a fixed-size buffer but performs a consistency check against the wrong size, causing a valid truncated list to fail the assertion. Any process performing name resolution via glibc is affected, including long-running processes that reload /etc/resolv.conf after changes. Attackers on the local network may trigger this without privileges, leveraging DHCP or VPN server configurations that update search domains.
A critical heap buffer overflow vulnerability (CVE-2026-81642) exists in the Unbound DNS resolver's DNSSEC validator when processing DNSKEY records. This flaw could lead to denial of service and potentially remote code execution. Multiple specific Unbound versions are affected. Security updates addressing this issue are available from Red Hat and SUSE with official advisories providing patching instructions.
CVE-2026-92091 is a moderate severity vulnerability in the jwcrypto library used by Red Hat Ansible Automation Platform 2. The JWK.import_key() function performs duplicate validation on the key_ops member with an inefficient O(n^2) algorithm and no limit on key_ops length. A remote unauthenticated attacker can supply a JWK with a large key_ops array to cause excessive CPU consumption, resulting in denial of service.
CVE-2026-90781 is a medium severity vulnerability in alsa-lib, a library interfacing with ALSA in the Linux kernel. It involves a stack buffer overflow caused by an off-by-one error in the __snd_ctl_ascii_elem_id_parse() function when parsing a name= field with 64 or more characters. This overflow allows overwriting one byte past a 64-byte buffer, potentially crashing the calling process. The flaw affects alsa-lib versions up to and including 1.2.16.1.
CVE-2026-77159 is a symbolic link (symlink) following vulnerability in the libvirt component of Red Hat Enterprise Linux 10. The flaw exists in the qemuTPMEmulatorPrepareHost() function, which performs a chown() operation on the swtpm logfile without verifying if the path is a symlink. A local attacker with swtpm account access can exploit this to cause libvirtd (running as root) to change ownership of arbitrary files to the swtpm user. The default SELinux enforcing mode mitigates the impact by restricting symlink creation and ownership changes.
CVE-2026-89156 is an out-of-bounds read vulnerability in the PCRE2 library's pcre2_match function triggered after a JIT fallback when invalid UTF data is provided. PCRE2 is a C library for regular expression matching with separate 8-bit, 16-bit, and 32-bit APIs. This vulnerability affects versions from 10.34 up to but not including 10.48. The CVSS score is 2.9, indicating low severity for this specific issue. Multiple related vulnerabilities in PCRE2 before 10.48 address out-of-bounds reads and writes, integer overflows, and incorrect memory frees. The vendor has fixed these issues in version 10.48.
Implementation of JOSE for C/C++
Security Fix(es):
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms (`alg` = `A128KW`, `A192KW`, `A256KW`) does not validate the length of the attacker-supplied `encrypted_key` (JWE Encrypted Key) before unwrapping it into a fixed-size, heap-allocated Content Encryption Key (CEK) buffer. A remote, unauthenticated attacker who can submit a crafted JWE to an application that decrypts it with an AES-KW symmetric key can trigger an out-of-bounds heap write, corrupting the heap. This leads at minimum to a crash (denial of service) and, depending on the heap layout and allocator, may be leverageable for further memory-corruption impact. `cjose_jwe_import()` / `cjose_jwe_decrypt()` are pre-authentication entry points: they parse and process fully attacker-controlled input. Upgrade to cjose 0.6.2.5 to receive a patch. If upgrading is not immediately possible, reject the AES Key Wrap algorithms (`A128KW`/`A192KW`/`A256KW`) for untrusted JWEs at the application layer.(CVE-2026-53938)
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm (`A128CBC-HS256`, `A192CBC-HS384`, or `A256CBC-HS512`) together with any key-management algorithm that generates a fresh content-encryption key (CEK), the CEK is all zero bytes instead of being randomly generated. The resulting JWE is therefore encrypted and authenticated under a fixed, publicly known key, so anyone who obtains the JWE can recover the plaintext and forge or modify the content. This is fixed in version 0.6.2.6 by `_cjose_jwe_set_cek_aes_cbc()` generating the CEK from `RAND_bytes`. A regression test asserts that the `encrypted_key` differs across two encryptions for each AES-CBC-HMAC variant. Until upgrading, for data encrypted with cjose, three options are available. Use an AES-GCM `enc` (`A128GCM` / `A192GCM` / `A256GCM`) instead of an AES-CBC-HMAC `enc`, use `alg=dir` with a caller-supplied CEK, or avoid using cjose for JWE encryption with the affected algorithm pair. These are mitigations for new ciphertexts only; data already encrypted under the zero key remains compromised and should be re-encrypted (and any secrets it contained rotated).(CVE-2026-53939)
Xapian is an Open Source Search Engine Library, released under the GPL v2+. It is a highly adaptable toolkit which allows developers to easily add advanced indexing and search facilities to their own applications. It has built-in support for several families of weighting models and also supports a rich set of boolean query operators.
Security Fix(es):
A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.(CVE-2026-77643)
CVE-2026-19880 is a path traversal vulnerability in QOS.CH Sarl Logback-classic (logback-classic module) affecting versions from 0.9.14 through 1.6.2. The issue arises because an MDC-based discriminator value is not sanitized before being used in a nested FileAppender path, allowing an attacker who can influence this MDC value (for example, via an HTTP header) to create or append log files outside the intended directory. This vulnerability has a medium severity rating with a CVSS score of 6.3.
A use-after-free vulnerability (CVE-2025-10729) exists in the Qt SVG module, which handles rendering and displaying SVG images. The flaw occurs when the module parses a <pattern> node not properly nested under a structural node, leading to potential use-after-free conditions. This vulnerability affects multiple versions of qt5-qtsvg and has been rated critical. A security update addressing this issue is available from Red Hat.