Snyk test report

Authentication Bypass

NVD Description

Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

A flaw was found in util-linux. Improper hostname canonicalization in the login(1) utility, when invoked with the -h option, can modify the supplied remote hostname before setting PAM_RHOST. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.

Remediation

There is no fixed version for Ubuntu:25.10 util-linux.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-3184
• https://access.redhat.com/errata/RHSA-2026:7180
• https://access.redhat.com/security/cve/CVE-2026-3184
• https://bugzilla.redhat.com/show_bug.cgi?id=2442570

Time-of-check Time-of-use (TOCTOU)

NVD Description

Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.

Remediation

There is no fixed version for Ubuntu:25.10 util-linux.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-27456
• https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4
• https://github.com/util-linux/util-linux/releases/tag/v2.41.4
• https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g

Directory Traversal

NVD Description

Note: Versions mentioned in the description apply only to the upstream tar package and not the tar package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which "tar xf" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each "tar xf" in its Security Rules of Thumb; however, third-party advice leads users to run "tar xf" more than once into the same directory.

Remediation

There is no fixed version for Ubuntu:25.10 tar.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-45582
• https://github.com/i900008/vulndb/blob/main/Gnu_tar_vuln.md
• https://www.gnu.org/software/tar/
• https://lists.gnu.org/archive/html/bug-tar/2025-08/msg00012.html
• https://www.gnu.org/software/tar/manual/html_node/Integrity.html
• https://www.gnu.org/software/tar/manual/html_node/Security-rules-of-thumb.html
• http://www.openwall.com/lists/oss-security/2025/11/01/6

Unrestricted Upload of File with Dangerous Type

NVD Description

Note: Versions mentioned in the description apply only to the upstream tar package and not the tar package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.

Remediation

There is no fixed version for Ubuntu:25.10 tar.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-5704
• https://access.redhat.com/security/cve/CVE-2026-5704
• https://bugzilla.redhat.com/show_bug.cgi?id=2455360
• http://www.openwall.com/lists/oss-security/2026/04/11/10
• http://www.openwall.com/lists/oss-security/2026/04/11/11
• http://www.openwall.com/lists/oss-security/2026/04/12/2

Use of Less Trusted Source

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.

Remediation

Upgrade Ubuntu:25.10 systemd to version 257.9-0ubuntu2.5 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-40226
• https://github.com/systemd/systemd/security/advisories/GHSA-9mj4-rrc3-gjcx

CVE-2026-35354

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based system calls that perform fresh path-to-inode lookups for each operation. A local attacker with write access to the directory can exploit this race to swap files between calls, causing the destination file to receive an inconsistent mix of security xattrs, such as SELinux labels or file capabilities.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35354
• https://github.com/uutils/coreutils/issues/10014

CVE-2026-35344

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts, as the utility may report a successful operation even when the destination file contains old or garbage data.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35344
• https://github.com/uutils/coreutils/issues/9745

CVE-2026-35360

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

The touch utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file creation. When the utility identifies a missing path, it later attempts creation using File::create(), which internally uses O_TRUNC. An attacker can exploit this window to create a file or swap a symlink at the target path, causing touch to truncate an existing file and leading to permanent data loss.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35360
• https://github.com/uutils/coreutils/issues/10019

CVE-2026-35378

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

A logic error in the expr utility of uutils coreutils causes the program to evaluate parenthesized subexpressions during the parsing phase rather than at the execution phase. This implementation flaw prevents the utility from performing proper short-circuiting for logical OR (|) and AND (&) operations. As a result, arithmetic errors (such as division by zero) occurring within "dead" branches, branches that should be ignored due to short-circuiting, are raised as fatal errors. This divergence from GNU expr behavior can cause guarded expressions within shell scripts to fail with hard errors instead of returning expected boolean results, leading to premature script termination and breaking GNU-compatible shell control flow.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35378
• https://github.com/uutils/coreutils/pull/11395
• https://github.com/uutils/coreutils/releases/tag/0.8.0

CVE-2026-35361

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling fails, the utility attempts cleanup using std::fs::remove_dir, which cannot remove device nodes or FIFOs. This leaves mislabeled nodes behind with incorrect default contexts, potentially allowing unauthorized access to device nodes that should have been restricted by mandatory access controls.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35361
• https://github.com/uutils/coreutils/releases/tag/0.6.0
• https://github.com/uutils/coreutils/pull/10582

CVE-2026-35345

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting the contents of the link's target. In environments where a privileged user (e.g., root) monitors a log directory, a local attacker with write access to that directory can replace a log file with a symlink to a sensitive system file (such as /etc/shadow), causing tail to disclose the contents of the sensitive file.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35345
• https://github.com/uutils/coreutils/issues/10328

CVE-2026-35355

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

The install utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file installation. The implementation unlinks an existing destination file and then recreates it using a path-based operation without the O_EXCL flag. A local attacker can exploit the window between the unlink and the subsequent creation to swap the path with a symbolic link, allowing them to redirect privileged writes to overwrite arbitrary system files.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35355
• https://github.com/uutils/coreutils/releases/tag/0.6.0
• https://github.com/uutils/coreutils/pull/10067

CVE-2026-35379

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and [:print:] character classes. The implementation mistakenly includes the ASCII space character (0x20) in the [:graph:] class and excludes it from the [:print:] class, effectively reversing the standard behavior established by POSIX and GNU coreutils. This vulnerability leads to unintended data modification or loss when the utility is used in automated scripts or data-cleaning pipelines that rely on standard character class semantics. For example, a command executed to delete all graphical characters while intending to preserve whitespace will incorrectly delete all ASCII spaces, potentially resulting in data corruption or logic failures in downstream processing.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35379
• https://github.com/uutils/coreutils/pull/11405
• https://github.com/uutils/coreutils/releases/tag/0.8.0

