DEBIAN-CVE-2026-86845

A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend...

DEBIAN-CVE-2026-86567

A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap...

DEBIAN-CVE-2026-107349

An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignorestartupparameters list lookup loop forever. Because PgBouncer serve...

DEBIAN-CVE-2026-107350

Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in authfile to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM...

DEBIAN-CVE-2026-107348

Integer overflow in the message buffer growth logic mbufmakeroom in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when maxpacketsize is configured above 2147483648. A packet header declaring a length above 2^31 makes the buffer size computation overflow,...

DEBIAN-CVE-2026-96596

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Erlang OTP stdlib erltar module, hexpm hexcore hexerltar module, hexpm hex mixhexerltar module and erlang rebar3 r3hexerltar module allows an attacker who supplies a tar archive to cause a denial of service via a crafted GNU...

DEBIAN-CVE-2026-94200

Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl tlshandshake13, sslhandshake and tlsclientticketstore modules allows a malicious TLS 1.3 server to cause a denial of service of the ssl application on the client node. The TLS 1.3 client decodes the extensions of a...

DEBIAN-CVE-2026-86562

A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler...

DEBIAN-CVE-2026-86563

A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access...

DEBIAN-CVE-2026-86565

A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process...

DEBIAN-CVE-2026-67418

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, the MQTT 5 parser in deps/rabbitmqmqtt/src/rabbitmqttpacket.erl accepts Request-Problem-Information on PUBLISH packets even though the property is valid only for CONNECT. An authenticated...

DEBIAN-CVE-2026-100236

A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. ...

DEBIAN-CVE-2026-93683

A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an...

DEBIAN-CVE-2026-86561

A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption...

DEBIAN-CVE-2026-67416

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, the optimized AMQP 1.0 servermode parser in deps/amqp10common/src/amqp10binaryparser.erl matches the textual prefixes of symbolic data, sequence, and value body descriptors without verifying their...

DEBIAN-CVE-2026-67414

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10common/src/amqp10binaryparser.erl materializes each element of AMQP 1.0 arrays whose shared constructor has zero width, while limiting only the number of elements in each array and not the...

DEBIAN-CVE-2026-53615

util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, parsedosextended in libblkid/src/partitions/dos.c computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who...

DEBIAN-CVE-2026-53614

util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID mount utility reads the attacker-controlled LIBMOUNTFORCEMOUNT2 environment variable with getenv, allowing a local low-privileged user to force the non-atomic legacy...

DEBIAN-CVE-2026-110735

Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader core/io/resourceformatbinary.cpp, ResourceLoaderBinary::getunicodestring. A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a...

DEBIAN-CVE-2026-110734

Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR .hdr image decoder modules/hdr/imageloaderhdr.cpp. The run-length decoding loop expands RLE instructions read from the file into a buffer sized from the image dimensions, without validating that an instruction's...

DEBIAN-CVE-2026-110736

Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader core/string/optimizedtranslation.cpp, OptimizedTranslation::getmessage. Offsets read from the hash table of a crafted .translation resource are used as indices into the bucket table without bounds validation;...

DEBIAN-CVE-2026-97629

Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...

DEBIAN-CVE-2026-97205

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O AIO is enabled in certain configurations, processing a Server Side Includes SSI page containing “include virtual” commands may trigger a Use-After-Free UAF in the NGINX worker process...

DEBIAN-CVE-2026-95101

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject...

DEBIAN-CVE-2026-93479

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a...

DEBIAN-CVE-2026-84471

The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry...

DEBIAN-CVE-2026-53612

util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID mount utility's hookowner.c post-mount hook performs path-based chmod and lchown operations on a previously validated mount target. A local low-privileged user authorized by a...

DEBIAN-CVE-2026-53613

util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy mount2 path is used without /proc, restricted non-root mount requests validate an /etc/fstab target before the mount operation re-resolves that pathname. ...

DEBIAN-CVE-2026-15176

A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $requestfilename variable. Alternatively, the same result could be achieved when the $requestfilename variable...

DEBIAN-CVE-2026-101025

Description NGINX JavaScript njs has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with...

DEBIAN-CVE-2026-101019

Description NGINX JavaScript njs has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an...

DEBIAN-CVE-2026-98431

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Fix mmaplock/disassociationlock circular dependency Commit 51976c6cd786 "RDMA/core: Provide rdmausermmapdisassociate to disassociate mmap pages" introduced disassociationlock to protect new mmap registrations against...

