MGASA-2026-0188 Updated jq packages fix security vulnerabilities

An integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. CVE-2024-23337 It was discovered that jq did not correctly handle certain string concatenations. An attacker could possibly use this issue to cause a denial of...

TencentOS Server 4: php (TSSA-2026:0342)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0342 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2025-14179

A flaw was found in PHP. The PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat, which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens...

CVE-2026-23863

An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename to be shown in the application as one type of file but run as an executable when opened. We have not seen evidence of...

Security update for jq

This update for jq fixes the following issue CVE-2026-33948: CLI input parsing may allow validation bypass via embedded NUL bytes bsc1262043 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you ca...

net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows

A flaw was found in the net package of Go golang. When running on Windows, the Dial and LookupPort functions can panic if they receive an input containing a NUL 0 byte. This can be triggered by a remote attacker providing a specially crafted input, leading to a denial of service DoS for...

net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows

A flaw was found in the net package of Go golang. When running on Windows, the Dial and LookupPort functions can panic if they receive an input containing a NUL 0 byte. This can be triggered by a remote attacker providing a specially crafted input, leading to a denial of service DoS for...

net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows

A flaw was found in the net package of Go golang. When running on Windows, the Dial and LookupPort functions can panic if they receive an input containing a NUL 0 byte. This can be triggered by a remote attacker providing a specially crafted input, leading to a denial of service DoS for...

net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows

A flaw was found in the net package of Go golang. When running on Windows, the Dial and LookupPort functions can panic if they receive an input containing a NUL 0 byte. This can be triggered by a remote attacker providing a specially crafted input, leading to a denial of service DoS for...

net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows

A flaw was found in the net package of Go golang. When running on Windows, the Dial and LookupPort functions can panic if they receive an input containing a NUL 0 byte. This can be triggered by a remote attacker providing a specially crafted input, leading to a denial of service DoS for...

SUSE-SU-2026:2092-1 Security update for go1.26-openssl

This update for go1.26-openssl fixes the following issues Security issues: - CVE-2026-33811: net: crash when handling long CNAME response bsc1264508. - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1264506. - CVE-2026-39817: cmd/go: 'go tool...

SUSE-SU-2026:2079-1 Security update for go1.25-openssl

This update for go1.25-openssl fixes the following issues Security issues: - CVE-2026-33811: net: crash when handling long CNAME response bsc1264508. - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1264506. - CVE-2026-39817: cmd/go: 'go tool...

CVE-2026-6104

A flaw was found in PHP. When an encoding name containing an embedded NUL byte is passed to mbconvertencoding or related mbstring functions, an out-of-bounds read of only 1 byte can occur due to the incorrect processing of string lengths. This issue can cause a denial of service or limited...

gnutls: gnutls: Authentication Bypass via NUL Character in Username

A flaw was found in gnutls. Servers configured with RSA-PSK Rivest–Shamir–Adleman – Pre-Shared Key wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass...

CLSA-2026-1779462193 Fix CVE(s): CVE-2026-33515

SECURITY UPDATE: out-of-bounds read when handling malformed ICP traffic - debian/patches/CVE-2026-33515.patch: validate ICP packet sizes and URLs in icpGetUrl; reject non-NUL-terminated URLs, URLs with embedded NULs or trailing garbage; guard icpHandleUdp against a nil icpOutgoingConn pointer -...

OESA-2026-2425 jq security update

jq is a lightweight and flexible command-line JSON processor. you can use it to slice and filter and map and transform structured data. It is written in portable C, and it has zero runtime dependencies. it can mangle the data format that you have into the one that you want. Security Fixes: jq is ...

CLSA-2026-1779272835 gnutls: Fix of CVE-2026-42010

CVE-2026-42010: fix RSA-PSK identity truncation allowing authentication bypass via NUL byte in client-supplied username...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ice: Ensure that the copied buffer is terminated with NUL characters. Currently, we allocate a kernel buffer of a certain size and copy a certain number of bytes from user space to that buffer. Later, we use sscanf on this buffer...

Astra Linux – Vulnerability in PHP 7.3

In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26, and 8.0.x below 8.0.13, certain XML parsing functions, such as simplexmlloadfile, decode the filename passed to them using URL encoding. If the filename contains a URL-encoded NUL character, this may cause the function to interpret this as t...

Astra Linux – Vulnerability in openssl, openssl1.0

ASN.1 strings are internally represented within OpenSSL as an ASN1STRING structure, which contains a buffer for storing the string data and a field for storing the buffer length. This is different from regular C strings, which are represented as a buffer for the string data, terminated with a NUL...