UBUNTU-CVE-2026-93925

Stack-based buffer overflow, Incorrect bitwise shift of integer vulnerability in Apache Thrift C++ THeaderProtocol. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

UBUNTU-CVE-2026-91135

Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as...

CLSA-2026-1790939353 TuxCare security update for devalue (1 CVE)

TuxCare rebuilt devalue to address 1 CVE. Fixed in 5.9.0-tuxcare.2...

ai.chatur:cortex-core (>=0.0.1, <=0.1.4), ai.chatur:cortex-spring-boot-autoconfigure (>=0.0.1, <=0.1.4) +2224 more potentially affected by CVE-2026-61373 via org.apache.thrift:libthrift (>=0.14.0, <=0.24.0)

org.apache.thrift:libthrift MAVEN version =0.14.0, =0.0.1, =0.0.1, =0.0.1, =3.10.0.5, =6.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =5.0.1, =1.2.0, =1.2.0, =2.0.0 - be.ugent.solidlab:shapeshift 0.0.1 and more Source cves: CVE-2026-61373 Source advisory: MEND:CVE-2026-61373...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the C GLib bindings. An attacker can cause the application to crash by sending specially crafted input that triggers excessive nested function calls, leading to stack...

0lever-utils (>=0.1.0, <=0.1.6), airavata-python-sdk-test (>=0.0.1, <=0.0.8) +164 more potentially affected by CVE-2026-85494 via thrift (>=0.9.2, <=0.24.0)

thrift PYPI version =0.9.2, =0.1.0, =0.0.1, =1.0.1, =0.6.6, =2.7.0rc1, =0.0.32, =0.1.9, =0.1.0, =4.0.5a1, =0.0.1, =1.0.1, =1.0.3 and more Source cves: CVE-2026-85494 Source advisory: SNYK:PYTHON-THRIFT-20417151...

0lever-utils (>=0.1.0, <=0.1.6), airavata-python-sdk-test (>=0.0.1, <=0.0.8) +164 more potentially affected by CVE-2026-85494 via thrift (>=0.9.2, <=0.24.0)

thrift PYPI version =0.9.2, =0.1.0, =0.0.1, =1.0.1, =0.6.6, =2.7.0rc1, =0.0.32, =0.1.9, =0.1.0, =4.0.5a1, =0.0.1, =1.0.1, =1.0.3 and more Source cves: CVE-2026-85494 Source advisory: MEND:CVE-2026-85494...

Improper Handling of Length Parameter Inconsistency

Overview Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency via improper message handling in language bindings. An attacker can cause application crashes or excessive resource consumption by sending specially crafted requests. Remediation Upgra...

CLSA-2026-1790937673 TuxCare security update for vm2 (7 CVEs)

TuxCare rebuilt vm2 to address 7 CVEs. Fixed in 3.10.0-tuxcare.2...

CLSA-2026-1790937670 TuxCare security update for piscina (1 CVE)

TuxCare rebuilt piscina to address 1 CVE. Fixed in 4.6.1-tuxcare.2...

CLSA-2026-1790937659 TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.15-tuxcare.3...

CLSA-2026-1790937656 TuxCare security update for devalue (4 CVEs)

TuxCare rebuilt devalue to address 4 CVEs. Fixed in 5.9.1-tuxcare.1...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write via the THeaderProtocol. An attacker can cause the application to crash by sending specially crafted input that triggers a stack-based buffer overflow. Remediation Upgrade thrift to version 0.25.0 or higher. Referenc...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Dart bindings when processing input with inconsistent length parameters. An attacker can cause excessive memory allocation by sending specially crafted input, potentially...

ai.h2o:sparkling-water-core_2.11 (>=3.46.0.1-1-2.3, <=3.46.0.6-1-2.4), ai.h2o:sparkling-water-core_2.12 (>=3.46.0.1-1-3.0, <=3.46.0.6-1-3.5) +599 more potentially affected by CVE-2026-103885 via org.apache.directory.api:api-ldap-model (>=2.1.0, <=2.1.8)

org.apache.directory.api:api-ldap-model MAVEN version =2.1.0, =3.46.0.1-1-2.3, =3.46.0.1-1-3.0, =3.46.0.1-1-2.3, =3.46.0.1-1-3.0, =3.46.0.1-1-2.3, =3.46.0.1-1-3.0, =3.46.0.1-1-2.3, =3.46.0.1-1-3.0, =2.0.20, =4.0.2 - com.google.appengine:appengine-local-runtime-jetty12 2.0.23 -...