CVE-2026-35366

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in environment strings, the uutils implementation silently skips these entries rather than printing the raw bytes. This vulnerability allows malicious environment variables (e.g., adversarial LD_PRELOAD values) to evade inspection by administrators or security auditing tools, potentially allowing library injection or other environment-based attacks to go undetected.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35366
• https://github.com/uutils/coreutils/pull/9728
• https://github.com/uutils/coreutils/releases/tag/0.6.0
• https://github.com/uutils/coreutils/issues/9701

CVE-2026-35376

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the chcon utility of uutils coreutils during recursive operations. The implementation resolves recursive targets using a fresh path lookup (via fts_accpath) rather than binding the traversal and label application to the specific directory state encountered during traversal. Because these operations are not anchored to file descriptors, a local attacker with write access to a directory tree can exploit timing-sensitive rename or symbolic link races to redirect a privileged recursive relabeling operation to unintended files or directories. This vulnerability breaks the hardening expectations for SELinux administration workflows and can lead to the unauthorized modification of security labels on sensitive system objects.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35376
• https://github.com/uutils/coreutils/pull/11402
• https://github.com/uutils/coreutils/releases/tag/0.8.0

CVE-2026-35374

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the split utility of uutils coreutils. The program attempts to prevent data loss by checking for identity between input and output files using their file paths before initiating the split operation. However, the utility subsequently opens the output file with truncation after this path-based validation is complete. A local attacker with write access to the directory can exploit this race window by manipulating mutable path components (e.g., swapping a path with a symbolic link). This can cause split to truncate and write to an unintended target file, potentially including the input file itself or other sensitive files accessible to the process, leading to permanent data loss.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35374
• https://github.com/uutils/coreutils/pull/11401

CVE-2026-35340

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

A flaw in the ChownExecutor used by uutils coreutils chown and chgrp causes the utilities to return an incorrect exit code during recursive operations. The final exit code is determined only by the last file processed. If the last operation succeeds, the command returns 0 even if earlier ownership or group changes failed due to permission errors. This can lead to security misconfigurations where administrative scripts incorrectly assume that ownership has been successfully transferred across a directory tree.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35340
• https://github.com/uutils/coreutils/pull/10035
• https://github.com/uutils/coreutils/releases/tag/0.6.0

CVE-2026-35375

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

A logic error in the split utility of uutils coreutils causes the corruption of output filenames when provided with non-UTF-8 prefix or suffix inputs. The implementation utilizes to_string_lossy() when constructing chunk filenames, which automatically rewrites invalid byte sequences into the UTF-8 replacement character (U+FFFD). This behavior diverges from GNU split, which preserves raw pathname bytes intact. In environments utilizing non-UTF-8 encodings, this vulnerability leads to the creation of files with incorrect names, potentially causing filename collisions, broken automation, or the misdirection of output data.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35375
• https://github.com/uutils/coreutils/pull/11397
• https://github.com/uutils/coreutils/releases/tag/0.8.0

CVE-2026-35341

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files. When mkfifo fails to create a FIFO because a file already exists at the target path, it fails to terminate the operation for that path and continues to execute a follow-up set_permissions call. This results in the existing file's permissions being changed to the default mode (often 644 after umask), potentially exposing sensitive files such as SSH private keys to other users on the system.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35341
• https://github.com/uutils/coreutils/issues/10020

CVE-2026-35348

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect(), causing an immediate crash when encountering valid but non-UTF-8 paths. This diverges from GNU sort, which treats filenames as raw bytes. A local attacker can exploit this to crash the utility and disrupt automated pipelines.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35348
• https://github.com/uutils/coreutils/issues/9696

CVE-2026-35356

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the install utility of uutils coreutils when using the -D flag. The command creates parent directories and subsequently performs a second path resolution to create the target file, neither of which is anchored to a directory file descriptor. An attacker with concurrent write access can replace a path component with a symbolic link between these operations, redirecting the privileged write to an arbitrary file system location.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35356
• https://github.com/uutils/coreutils/pull/10140
• https://github.com/uutils/coreutils/releases/tag/0.7.0

CVE-2026-35357

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

The cp utility in uutils coreutils is vulnerable to an information disclosure race condition. Destination files are initially created with umask-derived permissions (e.g., 0644) before being restricted to their final mode (e.g., 0600) later in the process. A local attacker can race to open the file during this window; once obtained, the file descriptor remains valid and readable even after the permissions are tightened, exposing sensitive or private file contents.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35357
• https://github.com/uutils/coreutils/issues/10011

CVE-2026-35349

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

A vulnerability in the rm utility of uutils coreutils allows a bypass of the --preserve-root protection. The implementation uses a path-string check rather than comparing device and inode numbers to identify the root directory. An attacker or accidental user can bypass this safeguard by using a symbolic link that resolves to the root directory (e.g., /tmp/rootlink -> /), potentially leading to the unintended recursive deletion of the entire root filesystem.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35349
• https://github.com/uutils/coreutils/pull/9706
• https://github.com/uutils/coreutils/releases/tag/0.7.0

CVE-2026-35377

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line arguments when utilizing the -S (split-string) option. In GNU env, backslashes within single quotes are treated literally (with the exceptions of \ and '). However, the uutils implementation incorrectly attempts to validate these sequences, resulting in an "invalid sequence" error and an immediate process termination with an exit status of 125 when encountering valid but unrecognized sequences like \a or \x. This divergence from GNU behavior breaks compatibility for automated scripts and administrative workflows that rely on standard split-string semantics, leading to a local denial of service for those operations.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35377
• https://github.com/uutils/coreutils/pull/11512

CVE-2026-35367

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (0644). In multi-user environments, this allows any user on the system to read the captured stdout/stderr output of a command, potentially exposing sensitive information. This behavior diverges from GNU coreutils, which creates nohup.out with owner-only (0600) permissions.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35367
• https://github.com/uutils/coreutils/issues/10021

CVE-2026-35358

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35358
• https://github.com/uutils/coreutils/pull/11163
• https://github.com/uutils/coreutils/releases/tag/0.7.0
• https://github.com/uutils/coreutils/issues/9746

CVE-2026-35364

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the destination path before recreating it through a copy operation. A local attacker with write access to the destination directory can exploit this window to replace the destination with a symbolic link. The subsequent privileged move operation will follow the symlink, allowing the attacker to redirect the write and overwrite an arbitrary target file with contents from the source.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35364
• https://github.com/uutils/coreutils/issues/10015

CVE-2026-35359

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag. An attacker with concurrent write access can swap a regular file for a symbolic link during this window, causing a privileged cp process to copy the contents of arbitrary sensitive files into a destination controlled by the attacker.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35359
• https://github.com/uutils/coreutils/issues/10017

CVE-2026-35365

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

The mv utility in uutils coreutils improperly handles directory trees containing symbolic links during moves across filesystem boundaries. Instead of preserving symlinks, the implementation expands them, copying the linked targets as real files or directories at the destination. This can lead to resource exhaustion (disk space or time) if symlinks point to large external directories, unexpected duplication of sensitive data into unintended locations, or infinite recursion and repeated copying in the presence of symlink loops.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35365
• https://github.com/uutils/coreutils/pull/10546
• https://github.com/uutils/coreutils/releases/tag/0.7.0

CVE-2026-35371

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35371
• https://github.com/uutils/coreutils/issues/10006

CVE-2026-35370

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of their effective GID to compute the group list, leading to potentially divergent output compared to GNU coreutils. Because many scripts and automated processes rely on the output of id to make security-critical access-control or permission decisions, this discrepancy can lead to unauthorized access or security misconfigurations.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35370
• https://github.com/uutils/coreutils/issues/10006

CVE-2026-35342

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to /tmp when TMPDIR is an empty string, the uutils implementation treats the empty string as a valid path. This causes temporary files to be created in the current working directory (CWD) instead of the intended secure temporary directory. If the CWD is more permissive or accessible to other users than /tmp, it may lead to unintended information disclosure or unauthorized access to temporary data.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35342
• https://github.com/uutils/coreutils/pull/10566
• https://github.com/uutils/coreutils/releases/tag/0.6.0

CVE-2026-35352

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mkfifo utility of uutils coreutils. The utility creates a FIFO and then performs a path-based chmod to set permissions. A local attacker with write access to the parent directory can swap the newly created FIFO for a symbolic link between these two operations. This redirects the chmod call to an arbitrary file, potentially enabling privilege escalation if the utility is run with elevated privileges.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35352
• http://www.openwall.com/lists/oss-security/2026/05/04/4
• http://www.openwall.com/lists/oss-security/2026/05/04/5
• http://www.openwall.com/lists/oss-security/2026/05/04/6
• https://github.com/uutils/coreutils/issues/10020

CVE-2026-35380

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

A logic error in the cut utility of uutils coreutils causes the program to incorrectly interpret the literal two-byte string '' (two single quotes) as an empty delimiter. The implementation mistakenly maps this string to the NUL character for both the -d (delimiter) and --output-delimiter options. This vulnerability can lead to silent data corruption or logic errors in automated scripts and data pipelines that process strings containing these characters, as the utility may unintentionally split or join data on NUL bytes rather than the intended literal characters.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35380
• https://github.com/uutils/coreutils/pull/11399
• https://github.com/uutils/coreutils/releases/tag/0.8.0

CVE-2026-35343

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35343
• https://github.com/uutils/coreutils/pull/11143
• https://github.com/uutils/coreutils/releases/tag/0.7.0

CVE-2026-35381

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag when using the -z (null-terminated) and -d '' (empty delimiter) options together. The implementation incorrectly routes this specific combination through a specialized newline-delimiter code path that fails to check the record suppression status. Consequently, uutils cut emits the entire record plus a NUL byte instead of suppressing it. This divergence from GNU coreutils behavior creates a data integrity risk for automated pipelines that rely on cut -s to filter out undelimited data.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35381
• https://github.com/uutils/coreutils/pull/11394
• https://github.com/uutils/coreutils/releases/tag/0.8.0

CVE-2026-35362

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35362
• https://github.com/uutils/coreutils/pull/9792
• https://github.com/uutils/coreutils/releases/tag/0.6.0

CVE-2026-35353

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived permissions (typically 0755) before subsequently changing them to the requested mode via a separate chmod system call. In multi-user environments, this introduces a brief window where a directory intended to be private is accessible to other users, potentially leading to unauthorized data access.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35353
• https://github.com/uutils/coreutils/pull/10036
• https://github.com/uutils/coreutils/releases/tag/0.6.0

