Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: phy: Fix for accessing an empty array when the phygetinternaldelay function is called, provided that the driver calls phygetinternaldelay without defining delayvalues, and rx-internal-delay-ps or tx-internal-delay-ps is...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fixed a use-after-free in ksmbdtreeconnectput under concurrency conditions. Under high concurrency, a tree-connection object tcon is freed during a disconnection path, while another path still holds a reference to it...

CVE-2017-20285

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY does depends on th...

CVE-2017-20285 YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY does depends on th...

CVE-2017-20285

YAML versions before 1.30 for Perl are vulnerable to a flaw where a loaded document can trigger the DESTROY method of arbitrary classes. The vulnerability occurs because a perl/hash:Class tag blesses a hash into a class named in the document; when the object goes out of scope, Perl executes its d...

CVE-2017-20285

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY does depends on th...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals through external MLS commit Remove proposal validation. An attacker can evict an arbitrary group member and take over that slot in the ratche...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals through external MLS commit Remove proposal validation. An attacker can evict an arbitrary group member and take over that slot in the ratche...

DEBIAN-CVE-2026-71890

In Bouncy Castle for Java before 1.86, validation of an MLS RFC 9420 external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to d...

CVE-2026-71890

In Bouncy Castle for Java before 1.86, validation of an MLS RFC 9420 external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to d...

CVE-2026-71890

In Bouncy Castle for Java before 1.86, validation of an MLS RFC 9420 external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to d...

CVE-2026-71890

In Bouncy Castle for Java before 1.86, validation of an MLS RFC 9420 external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to d...

CVE-2026-71890 MLS external commit can remove an arbitrary group member

In Bouncy Castle for Java before 1.86, validation of an MLS RFC 9420 external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to d...

EUVD-2026-92006

In Bouncy Castle for Java before 1.86, validation of an MLS RFC 9420 external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to d...

CVE-2026-71890 MLS external commit can remove an arbitrary group member

In Bouncy Castle for Java before 1.86, validation of an MLS RFC 9420 external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to d...

CVE-2026-71890 MLS external commit can remove an arbitrary group member

In Bouncy Castle for Java before 1.86, validation of an MLS RFC 9420 external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to d...

CVE-2026-71890

Bouncy Castle for Java versions before 1.86 are vulnerable to an authorization flaw in the MLS (RFC 9420) protocol implementation. The org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals method fails to verify that a Remove proposal in an external commit belongs to the joiner. Thi...

CVE-2026-71890: Incorrect Authorization

In Bouncy Castle for Java before 1.86, validation of an MLS RFC 9420 external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the removed leaf index but never established that the removed leaf had anything to d...

Linux Distros Unpatched Vulnerability : CVE-2026-71890

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.86, validation of an MLS RFC 9420 external commit's proposal list,...

CLEANSTART-2026-LZ15854 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the consul package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...