Security update for apr-util

This update for apr-util fixes the following issues: CVE-2025-49506: leaking content via side channel timing attack bsc1274237. CVE-2026-32327: XML stack recursion crash bsc1274235. CVE-2026-34191: SQL Injection via aprdbdoracle bsc1274850. CVE-2026-34501: heap buffer overflow in redis client...

CLSA-2026-1792519677 apr-util: Fix of 2 CVEs

CVE-2026-32327: apr-util: stack recursion crash parsing deeply nested XML in aprxmlquoteelem - CVE-2026-34502: apr-util: heap buffer overflow in the APR memcached client...

CLSA-2026-1792441390 apr-util: Fix of 2 CVEs

CVE-2026-32327: apr-util: stack recursion crash parsing deeply nested XML in aprxmlquoteelem - CVE-2026-34502: apr-util: heap buffer overflow in the APR memcached client...

SUSE-SU-2026:3937-1 Security update for apr-util

This update for apr-util fixes the following issues: - CVE-2022-25147: buffer overflow possible with specially crafted input bsc1207866. - CVE-2025-49506: leaking content via side channel timing attack bsc1274237. - CVE-2026-32327: XML stack recursion crash bsc1274235. - CVE-2026-34191: SQL...

MGASA-2026-0364 Updated apr-util packages fix security vulnerabilities

Apache Portable Runtime Utility: aprpasswordvalidate vulnerable to timing attack. CVE-2025-49506 Apache Portable Runtime Utility: apr-util XML stack recursion crash. CVE-2026-32327 Apache Portable Runtime Utility: SQL Injection in aprdbdoracle. CVE-2026-34191 Apache Portable Runtime Utility: Heap...

openSUSE 16: apr-util-devel / libapr-util1-0 / libapr-util1-0-dbd-mysql / etc (openSUSE-SU-2026:21672-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21672-1 advisory. - CVE-2025-49506: hash/password content leak via side channel timing attack against aprpasswordvalidate bsc1274237. - CVE-2026-32327: XML stack...

SUSE-SU-2026:23551-1 Security update for apr-util

This update for apr-util fixes the following issues: - CVE-2025-49506: hash/password content leak via side channel timing attack against aprpasswordvalidate bsc1274237. - CVE-2026-32327: XML stack recursion crash bsc1274235. - CVE-2026-34191: SQL injection via aprdbdoracle bsc1274850. -...

Security update for apr-util

This update for apr-util fixes the following issues: CVE-2025-49506: hash/password content leak via side channel timing attack against aprpasswordvalidate bsc1274237. CVE-2026-32327: XML stack recursion crash bsc1274235. CVE-2026-34191: SQL injection via aprdbdoracle bsc1274850. CVE-2026-34501:...

CLSA-2026-1787141541 Fix CVE(s): CVE-2026-32327, CVE-2026-34501, CVE-2026-34502

SECURITY UPDATE: heap buffer overflow in the memcached client - debian/patches/CVE-2026-34502.patch: validate CRLF line termination and response lengths in memcache/aprmemcache.c - CVE-2026-34502 SECURITY UPDATE: heap buffer overflow in the redis client - debian/patches/CVE-2026-34501.patch: boun...

CLSA-2026-1786495987 apr-util: Fix of 2 CVEs

CVE-2026-32327: apr-util: stack recursion crash parsing deeply nested XML in aprxmlquoteelem - CVE-2026-34502: apr-util: heap buffer overflow in the APR memcached client...

OESA-2026-3294 python-zeroconf security update

Pure Python Multicast DNS Service Discovery Library Bonjour/Avahi compatible Security Fixes: Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIncoming.decodelabelsatoffset recurses once per DNS-name compression pointer, and a single mDNS packet...

K000162775: PHP Phar vulnerability CVE-2026-7260

Security Advisory Description Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9. CVE-2026-7260 Impac...

Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2026-2043)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2043 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24...

Critical: php8.4

Issue Overview: Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9. CVE-2026-17543 Attacker-provided inputs to bccomp could lea...

FreeBSD : Erlang/OTP -- TLS denial of service using invalid certificate chains (445d3f14-89e1-11f1-b35c-4c526214c986)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 445d3f14-89e1-11f1-b35c-4c526214c986 advisory. https://github.com/erlang/otp/security/advisories/GHSA-r5jr-mq46-vmhw reports: A TLS/DTLS peer can cras...

CVE-2026-59927

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py detects only direct self-includes and not indirect cycles, allowing two markdown files that include each other to trigger unbounded recursion, raise...

CVE-2026-41434

OP-TEE is a Trusted Execution Environment TEE designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.10.0 and prior to version 4.11.0, an unbounded recursion can crash the PKCS11 TA. Version 4.11.0 contains a patch. ...

EUVD-2026-41893

OP-TEE is a Trusted Execution Environment TEE designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.10.0 and prior to version 4.11.0, an unbounded recursion can crash the PKCS11 TA. Version 4.11.0 contains a patch. ...

Security update for avahi

This update for avahi fixes the following issue: CVE-2026-24401: uncontrolled recursion in lookuphandlecname can crash the avahi-daemon bsc1257235. CVE-2026-34933: reachable assertion in transportflagsfromdomain can crash the avahi-daemon bsc1261546. Patch Instructions: To install this SUSE updat...

SUSE-SU-2026:2311-1 Security update for avahi

This update for avahi fixes the following issue: - CVE-2026-24401: uncontrolled recursion in lookuphandlecname can crash the avahi-daemon bsc1257235. - CVE-2026-34933: reachable assertion in transportflagsfromdomain can crash the avahi-daemon bsc1261546...