CVE-2026-35363

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility correctly refuses to delete . or .., it fails to recognize equivalent paths with trailing slashes, such as ./ or .///. An accidental or malicious execution of rm -rf ./ results in the silent recursive deletion of all contents within the current directory. The command further obscures the data loss by reporting a misleading 'Invalid input' error, which may cause users to miss the critical window for data recovery.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35363
• https://github.com/uutils/coreutils/issues/9749

CVE-2026-35351

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID rather than the source's metadata. This flaw breaks backups and migrations, causing files moved by a privileged user (e.g., root) to become root-owned unexpectedly, which can lead to information disclosure or restricted access for the intended owners.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35351
• https://github.com/uutils/coreutils/issues/9714

CVE-2026-35347

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison operations. The are_files_identical function opens and reads from both input paths to compare content without first verifying if the paths refer to regular files. If an input path is a FIFO or a pipe, this pre-read operation drains the stream, leading to silent data loss before the actual comparison logic is executed. Additionally, the utility may hang indefinitely if it attempts to pre-read from infinite streams like /dev/zero.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35347
• https://github.com/uutils/coreutils/releases/tag/0.6.0
• https://github.com/uutils/coreutils/pull/9545

CVE-2026-35369

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

An argument parsing error in the kill utility of uutils coreutils incorrectly interprets kill -1 as a request to send the default signal (SIGTERM) to PID -1. Sending a signal to PID -1 causes the kernel to terminate all processes visible to the caller, potentially leading to a system crash or massive process termination. This differs from GNU coreutils, which correctly recognizes -1 as a signal number in this context and would instead report a missing PID argument.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35369
• https://github.com/uutils/coreutils/pull/9700
• https://github.com/uutils/coreutils/releases/tag/0.6.0

CVE-2026-35368

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this can trigger the Name Service Switch (NSS) to load shared libraries (e.g., libnss_*.so.2) from the new root directory. If the NEWROOT is writable by an attacker, they can inject a malicious NSS module to execute arbitrary code as root, facilitating a full container escape or privilege escalation.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35368
• https://github.com/uutils/coreutils/issues/10327

CVE-2026-35350

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35350
• https://github.com/uutils/coreutils/issues/9750

CVE-2026-35338

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

A vulnerability in the chmod utility of uutils coreutils allows users to bypass the --preserve-root safety mechanism. The implementation only validates if the target path is literally / and does not canonicalize the path. An attacker or accidental user can use path variants such as /../ or symbolic links to execute destructive recursive operations (e.g., chmod -R 000) on the entire root filesystem, leading to system-wide permission loss and potential complete system breakdown.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35338
• https://github.com/uutils/coreutils/pull/10033
• https://github.com/uutils/coreutils/releases/tag/0.6.0

CVE-2026-35339

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

The recursive mode (-R) of the chmod utility in uutils coreutils incorrectly handles exit codes when processing multiple files. The final return value is determined solely by the success or failure of the last file processed. This allows the command to return an exit code of 0 (success) even if errors were encountered on previous files, such as 'Operation not permitted'. Scripts relying on these exit codes may proceed under a false sense of success while sensitive files remain with restrictive or incorrect permissions.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35339
• https://github.com/uutils/coreutils/pull/9793
• https://github.com/uutils/coreutils/releases/tag/0.6.0

CVE-2026-35346

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::from_utf8_lossy(), which replaces invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD). This behavior differs from GNU comm, which processes raw bytes and preserves the original input. This results in corrupted output when the utility is used to compare binary files or files using non-UTF-8 legacy encodings.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35346
• https://github.com/uutils/coreutils/pull/10206
• https://github.com/uutils/coreutils/releases/tag/0.6.0
• https://github.com/uutils/coreutils/issues/10192

CVE-2026-35372

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

A logic error in the ln utility of uutils coreutils allows the utility to dereference a symbolic link target even when the --no-dereference (or -n) flag is explicitly provided. The implementation previously only honored the "no-dereference" intent if the --force (overwrite) mode was also enabled. This flaw causes ln to follow a symbolic link that points to a directory and create new links inside that target directory instead of treating the symbolic link itself as the destination. In environments where a privileged user or system script uses ln -n to update a symlink, a local attacker could manipulate existing symbolic links to redirect file creation into sensitive directories, potentially leading to unauthorized file creation or system misconfiguration.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35372
• https://github.com/uutils/coreutils/pull/11253
• https://github.com/uutils/coreutils/releases/tag/0.8.0

CVE-2026-35373

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-coreutils package and not the rust-coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory forms (e.g., ln SOURCE... DIRECTORY). While GNU ln treats filenames as raw bytes and creates the links correctly, the uutils implementation enforces UTF-8 encoding, resulting in a failure to stat the file and a non-zero exit code. In environments where automated scripts or system tasks process valid but non-UTF-8 filenames common on Unix filesystems, this divergence causes the utility to fail, leading to a local denial of service for those specific operations.

Remediation

There is no fixed version for Ubuntu:25.10 rust-coreutils.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35373
• https://github.com/uutils/coreutils/pull/11403

Directory Traversal

NVD Description

Note: Versions mentioned in the description apply only to the upstream pam package and not the pam package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.

Remediation

There is no fixed version for Ubuntu:25.10 pam.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-8941
• https://access.redhat.com/security/cve/CVE-2025-8941
• https://bugzilla.redhat.com/show_bug.cgi?id=2388220
• https://access.redhat.com/errata/RHSA-2025:14557
• https://access.redhat.com/errata/RHSA-2025:15100
• https://access.redhat.com/errata/RHSA-2025:15104
• https://access.redhat.com/errata/RHSA-2025:15107
• https://access.redhat.com/errata/RHSA-2025:15099
• https://access.redhat.com/errata/RHSA-2025:15101
• https://access.redhat.com/errata/RHSA-2025:15102
• https://access.redhat.com/errata/RHSA-2025:15103
• https://access.redhat.com/errata/RHSA-2025:15105
• https://access.redhat.com/errata/RHSA-2025:15106
• https://access.redhat.com/errata/RHSA-2025:15709
• https://access.redhat.com/errata/RHSA-2025:15828
• https://access.redhat.com/errata/RHSA-2025:15827
• https://access.redhat.com/errata/RHSA-2025:16524
• https://access.redhat.com/errata/RHSA-2025:18219
• https://access.redhat.com/errata/RHSA-2025:17181
• https://access.redhat.com/errata/RHSA-2025:21885

CVE-2026-34183

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames.

Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service.

A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.

Remediation

Upgrade Ubuntu:25.10 openssl to version 3.5.3-1ubuntu3.4 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-34183
• https://github.com/openssl/security/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517
• https://github.com/openssl/security/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac
• https://github.com/openssl/security/commit/d2e9efbe4900a373227deb136e8665401404ffac
• https://github.com/openssl/security/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb
• https://openssl-library.org/news/secadv/20260609.txt
• https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517
• https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac
• https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac
• https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb

CVE-2026-42764

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled.

Impact summary: NULL pointer dereference typically causes abnormal termination of the affected QUIC server process and a Denial of Service.

If the address validation is disabled in the OpenSSL QUIC server implementation, an attacker can crash the server by sending an initial packet with an invalid or expired token.

By default, the client address validation is enabled in the OpenSSL QUIC server implementation, which makes the default configuration not vulnerable to this issue. However if the SSL_LISTENER_FLAG_NO_VALIDATE is used with the SSL_new_listener() call, the address validation is disabled making the vulnerable code reachable.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Ubuntu:25.10 openssl to version 3.5.3-1ubuntu3.4 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-42764
• https://github.com/openssl/security/commit/5e3ed291b8af0b03d5d3b9e56a1da69a187e9729
• https://github.com/openssl/security/commit/a45a0aba8095682c88ff4fc4a784892b8c6f0677
• https://github.com/openssl/security/commit/bf29a458c1a231eca87e384c62b9c2553fa57a91
• https://openssl-library.org/news/secadv/20260609.txt
• https://github.com/openssl/openssl/commit/5e3ed291b8af0b03d5d3b9e56a1da69a187e9729
• https://github.com/openssl/openssl/commit/a45a0aba8095682c88ff4fc4a784892b8c6f0677
• https://github.com/openssl/openssl/commit/bf29a458c1a231eca87e384c62b9c2553fa57a91

CVE-2026-34182

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises.

Impact Summary: Attackers making use of these vulnerabilities may achieve key-equivalent functionality for a given CMS recipient and/or bypass integrity validation for a given message.

In one use case, an attacker may send a CMS message containing AuthEnvelopedData with the cipher specified as a non-AEAD cipher. OpenSSL erroneously allows this selection, and attempts to decrypt and validate the message.

An on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData addressed to the victim can re-emit it with the recipientInfos set left byte-for-byte intact, so the victim's private key still unwraps the genuine CEK (the content-encryption key), but with the inner OID rewritten to AES-256-OFB (Output Feedback Mode, an unauthenticated keystream mode) and with an attacker-chosen IV and ciphertext. The victim initializes AES-256-OFB under the real CEK, never consults the MAC field, and CMS_decrypt() returns success.

If the application under attack responds to the attacker with any indicator showing success or failure of the decryption effort, it is possible for the attacker to use this as an oracle to obtain key equivalent functionality for the CEK used for the chosen recipient of the message.

In another use case, an attacker can reduce the tag length of the chosen AEAD cipher for a given AuthEnvelopedData container to be a single byte long, allowing an attacker to brute force CMS decryption, producing an integrity bypass for applications that trust CMS_decrypt() to reject modified content.

The FIPS modules are not affected by this issue.

Remediation

Upgrade Ubuntu:25.10 openssl to version 3.5.3-1ubuntu3.4 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-34182
• https://github.com/openssl/security/commit/03c1f4d45fb963aee7d5833390c507cd290182bc
• https://github.com/openssl/security/commit/439ed7d2c0962ce964482727264668bf277c333f
• https://github.com/openssl/security/commit/7947e6a81eb8776802f159fb6762cb7fcf7e34c7
• https://github.com/openssl/security/commit/9fd97f8cfdc2c0be214998de3b2b55c8edf6c7ac
• https://github.com/openssl/security/commit/d2ca86bcd43e4f17d899f347101766b6107676e0
• https://openssl-library.org/news/secadv/20260609.txt
• https://github.com/openssl/openssl/commit/03c1f4d45fb963aee7d5833390c507cd290182bc
• https://github.com/openssl/openssl/commit/439ed7d2c0962ce964482727264668bf277c333f
• https://github.com/openssl/openssl/commit/7947e6a81eb8776802f159fb6762cb7fcf7e34c7
• https://github.com/openssl/openssl/commit/9fd97f8cfdc2c0be214998de3b2b55c8edf6c7ac
• https://github.com/openssl/openssl/commit/d2ca86bcd43e4f17d899f347101766b6107676e0

CVE-2026-45445

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded.

Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message.

