GHSA-V3J6-27VC-7PW2 ImageMagick: Policy Bypass in APNG encoder and delegates due to a missing check

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path...

GHSA-56M6-8Q75-F2RW ImageMagick: Policy Bypass due to an incomplete fix of CVE-2026-49219

An incomplete fix of CVE-2026-49219 could result in a policy bypass...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to an incomplete fix in the policy. An attacker can gain unauthorized access to restricted functionality or data by bypassing intended security policies. Remediation A fix was pushed into the master branch bu...

ImageMagick: Policy Bypass due to an incomplete fix of CVE-2026-49219

An incomplete fix of CVE-2026-49219 could result in a policy bypass...

ImageMagick: Policy Bypass possible with matrix-backed operations

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed...

GHSA-RVHP-75F6-9JQH ImageMagick: Policy Bypass possible with matrix-backed operations

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed...

ImageMagick: Policy Bypass in concatenate operation due to missing checks

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy...

GHSA-82MP-VP5C-9PF7 ImageMagick: Policy Bypass in concatenate operation due to missing checks

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy...

EUVD-2026-41112

ImageMagick: Policy Bypass in concatenate operation due to missing checks...

CVE-2026-66144

Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes this issue by imposing a default maximu...

CVE-2026-66143

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue...

CVE-2026-66142

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes th...

CVE-2026-66144

CVE-2026-66144 concerns Apache Neethi: remote PolicyReference fetch lacks resource bounds during policy normalization. If a policy is retrieved in full via the API, a large policy can trigger a denial of service. The issue is mitigated by upgrading to version 3.2.3, which enforces a default maxim...

EUVD-2026-48583

Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes this issue by imposing a default maximu...

CVE-2026-66144

Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes this issue by imposing a default maximu...

CVE-2026-66144 Apache Neethi: Remote PolicyReference fetch lacks resource bounds

Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes this issue by imposing a default maximu...

EUVD-2026-48579

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue...

CVE-2026-66143 Apache Neethi: Missing global alternative-output budget across policy computation paths

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue...

CVE-2026-66143 Apache Neethi: Missing global alternative-output budget across policy computation paths

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue...

CVE-2026-66143

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue...