CVE-2026-54586

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchindex, mportfetchbootstrapindex, and mportfetchbundle paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a urlishttps enforcement check. When a cleartext URL was configured or returned by...

CVE-2026-54583

mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index data could place an unsafe value in indexEntry-bundlefile, an...

CVE-2026-54579 mport mirror-selection ping accepts insufficiently validated ICMP replies

mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping in libmport/ping.c accepted ICMP replies without validating icmpid or icmpseq and parsed the reply using a fixed IP-header offset instead of iphl. A network attacker able to inject or spoof visible ICMP replies could influence mirror...

CVE-2026-54579 mport mirror-selection ping accepts insufficiently validated ICMP replies

mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping in libmport/ping.c accepted ICMP replies without validating icmpid or icmpseq and parsed the reply using a fixed IP-header offset instead of iphl. A network attacker able to inject or spoof visible ICMP replies could influence mirror...

CVE-2026-54579 mport mirror-selection ping accepts insufficiently validated ICMP replies

mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping in libmport/ping.c accepted ICMP replies without validating icmpid or icmpseq and parsed the reply using a fixed IP-header offset instead of iphl. A network attacker able to inject or spoof visible ICMP replies could influence mirror...

EUVD-2026-82324

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchindex, mportfetchbootstrapindex, and mportfetchbundle paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a urlishttps enforcement check. When a cleartext URL was configured or returned by...

CVE-2026-54586 mport permits repository and package mirror fetches over insecure transport

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchindex, mportfetchbootstrapindex, and mportfetchbundle paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a urlishttps enforcement check. When a cleartext URL was configured or returned by...

CVE-2026-54586 mport permits repository and package mirror fetches over insecure transport

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchindex, mportfetchbootstrapindex, and mportfetchbundle paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a urlishttps enforcement check. When a cleartext URL was configured or returned by...

CVE-2026-54580 mport index decompression can leave partial or corrupt index data after zstd failures

mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal in mportdecompresszstd, and libmport/fetch.c did not consistently propagate those failures to index-fetch callers. A malicious or faulty mirror could supply...

CVE-2026-54580 mport index decompression can leave partial or corrupt index data after zstd failures

mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal in mportdecompresszstd, and libmport/fetch.c did not consistently propagate those failures to index-fetch callers. A malicious or faulty mirror could supply...

CVE-2026-54583

mport , the MidnightBSD Package Manager, had an insufficient input-validation flaw in libmport/fetch.c prior to version 2.7.8. The missing is_valid_bundle_filename() checks failed to reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths...

CVE-2026-54583 mport package bundle downloads allow unsafe destination filenames

mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index data could place an unsafe value in indexEntry-bundlefile, an...

PT-2026-95010

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The MidnightBSD Package Manager contains a flaw where the do actual install function in libmport/bundle read install pkg.c utilizes path-based lstat, chown, stat, and chmod operations during package...

CVE-2026-54576: Improper Link Resolution Before File Access

mport is the MidnightBSD Package Manager. Prior to 2.7.8, doactualinstall in libmport/bundlereadinstallpkg.c used path-based lstat, chown, stat, and chmod operations while installing package files. A local attacker with write access to a target directory could replace a checked file with a symlin...

PT-2026-95013

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The MidnightBSD Package Manager fails to treat all truncated, corrupt, or failed zstd streams as fatal within the mport decompress zstd function. Additionally, the libmport/fetch.c component does not...

PT-2026-95012

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The ping function in libmport/ping.c fails to validate icmp id or icmp seq when accepting ICMP replies and uses a fixed IP-header offset instead of ip hl for parsing. A network attacker capable of...

CVE-2026-54583: Improper Limitation of a Pathname to a Restricted Directory

mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index data could place an unsafe value in indexEntry-bundlefile, an...

CVE-2026-54579: Out-of-bounds Read

mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping in libmport/ping.c accepted ICMP replies without validating icmpid or icmpseq and parsed the reply using a fixed IP-header offset instead of iphl. A network attacker able to inject or spoof visible ICMP replies could influence mirror...

CVE-2026-54587: Improper Link Resolution Before File Access

mport is the MidnightBSD Package Manager. Prior to 2.7.8, directory assets handled as ASSETDIR or ASSETDIROWNERMODE in libmport/bundlereadinstallpkg.c used path-based mportmkdirp, ownership, and permission operations. A local attacker able to modify part of the target installation tree could use...

CVE-2026-54581: Insufficient Verification of Data Authenticity

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchbootstrapindex function in libmport/fetch.c could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or...