OpenSSL provides two ways to drive a cipher: the documented streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level one-shot, EVP_Cipher(), whose documentation explicitly recommends against use by applications in favour of EVP_CipherUpdate() and EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes the application-supplied IV into the OCB context before processing data; the one-shot handler did not. Every call to EVP_Cipher() on an AES-OCB context therefore ran with the all-zero key-derived offset state left by cipher initialisation, regardless of the caller's IV.

If EVP_EncryptFinal_ex() is subsequently used to obtain the authentication tag, the deferred IV setup runs at that point and clears the running checksum that should have been accumulated over the plaintext. The resulting tag is a function of (key, IV) only and verifies against any ciphertext produced under the same (key, IV) pair.

The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a TLS cipher suite, and libssl does not call EVP_Cipher() in any case. Applications that drive AES-OCB through the documented streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only applications that combine the AES-OCB cipher with the EVP_Cipher() one-shot API are vulnerable.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.

Remediation

Upgrade Ubuntu:25.10 openssl to version 3.5.3-1ubuntu3.4 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45445
• https://github.com/openssl/security/commit/323f0b6e7d530a4cb4336d50c88cb70f3ac2a451
• https://github.com/openssl/security/commit/787a6dfba81b7b09c1e05ab31396c0cd7c36b3f7
• https://github.com/openssl/security/commit/7ac4715234ee72d9f3c93426a2c08554b5b771af
• https://github.com/openssl/security/commit/843c9b94ca9c2ed248bb30127bb4f3d7af0d607c
• https://github.com/openssl/security/commit/983d54b5cce8d16147548ed1a37892d1720bbab6
• https://openssl-library.org/news/secadv/20260609.txt
• https://github.com/openssl/openssl/commit/323f0b6e7d530a4cb4336d50c88cb70f3ac2a451
• https://github.com/openssl/openssl/commit/787a6dfba81b7b09c1e05ab31396c0cd7c36b3f7
• https://github.com/openssl/openssl/commit/7ac4715234ee72d9f3c93426a2c08554b5b771af
• https://github.com/openssl/openssl/commit/843c9b94ca9c2ed248bb30127bb4f3d7af0d607c
• https://github.com/openssl/openssl/commit/983d54b5cce8d16147548ed1a37892d1720bbab6

Cross-site Scripting (XSS)

Overview

golang.org/x/net/html is a package that implements an HTML5-compliant tokenizer and parser.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the inBodyEndTagOther() function, when rendering sanitized HTML. An attacker can cause the execution of scripts in the context of the affected application by providing malicious HTML input containing unmatched tags.

Details

Cross-site scripting (or XSS) is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and executed by the end user’s browser when the user interacts with the compromised website.

This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.

Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.

Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, < can be coded as &lt; and > can be coded as &gt; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses < and > as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.

The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.

Types of attacks

There are a few methods by which XSS can be manipulated:

Affected environments

The following environments are susceptible to an XSS attack:

• Web servers
• Application servers
• Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

• Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
• Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
• Give users the option to disable client-side scripts.
• Redirect invalid requests.
• Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
• Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
• Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade golang.org/x/net/html to version 0.55.0 or higher.

References

• GitHub Commit
• Go Advisory
• Go Commit
• Go Issue
• Google Groups Forum

Cross-site Scripting (XSS)

Overview

golang.org/x/net/html is a package that implements an HTML5-compliant tokenizer and parser.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the readStartTag() function in the Tokenizer. An attacker can cause the execution of scripts in the context of the affected application by supplying malicious HTML with duplicate attributes.

Details

Cross-site scripting (or XSS) is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and executed by the end user’s browser when the user interacts with the compromised website.

This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.

Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.

Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, < can be coded as &lt; and > can be coded as &gt; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses < and > as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.

The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.

Types of attacks

There are a few methods by which XSS can be manipulated:

Affected environments

The following environments are susceptible to an XSS attack:

• Web servers
• Application servers
• Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

• Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
• Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
• Give users the option to disable client-side scripts.
• Redirect invalid requests.
• Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
• Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
• Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade golang.org/x/net/html to version 0.55.0 or higher.

References

• GitHub Commit
• Go Advisory
• Go Commit
• Go Issue
• Google Groups Forum

Cross-site Scripting (XSS)

Overview

golang.org/x/net/html is a package that implements an HTML5-compliant tokenizer and parser.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the childTextNodesAreLiteral() function in `render.go. An attacker can cause the execution of scripts in the context of the affected application by providing malicious HTML input containing fostered elements that are outside their parent namespace.

Details

Cross-site scripting (or XSS) is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and executed by the end user’s browser when the user interacts with the compromised website.

This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.

Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.

Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, < can be coded as &lt; and > can be coded as &gt; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses < and > as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.

The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.

Types of attacks

There are a few methods by which XSS can be manipulated:

Affected environments

The following environments are susceptible to an XSS attack:

• Web servers
• Application servers
• Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

• Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
• Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
• Give users the option to disable client-side scripts.
• Redirect invalid requests.
• Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
• Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
• Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade golang.org/x/net/html to version 0.55.0 or higher.

References

• GitHub Commit
• Go Advisory
• Go Commit
• Go Issue
• Google Groups Forum

Cross-site Scripting (XSS)

Overview

golang.org/x/net/html is a package that implements an HTML5-compliant tokenizer and parser.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the writeQuoted() function, which does not properly handle > characters in DOCTYPE data. An attacker can cause the execution of scripts in the context of the affected application by providing malicious HTML input that contains unescaped >s.

Details

Cross-site scripting (or XSS) is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and executed by the end user’s browser when the user interacts with the compromised website.

This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.

Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.

Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, < can be coded as &lt; and > can be coded as &gt; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses < and > as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.

The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.

Types of attacks

There are a few methods by which XSS can be manipulated:

Affected environments

The following environments are susceptible to an XSS attack:

• Web servers
• Application servers
• Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

• Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
• Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
• Give users the option to disable client-side scripts.
• Redirect invalid requests.
• Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
• Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
• Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade golang.org/x/net/html to version 0.55.0 or higher.

References

• GitHub Commit
• Go Advisory
• Go Commit
• Go Issue
• Google Groups Forum

Inefficient Algorithmic Complexity

Overview

golang.org/x/net/html is a package that implements an HTML5-compliant tokenizer and parser.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in parse.go, when checking attributes iteratively. An attacker can cause excessive CPU consumption by providing malicious HTML input.

Remediation

Upgrade golang.org/x/net/html to version 0.55.0 or higher.

References

• GitHub Commit
• Go Advisory
• Go Commit
• Go Issue
• Google Groups Forum

Improper Check for Dropped Privileges

Overview

Affected versions of this package are vulnerable to Improper Check for Dropped Privileges due to the omission of constraint extensions such as restrict-destination-v00@openssh.com when adding a key to a remote agent. An attacker can bypass intended key usage restrictions by forwarding keys without the associated constraints, enabling unrestricted use of the key on the remote host.

Remediation

Upgrade golang.org/x/crypto/ssh/agent to version 0.52.0 or higher.

References

• Go Advisory
• Go Commit
• Go Issue
• Google Groups Forum

Missing Authorization

Overview

Affected versions of this package are vulnerable to Missing Authorization due to the NewKeyring function not enforcing the ConfirmBeforeUse constraint. An attacker can perform unauthorized signing operations by adding keys with constraints that are silently ignored.

Remediation

Upgrade golang.org/x/crypto/ssh/agent to version 0.52.0 or higher.

References

• Go Advisory
• Go Commit
• Go Commit
• Go Issue
• Google Groups Forum

Allocation of Resources Without Limits or Throttling

Overview

golang.org/x/crypto/ssh is a SSH client and server

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the public key parsers. An attacker can exhaust CPU resources by submitting crafted RSA or DSA public keys with excessively large parameters during signature verification. This can be triggered by unauthenticated clients during public key authentication.

Remediation

Upgrade golang.org/x/crypto/ssh to version 0.52.0 or higher.

References

• Go Advisory
• Go Commit
• Go Commit
• Go Issue
• Google Groups Forum

Integer Overflow or Wraparound

Overview

golang.org/x/crypto/ssh is a SSH client and server

Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the payload size calculation within the Write process. An attacker can cause the process to enter an infinite loop and exhaust system resources by sending a single write operation with data larger than 4GB.

Remediation

Upgrade golang.org/x/crypto/ssh to version 0.52.0 or higher.

References

• Go Advisory
• Go Commit
• Go Issue
• Google Groups Forum

Missing Release of Resource after Effective Lifetime

Overview

golang.org/x/crypto/ssh is a SSH client and server

Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime through the handling of unsolicited global request responses, which can fill an internal buffer and block the connection's read loop. An attacker can cause a resource leak and prevent the release of blocked goroutines by sending unexpected responses.

Remediation

Upgrade golang.org/x/crypto/ssh to version 0.52.0 or higher.

References

• Go Advisory
• Go Commit
• Go Commit
• Go Issue
• Google Groups Forum

Incorrect Authorization

Overview

golang.org/x/crypto/ssh is a SSH client and server

Affected versions of this package are vulnerable to Incorrect Authorization. When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

Remediation

Upgrade golang.org/x/crypto/ssh to version 0.52.0 or higher.

References

• Go Advisory
• Go Commit
• Go Issue
• Google Groups Forum

Incorrect Authorization

Overview

golang.org/x/crypto/ssh is a SSH client and server

Affected versions of this package are vulnerable to Incorrect Authorization due to improper enforcement of permissions in the VerifiedPublicKeyCallback process. An attacker can bypass source-address validation by passing a callback type other than public key.

Remediation

Upgrade golang.org/x/crypto/ssh to version 0.52.0 or higher.

References

• Go Advisory
• Go Commit
• Go Issue
• Google Groups Forum

Memory Allocation with Excessive Size Value

Overview

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the Parse function. An attacker can exhaust CPU resources and generate excessive log output by sending oversized or malformed headers that are processed without length checks.

Remediation

Upgrade go.opentelemetry.io/otel/propagation to version 1.44.0 or higher.

References

• GitHub Advisory
• GitHub Commit

Improper Verification of Cryptographic Signature

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnupg2 package and not the gnupg2 package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

Remediation

There is no fixed version for Ubuntu:25.10 gnupg2.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-68972
• https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i
• https://news.ycombinator.com/item?id=46404339
• https://gpg.fail/formfeed

CVE-2026-4437

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.

Remediation

There is no fixed version for Ubuntu:25.10 glibc.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-4437
• https://sourceware.org/bugzilla/show_bug.cgi?id=34014

CVE-2026-4438

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.

Remediation

There is no fixed version for Ubuntu:25.10 glibc.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-4438
• https://sourceware.org/bugzilla/show_bug.cgi?id=34015

CVE-2026-4046

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.

This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.

Remediation

There is no fixed version for Ubuntu:25.10 glibc.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-4046
• https://sourceware.org/bugzilla/show_bug.cgi?id=33980
• https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0007;hb=HEAD
• https://inbox.sourceware.org/libc-announce/76814edf-cf7f-47ec-979d-2dce0a2c76bf@gotplt.org/T/#u

CVE-2026-6238

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to validate the RDATA content against the RDATA length in a DNS response when processing LOC, CERT, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.