DEBIAN-CVE-2026-98424

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: undo netns switch if renaming the wiphy fails Once all the interfaces have been moved, cfg80211switchnetns moves the wiphy itself by setting its network namespace and then renaming it, which makes sysfs move it. T...

DEBIAN-CVE-2026-98425

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't warn when an IBSS has no channel to scan ieee80211requestibssscan warns when regulatory leaves no allowed channel, but that can happen as the regdomain can change while IBSS is operating, and it can continue...

DEBIAN-CVE-2026-98429

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Keep EQ resources alive while IRQ is registered The completion IRQ handler accesses the EQ state and DMA buffer. Its IRQ was registered before that state was initialized, while teardown released the buffer before freeir...

DEBIAN-CVE-2026-98430

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Keep admin queues alive while IRQ is registered The management IRQ handler accesses both the admin completion queue and the async event queue. The driver registered the IRQ before constructing these queues and destroyed...

DEBIAN-CVE-2026-98428

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: 6fire: Avoid embedded URBs The USB 6fire driver uses URBs embedded in different structs for PCM, MIDI and communication, and this is basically a buggy implementation nowadays; since a URB is managed with a refcount, th...

DEBIAN-CVE-2026-98427

In the Linux kernel, the following vulnerability has been resolved: net/sched: codel: bound the dropping loop per dequeue call The CoDel control law schedules the next drop one interval/sqrtcount after the previous drop, using the configured interval codelparams.interval. For very small intervals...

DEBIAN-CVE-2026-98426

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path mwifiexpcierequestirq registers each MSI-X vector with a per-index devid &card-msixctxi. On a requestirq failure the cleanup loop "for j = 0; j msixctxi as the...

DEBIAN-CVE-2026-98422

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset the APVLAN tailroom counter on ifdown On ifup, APVLAN interfaces get cryptotxtailroomneededcnt from the AP interface, but it's never decremented again unless the AP is also brought down. Thus, bringing the...

DEBIAN-CVE-2026-98419

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix out-of-bounds write in resetpercpudata In resetpercpudata, al is computed as: al = sizeofstruct netdmalertmsg; al += dmhitlimit sizeofstruct netdmdroppoint; al += sizeofstruct nlattr; skb = genlmsgnewal, GFPKERNE...

DEBIAN-CVE-2026-98423

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: don't hand frames to mac80211 while stopping The code checks -started for frames coming from wmediumd, but the radio can be stopped after the check and before frame delivery, causing mac80211 to hit the...

DEBIAN-CVE-2026-98420

In the Linux kernel, the following vulnerability has been resolved: ksmbd: follow SMB2 session expiration semantics ksmbdsessionregister destroys valid sessions after ten seconds of inactivity whenever a client starts another SessionSetup exchange. This confuses Session.IdleTime with...

DEBIAN-CVE-2026-98421

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: require a peer station for TDLS setup confirm It's nonsense for the setup confirm to go to station that doesn't even exist, and it hits a warning when building the frame: WARNONONCE!sta || !apsta Only accept...

DEBIAN-CVE-2026-98417

In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates...

DEBIAN-CVE-2026-98418

In the Linux kernel, the following vulnerability has been resolved: sched/core: Avoid false migration warning for proxy donors Proxy execution can move a blocked donor's scheduling context to the lock owner's CPU even when the donor is migration-disabled. The donor does not execute there, and its...

DEBIAN-CVE-2026-98411

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: fix NULL-pointer dereference in pwrseqdeviceregister If devsetname fails in pwrseqdeviceregister, we jump to the errputpwrseq label before initializing pwrseq-targets. pwrseqrelease will try to iterate over...

DEBIAN-CVE-2026-98409

In the Linux kernel, the following vulnerability has been resolved: watchdog: rtd119x: Avoid division by zero clkgetrate could return 0. Avoid a division by zero panic...

DEBIAN-CVE-2026-98415

In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node The setupcpuhpandcpuidle parses the device tree node for the interrupt generation block via ofparsephandle and decrements its reference count using ofnodepu...

DEBIAN-CVE-2026-98414

In the Linux kernel, the following vulnerability has been resolved: memcg: avoid charging the root memcg from objcgroupchargepages objcgroupchargepages resolves the objcg to its memcg and calls trychargememcg, which does not short circuit the root memcg. That memcg can be the root memcg:...