be.personify.iam:personify-provisioning (>=1.3.1.release, <=1.5.8.release), be.personify.iam:personify-scim-server (>=1.2.6.release, <=2.1.2.release) +31 more potentially affected by CVE-2026-103877 via org.apache.directory.api:api-all (>=2.1.0, <=2.1.8)

org.apache.directory.api:api-all MAVEN version =2.1.0, =1.3.1.release, =1.2.6.release, =3.0.0, =1.0.9, =1.6.9, =1.2.5, =1.1.7, =0.8.2, =1.2.15, =1.0.10, =4.3.2, =4.1.16, =4.1.17, =4.1.17, =4.4.5 and more Source cves: CVE-2026-103877 Source advisory: MEND:CVE-2026-103877...

ai.h2o:sparkling-water-core_2.11 (>=3.46.0.1-1-2.3, <=3.46.0.6-1-2.4), ai.h2o:sparkling-water-core_2.12 (>=3.46.0.1-1-3.0, <=3.46.0.6-1-3.5) +599 more potentially affected by CVE-2026-103880 via org.apache.directory.api:api-ldap-model (>=2.1.0, <=2.1.8)

org.apache.directory.api:api-ldap-model MAVEN version =2.1.0, =3.46.0.1-1-2.3, =3.46.0.1-1-3.0, =3.46.0.1-1-2.3, =3.46.0.1-1-3.0, =3.46.0.1-1-2.3, =3.46.0.1-1-3.0, =3.46.0.1-1-2.3, =3.46.0.1-1-3.0, =2.0.20, =4.0.2 - com.google.appengine:appengine-local-runtime-jetty12 2.0.23 -...

be.personify.iam:personify-provisioning (>=1.3.1.release, <=1.5.8.release), be.personify.iam:personify-scim-server (>=1.2.6.release, <=2.1.2.release) +31 more potentially affected by CVE-2026-103880 via org.apache.directory.api:api-all (>=2.1.0, <=2.1.8)

org.apache.directory.api:api-all MAVEN version =2.1.0, =1.3.1.release, =1.2.6.release, =3.0.0, =1.0.9, =1.6.9, =1.2.5, =1.1.7, =0.8.2, =1.2.15, =1.0.10, =4.3.2, =4.1.16, =4.1.17, =4.1.17, =4.4.5 and more Source cves: CVE-2026-103880 Source advisory: MEND:CVE-2026-103880...

io.github.bkoehm:apacheds-embedded (0.6), org.apache.camel.karaf:camel-ldif (>=4.14.5, <=4.18.4) +56 more potentially affected by CVE-2026-103878 via org.apache.directory.api:api-ldap-client-api (>=2.1.0, <=2.1.8)

org.apache.directory.api:api-ldap-client-api MAVEN version =2.1.0, =4.14.5, =3.26.0, =3.26.0, =4.14.0, =4.14.0, =2.1.0, =2.1.0, =2.1.0, =2.1.8 - org.apache.directory.server:apacheds-core 2.0.0.am27 - org.apache.directory.server:apacheds-core-annotations 2.0.0.am27 -...

be.personify.iam:personify-provisioning (>=1.3.1.release, <=1.5.8.release), be.personify.iam:personify-scim-server (>=1.2.6.release, <=2.1.2.release) +31 more potentially affected by CVE-2026-103878 via org.apache.directory.api:api-all (>=2.1.0, <=2.1.8)

org.apache.directory.api:api-all MAVEN version =2.1.0, =1.3.1.release, =1.2.6.release, =3.0.0, =1.0.9, =1.6.9, =1.2.5, =1.1.7, =0.8.2, =1.2.15, =1.0.10, =4.3.2, =4.1.16, =4.1.17, =4.1.17, =4.4.5 and more Source cves: CVE-2026-103878 Source advisory: MEND:CVE-2026-103878...