These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.

Remediation

There is no fixed version for Ubuntu:25.10 glibc.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-6238
• https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u
• https://sourceware.org/bugzilla/show_bug.cgi?id=34069

CVE-2026-5435

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.

Remediation

There is no fixed version for Ubuntu:25.10 glibc.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-5435
• https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u
• https://sourceware.org/bugzilla/show_bug.cgi?id=34033

Improper Validation of Specified Type of Input

Overview

Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in the calls plugin when handling websocket messages containing malformed msgpack frames. An attacker can cause the server to consume excessive memory and crash by sending specially crafted websocket requests.

Remediation

There is no fixed version for github.com/vmihailenco/msgpack/v5.

References

• GitHub Commit
• Mattermost Security Updates

MPL-2.0 license

MPL-2.0 license

MPL-2.0 license

MPL-2.0 license

MPL-2.0 license

MPL-2.0 license

MPL-2.0 license

MPL-2.0 license

MPL-2.0 license

MPL-2.0 license

MPL-2.0 license

MPL-2.0 license

MPL-2.0 license

MPL-2.0 license

Directory Traversal

Overview

Affected versions of this package are vulnerable to Directory Traversal due to improper path validation in the repository checkout process. An attacker can modify files outside the intended target directory, including .git directories, by supplying a maliciously crafted repository payload. This is only exploitable if the repository is cloned or checked out from untrusted sources and the .git directory is stored within the same filesystem as the worktree, particularly when submodules are present.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

• Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa
        

Note %2e is the URL encoded version of . (dot).

• Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
        2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys
        

Remediation

Upgrade github.com/go-git/go-git/v5/storage/filesystem/dotgit to version 5.19.1, 6.0.0-alpha.4 or higher.

References

• GitHub Advisory
• GitHub Commit

Improper Validation of Integrity Check Value

Overview

Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value for .idx and .pack files. An attacker can cause the application to consume corrupted files, leading to unexpected errors, due to checksums not being checked in the loadIdxFile() function.

Workaround

This vulnerability can be mitigated by running 'git fsck' from the git CLI to check for data corruption on a given repository.

Remediation

Upgrade github.com/go-git/go-git/v5/storage/filesystem to version 5.16.5 or higher.

References

• GitHub Commit
• GitHub Release

Allocation of Resources Without Limits or Throttling

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the parsing of maliciously crafted Git repository data, such as .pack, .idx, or loose objects. An attacker can cause the application to panic by providing a payload that exceeds the declared size of a slice for isCopyFromDelta(), or consume excessive resources by sending an unlimited stream of calls to isCopyFromDelta() or a stream of calls with excessively large targetSz values (i.e. amplification).

Note: This is only exploitable if the attacker can alter read-only files in the local repository's .git/objects/pack/ directory or if the user interacts with a malicious remote server.

Remediation

Upgrade github.com/go-git/go-git/v5/plumbing/format/packfile to version 5.19.1 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit

Allocation of Resources Without Limits or Throttling

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the handling of .idx files. An attacker with write access to the local repository's .git directory can exhaust system memory by introducing a maliciously crafted .idx file into the .git directory.

Remediation

Upgrade github.com/go-git/go-git/v5/plumbing/format/index to version 5.17.1 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit

Improper Validation of Array Index

Overview

Affected versions of this package are vulnerable to Improper Validation of Array Index through improper validation in the index decoding for version 4 files. An attacker with write access to the .git directory to modify or inject the index file can cause a panic and terminate the process by supplying a maliciously crafted .git/index file that triggers an out-of-bounds slice operation during index parsing.

Remediation

Upgrade github.com/go-git/go-git/v5/plumbing/format/index to version 5.17.1 or higher.

References

• GitHub Advisory
• GitHub Commit

Allocation of Resources Without Limits or Throttling

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the parsing of maliciously crafted Git repository data, such as .pack, .idx, or loose objects. An attacker can cause the application to panic by providing a payload that exceeds the declared size of a slice for isCopyFromDelta(), or consume excessive resources by sending an unlimited stream of calls to isCopyFromDelta() or a stream of calls with excessively large targetSz values (i.e. amplification).

Note: This is only exploitable if the attacker can alter read-only files in the local repository's .git/objects/pack/ directory or if the user interacts with a malicious remote server.

Remediation

Upgrade github.com/go-git/go-git/v5/plumbing/format/idxfile to version 5.19.1 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit

Improper Encoding or Escaping of Output

NVD Description

Note: Versions mentioned in the description apply only to the upstream git package and not the git package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called "sideband channel". These messages will be prefixed with "remote:" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information, or to mislead the user into executing untrusted scripts. As requested on the git-security mailing list, the patches are under discussion on the public mailing list. Users are advised to update as soon as possible. Users unable to upgrade should avoid recursive clones unless they are from trusted sources.

Remediation

There is no fixed version for Ubuntu:25.10 git.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2024-52005
• https://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329
• https://lore.kernel.org/git/1M9FnZ-1taoNo1wwh-00ESSd@mail.gmx.net

Algorithmic Complexity

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:25.10 relevant fixed versions and status.

In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.

Remediation

There is no fixed version for Ubuntu:25.10 expat.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-66382
• https://github.com/libexpat/libexpat/issues/1076
• http://www.openwall.com/lists/oss-security/2025/12/02/1
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html
• https://cert-portal.siemens.com/productcert/html/ssa-253495.html