CVE-2026-54580

mport , the MidnightBSD Package Manager, is vulnerable prior to version 2.7.8 in its zstd decompression handling. In libmport/util.c , the function mport_decompress_zstd() did not make every truncated, corrupt, or failed zstd stream fatal, and libmport/fetch.c did not consistently propagate those...

CVE-2026-54580: Improper Validation of Integrity Check Value

mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal in mportdecompresszstd, and libmport/fetch.c did not consistently propagate those failures to index-fetch callers. A malicious or faulty mirror could supply...