ML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices

Affected Crate: ml-dsa Affected Versions: v0.1.0-rc.2 and commits since b01c3b7 Severity: Medium Reporter: Oren Yomtov Fireblocks Summary The ML-DSA signature verification implementation in the RustCrypto ml-dsa crate incorrectly accepts signatures with repeated duplicate hint indices. According ...

CVE-2026-24850 ML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices

The ML-DSA crate is a Rust implementation of the Module-Lattice-Based Digital Signature Standard ML-DSA. Starting in version 0.0.4 and prior to version 0.1.0-rc.4, the ML-DSA signature verification implementation in the RustCrypto ml-dsa crate incorrectly accepts signatures with repeated duplicat...

CVE-2026-24850 ML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices

The ML-DSA crate is a Rust implementation of the Module-Lattice-Based Digital Signature Standard ML-DSA. Starting in version 0.0.4 and prior to version 0.1.0-rc.4, the ML-DSA signature verification implementation in the RustCrypto ml-dsa crate incorrectly accepts signatures with repeated duplicat...

CVE-2026-24850 ML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices

The ML-DSA crate is a Rust implementation of the Module-Lattice-Based Digital Signature Standard ML-DSA. Starting in version 0.0.4 and prior to version 0.1.0-rc.4, the ML-DSA signature verification implementation in the RustCrypto ml-dsa crate incorrectly accepts signatures with repeated duplicat...

CLSA-2026-1769542154 libxml2: Fix of CVE-2022-23308

CVE-2022-23308-fix.patch: fix undefined reference to ID variable and apply upstream regression fix to CVE-2022-23308 patch...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005172)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005172 advisory. In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix regression with module command in stacktracefilter When executing the following...

DLA-4426-2 osslsigncode - regression update

Bulletin has no description...

[SECURITY] [DSA 6102-2] python-urllib3 regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-6102-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 22, 2026 https://www.debian.org/security/faq -...

Freeform Craft Plugin CP UI (builder/integrations) has Stored Cross-Site Scripting (XSS) issue

Summary An authenticated, low-privilege user able to create/edit forms can inject arbitrary HTML/JS into the Craft Control Panel CP builder and integrations views. User-controlled form labels and integration metadata are rendered with dangerouslySetInnerHTML without sanitization, leading to store...

CLSA-2026-1769099972 httpd: Fix of 2 CVEs

CVE-2025-65082: fix CGI environment variable injection by preventing HTTP headers from overriding server-set variables and added regression tests - CVE-2025-66200: prevent suexec bypass by removing request notes usage and rejecting the undocumented RequestHeader note option...

DSA-6102-2 python-urllib3 - regression update

Bulletin has no description...

Azure Linux 3.0 Security Update: kernel (CVE-2024-50026)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-50026 advisory. - In the Linux kernel, the following vulnerability has been resolved: scsi: wd33c93: Don't use stale scsipoint...

Azure Linux 3.0 Security Update: hyperv-daemons (CVE-2024-26935)

The version of hyperv-daemons installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-26935 advisory. - In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix unremoved procfs...

MiracleLinux 8 : httpd:2.4 (AXSA:2021-2541:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2541:01 advisory. httpd: modsession: NULL pointer dereference when parsing Cookie header CVE-2021-26690 httpd: Unexpected URL matching with 'MergeSlashes OFF'...

MiracleLinux 9 : pcs-0.11.4-7.el9.ML.1 (AXSA:2023-6066:10)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-6066:10 advisory. pcs: webpack: Regression of CVE-2023-28154 fixes in the MIRACLE LINUX CVE-2023-2319 rubygem-rack: Denial of service in Multipart MIME parsing...

USN-7955-2 python-urllib3 regression

USN-7955-1 fixed vulnerabilities in urllib3. The update introduced a regression in response streaming on Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that urllib3 incorrectly handled...

USN-7955-2: urllib3 regression

USN-7955-1 fixed vulnerabilities in urllib3. The update introduced a regression in response streaming on Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that urllib3 incorrectly handled...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-004804)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004804 advisory. In the Linux kernel, the following vulnerability has been resolved: i40e: fix vf may be used uninitialized in this function warning To fix the regression introduced ...

MiracleLinux 7 : samba-4.8.3-4.el7 (AXSA:2019-3544:01)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3544:01 advisory. samba: Weak authentication protocol regression CVE-2018-1139 samba: Insufficient input validation in libsmbclient CVE-2018-10858 samba: NULL pointer...

MiracleLinux 4 : python27-python-2.7.16-6.0.1.AXS4 (AXSA:2019-3987:01)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3987:01 advisory. python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc CVE-2019-10160 python: undocumented localfile protocol...