AZL-91248 CVE-2026-11972 affecting package python3 for versions less than 3.12.9-14

When using the "tarfile" module with a file opened in "streaming mode" mode="r|" the tarfile module did not properly handle EOF, making archive parsing take exponentially longer...

AZL-91170 CVE-2026-57062 affecting package gnupg2 for versions less than 2.4.9-3

CMS Cryptographic Message Syntax parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182...

AZL-91260 CVE-2026-0864 affecting package python3 for versions less than 3.12.9-14

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters \r the resulting file could be injected with unexpected keys and values if the attacker controls the written value...

AZL-90216 CVE-2026-56114 affecting package dhcpcd for versions less than 10.0.8-2

dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6makemessage in src/dhcp6.c that allows unauthenticated same-link attackers to write beyond a fixed local buffer by serializing an oversized RFC6603 OPTIONPDEXCLUDE option body...

AZL-90222 CVE-2026-56117 affecting package dhcpcd for versions less than 10.0.8-2

dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attackers can connect to the control socket...

AZL-90213 CVE-2026-56113 affecting package dhcpcd for versions less than 10.0.8-4

dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTIONPDEXCLUDE and both preferred and valid lifetimes set to zero. Attackers actin...

AZL-90219 CVE-2026-56116 affecting package dhcpcd for versions less than 10.0.8-2

dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send...

AZL-91164 CVE-2026-12969 affecting package dnsmasq for versions less than 2.93-1

An out-of-bounds read vulnerability exists in dnsmasq's findsoa function in src/rfc1035.c. When parsing NS section records, extractname is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can...

AZL-91197 CVE-2026-55655 affecting package openssh 9.8p1-10

A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack ca...

AZL-91200 CVE-2026-55653 affecting package openssh 9.8p1-10

A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange DH-GEX client path. This occurs during FIPS Federal Information Processing Standards mode known-group validation when the client processes attacker-controlled DH-GEX...

AZL-91362 CVE-2026-44889 affecting package python-webob for versions less than 1.8.10-1

WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to the request URI using Python's urljoin, and since Python 3.10 the underlying urlsplit stri...

AZL-91284 CVE-2026-47242 affecting package ruby 3.3.5-10

Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to 0.6.5 and 0.5.15, when Net::IMAPid is called with a hash argument, although the ID field value strings are correctly quoted escaping quoted specials, they were not validated to prohibit CRLF sequence...

AZL-91281 CVE-2026-47240 affecting package ruby 3.3.5-10

Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a "raw data" argument that is sent verbatim after validation to prevent command injection. However, if a server does not support non-synchronizing...

AZL-91206 CVE-2026-48931 affecting package nodejs for versions less than 24.17.0-1

A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26...

AZL-90204 CVE-2026-56109 affecting package alsa-lib for versions less than 1.2.16.1-1

The Advanced Linux Sound Architecture ALSA library before 1.2.16.1 contains a double-free vulnerability in parsedef in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parsedef...

AZL-90671 CVE-2026-54277 affecting package python-aiohttp 3.6.2-3

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the maxlinesize check in parts of an HTTP request in the C parser. If using the optimised C parser the default in pre-built wheels, then an attacker may be able to send...

AZL-90662 CVE-2026-54280 affecting package python-aiohttp 3.6.2-3

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause...

AZL-90650 CVE-2026-54273 affecting package python-aiohttp 3.6.2-3

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS. This...

AZL-90656 CVE-2026-50269 affecting package python-aiohttp 3.6.2-3

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing...

AZL-91167 CVE-2026-12725 affecting package dnsmasq for versions less than 2.93-1

A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply su...

AZL-90246 CVE-2026-56411 affecting package expat for versions less than 2.8.2-1

xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations...

AZL-90255 CVE-2026-56412 affecting package expat for versions less than 2.8.2-1

libexpat before 2.8.2 does not consider XMLTOKDATACHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219...

AZL-90225 CVE-2026-56408 affecting package expat for versions less than 2.8.2-1

libexpat before 2.8.2 has an integer overflow in copyString...

AZL-90249 CVE-2026-56409 affecting package expat for versions less than 2.8.2-1

xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used...

AZL-90252 CVE-2026-56410 affecting package expat for versions less than 2.8.2-1

xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId...

AZL-90237 CVE-2026-56407 affecting package expat for versions less than 2.8.2-1

libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen...

AZL-90228 CVE-2026-56405 affecting package expat for versions less than 2.8.2-1

libexpat before 2.8.2 has an integer overflow in getAttributeId...

AZL-90234 CVE-2026-56406 affecting package expat for versions less than 2.8.2-1

libexpat before 2.8.2 has an integer overflow in XMLParseBuffer because it lacked a check that was present in XMLParse...

