CVE-2026-62979

A flaw was found in jack. The application serializes internal error objects directly into HTTP error responses without redacting outbound request headers. An authenticated remote user can trigger an error on specific endpoints to cause the disclosure of sensitive credentials, including internal A...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: ASoC: nau8821: Cancel delayed work on component remove Attempting to unload the driver while a jack detection work is pending would likely crash the kernel when it is eventually scheduled for execution: 1984.896308 BUG: unable to...

CVE-2026-62979

jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, middleware/handle-error.ts serializes raw FetchError objects into HTTP responses. lib/servers/base.ts attaches outbound request headers on upstream non-success responses and schema-validation...

CVE-2026-62979 jack: upstream error responses expose backend and peer credentials

jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, middleware/handle-error.ts serializes raw FetchError objects into HTTP responses. lib/servers/base.ts attaches outbound request headers on upstream non-success responses and schema-validation...

EUVD-2026-114471

jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, middleware/handle-error.ts serializes raw FetchError objects into HTTP responses. lib/servers/base.ts attaches outbound request headers on upstream non-success responses and schema-validation...

CVE-2026-62979

The jack application (a tool for sharing Radarr/Sonarr media libraries) is vulnerable to sensitive information exposure in versions prior to 0.1.0 . The root cause is that middleware/handle-error.ts serializes raw FetchError objects into HTTP responses. Because the extras field in lib/errors/Fetc...

CVE-2026-62979 jack: upstream error responses expose backend and peer credentials

jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, middleware/handle-error.ts serializes raw FetchError objects into HTTP responses. lib/servers/base.ts attaches outbound request headers on upstream non-success responses and schema-validation...

CVE-2026-62979 jack: upstream error responses expose backend and peer credentials

jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, middleware/handle-error.ts serializes raw FetchError objects into HTTP responses. lib/servers/base.ts attaches outbound request headers on upstream non-success responses and schema-validation...

CVE-2026-62979: roziscoding jack: jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer

jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, middleware/handle-error.ts serializes raw FetchError objects into HTTP responses. lib/servers/base.ts attaches outbound request headers on upstream non-success responses and schema-validation...

PT-2026-134214

jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, middleware/handle-error.ts serializes raw FetchError objects into HTTP responses. lib/servers/base.ts attaches outbound request headers on upstream non-success responses and schema-validation...

Jack Lloyd Botan encryption issue vulnerability

Versions 3.7.0 through 3.13.0 of Jack Lloyd Botan contain an encryption-related vulnerability. This flaw arises because AutoSeededRNG, when processing an empty output buffer without seeding, fails to consult its configured entropy source; as a result, it marks itself as seeded. Additionally, the...

Jack Lloyd Botan encryption issue vulnerability

Versions 1.11.34 through 3.13.0 of Jack Lloyd Botan contain an encryption-related vulnerability. This vulnerability arises because the ocspcheck command fails to validate the signature or authorization of the response when it receives an OCSP response from a certificate’s Authority Information...

Jack Lloyd Botan input validation error vulnerability

Versions of Jack Lloyd Botan from 1.11.22 up to but not including 3.13.0 contain an input validation error vulnerability. This vulnerability arises because Python’s binding fails to consistently reject embedded NUL characters when converting a Python string containing U+0000 into a const char. As...

Jack Lloyd Botan server-side request forgery vulnerability

Versions prior to Jack Lloyd Botan 3.13.0 contain a server-side request forgery vulnerability. This vulnerability arises because their online OCSP client allows a single HTTP redirect when sending OCSP requests to URIs within the Certificate Authority Information Access extension. Malicious OCSP...

Jack Lloyd Botan buffer error vulnerability

Versions 2.1.0 through 3.13.0 of Jack Lloyd Botan contain a security vulnerability. This vulnerability arises because the Botan C API function botanblockcipherblocksize fails to perform boundary checks when converting a sizet block size to an int. In applications that receive external algorithm...

DEBIAN-CVE-2026-98770

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix the jack descriptor array sizes The jack in/out descriptor arrays in struct fmidi2usbconfig have the size of MAXCABLES, which look reasonable -- but it turned out to be incorrect. Namely, the entries for...

UBUNTU-CVE-2026-98770

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix the jack descriptor array sizes The jack in/out descriptor arrays in struct fmidi2usbconfig have the size of MAXCABLES, which look reasonable -- but it turned out to be incorrect. Namely, the entries for...

CVE-2026-98770 usb: gadget: midi2: Fix the jack descriptor array sizes

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix the jack descriptor array sizes The jack in/out descriptor arrays in struct fmidi2usbconfig have the size of MAXCABLES, which look reasonable -- but it turned out to be incorrect. Namely, the entries for...

CVE-2026-98770 usb: gadget: midi2: Fix the jack descriptor array sizes

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix the jack descriptor array sizes The jack in/out descriptor arrays in struct fmidi2usbconfig have the size of MAXCABLES, which look reasonable -- but it turned out to be incorrect. Namely, the entries for...

CVE-2026-98770

The Linux kernel contains a vulnerability in the usb gadget midi2 component. Specifically, the jack_ins and jack_outs descriptor arrays in struct f_midi2_usb_config were incorrectly sized to MAX_CABLES. Because entries are added from both inputs and outputs during loop cycles, the arrays actually...