CVE-2026-68497

A flaw was found in jackson-databind. An unauthenticated attacker can trigger a denial of service DoS by exploiting an unbounded numeric parse vulnerability. This occurs during the deserialization of javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar fields from JSON strings,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Tracing: Fixed a race condition between CPU buffer write and swapping. A warning occurred in rbendcommit at the following line of code: if RBWARNONcpubuffer, !localread&cpubuffer-committing WARNING: CPU: 0 PID: 139 at...

Astra Linux – Vulnerability in libpgjava

pgjdbc is an open-source PostgreSQL JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc was vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server could instruct the driver to perform SCRAM authentication with a very large iteration...

Astra Linux – Vulnerability in libxstream-java

XStream is an open-source Java library for serializing objects to XML and back. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% of the CPU time on the target system, depending on the CPU type or through parallel execution of such operations. This can lead to a denial of...

Astra Linux – Vulnerability in dovecot

A mail message containing an excessive number of RFC 2231 MIME parameters causes LMTP to consume too much CPU resources. A properly formatted mail message prevents the mail delivery process from consuming excessive CPU time. Use MTA capabilities to limit the number of RFC 2231 MIME parameters in...

Astra Linux – Vulnerability in cairosvg

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG, there was exponential denial of service due to recursive elements being amplified in the cairosvg/defs.py file. This caused CPU exhaustion with even small inputs...

Astra Linux – Vulnerability in dovecot

The attacker can upload a malicious Sieve script through the ManageSieve service or locally to bypass the configured CPU time limits for Sieve up to 130 times the configured limit. This allows the attacker to degrade server performance and bypass the configured CPU time limits for Sieve scripts. ...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom: fixed a memory leak in the error path. If, for some reason, the speedbin length is incorrect, then there is a memory leak in the error path, as we never free the speedbin buffer. This commit fixes this issue by...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: spi: Fixed a use-after-free issue during controller registration failures. Be sure to also deregister from the driver core in case the per-cpu statistics allocation fails during controller registration, in order to avoid...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: AppArmor: Fixed the rlimit settings for posix cpu timers. posix cpu timers require an additional step beyond simply setting rlimit. The code should be refactored so it’s clear which code is setting the limits, and the posix cp...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: sched/rt: The function rtonextcpu should now properly handle situations where only CPU0 is overloaded. In such cases, rtonextcpu should ideally return -1, indicating that no further IPIs are needed. The vulnerability arises when...

Astra Linux – Vulnerability in python-urllib3

urllib3 is a user-friendly HTTP client library for Python. Starting from version 1.24 and before 2.6.0, the number of links in the decompression chain was unbounded, allowing a malicious server to insert virtually an unlimited number of compression steps. This led to high CPU usage and massive...

Astra Linux – Vulnerability in freeipa

A flaw was discovered in all IPA versions ranging from 4.x.x to 4.8.0. When sending a very long password = 1,000,000 characters to the server, the password hashing process could exhaust memory and CPU resources, resulting in a denial of service and making the website unresponsive. The greatest...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: msm8998: Fixed the latency and residency issues during CPU/L2 idle states. The entry/exit latency and minimum residency in the idle states of the MSM8998 device were incorrect. Firstly, the timings were set for...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: perf: Fixed list corruption in perfcgroupswitch. There is list corruption in cgrpcpuctxlist. This occurs at the following path: perfcgroupswitch: listforeachentrycgrpcpuctxlist cpuctxschedin ctxschedin ctxpinnedschedin...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Netfilter: Use getrandomu32 instead of prandom. This issue may occur during the update of per-cpu rndstate from the user context, i.e., at the localout path. BUG: Using smpprocessorid in preemptible 00000000 code: nginx/2725...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fixed an oops during rmmod on single-CPU platforms. During the removal of the idxd driver, a registered offline callback was invoked as part of the cleanup process. However, on systems with only one CPU online, n...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: media: rc: gpio-ir-recv: added/removed functions If runtime PM is enabled, perform runtime PM cleanup to remove the cpu latency QoS request. Otherwise, driver removal may result in the following kernel dump: 19.463299 Unable t...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net/iucv: Fixed the size of interrupt data iucvirqdata needs to be 4 bytes larger. These bytes are not used by the iucv module, but are written by the z/VM hypervisor in case a CPU is deconfigured. Reported as: BUG...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: kthread: Unpark only parks kthreads. Calling kthreadunpark unconditionally is mostly harmless when the kthread is already unparked. In that case, the wake-up call is simply ignored because the task is not in the TASKPARKED state...