CVE-2026-63072

🔐 CVE-2026-63072 — OpenSSL CMS ヒープバッファオーバーフロー OpenSSL の CMS キーラップ解除機能に影響を及ぼすヒープベースの領域外書き込みであるCVE-2026-63072 の技術的分析。 📌 概要 CVE-2026-63072 は、OpenSSL の CMS（Cryptographic Message Syntax） 実装における ヒープベースのバッファオーバーフロー の脆弱性です。 この脆弱性は、影響を受ける AES-WRAP-PAD キーラップ解除パスを使用して、特別に細工された CMS メッセージを処理する際にトリガーされる可能性がありま...

Rocky Linux 10.1 [CIQ] Security Update: openssl / openssl-debuginfo / openssl-debugsource / openssl-devel / etc (crlsa-2025_21248)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202521248 advisory. openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap CVE-2025-9230 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9 [CIQ] Security Update: openssl / openssl-debuginfo / openssl-debugsource / openssl-devel / etc (crlsa-2025_21255)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202521255 advisory. openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap CVE-2025-9230 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9 [CIQ] Security Update: edk2-aarch64 / edk2-debugsource / edk2-ovmf / edk2-tools / etc (crlsa-2026_2776)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20262776 advisory. openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap CVE-2025-9230 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 8 [CIQ] Security Update: edk2-aarch64 / edk2-ovmf (crlsa-2026_36721)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202636721 advisory. openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap CVE-2025-9230 Bug Fixes and Enhancements: FJ8.10 Bug How to Update Secure Boot Certificates with Microso...

CVE-2026-32641 Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middleware

Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap while parsing the x-amz-firehose-common-attributes header before authentication. A remote unauthenticated attacker can supply non-UTF-8 header data,...

EUVD-2026-83265

Parseable is a log analytics platform built for high-volume data ingestion and analysis. Prior to 3.0.0, src/handlers/http/middleware.rs uses unwrap while parsing the x-amz-firehose-common-attributes header before authentication. A remote unauthenticated attacker can supply non-UTF-8 header data,...

CVE-2026-54541

Nimiq core-rs-albatross (≤ 1.5.1) contains a denial-of-service vulnerability in the TrieProof verification path used during state sync. A malicious sync peer can send a crafted TrieChunk containing two TrieProofNode values with identical keys, triggering an unconditional unwrap() on KeyNibbles::g...

EUVD-2026-77576

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk proof containing two TrieProofNode values with identical keys. TrieProof::verify call...

CVE-2026-54541 Nimiq: Panic in TrieProof::verify via child_index unwrap on equal-length keys

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk proof containing two TrieProofNode values with identical keys. TrieProof::verify call...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: usb: gadget: feem: Fixed a memory leak in eemunwrap. The existing code did not handle the failure case of usbepqueue in the command path, potentially leading to memory leaks. Improved error handling to free all allocated...

Astra Linux – Vulnerability in Heimdal, Samba

A heap-based buffer overflow vulnerability was discovered in Samba, specifically within the GSSAPI unwrapdes and unwrapdes3 routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow for a length-limited write buffer overflow on memory allocated by malloc,...

CVE-2026-89541

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gssunwrapresppriv length checks gssunwrapresppriv validates the RPCSECGSS opaque length with offset = u8 p - u8 head-iovbase; if offset + opaquelen rcvbuf-len goto unwrapfailed; majstat = gssunwrapctx-gcgssctx,...

UBUNTU-CVE-2026-89550

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauthgss: enforce krb5 token minimum length svcauthgssunwrappriv validates only an upper bound on the wire-supplied opaque length before handing the buffer to gssunwrap: if len xdrstreamremainingxdr goto unwrapfailed;...

CVE-2026-89551 SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: xdrbuftrim: clamp buf-len to avoid underflow xdrbuftrim trims len bytes from the tail of an xdrbuf by walking the tail, pages, and head iovecs. Each per-section step uses mint so it never removes more bytes than that...

EUVD-2026-76461

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauthgss: enforce krb5 token minimum length svcauthgssunwrappriv validates only an upper bound on the wire-supplied opaque length before handing the buffer to gssunwrap: if len xdrstreamremainingxdr goto unwrapfailed;...

EUVD-2026-76452

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gssunwrapresppriv length checks gssunwrapresppriv validates the RPCSECGSS opaque length with offset = u8 p - u8 head-iovbase; if offset + opaquelen rcvbuf-len goto unwrapfailed; majstat = gssunwrapctx-gcgssctx,...

PT-2026-96479

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss krb5 unwrap v2 against short tokens gss krb5 unwrap v2 reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSS KRB5 TOK HDR LEN 16 bytes long, and its rotate left...

PT-2026-96600

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss unwrap resp priv length checks gss unwrap resp priv validates the RPCSEC GSS opaque length with offset = u8 p - u8 head-iov base; if offset + opaque len rcv buf-len goto unwrap failed; maj stat = gss unwrapctx-...

PT-2026-90266

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SUNRPC component where the svcauth gss unwrap priv function only validates the upper bound of the wire-supplied opaque length len before passing the buffer to gss...