AZL-90231 CVE-2026-56404 affecting package expat for versions less than 2.8.2-1

libexpat before 2.8.2 has an integer overflow in addBinding...

AZL-90240 CVE-2026-56403 affecting package expat for versions less than 2.8.2-1

libexpat before 2.8.2 has an integer overflow in storeAtts...

AZL-91275 CVE-2026-48715 affecting package radvd for versions less than 2.21-1

radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the radvdump utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, printff copies up to 2032 bytes from attacker-controlled...

AZL-91272 CVE-2026-3196 affecting package qemu for versions less than 9.1.0-10

An integer overflow vulnerability was found in the virtio-snd device via PCMINFO requests from the guest. A malicious guest can provide out-of-bounds stream counts, potentially leading to unbounded memory allocation on the host and a denial of service condition...

AZL-91269 CVE-2026-3195 affecting package qemu for versions less than 9.1.0-9

A flaw was found in QEMU. When reading input audio in the virtio-snd device input callback, the virtiosndpcmincb function did not check whether the iov could fit the data buffer, potentially leading to a heap out-of-bounds write. This issue exists due to an incomplete fix for CVE-2024-7730...

AZL-91370 CVE-2026-52909 affecting package kernel for versions less than 6.6.144.1-1

In the Linux kernel, the following vulnerability has been resolved: ip6vti: set netnsimmutable on the fallback device. john1988 and Noam Rathaus reported that vti6initnet does not set the netnsimmutable flag on the per-netns fallback tunnel device ip6vti0. Other similar tunnel drivers like...

AZL-90258 CVE-2026-56131 affecting package expat for versions less than 2.8.2-1

libexpat before 2.8.2 lacks handler call depth tracking for calls to XMLResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur similar to the CVE-2026-50219 situation...

AZL-90243 CVE-2026-56132 affecting package expat for versions less than 2.8.2-1

In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers...

AZL-90936 CVE-2025-15661 affecting package libssh2 for versions less than 1.11.1-4

libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftpsymlink function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted SSHFXPNAME response...

AZL-91127 CVE-2026-48937 affecting package nodejs for versions less than 24.17.0-1

A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a GOAWAY frame. This vulnerability affects two supported release lines: Node.js 22 and Node.js 24...

AZL-90200 CVE-2026-55392 affecting package nilfs-utils 2.2.11-4

NILFS utilities through 2.3.0, fixed in commit 26efb5d, nilfssbisvalid function fails to validate slogblocksize field in NILFS2 superblock before bit-shift operations. Attackers supplying crafted NILFS2 images trigger undefined behavior through oversized shifts or out-of-memory conditions, crashi...

AZL-90261 CVE-2026-55204 affecting package haproxy for versions less than 2.9.11-7

HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpackdhtinsert within src/hpack-tbl.c that fails to validate the return value of hpackdhtdefrag when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memo...

AZL-90264 CVE-2026-55203 affecting package haproxy for versions less than 2.9.11-7

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgiconn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record...

AZL-91124 CVE-2026-48617 affecting package nodejs for versions less than 24.17.0-1

A flaw in Node.js Permission Model enforcement allows Bypass via process.report.writeReport Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: Node.js 22,...

AZL-90206 CVE-2026-11791 affecting package 389-ds-base 3.1.1-12

A flaw was found in 389 Directory Server. During schema reload, the attrsyntaxswapht function unconditionally frees attribute syntax information nodes, bypassing the refcount-based deferred deletion used elsewhere in the attribute syntax subsystem. If an administrator triggers schema reload while...

AZL-91131 CVE-2026-12505 affecting package cifs-utils for versions less than 7.6-1

A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled environment. A local, low privileged attacker can exploit this by using a crafted requestkey payload to trick the root-own...

AZL-90933 CVE-2026-55199 affecting package libssh2 for versions less than 1.11.1-4

libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSHMSGEXTINFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can s...

AZL-90927 CVE-2026-55200 affecting package libssh2 for versions less than 1.11.1-3

libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2transportread that fails to enforce upper bounds on packetlength field. Remote attackers can send crafted SSH packets with excessively large packetlength values to corrupt heap memory and achieve...

AZL-91188 CVE-2026-9679 affecting package nodejs for versions less than 24.18.1-1

Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not specify any decoding and browsers do not decode either. Applications that parse a...

AZL-91227 CVE-2026-9697 affecting package nodejs for versions less than 24.17.0-1

Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI socks5:// or socks://. The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servernam...

AZL-91194 CVE-2026-11525 affecting package nodejs for versions less than 24.18.1-1

Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example,...

AZL-91191 CVE-2026-12151 affecting package nodejs for versions less than 24.18.1-1

Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size...