19460 matches found
AZL-110549 CVE-2026-114583 affecting package python-py 1.11.0-1
tarfile.tarfilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall with filter="tar" to write files...
AZL-110552 CVE-2026-114583 affecting package python3 3.12.14-2
tarfile.tarfilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall with filter="tar" to write files...
AZL-110546 CVE-2026-115506 affecting package expat 2.8.3-2
libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of...
AZL-110540 CVE-2026-115504 affecting package cfitsio 4.0.0-5
CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2 in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string...
AZL-110543 CVE-2026-114608 affecting package pylint 4.0.2-2
Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINTHOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can...
AZL-110384 CVE-2026-111497 affecting package brotli 1.1.0-2
A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially...
AZL-110492 CVE-2026-115327 affecting package libyang 2.1.148-3
libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxmlenvnetconfrpc in src/parserxml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lydparseop to crash servers like netopeer2 or...
AZL-109815 CVE-2026-109618 affecting package php for versions less than 8.3.35-2
PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may re...
AZL-109818 CVE-2026-109619 affecting package php for versions less than 8.3.35-2
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on...
AZL-109824 CVE-2026-97206 affecting package unbound 1.26.1-1
NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC DoQ lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the Do...
AZL-110534 CVE-2026-96405 affecting package unbound 1.26.1-1
NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious act...
AZL-110531 CVE-2026-50106 affecting package unbound 1.26.1-1
When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor who can deliver one forged NXDOMAIN response for a name...
AZL-109821 CVE-2026-35501 affecting package unbound 1.26.1-1
When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an island-of-security zone whose parent is provably insecure under the root chain, a malicious actor with a forged NSEC reply with the SOA bit cleared...
AZL-109826 CVE-2026-114236 affecting package buildah 1.43.1-3
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit...
AZL-109875 CVE-2026-114236 affecting package podman 5.6.1-10
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit...
AZL-109935 CVE-2026-114236 affecting package containerized-data-importer 1.62.0-8
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit...
AZL-110528 CVE-2026-109125 affecting package unbound 1.26.1-1
In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold 0' configurations not a default configuration. If a response-like UDP datagram reaches the upstream source port currently used by a recursive query, but i...
AZL-109890 CVE-2026-114094 affecting package python-dulwich 0.21.7-6
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code...
AZL-109893 CVE-2026-114095 affecting package python-dulwich 0.21.7-6
Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolveobject that allows attackers to cause infinite recursion via self-referential OFSDELTA objects. Attackers can supply a malicious packfile with an OFSDELTA deltaoffset of 0 to exhaust CPU during clone, fetch, or cat-fil...
AZL-109992 CVE-2026-111943 affecting package gcc 13.2.0-7
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when...
AZL-109995 CVE-2026-111943 affecting package golang 1.26.7-1
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when...
AZL-109998 CVE-2026-111943 affecting package golang 1.27.1-1
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when...
AZL-110082 CVE-2026-111943 affecting package python-tensorboard 2.16.2-6
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when...
AZL-110289 CVE-2026-111943 affecting package tensorflow 2.16.1-11
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when...
AZL-109872 CVE-2026-113812 affecting package perl-Mozilla-CA 20240730-2
Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates. The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificates whose private keys are publicly available. An attacker able...
AZL-110106 CVE-2026-113776 affecting package python-virtualenv 20.36.1-6
virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...
AZL-110091 CVE-2026-113732 affecting package python-virtualenv 20.36.1-6
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...
AZL-110076 CVE-2026-113726 affecting package python-pip 24.2-10
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...
AZL-110100 CVE-2026-113726 affecting package python-virtualenv 20.36.1-6
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...
AZL-110061 CVE-2026-111879 affecting package perl-DBI 1.652-1
DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed opendata does not release the table's lock. opendata creates the table's lock file and takes an exclusive flock on it for a CREATE, before the checks that can croak: a dbmmldbm value that is not a module...
AZL-110058 CVE-2026-108518 affecting package perl-DBI 1.652-1
DBI versions before 1.656 for Perl crash via type confusion in dbiprofile when a database handle is destroyed under a Profile Path with an attr element. An attr element names a database handle attribute, which dbiprofile reads from the handle's inner hash. It expects the inner handle as a referen...
AZL-109908 CVE-2026-94266 affecting package cmake 3.30.3-15
libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...
AZL-109947 CVE-2026-94266 affecting package curl 8.11.1-11
libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...
AZL-110034 CVE-2026-94266 affecting package mysql 8.0.46-2
libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...
AZL-110157 CVE-2026-94266 affecting package rust 1.75.0-31
libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...
AZL-110220 CVE-2026-94266 affecting package rust 1.96.1-2
libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...
AZL-110292 CVE-2026-94266 affecting package tensorflow 2.16.1-11
libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...
AZL-110187 CVE-2026-92391 affecting package rust 1.75.0-31
A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within curlmimefree leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process...
AZL-110013 CVE-2026-92389 affecting package mysql 8.0.46-2
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,...
AZL-110151 CVE-2026-92386 affecting package rust 1.75.0-31
When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...
AZL-110019 CVE-2026-92387 affecting package mysql 8.0.46-2
By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle...
AZL-110190 CVE-2026-92389 affecting package rust 1.75.0-31
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,...
AZL-110139 CVE-2026-92387 affecting package rust 1.75.0-31
By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle...
AZL-110235 CVE-2026-92389 affecting package rust 1.96.1-2
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,...
AZL-110229 CVE-2026-92391 affecting package rust 1.96.1-2
A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within curlmimefree leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process...
AZL-110301 CVE-2026-92389 affecting package tensorflow 2.16.1-11
libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,...
AZL-110250 CVE-2026-92386 affecting package rust 1.96.1-2
When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...
AZL-109899 CVE-2026-92386 affecting package cmake 3.30.3-15
When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...
AZL-109977 CVE-2026-92386 affecting package curl 8.11.1-11
When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...
AZL-109974 CVE-2026-92387 affecting package curl 8.11.1-11
By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle...