{"grype_matches":[{"artifact":{"id":"6828f0176c654c6d","cpes":["cpe:2.3:a:openssl-fips-provider-latest:openssl-fips-provider-latest:1\\:3.5.7-2.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-fips-provider-latest:openssl_fips_provider_latest:1\\:3.5.7-2.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_fips_provider_latest:openssl-fips-provider-latest:1\\:3.5.7-2.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_fips_provider_latest:openssl_fips_provider_latest:1\\:3.5.7-2.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-fips-provider:openssl-fips-provider-latest:1\\:3.5.7-2.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-fips-provider:openssl_fips_provider_latest:1\\:3.5.7-2.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_fips_provider:openssl-fips-provider-latest:1\\:3.5.7-2.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_fips_provider:openssl_fips_provider_latest:1\\:3.5.7-2.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-fips:openssl-fips-provider-latest:1\\:3.5.7-2.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-fips:openssl_fips_provider_latest:1\\:3.5.7-2.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_fips:openssl-fips-provider-latest:1\\:3.5.7-2.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_fips:openssl_fips_provider_latest:1\\:3.5.7-2.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:openssl-fips-provider-latest:1\\:3.5.7-2.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:openssl_fips_provider_latest:1\\:3.5.7-2.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-fips-provider-latest:1\\:3.5.7-2.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_fips_provider_latest:1\\:3.5.7-2.amzn2023.0.2:*:*:*:*:*:*:*"],"name":"openssl-fips-provider-latest","purl":"pkg:rpm/amzn/openssl-fips-provider-latest@3.5.7-2.amzn2023.0.2?arch=x86_64&distro=amzn-2023&epoch=1&upstream=openssl-3.5.7-2.amzn2023.0.2.src.rpm","type":"rpm","version":"1:3.5.7-2.amzn2023.0.2","language":"","licenses":["ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:fae7516be161dd7b75539487dbdd190ad7811e3177436d8c27328e8d0710a964","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.7-2.amzn2023.0.2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-1.amzn2023.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-2136","versionConstraint":"< 3.5.8-1.amzn2023.0.1 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"openssl-fips-provider-latest","version":"1:3.5.7-2.amzn2023.0.2"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"3.5.8-1.amzn2023.0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-2136","versionConstraint":"< 3.5.8-1.amzn2023.0.1 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"openssl","version":"3.5.7-2.amzn2023.0.2"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-2136","fix":{"state":"fixed","versions":["3.5.8-1.amzn2023.0.1"],"available":[{"date":"2026-09-14","kind":"advisory","version":"3.5.8-1.amzn2023.0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-14457","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-18798","cwe":"CWE-415","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-54874","cwe":"CWE-405","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-63073","cwe":"CWE-134","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-63074","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-63075","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-63076","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-75803","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-14457","date":"2026-10-10","epss":0.01021,"percentile":0.62388},{"cve":"CVE-2026-18798","date":"2026-10-10","epss":0.01537,"percentile":0.74152},{"cve":"CVE-2026-54874","date":"2026-10-10","epss":0.00622,"percentile":0.48271},{"cve":"CVE-2026-63072","date":"2026-10-10","epss":0.00916,"percentile":0.59051},{"cve":"CVE-2026-63073","date":"2026-10-10","epss":0.01159,"percentile":0.66188},{"cve":"CVE-2026-63074","date":"2026-10-10","epss":0.00588,"percentile":0.46511},{"cve":"CVE-2026-63075","date":"2026-10-10","epss":0.00778,"percentile":0.54553},{"cve":"CVE-2026-63076","date":"2026-10-10","epss":0.01602,"percentile":0.7512},{"cve":"CVE-2026-75803","date":"2026-10-10","epss":0.00232,"percentile":0.1291}],"risk":0.76575,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-2136.html","description":"Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs)enabled, and only the private key (with no associated certificate) configured locally,a NULL pointer dereference may occur when the remote peer solicits raw public keys andalso sends the typically omitted \"signature_algorithms_cert\" TLS extension.Impact summary: The impact is limited to a possible Denial of Service as a result ofan application abort, no data disclosure or remote command execution are possible.CWE: CWE-476: NULL Pointer DereferenceDescription: While a passing comment in sample code in the documentation suggeststhat key-only RPK configurations are supported, the best-practice RPK configurationis to always configure a corresponding certificate (possibly self-signed orsigned by any convenient CA).When the private key is configured along with a matching certificate, the\"signature_algorithms_cert\" extension is handled reliably even without thefix, and peer clients or servers that don't support raw public keys may beable to complete a TLS connection by pinning or verifying the correspondingcertificate or its public key.Deployments that prefer to configure just a private key with no certificateneed to upgrade to an updated release as noted below.FIPS impact: noNo FIPS modules are affected by this issue, as the SSL protocol implementationis outside the OpenSSL FIPS module boundary. (CVE-2026-14457)Issue summary: QUIC server may double free QRX (QUIC record layer RX) objectwhen channel creation fails for initial packet.Impact summary: Double free leads to heap corruption, which typically results intermination of QUIC server process, leading to Denial of Service. There is sofar no evidence that this double free is exploitable for remote code execution,thus it is considered highly improbable.CWE: CWE-415: Double FreeDescription: In order to validate initial packet, OpenSSL QUIC stack defaultpacket handler (port_default_packet_handler()) creates a so-called QRX object.If the initial packet validates successfully with QRX object, the default packethandler proceeds to channel (connection object) creation. The QRX object usedfor packet validation is passed to port_bind_channel(), so it becomes part ofthe newly created connection. If port_bind_channel() fails, then it also freesthe QRX object. Once port_bind_channel() returns, the port_default_packet_handler()detects the failure and proceeds to the error branch, where the same QRX object isfreed for the second time.The failure in port_bind_channel() function can be induced with a relativelylow effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packetcarries DCID (destination connection ID) which is shorter than 8 bytes, thenport_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid()detects that the DCID has invalid length.FIPS impact: noThe FIPS module is not affected, as the QUIC implementation is outside ofthe OpenSSL FIPS module boundary. (CVE-2026-18798)Issue summary: Receiving a DTLS record for a future epoch while a handshakeis in progress causes OpenSSL to buffer far more memory than the recorditself requires.Impact summary: A peer can use a small amount of network traffic to make anOpenSSL DTLS endpoint retain a disproportionately large amount of memory,which may lead to a Denial of Service.CWE: CWE-405: Asymmetric Resource Consumption (Amplification)Description: While a DTLS handshake is in progress, a peer may legitimatelyhave already moved on to the next epoch (for example, having sent itsChangeCipherSpec and Finished messages) before the local endpoint hasprocessed the same transition, typically because of reordering on theunderlying UDP transport. OpenSSL buffers such early records so that theycan be processed once the local endpoint catches up.Buffering a record currently retains the entire read buffer it arrived in,which is sized to hold the largest possible DTLS record (around 16kilobytes), rather than just the bytes that make up the record itself. Upto 100 such records may be buffered per connection. As a result, a peerthat sends a stream of small forged records claiming to belong to the nextepoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes ofmemory, despite sending only a small fraction of that amount of data overthe network.An attacker therefore gains a memory amplification factor of around 1200,and can multiply the effect across as many associations as it is able toopen, making this a remote memory exhaustion Denial of Service risk forDTLS servers. Since the memory retained per connection remains bounded,and any limit an application already places on the number of concurrentassociations also bounds the total exposure, this issue has been assessedas Low severity.FIPS impact: noNo FIPS modules are affected by this issue as the affected code is outsidethe OpenSSL FIPS module boundary.OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to thisissue.OpenSSL 4.0 users should upgrade to OpenSSL 4.0.2.OpenSSL 3.6 users should upgrade to OpenSSL 3.6.4.OpenSSL 3.5 users should upgrade to OpenSSL 3.5.8.OpenSSL 3.4 users should upgrade to OpenSSL 3.4.7.OpenSSL 3.0 users should upgrade to OpenSSL 3.0.22.Premium support customers only:OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1ziOpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zrThis issue was reported on 18 May 2026 by Amazon Web Services.The fix has been developed by Matt Caswell.-- cut (non-publishing metadata for internal use) --Reported by: Amazon Web ServicesFixed by: Matt Caswell (CVE-2026-54874)Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer basedon querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitivecan write and cleanse more bytes than that query reports, causing an 8-byteout-of-bounds heap write.Impact summary: An attacker who supplies a crafted CMS message can trigger adeterministic 8-byte out-of-bounds heap write when the victim decrypts itwith CMS_decrypt(), corrupting the heap and typically resulting in a Denialof Service.CWE: CWE-787: Out-of-bounds WriteDescription: The key-wrap OID is potentially attacker-controlled on the wire.CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.An attacker can take a legitimate message and change a single OID byte toselect the padded variant while leaving the message otherwise valid. Sincethe unwrap key is derived from the recipient's private operation (ECDH keyagreement or ML-KEM decapsulation), the RFC 5649 integrity check cannotpass, and the decryption fails with integrity failure.The write is a fixed-size (8-byte), fixed-value (zero) heap overflowimmediately past the allocation, requires no special configuration, and isreachable from the public CMS_decrypt() function. The consequence isa heap corruption leading to a Denial of Service. The fix in the CMS codesizes the unwrap output buffer for the worst case so a failed unwrap cannotwrite past the allocation.FIPS impact: noAs the CMS code lives outside the FIPS module boundary, no FIPSmodules are affected by this CVE. (CVE-2026-63072)Issue summary: OpenSSL CMP response validation passed an unexpected responsesender distinguished name directly as the format string to `ERR_raise_data()`.Impact summary: A malicious or intercepted CMP endpoint can crash a CMP clientthat enforces an expected sender or uses a pinned server certificate whosesubject becomes the default expected sender.CWE: CWE-134 (Use of Externally-Controlled Format String)Description: When validating a received CMP message, ossl_cmp_msg_check_update()converts the peer-supplied sender distinguished name with X509_NAME_oneline()and passes it directly as the format argument to ERR_raise_data(). Percentcharacters survive the conversion, so a sender DN such as \"CN=%s%n\" reachesBIO_vsnprintf() as an attacker-controlled format string with no matching variadicarguments. This path is only reached when the caller configures an expectedsender or pins a server certificate, which is the normal configuration for aCMP client validating server responses.Since the attacker controls the format string but none of the variadicarguments, such specifiers as %s and %n dereference or write through unrelatedstack contents and crash the client. The reliable consequence is a denial ofservice, when the response comes from a malicious or intercepted CMP endpoint.There is no controlled memory write, arbitrary-address read, or reliable pathto remote code execution.FIPS impact: noNo FIPS modules are affected by this issue, as the CMP protocolimplementation is outside the OpenSSL FIPS module boundary. (CVE-2026-63073)Issue summary: The OpenSSL Certificate Management Protocol (CMP) cachesadditional certificates (extraCerts) sent in a CMP message, but never expungesthem (for instance if they are invalid).  If a server reuses an OSSL_CMP_CTXfrequently, this cache of extraCerts may grow unboundedly, and a maliciousclient may flood a CMP server with requests driving this growth.Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTXfor the lifetime of a server process may observe unbounded memory growth in theevent a malicious client repeatedly sends requests containing unique extracertificates, which may lead to OOM conditions.CWE: CWE-770: Allocation of Resources Without Limits or ThrottlingDescription: If a remote user sends CMP messages to a server with a list ofextraCerts and the message is rejected, the extraCerts from the message remainsin the server contexts untrusted certificate stack.  This exposes servers withlong lived ctx objects to Denial of Service attacks in which an attacker sendsmessages intending to be rejected with a large list of additional certificatesrepeatedly, forcing the server to store them indefinitely.The issue was fixed by removing the added extra certs if the message isrejected, using the same method as when the context is configured to not docaching at all.FIPS impact: noAs the CMP code lives outside the FIPS module boundary, no FIPSmodules are affected by this CVE. (CVE-2026-63074)Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedlysends ack-eliciting packets while not acknowledging ACK-only responses, theQUIC stack can retain ACK-only packet metadata for the lifetime of theconnection.Impact summary: A remote peer that can complete a QUIC handshake cancause connection-scoped memory growth which may lead to Denial of Servicethrough memory exhaustion, especially with sustained traffic or many concurrentQUIC connections.CWE: CWE-770: Allocation of Resources Without Limits or ThrottlingDescription: When the OpenSSL QUIC stack sends an ACK-only packet,there is no requirement by the QUIC protocol that the peer will acknowledgethat ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSLimplementation stores the metadata about the ACK frames regardless.In and of itself that's ok, but if a malicious peer establishes a connection, andthen drives the connection such that ACK-only packets are forced from theOpenSSL implementation peer (i.e., by sending numerous PING frames),and then withholding any subsequent acks for ack-eliciting data, likelegitimate data, said malicious peer can force inappropriate memory growthon the OpenSSL peer, potentially leading to a Denial of Service.The fix is to ensure that we account for the transmission of the ACK-onlypacket in the packet histories high and low watermark without actually storingthe ACK-only packet metadata itself.FIPS impact: noThe OpenSSL FIPS module is not affected as the QUIC code isoutside the FIPS module boundary. (CVE-2026-63075)Issue summary: OpenSSL CMP password based protection verification onlychecks whether the protectionAlg parameter was not NULL and not itsASN.1 type, before treating it as a PBMParameter. A crafted message cancontain a parameter of a different type, which is then dereferenced as aninvalid pointer.Impact summary: A remote, unauthenticated attacker can crash an applicationacting as a CMP server that accepts PBM-protected messages, or a CMP clienttalking to a malicious or intercepted CMP server, resulting in a Denial ofService.CWE: CWE-476: NULL Pointer DereferenceDescription: When verifying the password-based MAC protection of a CMPmessage, OpenSSL library reads the protectionAlg algorithm parameter withX509_ALGOR_get0(), which returns both the parameter type and its valuepointer. The value is then cast to an ASN1_STRING and treated as theexpected PBMParameter after only checking that pointer is not NULL. Theparameter type returned by X509_ALGOR_get0() was never consulted.This happens during protection verification, before any MAC is computed, sono knowledge of the PBM shared secret is required; the only precondition isthat PBM verification is reachable. On the server side this is reached fromOSSL_CMP_SRV_process_request() for any application that stands up a CMPserver accepting PBM-protected messages, and on the client side from CMPresponse validation against a malicious or on-path (MITM) server. Thereliable consequence is a denial of service; there is no memory disclosure,no controlled memory write, and no path to code execution. CMP is aspecialized feature that an application must explicitly enable.FIPS impact: noAs the CMP code lives outside the FIPS module boundary, no FIPS modulesare affected by this CVE. (CVE-2026-63076)Check the tag on EVP_Cipher() finalize: Poly1305 and OCB AEADs (CVE-2026-75803)"},"relatedVulnerabilities":[{"id":"CVE-2026-14457","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14457","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-14457","date":"2026-10-10","epss":0.01021,"percentile":0.62388}],"urls":["https://github.com/openssl/openssl/commit/1e8c398db67404babd3e5af999bb6bd86f720c76","https://github.com/openssl/openssl/commit/581aaa0f0a35d214740f0fe1f5283ec41f1212e1","https://github.com/openssl/openssl/commit/d0af20478688a6aa2f59d61caa3f82136b181d7f","https://github.com/openssl/openssl/commit/dad836b071da6579510c968615848ba03cac593b","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14457","description":"Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs)\nenabled, and only the private key (with no associated certificate) configured locally,\na NULL pointer dereference may occur when the remote peer solicits raw public keys and\nalso sends the typically omitted \"signature_algorithms_cert\" TLS extension.\n\nImpact summary: The impact is limited to a possible Denial of Service as a result of\nan application abort, no data disclosure or remote command execution are possible.\n\nCWE: CWE-476: NULL Pointer Dereference\n\nDescription: While a passing comment in sample code in the documentation suggests\nthat key-only RPK configurations are supported, the best-practice RPK configuration\nis to always configure a corresponding certificate (possibly self-signed or\nsigned by any convenient CA).\n\nWhen the private key is configured along with a matching certificate, the\n\"signature_algorithms_cert\" extension is handled reliably even without the\nfix, and peer clients or servers that don't support raw public keys may be\nable to complete a TLS connection by pinning or verifying the corresponding\ncertificate or its public key.\n\nDeployments that prefer to configure just a private key with no certificate\nneed to upgrade to an updated release as noted below.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue, as the SSL protocol implementation\nis outside the OpenSSL FIPS module boundary."},{"id":"CVE-2026-18798","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18798","cwe":"CWE-415","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-18798","date":"2026-10-10","epss":0.01537,"percentile":0.74152}],"urls":["https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af","https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c","https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18798","description":"Issue summary: QUIC server may double free QRX (QUIC record layer RX) object\nwhen channel creation fails for initial packet.\n\nImpact summary: Double free leads to heap corruption, which typically results in \ntermination of QUIC server process, leading to Denial of Service. There is so\nfar no evidence that this double free is exploitable for remote code execution,\nthus it is considered highly improbable.\n\nCWE: CWE-415: Double Free\n\nDescription: In order to validate initial packet, OpenSSL QUIC stack default\npacket handler (port_default_packet_handler()) creates a so-called QRX object.\nIf the initial packet validates successfully with QRX object, the default packet\nhandler proceeds to channel (connection object) creation. The QRX object used\nfor packet validation is passed to port_bind_channel(), so it becomes part of\nthe newly created connection. If port_bind_channel() fails, then it also frees\nthe QRX object. Once port_bind_channel() returns, the port_default_packet_handler()\ndetects the failure and proceeds to the error branch, where the same QRX object is\nfreed for the second time.\n\nThe failure in port_bind_channel() function can be induced with a relatively\nlow effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet\ncarries DCID (destination connection ID) which is shorter than 8 bytes, then\nport_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid()\ndetects that the DCID has invalid length.\n\nFIPS impact: no\nThe FIPS module is not affected, as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."},{"id":"CVE-2026-54874","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54874","cwe":"CWE-405","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54874","date":"2026-10-10","epss":0.00622,"percentile":0.48271}],"urls":["https://github.com/openssl/openssl/commit/4808b5d64176451f3d93d87d0ac9c81a9b13fb23","https://github.com/openssl/openssl/commit/7110cb2f75806d0bf809eb2f90790d477900be40","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://github.com/openssl/openssl/commit/cc0c6710917cd5eec001b297355d2ba723505107","https://github.com/openssl/openssl/commit/f52ffc11b90737ac89083909618dc2e1f42c561c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54874","description":"Issue summary: Receiving a DTLS record for a future epoch while a handshake\nis in progress causes OpenSSL to buffer far more memory than the record\nitself requires.\n\nImpact summary: A peer can use a small amount of network traffic to make an\nOpenSSL DTLS endpoint retain a disproportionately large amount of memory,\nwhich may lead to a Denial of Service.\n\nCWE: CWE-405: Asymmetric Resource Consumption (Amplification)\n\nDescription: While a DTLS handshake is in progress, a peer may legitimately\nhave already moved on to the next epoch (for example, having sent its\nChangeCipherSpec and Finished messages) before the local endpoint has\nprocessed the same transition, typically because of reordering on the\nunderlying UDP transport. OpenSSL buffers such early records so that they\ncan be processed once the local endpoint catches up.\n\nBuffering a record currently retains the entire read buffer it arrived in,\nwhich is sized to hold the largest possible DTLS record (around 16\nkilobytes), rather than just the bytes that make up the record itself. Up\nto 100 such records may be buffered per connection. As a result, a peer\nthat sends a stream of small forged records claiming to belong to the next\nepoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of\nmemory, despite sending only a small fraction of that amount of data over\nthe network.\n\nAn attacker therefore gains a memory amplification factor of around 1200,\nand can multiply the effect across as many associations as it is able to\nopen, making this a remote memory exhaustion Denial of Service risk for\nDTLS servers. Since the memory retained per connection remains bounded,\nand any limit an application already places on the number of concurrent\nassociations also bounds the total exposure, this issue has been assessed\nas Low severity.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary.\n\nOpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this\nissue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.2.\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.4.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.8.\nOpenSSL 3.4 users should upgrade to OpenSSL 3.4.7.\nOpenSSL 3.0 users should upgrade to OpenSSL 3.0.22.\n\nPremium support customers only:\nOpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi\nOpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr\n\nThis issue was reported on 18 May 2026 by Amazon Web Services.\nThe fix has been developed by Matt Caswell.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Amazon Web Services\nFixed by: Matt Caswell"},{"id":"CVE-2026-63072","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-10-10","epss":0.00916,"percentile":0.59051}],"urls":["https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756","https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42","https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335","https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072","description":"Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-bounds heap write.\n\nImpact summary: An attacker who supplies a crafted CMS message can trigger a\ndeterministic 8-byte out-of-bounds heap write when the victim decrypts it\nwith CMS_decrypt(), corrupting the heap and typically resulting in a Denial\nof Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: The key-wrap OID is potentially attacker-controlled on the wire.\nCMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.\nAn attacker can take a legitimate message and change a single OID byte to\nselect the padded variant while leaving the message otherwise valid. Since\nthe unwrap key is derived from the recipient's private operation (ECDH key\nagreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot\npass, and the decryption fails with integrity failure.\n\nThe write is a fixed-size (8-byte), fixed-value (zero) heap overflow\nimmediately past the allocation, requires no special configuration, and is\nreachable from the public CMS_decrypt() function. The consequence is\na heap corruption leading to a Denial of Service. The fix in the CMS code\nsizes the unwrap output buffer for the worst case so a failed unwrap cannot\nwrite past the allocation.\n\nFIPS impact: no\n\nAs the CMS code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."},{"id":"CVE-2026-63073","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63073","cwe":"CWE-134","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63073","date":"2026-10-10","epss":0.01159,"percentile":0.66188}],"urls":["https://github.com/openssl/openssl/commit/0cc20b322639919aa423e90799d9a57c3b4b76ca","https://github.com/openssl/openssl/commit/6a0acc072b4d37a7cac1252a29c1ce1f00c5ec29","https://github.com/openssl/openssl/commit/7eb2e3ec9d1d4f35c8022fccd4b03398b3f33e21","https://github.com/openssl/openssl/commit/a7e5a6eea8fd3ccca6b6fbba031a5fbf8a3d93b4","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63073","description":"Issue summary: OpenSSL CMP response validation passed an unexpected response\nsender distinguished name directly as the format string to `ERR_raise_data()`.\n\nImpact summary: A malicious or intercepted CMP endpoint can crash a CMP client\nthat enforces an expected sender or uses a pinned server certificate whose\nsubject becomes the default expected sender.\n\nCWE: CWE-134 (Use of Externally-Controlled Format String)\n\nDescription: When validating a received CMP message, ossl_cmp_msg_check_update()\nconverts the peer-supplied sender distinguished name with X509_NAME_oneline()\nand passes it directly as the format argument to ERR_raise_data(). Percent\ncharacters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches\nBIO_vsnprintf() as an attacker-controlled format string with no matching variadic\narguments. This path is only reached when the caller configures an expected\nsender or pins a server certificate, which is the normal configuration for a\nCMP client validating server responses.\n\nSince the attacker controls the format string but none of the variadic\narguments, such specifiers as %s and %n dereference or write through unrelated\nstack contents and crash the client. The reliable consequence is a denial of\nservice, when the response comes from a malicious or intercepted CMP endpoint.\nThere is no controlled memory write, arbitrary-address read, or reliable path\nto remote code execution.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue, as the CMP protocol\nimplementation is outside the OpenSSL FIPS module boundary."},{"id":"CVE-2026-63074","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63074","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63074","date":"2026-10-10","epss":0.00588,"percentile":0.46511}],"urls":["https://github.com/openssl/openssl/commit/01e567978a55fba18142a230380c31296049fae7","https://github.com/openssl/openssl/commit/21a5d9658b0c66daace60e10ea18ff32a448de9f","https://github.com/openssl/openssl/commit/74ae7f6df47a5767c1010b88c47507dfc5b32c46","https://github.com/openssl/openssl/commit/75360af9650d4e0c82ba0050c5c9912cd79e54af","https://github.com/openssl/openssl/commit/f636f9ca0fa1bae5b42f9e787f025c96fb09c43a","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63074","description":"Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches\nadditional certificates (extraCerts) sent in a CMP message, but never expunges\nthem (for instance if they are invalid).  If a server reuses an OSSL_CMP_CTX\nfrequently, this cache of extraCerts may grow unboundedly, and a malicious\nclient may flood a CMP server with requests driving this growth.\n\nImpact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX\nfor the lifetime of a server process may observe unbounded memory growth in the\nevent a malicious client repeatedly sends requests containing unique extra\ncertificates, which may lead to OOM conditions.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: If a remote user sends CMP messages to a server with a list of\nextraCerts and the message is rejected, the extraCerts from the message remains\nin the server contexts untrusted certificate stack.  This exposes servers with\nlong lived ctx objects to Denial of Service attacks in which an attacker sends\nmessages intending to be rejected with a large list of additional certificates\nrepeatedly, forcing the server to store them indefinitely.\n   \nThe issue was fixed by removing the added extra certs if the message is\nrejected, using the same method as when the context is configured to not do\ncaching at all.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."},{"id":"CVE-2026-63075","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63075","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63075","date":"2026-10-10","epss":0.00778,"percentile":0.54553}],"urls":["https://github.com/openssl/openssl/commit/7308946576b12e64b8be53bcf0a120354b2b42bc","https://github.com/openssl/openssl/commit/7c98d79738549df92868e7dd9be4bbf061eed709","https://github.com/openssl/openssl/commit/bf84721c2548351176e367e6de505792f0118dc6","https://github.com/openssl/openssl/commit/c902e5f16d6a9e130e96d3ca6d8f64d71652e393","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63075","description":"Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly\nsends ack-eliciting packets while not acknowledging ACK-only responses, the\nQUIC stack can retain ACK-only packet metadata for the lifetime of the\nconnection.\n\nImpact summary: A remote peer that can complete a QUIC handshake can\ncause connection-scoped memory growth which may lead to Denial of Service\nthrough memory exhaustion, especially with sustained traffic or many concurrent\nQUIC connections.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: When the OpenSSL QUIC stack sends an ACK-only packet,\nthere is no requirement by the QUIC protocol that the peer will acknowledge\nthat ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL\nimplementation stores the metadata about the ACK frames regardless.\nIn and of itself that's ok, but if a malicious peer establishes a connection, and\nthen drives the connection such that ACK-only packets are forced from the \nOpenSSL implementation peer (i.e., by sending numerous PING frames),\nand then withholding any subsequent acks for ack-eliciting data, like\nlegitimate data, said malicious peer can force inappropriate memory growth\non the OpenSSL peer, potentially leading to a Denial of Service.\n\nThe fix is to ensure that we account for the transmission of the ACK-only\npacket in the packet histories high and low watermark without actually storing\nthe ACK-only packet metadata itself.\n\nFIPS impact: no\nThe OpenSSL FIPS module is not affected as the QUIC code is\noutside the FIPS module boundary."},{"id":"CVE-2026-63076","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63076","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63076","date":"2026-10-10","epss":0.01602,"percentile":0.7512}],"urls":["https://github.com/openssl/openssl/commit/37882aa2e0256e1072442a8f62f7db45b995c45b","https://github.com/openssl/openssl/commit/a17cc8d612ecff6d94a9b7ca8b5283ddf5ff570e","https://github.com/openssl/openssl/commit/a1f348ccb328c3afbd4ba6883f9b7c813c043259","https://github.com/openssl/openssl/commit/a7af46a92d0ce19a90e669ef56d2576a07924226","https://github.com/openssl/openssl/commit/cdacfff557389abfa9e4615abded2ec984517d6c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63076","description":"Issue summary: OpenSSL CMP password based protection verification only\nchecks whether the protectionAlg parameter was not NULL and not its\nASN.1 type, before treating it as a PBMParameter. A crafted message can\ncontain a parameter of a different type, which is then dereferenced as an\ninvalid pointer.\n\nImpact summary: A remote, unauthenticated attacker can crash an application\nacting as a CMP server that accepts PBM-protected messages, or a CMP client\ntalking to a malicious or intercepted CMP server, resulting in a Denial of\nService.\n\nCWE: CWE-476: NULL Pointer Dereference\n\nDescription: When verifying the password-based MAC protection of a CMP\nmessage, OpenSSL library reads the protectionAlg algorithm parameter with\nX509_ALGOR_get0(), which returns both the parameter type and its value\npointer. The value is then cast to an ASN1_STRING and treated as the\nexpected PBMParameter after only checking that pointer is not NULL. The\nparameter type returned by X509_ALGOR_get0() was never consulted.\n\nThis happens during protection verification, before any MAC is computed, so\nno knowledge of the PBM shared secret is required; the only precondition is\nthat PBM verification is reachable. On the server side this is reached from\nOSSL_CMP_SRV_process_request() for any application that stands up a CMP\nserver accepting PBM-protected messages, and on the client side from CMP\nresponse validation against a malicious or on-path (MITM) server. The\nreliable consequence is a denial of service; there is no memory disclosure,\nno controlled memory write, and no path to code execution. CMP is a\nspecialized feature that an application must explicitly enable.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS modules\nare affected by this CVE."},{"id":"CVE-2026-75803","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75803","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75803","date":"2026-10-10","epss":0.00232,"percentile":0.1291}],"urls":["https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42","https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e05b","https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a","https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34","https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75803","description":"Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty\nciphertext can report success without verifying the supplied authentication\ntag when the operation is finalized by calling the EVP_Cipher() function.\n\nImpact summary: Applications calling EVP_Cipher() on an empty ciphertext and\nexpecting the call to check the AEAD tag may accept forged messages.\n\nCWE: CWE-354 (Improper Validation of Integrity Check Value)\n\nDescription: The EVP_Cipher() API call for AEAD ciphers behaves like a one\nshot encryption and decryption call. It also verifies the AEAD tag after the\ndecryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers\nit skipped the AEAD tag verification when an empty ciphertext was passed to\nthe function. The callers of this function might believe that a successful\nreturn indicates a valid AEAD tag for these ciphers, even when that has not\ntruly been validated in this case.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE\nas the affected algorithms are not FIPS approved and thus not implemented\nin the FIPS module."}]},{"artifact":{"id":"e1db5c22a31d1c89","cpes":["cpe:2.3:a:openssl-libs:openssl-libs:1\\:3.5.7-2.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:openssl-libs:openssl_libs:1\\:3.5.7-2.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl-libs:1\\:3.5.7-2.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:openssl_libs:openssl_libs:1\\:3.5.7-2.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:openssl-libs:1\\:3.5.7-2.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:openssl_libs:1\\:3.5.7-2.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl-libs:1\\:3.5.7-2.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl_libs:1\\:3.5.7-2.amzn2023.0.2:*:*:*:*:*:*:*"],"name":"openssl-libs","purl":"pkg:rpm/amzn/openssl-libs@3.5.7-2.amzn2023.0.2?arch=x86_64&distro=amzn-2023&epoch=1&upstream=openssl-3.5.7-2.amzn2023.0.2.src.rpm","type":"rpm","version":"1:3.5.7-2.amzn2023.0.2","language":"","licenses":["ASL 2.0"],"metadata":{"epoch":1,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:fae7516be161dd7b75539487dbdd190ad7811e3177436d8c27328e8d0710a964","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl","version":"3.5.7-2.amzn2023.0.2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.5.8-1.amzn2023.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-2136","versionConstraint":"< 3.5.8-1.amzn2023.0.1 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"openssl-libs","version":"1:3.5.7-2.amzn2023.0.2"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"3.5.8-1.amzn2023.0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-2136","versionConstraint":"< 3.5.8-1.amzn2023.0.1 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"openssl","version":"3.5.7-2.amzn2023.0.2"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-2136","fix":{"state":"fixed","versions":["3.5.8-1.amzn2023.0.1"],"available":[{"date":"2026-09-14","kind":"advisory","version":"3.5.8-1.amzn2023.0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-14457","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-18798","cwe":"CWE-415","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-54874","cwe":"CWE-405","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-63073","cwe":"CWE-134","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-63074","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-63075","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-63076","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-75803","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-14457","date":"2026-10-10","epss":0.01021,"percentile":0.62388},{"cve":"CVE-2026-18798","date":"2026-10-10","epss":0.01537,"percentile":0.74152},{"cve":"CVE-2026-54874","date":"2026-10-10","epss":0.00622,"percentile":0.48271},{"cve":"CVE-2026-63072","date":"2026-10-10","epss":0.00916,"percentile":0.59051},{"cve":"CVE-2026-63073","date":"2026-10-10","epss":0.01159,"percentile":0.66188},{"cve":"CVE-2026-63074","date":"2026-10-10","epss":0.00588,"percentile":0.46511},{"cve":"CVE-2026-63075","date":"2026-10-10","epss":0.00778,"percentile":0.54553},{"cve":"CVE-2026-63076","date":"2026-10-10","epss":0.01602,"percentile":0.7512},{"cve":"CVE-2026-75803","date":"2026-10-10","epss":0.00232,"percentile":0.1291}],"risk":0.76575,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-2136.html","description":"Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs)enabled, and only the private key (with no associated certificate) configured locally,a NULL pointer dereference may occur when the remote peer solicits raw public keys andalso sends the typically omitted \"signature_algorithms_cert\" TLS extension.Impact summary: The impact is limited to a possible Denial of Service as a result ofan application abort, no data disclosure or remote command execution are possible.CWE: CWE-476: NULL Pointer DereferenceDescription: While a passing comment in sample code in the documentation suggeststhat key-only RPK configurations are supported, the best-practice RPK configurationis to always configure a corresponding certificate (possibly self-signed orsigned by any convenient CA).When the private key is configured along with a matching certificate, the\"signature_algorithms_cert\" extension is handled reliably even without thefix, and peer clients or servers that don't support raw public keys may beable to complete a TLS connection by pinning or verifying the correspondingcertificate or its public key.Deployments that prefer to configure just a private key with no certificateneed to upgrade to an updated release as noted below.FIPS impact: noNo FIPS modules are affected by this issue, as the SSL protocol implementationis outside the OpenSSL FIPS module boundary. (CVE-2026-14457)Issue summary: QUIC server may double free QRX (QUIC record layer RX) objectwhen channel creation fails for initial packet.Impact summary: Double free leads to heap corruption, which typically results intermination of QUIC server process, leading to Denial of Service. There is sofar no evidence that this double free is exploitable for remote code execution,thus it is considered highly improbable.CWE: CWE-415: Double FreeDescription: In order to validate initial packet, OpenSSL QUIC stack defaultpacket handler (port_default_packet_handler()) creates a so-called QRX object.If the initial packet validates successfully with QRX object, the default packethandler proceeds to channel (connection object) creation. The QRX object usedfor packet validation is passed to port_bind_channel(), so it becomes part ofthe newly created connection. If port_bind_channel() fails, then it also freesthe QRX object. Once port_bind_channel() returns, the port_default_packet_handler()detects the failure and proceeds to the error branch, where the same QRX object isfreed for the second time.The failure in port_bind_channel() function can be induced with a relativelylow effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packetcarries DCID (destination connection ID) which is shorter than 8 bytes, thenport_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid()detects that the DCID has invalid length.FIPS impact: noThe FIPS module is not affected, as the QUIC implementation is outside ofthe OpenSSL FIPS module boundary. (CVE-2026-18798)Issue summary: Receiving a DTLS record for a future epoch while a handshakeis in progress causes OpenSSL to buffer far more memory than the recorditself requires.Impact summary: A peer can use a small amount of network traffic to make anOpenSSL DTLS endpoint retain a disproportionately large amount of memory,which may lead to a Denial of Service.CWE: CWE-405: Asymmetric Resource Consumption (Amplification)Description: While a DTLS handshake is in progress, a peer may legitimatelyhave already moved on to the next epoch (for example, having sent itsChangeCipherSpec and Finished messages) before the local endpoint hasprocessed the same transition, typically because of reordering on theunderlying UDP transport. OpenSSL buffers such early records so that theycan be processed once the local endpoint catches up.Buffering a record currently retains the entire read buffer it arrived in,which is sized to hold the largest possible DTLS record (around 16kilobytes), rather than just the bytes that make up the record itself. Upto 100 such records may be buffered per connection. As a result, a peerthat sends a stream of small forged records claiming to belong to the nextepoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes ofmemory, despite sending only a small fraction of that amount of data overthe network.An attacker therefore gains a memory amplification factor of around 1200,and can multiply the effect across as many associations as it is able toopen, making this a remote memory exhaustion Denial of Service risk forDTLS servers. Since the memory retained per connection remains bounded,and any limit an application already places on the number of concurrentassociations also bounds the total exposure, this issue has been assessedas Low severity.FIPS impact: noNo FIPS modules are affected by this issue as the affected code is outsidethe OpenSSL FIPS module boundary.OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to thisissue.OpenSSL 4.0 users should upgrade to OpenSSL 4.0.2.OpenSSL 3.6 users should upgrade to OpenSSL 3.6.4.OpenSSL 3.5 users should upgrade to OpenSSL 3.5.8.OpenSSL 3.4 users should upgrade to OpenSSL 3.4.7.OpenSSL 3.0 users should upgrade to OpenSSL 3.0.22.Premium support customers only:OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1ziOpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zrThis issue was reported on 18 May 2026 by Amazon Web Services.The fix has been developed by Matt Caswell.-- cut (non-publishing metadata for internal use) --Reported by: Amazon Web ServicesFixed by: Matt Caswell (CVE-2026-54874)Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer basedon querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitivecan write and cleanse more bytes than that query reports, causing an 8-byteout-of-bounds heap write.Impact summary: An attacker who supplies a crafted CMS message can trigger adeterministic 8-byte out-of-bounds heap write when the victim decrypts itwith CMS_decrypt(), corrupting the heap and typically resulting in a Denialof Service.CWE: CWE-787: Out-of-bounds WriteDescription: The key-wrap OID is potentially attacker-controlled on the wire.CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.An attacker can take a legitimate message and change a single OID byte toselect the padded variant while leaving the message otherwise valid. Sincethe unwrap key is derived from the recipient's private operation (ECDH keyagreement or ML-KEM decapsulation), the RFC 5649 integrity check cannotpass, and the decryption fails with integrity failure.The write is a fixed-size (8-byte), fixed-value (zero) heap overflowimmediately past the allocation, requires no special configuration, and isreachable from the public CMS_decrypt() function. The consequence isa heap corruption leading to a Denial of Service. The fix in the CMS codesizes the unwrap output buffer for the worst case so a failed unwrap cannotwrite past the allocation.FIPS impact: noAs the CMS code lives outside the FIPS module boundary, no FIPSmodules are affected by this CVE. (CVE-2026-63072)Issue summary: OpenSSL CMP response validation passed an unexpected responsesender distinguished name directly as the format string to `ERR_raise_data()`.Impact summary: A malicious or intercepted CMP endpoint can crash a CMP clientthat enforces an expected sender or uses a pinned server certificate whosesubject becomes the default expected sender.CWE: CWE-134 (Use of Externally-Controlled Format String)Description: When validating a received CMP message, ossl_cmp_msg_check_update()converts the peer-supplied sender distinguished name with X509_NAME_oneline()and passes it directly as the format argument to ERR_raise_data(). Percentcharacters survive the conversion, so a sender DN such as \"CN=%s%n\" reachesBIO_vsnprintf() as an attacker-controlled format string with no matching variadicarguments. This path is only reached when the caller configures an expectedsender or pins a server certificate, which is the normal configuration for aCMP client validating server responses.Since the attacker controls the format string but none of the variadicarguments, such specifiers as %s and %n dereference or write through unrelatedstack contents and crash the client. The reliable consequence is a denial ofservice, when the response comes from a malicious or intercepted CMP endpoint.There is no controlled memory write, arbitrary-address read, or reliable pathto remote code execution.FIPS impact: noNo FIPS modules are affected by this issue, as the CMP protocolimplementation is outside the OpenSSL FIPS module boundary. (CVE-2026-63073)Issue summary: The OpenSSL Certificate Management Protocol (CMP) cachesadditional certificates (extraCerts) sent in a CMP message, but never expungesthem (for instance if they are invalid).  If a server reuses an OSSL_CMP_CTXfrequently, this cache of extraCerts may grow unboundedly, and a maliciousclient may flood a CMP server with requests driving this growth.Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTXfor the lifetime of a server process may observe unbounded memory growth in theevent a malicious client repeatedly sends requests containing unique extracertificates, which may lead to OOM conditions.CWE: CWE-770: Allocation of Resources Without Limits or ThrottlingDescription: If a remote user sends CMP messages to a server with a list ofextraCerts and the message is rejected, the extraCerts from the message remainsin the server contexts untrusted certificate stack.  This exposes servers withlong lived ctx objects to Denial of Service attacks in which an attacker sendsmessages intending to be rejected with a large list of additional certificatesrepeatedly, forcing the server to store them indefinitely.The issue was fixed by removing the added extra certs if the message isrejected, using the same method as when the context is configured to not docaching at all.FIPS impact: noAs the CMP code lives outside the FIPS module boundary, no FIPSmodules are affected by this CVE. (CVE-2026-63074)Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedlysends ack-eliciting packets while not acknowledging ACK-only responses, theQUIC stack can retain ACK-only packet metadata for the lifetime of theconnection.Impact summary: A remote peer that can complete a QUIC handshake cancause connection-scoped memory growth which may lead to Denial of Servicethrough memory exhaustion, especially with sustained traffic or many concurrentQUIC connections.CWE: CWE-770: Allocation of Resources Without Limits or ThrottlingDescription: When the OpenSSL QUIC stack sends an ACK-only packet,there is no requirement by the QUIC protocol that the peer will acknowledgethat ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSLimplementation stores the metadata about the ACK frames regardless.In and of itself that's ok, but if a malicious peer establishes a connection, andthen drives the connection such that ACK-only packets are forced from theOpenSSL implementation peer (i.e., by sending numerous PING frames),and then withholding any subsequent acks for ack-eliciting data, likelegitimate data, said malicious peer can force inappropriate memory growthon the OpenSSL peer, potentially leading to a Denial of Service.The fix is to ensure that we account for the transmission of the ACK-onlypacket in the packet histories high and low watermark without actually storingthe ACK-only packet metadata itself.FIPS impact: noThe OpenSSL FIPS module is not affected as the QUIC code isoutside the FIPS module boundary. (CVE-2026-63075)Issue summary: OpenSSL CMP password based protection verification onlychecks whether the protectionAlg parameter was not NULL and not itsASN.1 type, before treating it as a PBMParameter. A crafted message cancontain a parameter of a different type, which is then dereferenced as aninvalid pointer.Impact summary: A remote, unauthenticated attacker can crash an applicationacting as a CMP server that accepts PBM-protected messages, or a CMP clienttalking to a malicious or intercepted CMP server, resulting in a Denial ofService.CWE: CWE-476: NULL Pointer DereferenceDescription: When verifying the password-based MAC protection of a CMPmessage, OpenSSL library reads the protectionAlg algorithm parameter withX509_ALGOR_get0(), which returns both the parameter type and its valuepointer. The value is then cast to an ASN1_STRING and treated as theexpected PBMParameter after only checking that pointer is not NULL. Theparameter type returned by X509_ALGOR_get0() was never consulted.This happens during protection verification, before any MAC is computed, sono knowledge of the PBM shared secret is required; the only precondition isthat PBM verification is reachable. On the server side this is reached fromOSSL_CMP_SRV_process_request() for any application that stands up a CMPserver accepting PBM-protected messages, and on the client side from CMPresponse validation against a malicious or on-path (MITM) server. Thereliable consequence is a denial of service; there is no memory disclosure,no controlled memory write, and no path to code execution. CMP is aspecialized feature that an application must explicitly enable.FIPS impact: noAs the CMP code lives outside the FIPS module boundary, no FIPS modulesare affected by this CVE. (CVE-2026-63076)Check the tag on EVP_Cipher() finalize: Poly1305 and OCB AEADs (CVE-2026-75803)"},"relatedVulnerabilities":[{"id":"CVE-2026-14457","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14457","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-14457","date":"2026-10-10","epss":0.01021,"percentile":0.62388}],"urls":["https://github.com/openssl/openssl/commit/1e8c398db67404babd3e5af999bb6bd86f720c76","https://github.com/openssl/openssl/commit/581aaa0f0a35d214740f0fe1f5283ec41f1212e1","https://github.com/openssl/openssl/commit/d0af20478688a6aa2f59d61caa3f82136b181d7f","https://github.com/openssl/openssl/commit/dad836b071da6579510c968615848ba03cac593b","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14457","description":"Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs)\nenabled, and only the private key (with no associated certificate) configured locally,\na NULL pointer dereference may occur when the remote peer solicits raw public keys and\nalso sends the typically omitted \"signature_algorithms_cert\" TLS extension.\n\nImpact summary: The impact is limited to a possible Denial of Service as a result of\nan application abort, no data disclosure or remote command execution are possible.\n\nCWE: CWE-476: NULL Pointer Dereference\n\nDescription: While a passing comment in sample code in the documentation suggests\nthat key-only RPK configurations are supported, the best-practice RPK configuration\nis to always configure a corresponding certificate (possibly self-signed or\nsigned by any convenient CA).\n\nWhen the private key is configured along with a matching certificate, the\n\"signature_algorithms_cert\" extension is handled reliably even without the\nfix, and peer clients or servers that don't support raw public keys may be\nable to complete a TLS connection by pinning or verifying the corresponding\ncertificate or its public key.\n\nDeployments that prefer to configure just a private key with no certificate\nneed to upgrade to an updated release as noted below.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue, as the SSL protocol implementation\nis outside the OpenSSL FIPS module boundary."},{"id":"CVE-2026-18798","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18798","cwe":"CWE-415","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-18798","date":"2026-10-10","epss":0.01537,"percentile":0.74152}],"urls":["https://github.com/openssl/openssl/commit/70cebd74d3592f5272945501b58a60374c4e13af","https://github.com/openssl/openssl/commit/967582d5037f01a26b6d19beae19af62a1b15c3c","https://github.com/openssl/openssl/commit/a14a1deac403522fbeafabcb198503cf6caa7dc4","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18798","description":"Issue summary: QUIC server may double free QRX (QUIC record layer RX) object\nwhen channel creation fails for initial packet.\n\nImpact summary: Double free leads to heap corruption, which typically results in \ntermination of QUIC server process, leading to Denial of Service. There is so\nfar no evidence that this double free is exploitable for remote code execution,\nthus it is considered highly improbable.\n\nCWE: CWE-415: Double Free\n\nDescription: In order to validate initial packet, OpenSSL QUIC stack default\npacket handler (port_default_packet_handler()) creates a so-called QRX object.\nIf the initial packet validates successfully with QRX object, the default packet\nhandler proceeds to channel (connection object) creation. The QRX object used\nfor packet validation is passed to port_bind_channel(), so it becomes part of\nthe newly created connection. If port_bind_channel() fails, then it also frees\nthe QRX object. Once port_bind_channel() returns, the port_default_packet_handler()\ndetects the failure and proceeds to the error branch, where the same QRX object is\nfreed for the second time.\n\nThe failure in port_bind_channel() function can be induced with a relatively\nlow effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet\ncarries DCID (destination connection ID) which is shorter than 8 bytes, then\nport_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid()\ndetects that the DCID has invalid length.\n\nFIPS impact: no\nThe FIPS module is not affected, as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary."},{"id":"CVE-2026-54874","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54874","cwe":"CWE-405","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54874","date":"2026-10-10","epss":0.00622,"percentile":0.48271}],"urls":["https://github.com/openssl/openssl/commit/4808b5d64176451f3d93d87d0ac9c81a9b13fb23","https://github.com/openssl/openssl/commit/7110cb2f75806d0bf809eb2f90790d477900be40","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://github.com/openssl/openssl/commit/cc0c6710917cd5eec001b297355d2ba723505107","https://github.com/openssl/openssl/commit/f52ffc11b90737ac89083909618dc2e1f42c561c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54874","description":"Issue summary: Receiving a DTLS record for a future epoch while a handshake\nis in progress causes OpenSSL to buffer far more memory than the record\nitself requires.\n\nImpact summary: A peer can use a small amount of network traffic to make an\nOpenSSL DTLS endpoint retain a disproportionately large amount of memory,\nwhich may lead to a Denial of Service.\n\nCWE: CWE-405: Asymmetric Resource Consumption (Amplification)\n\nDescription: While a DTLS handshake is in progress, a peer may legitimately\nhave already moved on to the next epoch (for example, having sent its\nChangeCipherSpec and Finished messages) before the local endpoint has\nprocessed the same transition, typically because of reordering on the\nunderlying UDP transport. OpenSSL buffers such early records so that they\ncan be processed once the local endpoint catches up.\n\nBuffering a record currently retains the entire read buffer it arrived in,\nwhich is sized to hold the largest possible DTLS record (around 16\nkilobytes), rather than just the bytes that make up the record itself. Up\nto 100 such records may be buffered per connection. As a result, a peer\nthat sends a stream of small forged records claiming to belong to the next\nepoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of\nmemory, despite sending only a small fraction of that amount of data over\nthe network.\n\nAn attacker therefore gains a memory amplification factor of around 1200,\nand can multiply the effect across as many associations as it is able to\nopen, making this a remote memory exhaustion Denial of Service risk for\nDTLS servers. Since the memory retained per connection remains bounded,\nand any limit an application already places on the number of concurrent\nassociations also bounds the total exposure, this issue has been assessed\nas Low severity.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary.\n\nOpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this\nissue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.2.\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.4.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.8.\nOpenSSL 3.4 users should upgrade to OpenSSL 3.4.7.\nOpenSSL 3.0 users should upgrade to OpenSSL 3.0.22.\n\nPremium support customers only:\nOpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi\nOpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr\n\nThis issue was reported on 18 May 2026 by Amazon Web Services.\nThe fix has been developed by Matt Caswell.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Amazon Web Services\nFixed by: Matt Caswell"},{"id":"CVE-2026-63072","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-10-10","epss":0.00916,"percentile":0.59051}],"urls":["https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756","https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42","https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335","https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072","description":"Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-bounds heap write.\n\nImpact summary: An attacker who supplies a crafted CMS message can trigger a\ndeterministic 8-byte out-of-bounds heap write when the victim decrypts it\nwith CMS_decrypt(), corrupting the heap and typically resulting in a Denial\nof Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: The key-wrap OID is potentially attacker-controlled on the wire.\nCMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.\nAn attacker can take a legitimate message and change a single OID byte to\nselect the padded variant while leaving the message otherwise valid. Since\nthe unwrap key is derived from the recipient's private operation (ECDH key\nagreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot\npass, and the decryption fails with integrity failure.\n\nThe write is a fixed-size (8-byte), fixed-value (zero) heap overflow\nimmediately past the allocation, requires no special configuration, and is\nreachable from the public CMS_decrypt() function. The consequence is\na heap corruption leading to a Denial of Service. The fix in the CMS code\nsizes the unwrap output buffer for the worst case so a failed unwrap cannot\nwrite past the allocation.\n\nFIPS impact: no\n\nAs the CMS code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."},{"id":"CVE-2026-63073","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63073","cwe":"CWE-134","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63073","date":"2026-10-10","epss":0.01159,"percentile":0.66188}],"urls":["https://github.com/openssl/openssl/commit/0cc20b322639919aa423e90799d9a57c3b4b76ca","https://github.com/openssl/openssl/commit/6a0acc072b4d37a7cac1252a29c1ce1f00c5ec29","https://github.com/openssl/openssl/commit/7eb2e3ec9d1d4f35c8022fccd4b03398b3f33e21","https://github.com/openssl/openssl/commit/a7e5a6eea8fd3ccca6b6fbba031a5fbf8a3d93b4","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63073","description":"Issue summary: OpenSSL CMP response validation passed an unexpected response\nsender distinguished name directly as the format string to `ERR_raise_data()`.\n\nImpact summary: A malicious or intercepted CMP endpoint can crash a CMP client\nthat enforces an expected sender or uses a pinned server certificate whose\nsubject becomes the default expected sender.\n\nCWE: CWE-134 (Use of Externally-Controlled Format String)\n\nDescription: When validating a received CMP message, ossl_cmp_msg_check_update()\nconverts the peer-supplied sender distinguished name with X509_NAME_oneline()\nand passes it directly as the format argument to ERR_raise_data(). Percent\ncharacters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches\nBIO_vsnprintf() as an attacker-controlled format string with no matching variadic\narguments. This path is only reached when the caller configures an expected\nsender or pins a server certificate, which is the normal configuration for a\nCMP client validating server responses.\n\nSince the attacker controls the format string but none of the variadic\narguments, such specifiers as %s and %n dereference or write through unrelated\nstack contents and crash the client. The reliable consequence is a denial of\nservice, when the response comes from a malicious or intercepted CMP endpoint.\nThere is no controlled memory write, arbitrary-address read, or reliable path\nto remote code execution.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue, as the CMP protocol\nimplementation is outside the OpenSSL FIPS module boundary."},{"id":"CVE-2026-63074","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63074","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63074","date":"2026-10-10","epss":0.00588,"percentile":0.46511}],"urls":["https://github.com/openssl/openssl/commit/01e567978a55fba18142a230380c31296049fae7","https://github.com/openssl/openssl/commit/21a5d9658b0c66daace60e10ea18ff32a448de9f","https://github.com/openssl/openssl/commit/74ae7f6df47a5767c1010b88c47507dfc5b32c46","https://github.com/openssl/openssl/commit/75360af9650d4e0c82ba0050c5c9912cd79e54af","https://github.com/openssl/openssl/commit/f636f9ca0fa1bae5b42f9e787f025c96fb09c43a","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63074","description":"Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches\nadditional certificates (extraCerts) sent in a CMP message, but never expunges\nthem (for instance if they are invalid).  If a server reuses an OSSL_CMP_CTX\nfrequently, this cache of extraCerts may grow unboundedly, and a malicious\nclient may flood a CMP server with requests driving this growth.\n\nImpact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX\nfor the lifetime of a server process may observe unbounded memory growth in the\nevent a malicious client repeatedly sends requests containing unique extra\ncertificates, which may lead to OOM conditions.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: If a remote user sends CMP messages to a server with a list of\nextraCerts and the message is rejected, the extraCerts from the message remains\nin the server contexts untrusted certificate stack.  This exposes servers with\nlong lived ctx objects to Denial of Service attacks in which an attacker sends\nmessages intending to be rejected with a large list of additional certificates\nrepeatedly, forcing the server to store them indefinitely.\n   \nThe issue was fixed by removing the added extra certs if the message is\nrejected, using the same method as when the context is configured to not do\ncaching at all.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."},{"id":"CVE-2026-63075","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63075","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63075","date":"2026-10-10","epss":0.00778,"percentile":0.54553}],"urls":["https://github.com/openssl/openssl/commit/7308946576b12e64b8be53bcf0a120354b2b42bc","https://github.com/openssl/openssl/commit/7c98d79738549df92868e7dd9be4bbf061eed709","https://github.com/openssl/openssl/commit/bf84721c2548351176e367e6de505792f0118dc6","https://github.com/openssl/openssl/commit/c902e5f16d6a9e130e96d3ca6d8f64d71652e393","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63075","description":"Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly\nsends ack-eliciting packets while not acknowledging ACK-only responses, the\nQUIC stack can retain ACK-only packet metadata for the lifetime of the\nconnection.\n\nImpact summary: A remote peer that can complete a QUIC handshake can\ncause connection-scoped memory growth which may lead to Denial of Service\nthrough memory exhaustion, especially with sustained traffic or many concurrent\nQUIC connections.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: When the OpenSSL QUIC stack sends an ACK-only packet,\nthere is no requirement by the QUIC protocol that the peer will acknowledge\nthat ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL\nimplementation stores the metadata about the ACK frames regardless.\nIn and of itself that's ok, but if a malicious peer establishes a connection, and\nthen drives the connection such that ACK-only packets are forced from the \nOpenSSL implementation peer (i.e., by sending numerous PING frames),\nand then withholding any subsequent acks for ack-eliciting data, like\nlegitimate data, said malicious peer can force inappropriate memory growth\non the OpenSSL peer, potentially leading to a Denial of Service.\n\nThe fix is to ensure that we account for the transmission of the ACK-only\npacket in the packet histories high and low watermark without actually storing\nthe ACK-only packet metadata itself.\n\nFIPS impact: no\nThe OpenSSL FIPS module is not affected as the QUIC code is\noutside the FIPS module boundary."},{"id":"CVE-2026-63076","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63076","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63076","date":"2026-10-10","epss":0.01602,"percentile":0.7512}],"urls":["https://github.com/openssl/openssl/commit/37882aa2e0256e1072442a8f62f7db45b995c45b","https://github.com/openssl/openssl/commit/a17cc8d612ecff6d94a9b7ca8b5283ddf5ff570e","https://github.com/openssl/openssl/commit/a1f348ccb328c3afbd4ba6883f9b7c813c043259","https://github.com/openssl/openssl/commit/a7af46a92d0ce19a90e669ef56d2576a07924226","https://github.com/openssl/openssl/commit/cdacfff557389abfa9e4615abded2ec984517d6c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63076","description":"Issue summary: OpenSSL CMP password based protection verification only\nchecks whether the protectionAlg parameter was not NULL and not its\nASN.1 type, before treating it as a PBMParameter. A crafted message can\ncontain a parameter of a different type, which is then dereferenced as an\ninvalid pointer.\n\nImpact summary: A remote, unauthenticated attacker can crash an application\nacting as a CMP server that accepts PBM-protected messages, or a CMP client\ntalking to a malicious or intercepted CMP server, resulting in a Denial of\nService.\n\nCWE: CWE-476: NULL Pointer Dereference\n\nDescription: When verifying the password-based MAC protection of a CMP\nmessage, OpenSSL library reads the protectionAlg algorithm parameter with\nX509_ALGOR_get0(), which returns both the parameter type and its value\npointer. The value is then cast to an ASN1_STRING and treated as the\nexpected PBMParameter after only checking that pointer is not NULL. The\nparameter type returned by X509_ALGOR_get0() was never consulted.\n\nThis happens during protection verification, before any MAC is computed, so\nno knowledge of the PBM shared secret is required; the only precondition is\nthat PBM verification is reachable. On the server side this is reached from\nOSSL_CMP_SRV_process_request() for any application that stands up a CMP\nserver accepting PBM-protected messages, and on the client side from CMP\nresponse validation against a malicious or on-path (MITM) server. The\nreliable consequence is a denial of service; there is no memory disclosure,\nno controlled memory write, and no path to code execution. CMP is a\nspecialized feature that an application must explicitly enable.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS modules\nare affected by this CVE."},{"id":"CVE-2026-75803","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75803","cwe":"CWE-354","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75803","date":"2026-10-10","epss":0.00232,"percentile":0.1291}],"urls":["https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42","https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e05b","https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a","https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34","https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75803","description":"Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty\nciphertext can report success without verifying the supplied authentication\ntag when the operation is finalized by calling the EVP_Cipher() function.\n\nImpact summary: Applications calling EVP_Cipher() on an empty ciphertext and\nexpecting the call to check the AEAD tag may accept forged messages.\n\nCWE: CWE-354 (Improper Validation of Integrity Check Value)\n\nDescription: The EVP_Cipher() API call for AEAD ciphers behaves like a one\nshot encryption and decryption call. It also verifies the AEAD tag after the\ndecryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers\nit skipped the AEAD tag verification when an empty ciphertext was passed to\nthe function. The callers of this function might believe that a successful\nreturn indicates a valid AEAD tag for these ciphers, even when that has not\ntruly been validated in this case.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE\nas the affected algorithms are not FIPS approved and thus not implemented\nin the FIPS module."}]},{"artifact":{"id":"520d302113b3bd3e","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:curl-minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:curl_minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/amzn/curl-minimal@8.17.0-1.amzn2023.0.3?arch=x86_64&distro=amzn-2023&upstream=curl-8.17.0-1.amzn2023.0.3.src.rpm","type":"rpm","version":"8.17.0-1.amzn2023.0.3","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:fae7516be161dd7b75539487dbdd190ad7811e3177436d8c27328e8d0710a964","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.17.0-1.amzn2023.0.3"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.21.0-5.amzn2023.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-2132","versionConstraint":"< 8.21.0-5.amzn2023.0.1 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"curl-minimal","version":"0:8.17.0-1.amzn2023.0.3"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"8.21.0-5.amzn2023.0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-2132","versionConstraint":"< 8.21.0-5.amzn2023.0.1 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"curl","version":"8.17.0-1.amzn2023.0.3"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-2132","fix":{"state":"fixed","versions":["8.21.0-5.amzn2023.0.1"],"available":[{"date":"2026-09-14","kind":"advisory","version":"8.21.0-5.amzn2023.0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-11586","cwe":"CWE-770","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-11586","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-12064","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-12064","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-8286","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8286","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-8458","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8924","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-8926","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8926","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-8932","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8932","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-9079","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9079","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-9545","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9547","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9547","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-10536","date":"2026-10-10","epss":0.00598,"percentile":0.47051},{"cve":"CVE-2026-11586","date":"2026-10-10","epss":0.00609,"percentile":0.47597},{"cve":"CVE-2026-11856","date":"2026-10-10","epss":0.00688,"percentile":0.51312},{"cve":"CVE-2026-12064","date":"2026-10-10","epss":0.00399,"percentile":0.32159},{"cve":"CVE-2026-8286","date":"2026-10-10","epss":0.00309,"percentile":0.21884},{"cve":"CVE-2026-8458","date":"2026-10-10","epss":0.00371,"percentile":0.29089},{"cve":"CVE-2026-8924","date":"2026-10-10","epss":0.00661,"percentile":0.50154},{"cve":"CVE-2026-8925","date":"2026-10-10","epss":0.0108,"percentile":0.64134},{"cve":"CVE-2026-8926","date":"2026-10-10","epss":0.00444,"percentile":0.36636},{"cve":"CVE-2026-8927","date":"2026-10-10","epss":0.005,"percentile":0.41038},{"cve":"CVE-2026-8932","date":"2026-10-10","epss":0.00396,"percentile":0.31814},{"cve":"CVE-2026-9079","date":"2026-10-10","epss":0.00584,"percentile":0.463},{"cve":"CVE-2026-9080","date":"2026-10-10","epss":0.00494,"percentile":0.40571},{"cve":"CVE-2026-9545","date":"2026-10-10","epss":0.00408,"percentile":0.33066},{"cve":"CVE-2026-9547","date":"2026-10-10","epss":0.00325,"percentile":0.23648}],"risk":0.299,"urls":[],"severity":"Medium","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-2132.html","description":"A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, subsequently invokes curl_easy_reset(), and finally terminates the handle with curl_easy_cleanup(). During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation. (CVE-2026-10536)By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages. (CVE-2026-11586)Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB. (CVE-2026-11856)When a user invokes curl using a schemeless URL combined with --proto-default sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error. (CVE-2026-12064)A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not. (CVE-2026-8286)libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different \"services\".libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services. (CVE-2026-8458)A flaw in curl's cookie parsing logic allows a malicious HTTP server to set \"super cookies\" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains. (CVE-2026-8924)The curl logic that works with SASL authentication could end up cleaning up the GSASL context twice without clearing the pointer in between, making it free() the same pointer twice. (CVE-2026-8925)When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username (without a password), like https://user@example.com/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is no match for the specified user. (CVE-2026-8926)When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA. (CVE-2026-8927)libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key. (CVE-2026-8932)libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them. (CVE-2026-9079)Calling curl_easy_pause() within the event-based CURLMOPT_SOCKETFUNCTION callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed. (CVE-2026-9080)In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate.When libcurl returns to the hostname the second time with a cached SSL session (CURLOPT_SSL_SESSIONID_CACHE is not disabled) and early data enabled (the CURLSSLOPT_EARLYDATA bit is set in CURLOPT_SSL_OPTIONS), libcurl might send off the second request's bytes on that new connection before enforcing the certificate verification failure. Potentially leaking sensitive information. (CVE-2026-9545)When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the known_hosts file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack. (CVE-2026-9547)"},"relatedVulnerabilities":[{"id":"CVE-2026-10536","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-10536","date":"2026-10-10","epss":0.00598,"percentile":0.47051}],"urls":["https://curl.se/docs/CVE-2026-10536.html","https://curl.se/docs/CVE-2026-10536.json","https://hackerone.com/reports/3751697"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-10536","description":"A use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation."},{"id":"CVE-2026-11586","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11586","cwe":"CWE-770","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-11586","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-11586","date":"2026-10-10","epss":0.00609,"percentile":0.47597}],"urls":["https://curl.se/docs/CVE-2026-11586.html","https://curl.se/docs/CVE-2026-11586.json","https://hackerone.com/reports/3788931"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11586","description":"By default, curl automatically responds to WebSocket PING frames. Because curl\nlacks an upper bound on memory allocation for unacknowledged frames, a\nmalicious server can exhaust all available memory by flooding curl with rapid,\nsequential PING messages."},{"id":"CVE-2026-11856","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-11856","date":"2026-10-10","epss":0.00688,"percentile":0.51312}],"urls":["https://curl.se/docs/CVE-2026-11856.html","https://curl.se/docs/CVE-2026-11856.json","https://hackerone.com/reports/3793260"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11856","description":"Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`."},{"id":"CVE-2026-12064","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12064","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-12064","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-12064","date":"2026-10-10","epss":0.00399,"percentile":0.32159}],"urls":["https://curl.se/docs/CVE-2026-12064.html","https://curl.se/docs/CVE-2026-12064.json","https://hackerone.com/reports/3797526"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12064","description":"When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error."},{"id":"CVE-2026-8286","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8286","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8286","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8286","date":"2026-10-10","epss":0.00309,"percentile":0.21884}],"urls":["https://curl.se/docs/CVE-2026-8286.html","https://curl.se/docs/CVE-2026-8286.json","https://hackerone.com/reports/3718195"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8286","description":"A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not."},{"id":"CVE-2026-8458","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8458","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8458","date":"2026-10-10","epss":0.00371,"percentile":0.29089}],"urls":["https://curl.se/docs/CVE-2026-8458.html","https://curl.se/docs/CVE-2026-8458.json","https://hackerone.com/reports/3721183"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8458","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services."},{"id":"CVE-2026-8924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8924","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8924","date":"2026-10-10","epss":0.00661,"percentile":0.50154}],"urls":["https://curl.se/docs/CVE-2026-8924.html","https://curl.se/docs/CVE-2026-8924.json","https://hackerone.com/reports/3733905"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8924","description":"A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set\n\"super cookies\" that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains."},{"id":"CVE-2026-8925","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8925","date":"2026-10-10","epss":0.0108,"percentile":0.64134}],"urls":["https://curl.se/docs/CVE-2026-8925.html","https://curl.se/docs/CVE-2026-8925.json","https://hackerone.com/reports/3735193"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8925","description":"The curl logic that works with SASL authentication could end up cleaning up\nthe GSASL context *twice* without clearing the pointer in between, making it\n`free()` the same pointer twice."},{"id":"CVE-2026-8926","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8926","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8926","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8926","date":"2026-10-10","epss":0.00444,"percentile":0.36636}],"urls":["https://curl.se/docs/CVE-2026-8926.html","https://curl.se/docs/CVE-2026-8926.json","https://hackerone.com/reports/3735184"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8926","description":"When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user."},{"id":"CVE-2026-8927","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8927","date":"2026-10-10","epss":0.005,"percentile":0.41038}],"urls":["https://curl.se/docs/CVE-2026-8927.html","https://curl.se/docs/CVE-2026-8927.json","https://hackerone.com/reports/3744543"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8927","description":"When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`."},{"id":"CVE-2026-8932","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8932","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8932","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8932","date":"2026-10-10","epss":0.00396,"percentile":0.31814}],"urls":["https://curl.se/docs/CVE-2026-8932.html","https://curl.se/docs/CVE-2026-8932.json","https://hackerone.com/reports/3733910"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8932","description":"libcurl would reuse a previously created connection even when some mTLS config\nrelated option had been changed that should have prohibited reuse.\n\nlibcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup. However, some TLS\nsettings related to client certificates were left out from the configuration\nmatch checks, making them match too easily. In particular options related to\nthe private key."},{"id":"CVE-2026-9079","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9079","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9079","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9079","date":"2026-10-10","epss":0.00584,"percentile":0.463}],"urls":["https://curl.se/docs/CVE-2026-9079.html","https://curl.se/docs/CVE-2026-9079.json","https://hackerone.com/reports/3750295"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9079","description":"libcurl had a flaw that when instructed to clear proxy authentication\ncredentials which made it not do so, leaving the old credentials around to get\nused for subsequent transfers that should not know nor use them."},{"id":"CVE-2026-9080","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9080","date":"2026-10-10","epss":0.00494,"percentile":0.40571}],"urls":["https://curl.se/docs/CVE-2026-9080.html","https://curl.se/docs/CVE-2026-9080.json","https://hackerone.com/reports/3749204"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9080","description":"Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION`\ncallback triggers a use-after-free vulnerability, where libcurl attempts to\nstore a flag using a dangling struct pointer immediately after that pointer's\nmemory has been freed."},{"id":"CVE-2026-9545","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9545","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9545","date":"2026-10-10","epss":0.00408,"percentile":0.33066}],"urls":["https://curl.se/docs/CVE-2026-9545.html","https://curl.se/docs/CVE-2026-9545.json","https://hackerone.com/reports/3752888"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9545","description":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when it makes a second transfer to the same site it has been\nreplaced by the attacker's impostor machine - without a valid certificate.\n\nWhen libcurl returns to the hostname the second time with a cached SSL session\n(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the\n`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might\nsend off the second request's bytes on that new connection *before* enforcing\nthe certificate verification failure. Potentially leaking sensitive\ninformation."},{"id":"CVE-2026-9547","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9547","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9547","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9547","date":"2026-10-10","epss":0.00325,"percentile":0.23648}],"urls":["https://curl.se/docs/CVE-2026-9547.html","https://curl.se/docs/CVE-2026-9547.json","https://hackerone.com/reports/3751712"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9547","description":"When a libcurl-based application performs transfers via `SCP://` or `SFTP://`\nand utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an\nuntrusted server. This vulnerability occurs when a server presents a host key\ntype that does not match the specific key type already recorded for that host\nin the `known_hosts` file. Instead of rejecting the mismatch, the callback\nmechanism fails to properly enforce the restriction, allowing the connection\nto succeed without warning and risking a potential man-in-the-middle attack."}]},{"artifact":{"id":"48ac50906f434801","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:libcurl-minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:libcurl_minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/amzn/libcurl-minimal@8.17.0-1.amzn2023.0.3?arch=x86_64&distro=amzn-2023&upstream=curl-8.17.0-1.amzn2023.0.3.src.rpm","type":"rpm","version":"8.17.0-1.amzn2023.0.3","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:fae7516be161dd7b75539487dbdd190ad7811e3177436d8c27328e8d0710a964","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.17.0-1.amzn2023.0.3"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.21.0-5.amzn2023.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-2132","versionConstraint":"< 8.21.0-5.amzn2023.0.1 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"libcurl-minimal","version":"0:8.17.0-1.amzn2023.0.3"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"8.21.0-5.amzn2023.0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-2132","versionConstraint":"< 8.21.0-5.amzn2023.0.1 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"curl","version":"8.17.0-1.amzn2023.0.3"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-2132","fix":{"state":"fixed","versions":["8.21.0-5.amzn2023.0.1"],"available":[{"date":"2026-09-14","kind":"advisory","version":"8.21.0-5.amzn2023.0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-11586","cwe":"CWE-770","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-11586","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-12064","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-12064","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-8286","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8286","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-8458","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8924","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-8926","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8926","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-8932","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8932","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-9079","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9079","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-9545","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9547","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9547","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-10536","date":"2026-10-10","epss":0.00598,"percentile":0.47051},{"cve":"CVE-2026-11586","date":"2026-10-10","epss":0.00609,"percentile":0.47597},{"cve":"CVE-2026-11856","date":"2026-10-10","epss":0.00688,"percentile":0.51312},{"cve":"CVE-2026-12064","date":"2026-10-10","epss":0.00399,"percentile":0.32159},{"cve":"CVE-2026-8286","date":"2026-10-10","epss":0.00309,"percentile":0.21884},{"cve":"CVE-2026-8458","date":"2026-10-10","epss":0.00371,"percentile":0.29089},{"cve":"CVE-2026-8924","date":"2026-10-10","epss":0.00661,"percentile":0.50154},{"cve":"CVE-2026-8925","date":"2026-10-10","epss":0.0108,"percentile":0.64134},{"cve":"CVE-2026-8926","date":"2026-10-10","epss":0.00444,"percentile":0.36636},{"cve":"CVE-2026-8927","date":"2026-10-10","epss":0.005,"percentile":0.41038},{"cve":"CVE-2026-8932","date":"2026-10-10","epss":0.00396,"percentile":0.31814},{"cve":"CVE-2026-9079","date":"2026-10-10","epss":0.00584,"percentile":0.463},{"cve":"CVE-2026-9080","date":"2026-10-10","epss":0.00494,"percentile":0.40571},{"cve":"CVE-2026-9545","date":"2026-10-10","epss":0.00408,"percentile":0.33066},{"cve":"CVE-2026-9547","date":"2026-10-10","epss":0.00325,"percentile":0.23648}],"risk":0.299,"urls":[],"severity":"Medium","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-2132.html","description":"A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, subsequently invokes curl_easy_reset(), and finally terminates the handle with curl_easy_cleanup(). During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation. (CVE-2026-10536)By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages. (CVE-2026-11586)Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB. (CVE-2026-11856)When a user invokes curl using a schemeless URL combined with --proto-default sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error. (CVE-2026-12064)A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not. (CVE-2026-8286)libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different \"services\".libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services. (CVE-2026-8458)A flaw in curl's cookie parsing logic allows a malicious HTTP server to set \"super cookies\" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains. (CVE-2026-8924)The curl logic that works with SASL authentication could end up cleaning up the GSASL context twice without clearing the pointer in between, making it free() the same pointer twice. (CVE-2026-8925)When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username (without a password), like https://user@example.com/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is no match for the specified user. (CVE-2026-8926)When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed through proxyB erroneously leaks the Proxy-Authorization: header intended solely for proxyA. (CVE-2026-8927)libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key. (CVE-2026-8932)libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them. (CVE-2026-9079)Calling curl_easy_pause() within the event-based CURLMOPT_SOCKETFUNCTION callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed. (CVE-2026-9080)In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate.When libcurl returns to the hostname the second time with a cached SSL session (CURLOPT_SSL_SESSIONID_CACHE is not disabled) and early data enabled (the CURLSSLOPT_EARLYDATA bit is set in CURLOPT_SSL_OPTIONS), libcurl might send off the second request's bytes on that new connection before enforcing the certificate verification failure. Potentially leaking sensitive information. (CVE-2026-9545)When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the known_hosts file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack. (CVE-2026-9547)"},"relatedVulnerabilities":[{"id":"CVE-2026-10536","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-10536","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-10536","date":"2026-10-10","epss":0.00598,"percentile":0.47051}],"urls":["https://curl.se/docs/CVE-2026-10536.html","https://curl.se/docs/CVE-2026-10536.json","https://hackerone.com/reports/3751697"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-10536","description":"A use-after-free vulnerability exists in libcurl when an application\nconfigures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or\n`CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and\nfinally terminates the handle with `curl_easy_cleanup()`. During this final\ncleanup phase, libcurl attempts to access and modify an internal structure\nthat was already freed during the reset operation."},{"id":"CVE-2026-11586","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11586","cwe":"CWE-770","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-11586","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-11586","date":"2026-10-10","epss":0.00609,"percentile":0.47597}],"urls":["https://curl.se/docs/CVE-2026-11586.html","https://curl.se/docs/CVE-2026-11586.json","https://hackerone.com/reports/3788931"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11586","description":"By default, curl automatically responds to WebSocket PING frames. Because curl\nlacks an upper bound on memory allocation for unacknowledged frames, a\nmalicious server can exhaust all available memory by flooding curl with rapid,\nsequential PING messages."},{"id":"CVE-2026-11856","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-11856","date":"2026-10-10","epss":0.00688,"percentile":0.51312}],"urls":["https://curl.se/docs/CVE-2026-11856.html","https://curl.se/docs/CVE-2026-11856.json","https://hackerone.com/reports/3793260"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11856","description":"Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`."},{"id":"CVE-2026-12064","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12064","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-12064","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-12064","date":"2026-10-10","epss":0.00399,"percentile":0.32159}],"urls":["https://curl.se/docs/CVE-2026-12064.html","https://curl.se/docs/CVE-2026-12064.json","https://hackerone.com/reports/3797526"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12064","description":"When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error."},{"id":"CVE-2026-8286","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8286","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8286","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8286","date":"2026-10-10","epss":0.00309,"percentile":0.21884}],"urls":["https://curl.se/docs/CVE-2026-8286.html","https://curl.se/docs/CVE-2026-8286.json","https://hackerone.com/reports/3718195"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8286","description":"A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not."},{"id":"CVE-2026-8458","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8458","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8458","date":"2026-10-10","epss":0.00371,"percentile":0.29089}],"urls":["https://curl.se/docs/CVE-2026-8458.html","https://curl.se/docs/CVE-2026-8458.json","https://hackerone.com/reports/3721183"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8458","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services."},{"id":"CVE-2026-8924","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8924","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8924","date":"2026-10-10","epss":0.00661,"percentile":0.50154}],"urls":["https://curl.se/docs/CVE-2026-8924.html","https://curl.se/docs/CVE-2026-8924.json","https://hackerone.com/reports/3733905"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8924","description":"A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set\n\"super cookies\" that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains."},{"id":"CVE-2026-8925","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8925","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8925","date":"2026-10-10","epss":0.0108,"percentile":0.64134}],"urls":["https://curl.se/docs/CVE-2026-8925.html","https://curl.se/docs/CVE-2026-8925.json","https://hackerone.com/reports/3735193"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8925","description":"The curl logic that works with SASL authentication could end up cleaning up\nthe GSASL context *twice* without clearing the pointer in between, making it\n`free()` the same pointer twice."},{"id":"CVE-2026-8926","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8926","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8926","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8926","date":"2026-10-10","epss":0.00444,"percentile":0.36636}],"urls":["https://curl.se/docs/CVE-2026-8926.html","https://curl.se/docs/CVE-2026-8926.json","https://hackerone.com/reports/3735184"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8926","description":"When asking curl to use a `.netrc` file to find credentials and at the same\ntime specifying a URL with a username (without a password), like\n`https://user@example.com/`, curl could wrongly get and use the password for\n*another* user set in the `.netrc` file for that host if such a one exists and\nthere is no match for the specified user."},{"id":"CVE-2026-8927","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8927","date":"2026-10-10","epss":0.005,"percentile":0.41038}],"urls":["https://curl.se/docs/CVE-2026-8927.html","https://curl.se/docs/CVE-2026-8927.json","https://hackerone.com/reports/3744543"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8927","description":"When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`."},{"id":"CVE-2026-8932","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8932","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8932","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8932","date":"2026-10-10","epss":0.00396,"percentile":0.31814}],"urls":["https://curl.se/docs/CVE-2026-8932.html","https://curl.se/docs/CVE-2026-8932.json","https://hackerone.com/reports/3733910"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8932","description":"libcurl would reuse a previously created connection even when some mTLS config\nrelated option had been changed that should have prohibited reuse.\n\nlibcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup. However, some TLS\nsettings related to client certificates were left out from the configuration\nmatch checks, making them match too easily. In particular options related to\nthe private key."},{"id":"CVE-2026-9079","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9079","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9079","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9079","date":"2026-10-10","epss":0.00584,"percentile":0.463}],"urls":["https://curl.se/docs/CVE-2026-9079.html","https://curl.se/docs/CVE-2026-9079.json","https://hackerone.com/reports/3750295"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9079","description":"libcurl had a flaw that when instructed to clear proxy authentication\ncredentials which made it not do so, leaving the old credentials around to get\nused for subsequent transfers that should not know nor use them."},{"id":"CVE-2026-9080","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9080","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9080","date":"2026-10-10","epss":0.00494,"percentile":0.40571}],"urls":["https://curl.se/docs/CVE-2026-9080.html","https://curl.se/docs/CVE-2026-9080.json","https://hackerone.com/reports/3749204"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9080","description":"Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION`\ncallback triggers a use-after-free vulnerability, where libcurl attempts to\nstore a flag using a dangling struct pointer immediately after that pointer's\nmemory has been freed."},{"id":"CVE-2026-9545","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9545","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-9545","date":"2026-10-10","epss":0.00408,"percentile":0.33066}],"urls":["https://curl.se/docs/CVE-2026-9545.html","https://curl.se/docs/CVE-2026-9545.json","https://hackerone.com/reports/3752888"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9545","description":"In this scenario, libcurl first uses a proper HTTP/3 server for the initial\ntransfers, and when it makes a second transfer to the same site it has been\nreplaced by the attacker's impostor machine - without a valid certificate.\n\nWhen libcurl returns to the hostname the second time with a cached SSL session\n(`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the\n`CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might\nsend off the second request's bytes on that new connection *before* enforcing\nthe certificate verification failure. Potentially leaking sensitive\ninformation."},{"id":"CVE-2026-9547","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9547","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9547","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9547","date":"2026-10-10","epss":0.00325,"percentile":0.23648}],"urls":["https://curl.se/docs/CVE-2026-9547.html","https://curl.se/docs/CVE-2026-9547.json","https://hackerone.com/reports/3751712"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9547","description":"When a libcurl-based application performs transfers via `SCP://` or `SFTP://`\nand utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an\nuntrusted server. This vulnerability occurs when a server presents a host key\ntype that does not match the specific key type already recorded for that host\nin the `known_hosts` file. Instead of rejecting the mismatch, the callback\nmechanism fails to properly enforce the restriction, allowing the connection\nto succeed without warning and risking a potential man-in-the-middle attack."}]},{"artifact":{"id":"520d302113b3bd3e","cpes":["cpe:2.3:a:curl-minimal:curl-minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:curl-minimal:curl_minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl-minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:curl_minimal:curl_minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:curl-minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:curl_minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl-minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:curl:curl_minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*"],"name":"curl-minimal","purl":"pkg:rpm/amzn/curl-minimal@8.17.0-1.amzn2023.0.3?arch=x86_64&distro=amzn-2023&upstream=curl-8.17.0-1.amzn2023.0.3.src.rpm","type":"rpm","version":"8.17.0-1.amzn2023.0.3","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:fae7516be161dd7b75539487dbdd190ad7811e3177436d8c27328e8d0710a964","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.17.0-1.amzn2023.0.3"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.21.0-5.amzn2023.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3128","versionConstraint":"< 8.21.0-5.amzn2023.0.2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"curl-minimal","version":"0:8.17.0-1.amzn2023.0.3"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"8.21.0-5.amzn2023.0.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3128","versionConstraint":"< 8.21.0-5.amzn2023.0.2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"curl","version":"8.17.0-1.amzn2023.0.3"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3128","fix":{"state":"fixed","versions":["8.21.0-5.amzn2023.0.2"],"available":[{"date":"2026-09-29","kind":"advisory","version":"8.21.0-5.amzn2023.0.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-10-10","epss":0.00371,"percentile":0.29087}],"risk":0.27825,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3128.html","description":"When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected. (CVE-2026-80230)"},"relatedVulnerabilities":[{"id":"CVE-2026-80230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-10-10","epss":0.00371,"percentile":0.29087}],"urls":["https://curl.se/docs/CVE-2026-80230.html","https://curl.se/docs/CVE-2026-80230.json","https://hackerone.com/reports/3969300"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80230","description":"When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected."}]},{"artifact":{"id":"48ac50906f434801","cpes":["cpe:2.3:a:libcurl-minimal:libcurl-minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:libcurl-minimal:libcurl_minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl-minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:libcurl_minimal:libcurl_minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:libcurl-minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:libcurl_minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl-minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:libcurl:libcurl_minimal:8.17.0-1.amzn2023.0.3:*:*:*:*:*:*:*"],"name":"libcurl-minimal","purl":"pkg:rpm/amzn/libcurl-minimal@8.17.0-1.amzn2023.0.3?arch=x86_64&distro=amzn-2023&upstream=curl-8.17.0-1.amzn2023.0.3.src.rpm","type":"rpm","version":"8.17.0-1.amzn2023.0.3","language":"","licenses":["curl"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:fae7516be161dd7b75539487dbdd190ad7811e3177436d8c27328e8d0710a964","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl","version":"8.17.0-1.amzn2023.0.3"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.21.0-5.amzn2023.0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3128","versionConstraint":"< 8.21.0-5.amzn2023.0.2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"libcurl-minimal","version":"0:8.17.0-1.amzn2023.0.3"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"8.21.0-5.amzn2023.0.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3128","versionConstraint":"< 8.21.0-5.amzn2023.0.2 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"curl","version":"8.17.0-1.amzn2023.0.3"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3128","fix":{"state":"fixed","versions":["8.21.0-5.amzn2023.0.2"],"available":[{"date":"2026-09-29","kind":"advisory","version":"8.21.0-5.amzn2023.0.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-10-10","epss":0.00371,"percentile":0.29087}],"risk":0.27825,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3128.html","description":"When CURLOPT_PINNEDPUBLICKEY is configured alongside options that disable standard peer verification (CURLOPT_SSL_VERIFYPEER = 0 and CURLOPT_SSL_VERIFYHOST = 0), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected. (CVE-2026-80230)"},"relatedVulnerabilities":[{"id":"CVE-2026-80230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-10-10","epss":0.00371,"percentile":0.29087}],"urls":["https://curl.se/docs/CVE-2026-80230.html","https://curl.se/docs/CVE-2026-80230.json","https://hackerone.com/reports/3969300"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80230","description":"When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected."}]},{"artifact":{"id":"664354e05a5a63a4","cpes":["cpe:2.3:a:amazonlinux:libxml2:2.10.4-1.amzn2023.0.20:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml2:2.10.4-1.amzn2023.0.20:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:rpm/amzn/libxml2@2.10.4-1.amzn2023.0.20?arch=x86_64&distro=amzn-2023&upstream=libxml2-2.10.4-1.amzn2023.0.20.src.rpm","type":"rpm","version":"2.10.4-1.amzn2023.0.20","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:fae7516be161dd7b75539487dbdd190ad7811e3177436d8c27328e8d0710a964","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.10.4-1.amzn2023.0.21"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3122","versionConstraint":"< 2.10.4-1.amzn2023.0.21 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"libxml2","version":"0:2.10.4-1.amzn2023.0.20"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3122","fix":{"state":"fixed","versions":["2.10.4-1.amzn2023.0.21"],"available":[{"date":"2026-09-29","kind":"advisory","version":"2.10.4-1.amzn2023.0.21"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-74860","cwe":"CWE-763","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-86137","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-86138","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-86140","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-86142","cwe":"CWE-122","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-86143","cwe":"CWE-192","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-86144","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-74860","date":"2026-10-10","epss":0.00447,"percentile":0.3698},{"cve":"CVE-2026-86137","date":"2026-10-10","epss":0.00195,"percentile":0.08433},{"cve":"CVE-2026-86138","date":"2026-10-10","epss":0.00132,"percentile":0.02412},{"cve":"CVE-2026-86140","date":"2026-10-10","epss":0.00157,"percentile":0.04329},{"cve":"CVE-2026-86142","date":"2026-10-10","epss":0.00157,"percentile":0.04269},{"cve":"CVE-2026-86143","date":"2026-10-10","epss":0.00194,"percentile":0.08299},{"cve":"CVE-2026-86144","date":"2026-10-10","epss":0.00186,"percentile":0.07599}],"risk":0.2235,"urls":[],"severity":"Medium","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3122.html","description":"A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings. (CVE-2026-74860)In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp. (CVE-2026-86137)In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow. (CVE-2026-86138)In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow. (CVE-2026-86140)In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation. (CVE-2026-86142)In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback. (CVE-2026-86143)In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow). (CVE-2026-86144)"},"relatedVulnerabilities":[{"id":"CVE-2026-74860","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74860","cwe":"CWE-763","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-74860","date":"2026-10-10","epss":0.00447,"percentile":0.3698}],"urls":["https://access.redhat.com/errata/RHSA-2026:64463","https://access.redhat.com/errata/RHSA-2026:71585","https://access.redhat.com/errata/RHSA-2026:71586","https://access.redhat.com/errata/RHSA-2026:71641","https://access.redhat.com/errata/RHSA-2026:72470","https://access.redhat.com/errata/RHSA-2026:72475","https://access.redhat.com/errata/RHSA-2026:72476","https://access.redhat.com/errata/RHSA-2026:79357","https://access.redhat.com/security/cve/CVE-2026-74860","https://bugzilla.redhat.com/show_bug.cgi?id=2529697"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74860","description":"A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings."},{"id":"CVE-2026-86137","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86137","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86137","date":"2026-10-10","epss":0.00195,"percentile":0.08433}],"urls":["https://github.com/GNOME/libxml2/commit/76fe08d97de88bfaef2f7d5cd27f11954cc5bee2","https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4","https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1099"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86137","description":"In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp."},{"id":"CVE-2026-86138","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86138","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86138","date":"2026-10-10","epss":0.00132,"percentile":0.02412}],"urls":["https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4","https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86138","description":"In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow."},{"id":"CVE-2026-86140","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86140","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86140","date":"2026-10-10","epss":0.00157,"percentile":0.04329}],"urls":["https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340","https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86140","description":"In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow."},{"id":"CVE-2026-86142","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86142","cwe":"CWE-122","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86142","date":"2026-10-10","epss":0.00157,"percentile":0.04269}],"urls":["https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58","https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4","https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86142","description":"In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation."},{"id":"CVE-2026-86143","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":7.3,"impactScore":5.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86143","cwe":"CWE-192","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86143","date":"2026-10-10","epss":0.00194,"percentile":0.08299}],"urls":["https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35","https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4","https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86143","description":"In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback."},{"id":"CVE-2026-86144","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86144","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86144","date":"2026-10-10","epss":0.00186,"percentile":0.07599}],"urls":["https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61","https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86144","description":"In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow)."}]},{"artifact":{"id":"afa9baa3a330a2e5","cpes":["cpe:2.3:a:amazonlinux:bind-libs:32\\:9.18.50-1.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:bind_libs:32\\:9.18.50-1.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:bind-libs:bind-libs:32\\:9.18.50-1.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:bind-libs:bind_libs:32\\:9.18.50-1.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind-libs:32\\:9.18.50-1.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:bind_libs:bind_libs:32\\:9.18.50-1.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-libs:32\\:9.18.50-1.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_libs:32\\:9.18.50-1.amzn2023.0.2:*:*:*:*:*:*:*"],"name":"bind-libs","purl":"pkg:rpm/amzn/bind-libs@9.18.50-1.amzn2023.0.2?arch=x86_64&distro=amzn-2023&epoch=32&upstream=bind-9.18.50-1.amzn2023.0.2.src.rpm","type":"rpm","version":"32:9.18.50-1.amzn2023.0.2","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:fae7516be161dd7b75539487dbdd190ad7811e3177436d8c27328e8d0710a964","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.50-1.amzn2023.0.2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.18.50-1.amzn2023.0.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3137","versionConstraint":"< 9.18.50-1.amzn2023.0.3 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"bind-libs","version":"32:9.18.50-1.amzn2023.0.2"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"9.18.50-1.amzn2023.0.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3137","versionConstraint":"< 9.18.50-1.amzn2023.0.3 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"bind","version":"9.18.50-1.amzn2023.0.2"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3137","fix":{"state":"fixed","versions":["9.18.50-1.amzn2023.0.3"],"available":[{"date":"2026-09-29","kind":"advisory","version":"9.18.50-1.amzn2023.0.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-19033","cwe":"CWE-349","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-19662","cwe":"CWE-416","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-19666","cwe":"CWE-416","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-19667","cwe":"CWE-197","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-19941","cwe":"CWE-345","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-75029","cwe":"CWE-405","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-78301","cwe":"CWE-349","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-80274","cwe":"CWE-617","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-81563","cwe":"CWE-401","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-81736","cwe":"CWE-1050","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19033","date":"2026-10-10","epss":0.0024,"percentile":0.13985},{"cve":"CVE-2026-19662","date":"2026-10-10","epss":0.00464,"percentile":0.38311},{"cve":"CVE-2026-19666","date":"2026-10-10","epss":0.00569,"percentile":0.45454},{"cve":"CVE-2026-19667","date":"2026-10-10","epss":0.00569,"percentile":0.45455},{"cve":"CVE-2026-19941","date":"2026-10-10","epss":0.00226,"percentile":0.1229},{"cve":"CVE-2026-75029","date":"2026-10-10","epss":0.0048,"percentile":0.39505},{"cve":"CVE-2026-78301","date":"2026-10-10","epss":0.00207,"percentile":0.09922},{"cve":"CVE-2026-80274","date":"2026-10-10","epss":0.00569,"percentile":0.45454},{"cve":"CVE-2026-81563","date":"2026-10-10","epss":0.00569,"percentile":0.45455},{"cve":"CVE-2026-81736","date":"2026-10-10","epss":0.00569,"percentile":0.45454}],"risk":0.18,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3137.html","description":"For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19033)An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19662)On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19666)If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19667)An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19941)In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-75029)A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-78301)If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-80274)A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups.This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-81563)If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response.This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-81736)"},"relatedVulnerabilities":[{"id":"CVE-2026-19033","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19033","cwe":"CWE-349","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19033","date":"2026-10-10","epss":0.0024,"percentile":0.13985}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-19033"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19033","description":"For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-19662","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19662","cwe":"CWE-416","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19662","date":"2026-10-10","epss":0.00464,"percentile":0.38311}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://kb.isc.org/docs/cve-2026-19662"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19662","description":"An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-19666","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19666","cwe":"CWE-416","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19666","date":"2026-10-10","epss":0.00569,"percentile":0.45454}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-19666"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19666","description":"On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-19667","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19667","cwe":"CWE-197","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19667","date":"2026-10-10","epss":0.00569,"percentile":0.45455}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-19667"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19667","description":"If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-19941","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19941","cwe":"CWE-345","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19941","date":"2026-10-10","epss":0.00226,"percentile":0.1229}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-19941"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19941","description":"An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-75029","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75029","cwe":"CWE-405","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-75029","date":"2026-10-10","epss":0.0048,"percentile":0.39505}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-75029"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75029","description":"In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-78301","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":5.8,"impactScore":4,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78301","cwe":"CWE-349","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-78301","date":"2026-10-10","epss":0.00207,"percentile":0.09922}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-78301"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78301","description":"A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-80274","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80274","cwe":"CWE-617","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-80274","date":"2026-10-10","epss":0.00569,"percentile":0.45454}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-80274"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80274","description":"If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-81563","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81563","cwe":"CWE-401","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-81563","date":"2026-10-10","epss":0.00569,"percentile":0.45455}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-81563"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81563","description":"A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-81736","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81736","cwe":"CWE-1050","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-81736","date":"2026-10-10","epss":0.00569,"percentile":0.45454}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-81736"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81736","description":"If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}]},{"artifact":{"id":"a95cc4ef02b3b485","cpes":["cpe:2.3:a:bind-license:bind-license:32\\:9.18.50-1.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:bind-license:bind_license:32\\:9.18.50-1.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind-license:32\\:9.18.50-1.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:bind_license:bind_license:32\\:9.18.50-1.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:bind-license:32\\:9.18.50-1.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:bind_license:32\\:9.18.50-1.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-license:32\\:9.18.50-1.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_license:32\\:9.18.50-1.amzn2023.0.2:*:*:*:*:*:*:*"],"name":"bind-license","purl":"pkg:rpm/amzn/bind-license@9.18.50-1.amzn2023.0.2?arch=noarch&distro=amzn-2023&epoch=32&upstream=bind-9.18.50-1.amzn2023.0.2.src.rpm","type":"rpm","version":"32:9.18.50-1.amzn2023.0.2","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:fae7516be161dd7b75539487dbdd190ad7811e3177436d8c27328e8d0710a964","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.50-1.amzn2023.0.2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.18.50-1.amzn2023.0.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3137","versionConstraint":"< 9.18.50-1.amzn2023.0.3 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"bind-license","version":"32:9.18.50-1.amzn2023.0.2"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"9.18.50-1.amzn2023.0.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3137","versionConstraint":"< 9.18.50-1.amzn2023.0.3 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"bind","version":"9.18.50-1.amzn2023.0.2"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3137","fix":{"state":"fixed","versions":["9.18.50-1.amzn2023.0.3"],"available":[{"date":"2026-09-29","kind":"advisory","version":"9.18.50-1.amzn2023.0.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-19033","cwe":"CWE-349","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-19662","cwe":"CWE-416","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-19666","cwe":"CWE-416","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-19667","cwe":"CWE-197","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-19941","cwe":"CWE-345","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-75029","cwe":"CWE-405","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-78301","cwe":"CWE-349","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-80274","cwe":"CWE-617","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-81563","cwe":"CWE-401","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-81736","cwe":"CWE-1050","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19033","date":"2026-10-10","epss":0.0024,"percentile":0.13985},{"cve":"CVE-2026-19662","date":"2026-10-10","epss":0.00464,"percentile":0.38311},{"cve":"CVE-2026-19666","date":"2026-10-10","epss":0.00569,"percentile":0.45454},{"cve":"CVE-2026-19667","date":"2026-10-10","epss":0.00569,"percentile":0.45455},{"cve":"CVE-2026-19941","date":"2026-10-10","epss":0.00226,"percentile":0.1229},{"cve":"CVE-2026-75029","date":"2026-10-10","epss":0.0048,"percentile":0.39505},{"cve":"CVE-2026-78301","date":"2026-10-10","epss":0.00207,"percentile":0.09922},{"cve":"CVE-2026-80274","date":"2026-10-10","epss":0.00569,"percentile":0.45454},{"cve":"CVE-2026-81563","date":"2026-10-10","epss":0.00569,"percentile":0.45455},{"cve":"CVE-2026-81736","date":"2026-10-10","epss":0.00569,"percentile":0.45454}],"risk":0.18,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3137.html","description":"For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19033)An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19662)On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19666)If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19667)An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19941)In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-75029)A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-78301)If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-80274)A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups.This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-81563)If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response.This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-81736)"},"relatedVulnerabilities":[{"id":"CVE-2026-19033","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19033","cwe":"CWE-349","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19033","date":"2026-10-10","epss":0.0024,"percentile":0.13985}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-19033"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19033","description":"For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-19662","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19662","cwe":"CWE-416","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19662","date":"2026-10-10","epss":0.00464,"percentile":0.38311}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://kb.isc.org/docs/cve-2026-19662"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19662","description":"An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-19666","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19666","cwe":"CWE-416","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19666","date":"2026-10-10","epss":0.00569,"percentile":0.45454}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-19666"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19666","description":"On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-19667","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19667","cwe":"CWE-197","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19667","date":"2026-10-10","epss":0.00569,"percentile":0.45455}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-19667"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19667","description":"If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-19941","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19941","cwe":"CWE-345","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19941","date":"2026-10-10","epss":0.00226,"percentile":0.1229}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-19941"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19941","description":"An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-75029","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75029","cwe":"CWE-405","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-75029","date":"2026-10-10","epss":0.0048,"percentile":0.39505}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-75029"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75029","description":"In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-78301","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":5.8,"impactScore":4,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78301","cwe":"CWE-349","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-78301","date":"2026-10-10","epss":0.00207,"percentile":0.09922}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-78301"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78301","description":"A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-80274","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80274","cwe":"CWE-617","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-80274","date":"2026-10-10","epss":0.00569,"percentile":0.45454}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-80274"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80274","description":"If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-81563","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81563","cwe":"CWE-401","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-81563","date":"2026-10-10","epss":0.00569,"percentile":0.45455}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-81563"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81563","description":"A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-81736","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81736","cwe":"CWE-1050","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-81736","date":"2026-10-10","epss":0.00569,"percentile":0.45454}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-81736"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81736","description":"If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}]},{"artifact":{"id":"bf03e5adfd539d91","cpes":["cpe:2.3:a:amazonlinux:bind-utils:32\\:9.18.50-1.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:bind_utils:32\\:9.18.50-1.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:bind-utils:bind-utils:32\\:9.18.50-1.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:bind-utils:bind_utils:32\\:9.18.50-1.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind-utils:32\\:9.18.50-1.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:bind_utils:bind_utils:32\\:9.18.50-1.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind-utils:32\\:9.18.50-1.amzn2023.0.2:*:*:*:*:*:*:*","cpe:2.3:a:bind:bind_utils:32\\:9.18.50-1.amzn2023.0.2:*:*:*:*:*:*:*"],"name":"bind-utils","purl":"pkg:rpm/amzn/bind-utils@9.18.50-1.amzn2023.0.2?arch=x86_64&distro=amzn-2023&epoch=32&upstream=bind-9.18.50-1.amzn2023.0.2.src.rpm","type":"rpm","version":"32:9.18.50-1.amzn2023.0.2","language":"","licenses":["MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause"],"metadata":{"epoch":32,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:fae7516be161dd7b75539487dbdd190ad7811e3177436d8c27328e8d0710a964","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"bind","version":"9.18.50-1.amzn2023.0.2"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"9.18.50-1.amzn2023.0.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3137","versionConstraint":"< 9.18.50-1.amzn2023.0.3 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"bind-utils","version":"32:9.18.50-1.amzn2023.0.2"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"9.18.50-1.amzn2023.0.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3137","versionConstraint":"< 9.18.50-1.amzn2023.0.3 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"bind","version":"9.18.50-1.amzn2023.0.2"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3137","fix":{"state":"fixed","versions":["9.18.50-1.amzn2023.0.3"],"available":[{"date":"2026-09-29","kind":"advisory","version":"9.18.50-1.amzn2023.0.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-19033","cwe":"CWE-349","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-19662","cwe":"CWE-416","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-19666","cwe":"CWE-416","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-19667","cwe":"CWE-197","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-19941","cwe":"CWE-345","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-75029","cwe":"CWE-405","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-78301","cwe":"CWE-349","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-80274","cwe":"CWE-617","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-81563","cwe":"CWE-401","type":"Secondary","source":"security-officer@isc.org"},{"cve":"CVE-2026-81736","cwe":"CWE-1050","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19033","date":"2026-10-10","epss":0.0024,"percentile":0.13985},{"cve":"CVE-2026-19662","date":"2026-10-10","epss":0.00464,"percentile":0.38311},{"cve":"CVE-2026-19666","date":"2026-10-10","epss":0.00569,"percentile":0.45454},{"cve":"CVE-2026-19667","date":"2026-10-10","epss":0.00569,"percentile":0.45455},{"cve":"CVE-2026-19941","date":"2026-10-10","epss":0.00226,"percentile":0.1229},{"cve":"CVE-2026-75029","date":"2026-10-10","epss":0.0048,"percentile":0.39505},{"cve":"CVE-2026-78301","date":"2026-10-10","epss":0.00207,"percentile":0.09922},{"cve":"CVE-2026-80274","date":"2026-10-10","epss":0.00569,"percentile":0.45454},{"cve":"CVE-2026-81563","date":"2026-10-10","epss":0.00569,"percentile":0.45455},{"cve":"CVE-2026-81736","date":"2026-10-10","epss":0.00569,"percentile":0.45454}],"risk":0.18,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3137.html","description":"For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19033)An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19662)On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19666)If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19667)An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-19941)In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-75029)A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-78301)If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit.This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-80274)A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups.This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-81563)If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response.This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1. (CVE-2026-81736)"},"relatedVulnerabilities":[{"id":"CVE-2026-19033","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19033","cwe":"CWE-349","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19033","date":"2026-10-10","epss":0.0024,"percentile":0.13985}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-19033"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19033","description":"For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-19662","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19662","cwe":"CWE-416","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19662","date":"2026-10-10","epss":0.00464,"percentile":0.38311}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://kb.isc.org/docs/cve-2026-19662"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19662","description":"An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the attacker. If the auth responds with a particular sequence of crafted answers, and those answers arrive in a particular order with particular timing, the `named` resolver will encounter a use-after-free bug, and abort.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-19666","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19666","cwe":"CWE-416","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19666","date":"2026-10-10","epss":0.00569,"percentile":0.45454}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-19666"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19666","description":"On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-19667","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19667","cwe":"CWE-197","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19667","date":"2026-10-10","epss":0.00569,"percentile":0.45455}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-19667"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19667","description":"If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-19941","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19941","cwe":"CWE-345","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-19941","date":"2026-10-10","epss":0.00226,"percentile":0.1229}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-19941"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19941","description":"An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wildcard record.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-75029","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75029","cwe":"CWE-405","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-75029","date":"2026-10-10","epss":0.0048,"percentile":0.39505}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-75029"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75029","description":"In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly lead to other memory attack vectors.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-78301","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":5.8,"impactScore":4,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78301","cwe":"CWE-349","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-78301","date":"2026-10-10","epss":0.00207,"percentile":0.09922}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-78301"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78301","description":"A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the configured zone then lose authoritative status and return an out-of-zone delegation. On a server that also provides recursion BIND can follow this locally sourced cut and cache attacker-supplied data, affecting names outside the configured zone. This situation persists as long as the malformed zone remains in the zone database.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-80274","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80274","cwe":"CWE-617","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-80274","date":"2026-10-10","epss":0.00569,"percentile":0.45454}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-80274"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80274","description":"If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-81563","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81563","cwe":"CWE-401","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-81563","date":"2026-10-10","epss":0.00569,"percentile":0.45455}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-81563"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81563","description":"A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."},{"id":"CVE-2026-81736","cvss":[{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81736","cwe":"CWE-1050","type":"Secondary","source":"security-officer@isc.org"}],"epss":[{"cve":"CVE-2026-81736","date":"2026-10-10","epss":0.00569,"percentile":0.45454}],"urls":["https://downloads.isc.org/isc/bind9/9.20.29","https://downloads.isc.org/isc/bind9/9.21.26","https://kb.isc.org/docs/cve-2026-81736"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81736","description":"If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1."}]},{"artifact":{"id":"2fe3707a2ac3050b","cpes":["cpe:2.3:a:amazonlinux:python3-rpm:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:python3_rpm:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:python3-rpm:python3-rpm:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:python3-rpm:python3_rpm:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3-rpm:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:python3_rpm:python3_rpm:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3-rpm:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3_rpm:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*"],"name":"python3-rpm","purl":"pkg:rpm/amzn/python3-rpm@4.16.1.3-29.amzn2023.0.7?arch=x86_64&distro=amzn-2023&upstream=rpm-4.16.1.3-29.amzn2023.0.7.src.rpm","type":"rpm","version":"4.16.1.3-29.amzn2023.0.7","language":"","licenses":["GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:fae7516be161dd7b75539487dbdd190ad7811e3177436d8c27328e8d0710a964","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.7"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3125","versionConstraint":"< 4.16.1.3-29.amzn2023.0.8 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"python3-rpm","version":"0:4.16.1.3-29.amzn2023.0.7"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3125","versionConstraint":"< 4.16.1.3-29.amzn2023.0.8 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.7"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3125","fix":{"state":"fixed","versions":["4.16.1.3-29.amzn2023.0.8"],"available":[{"date":"2026-09-29","kind":"advisory","version":"4.16.1.3-29.amzn2023.0.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-84233","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-10-10","epss":0.00197,"percentile":0.08602},{"cve":"CVE-2026-84233","date":"2026-10-10","epss":0.00194,"percentile":0.08345}],"risk":0.14775000000000002,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3125.html","description":"A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious tarball. (CVE-2026-78367)A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability. (CVE-2026-84233)"},"relatedVulnerabilities":[{"id":"CVE-2026-78367","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-10-10","epss":0.00197,"percentile":0.08602}],"urls":["https://access.redhat.com/security/cve/CVE-2026-78367","https://bugzilla.redhat.com/show_bug.cgi?id=2521857","https://github.com/rpm-software-management/rpm/issues/4314"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."},{"id":"CVE-2026-84233","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84233","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84233","date":"2026-10-10","epss":0.00194,"percentile":0.08345}],"urls":["https://access.redhat.com/errata/RHSA-2026:66637","https://access.redhat.com/security/cve/CVE-2026-84233","https://bugzilla.redhat.com/show_bug.cgi?id=2478409"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84233","description":"A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability."}]},{"artifact":{"id":"c400e983acf9633b","cpes":["cpe:2.3:a:amazonlinux:rpm:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*"],"name":"rpm","purl":"pkg:rpm/amzn/rpm@4.16.1.3-29.amzn2023.0.7?arch=x86_64&distro=amzn-2023&upstream=rpm-4.16.1.3-29.amzn2023.0.7.src.rpm","type":"rpm","version":"4.16.1.3-29.amzn2023.0.7","language":"","licenses":["GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:fae7516be161dd7b75539487dbdd190ad7811e3177436d8c27328e8d0710a964","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3125","versionConstraint":"< 4.16.1.3-29.amzn2023.0.8 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm","version":"0:4.16.1.3-29.amzn2023.0.7"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3125","fix":{"state":"fixed","versions":["4.16.1.3-29.amzn2023.0.8"],"available":[{"date":"2026-09-29","kind":"advisory","version":"4.16.1.3-29.amzn2023.0.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-84233","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-10-10","epss":0.00197,"percentile":0.08602},{"cve":"CVE-2026-84233","date":"2026-10-10","epss":0.00194,"percentile":0.08345}],"risk":0.14775000000000002,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3125.html","description":"A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious tarball. (CVE-2026-78367)A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability. (CVE-2026-84233)"},"relatedVulnerabilities":[{"id":"CVE-2026-78367","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-10-10","epss":0.00197,"percentile":0.08602}],"urls":["https://access.redhat.com/security/cve/CVE-2026-78367","https://bugzilla.redhat.com/show_bug.cgi?id=2521857","https://github.com/rpm-software-management/rpm/issues/4314"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."},{"id":"CVE-2026-84233","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84233","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84233","date":"2026-10-10","epss":0.00194,"percentile":0.08345}],"urls":["https://access.redhat.com/errata/RHSA-2026:66637","https://access.redhat.com/security/cve/CVE-2026-84233","https://bugzilla.redhat.com/show_bug.cgi?id=2478409"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84233","description":"A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability."}]},{"artifact":{"id":"1f12922cf118c2e5","cpes":["cpe:2.3:a:rpm-build-libs:rpm-build-libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build-libs:rpm_build_libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm-build-libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build_libs:rpm_build_libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:rpm-build-libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:rpm_build_libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm-build-libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rpm-build:rpm_build_libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm-build-libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rpm_build:rpm_build_libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-build-libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_build_libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*"],"name":"rpm-build-libs","purl":"pkg:rpm/amzn/rpm-build-libs@4.16.1.3-29.amzn2023.0.7?arch=x86_64&distro=amzn-2023&upstream=rpm-4.16.1.3-29.amzn2023.0.7.src.rpm","type":"rpm","version":"4.16.1.3-29.amzn2023.0.7","language":"","licenses":["GPLv2+ and LGPLv2+ with exceptions"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:fae7516be161dd7b75539487dbdd190ad7811e3177436d8c27328e8d0710a964","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.7"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3125","versionConstraint":"< 4.16.1.3-29.amzn2023.0.8 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm-build-libs","version":"0:4.16.1.3-29.amzn2023.0.7"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3125","versionConstraint":"< 4.16.1.3-29.amzn2023.0.8 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.7"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3125","fix":{"state":"fixed","versions":["4.16.1.3-29.amzn2023.0.8"],"available":[{"date":"2026-09-29","kind":"advisory","version":"4.16.1.3-29.amzn2023.0.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-84233","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-10-10","epss":0.00197,"percentile":0.08602},{"cve":"CVE-2026-84233","date":"2026-10-10","epss":0.00194,"percentile":0.08345}],"risk":0.14775000000000002,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3125.html","description":"A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious tarball. (CVE-2026-78367)A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability. (CVE-2026-84233)"},"relatedVulnerabilities":[{"id":"CVE-2026-78367","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-10-10","epss":0.00197,"percentile":0.08602}],"urls":["https://access.redhat.com/security/cve/CVE-2026-78367","https://bugzilla.redhat.com/show_bug.cgi?id=2521857","https://github.com/rpm-software-management/rpm/issues/4314"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."},{"id":"CVE-2026-84233","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84233","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84233","date":"2026-10-10","epss":0.00194,"percentile":0.08345}],"urls":["https://access.redhat.com/errata/RHSA-2026:66637","https://access.redhat.com/security/cve/CVE-2026-84233","https://bugzilla.redhat.com/show_bug.cgi?id=2478409"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84233","description":"A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability."}]},{"artifact":{"id":"d18dbcf8914e3542","cpes":["cpe:2.3:a:amazonlinux:rpm-libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:rpm_libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm-libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rpm-libs:rpm_libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm-libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rpm_libs:rpm_libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*"],"name":"rpm-libs","purl":"pkg:rpm/amzn/rpm-libs@4.16.1.3-29.amzn2023.0.7?arch=x86_64&distro=amzn-2023&upstream=rpm-4.16.1.3-29.amzn2023.0.7.src.rpm","type":"rpm","version":"4.16.1.3-29.amzn2023.0.7","language":"","licenses":["GPLv2+ and LGPLv2+ with exceptions"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:fae7516be161dd7b75539487dbdd190ad7811e3177436d8c27328e8d0710a964","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.7"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3125","versionConstraint":"< 4.16.1.3-29.amzn2023.0.8 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm-libs","version":"0:4.16.1.3-29.amzn2023.0.7"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3125","versionConstraint":"< 4.16.1.3-29.amzn2023.0.8 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.7"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3125","fix":{"state":"fixed","versions":["4.16.1.3-29.amzn2023.0.8"],"available":[{"date":"2026-09-29","kind":"advisory","version":"4.16.1.3-29.amzn2023.0.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-84233","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-10-10","epss":0.00197,"percentile":0.08602},{"cve":"CVE-2026-84233","date":"2026-10-10","epss":0.00194,"percentile":0.08345}],"risk":0.14775000000000002,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3125.html","description":"A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious tarball. (CVE-2026-78367)A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability. (CVE-2026-84233)"},"relatedVulnerabilities":[{"id":"CVE-2026-78367","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-10-10","epss":0.00197,"percentile":0.08602}],"urls":["https://access.redhat.com/security/cve/CVE-2026-78367","https://bugzilla.redhat.com/show_bug.cgi?id=2521857","https://github.com/rpm-software-management/rpm/issues/4314"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."},{"id":"CVE-2026-84233","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84233","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84233","date":"2026-10-10","epss":0.00194,"percentile":0.08345}],"urls":["https://access.redhat.com/errata/RHSA-2026:66637","https://access.redhat.com/security/cve/CVE-2026-84233","https://bugzilla.redhat.com/show_bug.cgi?id=2478409"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84233","description":"A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability."}]},{"artifact":{"id":"06a3ecdfe2ac244b","cpes":["cpe:2.3:a:rpm-sign-libs:rpm-sign-libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign-libs:rpm_sign_libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign_libs:rpm-sign-libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign_libs:rpm_sign_libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:rpm-sign-libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:rpm_sign_libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign:rpm-sign-libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rpm-sign:rpm_sign_libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign:rpm-sign-libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rpm_sign:rpm_sign_libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm-sign-libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm_sign_libs:4.16.1.3-29.amzn2023.0.7:*:*:*:*:*:*:*"],"name":"rpm-sign-libs","purl":"pkg:rpm/amzn/rpm-sign-libs@4.16.1.3-29.amzn2023.0.7?arch=x86_64&distro=amzn-2023&upstream=rpm-4.16.1.3-29.amzn2023.0.7.src.rpm","type":"rpm","version":"4.16.1.3-29.amzn2023.0.7","language":"","licenses":["GPLv2+ and LGPLv2+ with exceptions"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:fae7516be161dd7b75539487dbdd190ad7811e3177436d8c27328e8d0710a964","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.7"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3125","versionConstraint":"< 4.16.1.3-29.amzn2023.0.8 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm-sign-libs","version":"0:4.16.1.3-29.amzn2023.0.7"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"4.16.1.3-29.amzn2023.0.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3125","versionConstraint":"< 4.16.1.3-29.amzn2023.0.8 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"rpm","version":"4.16.1.3-29.amzn2023.0.7"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3125","fix":{"state":"fixed","versions":["4.16.1.3-29.amzn2023.0.8"],"available":[{"date":"2026-09-29","kind":"advisory","version":"4.16.1.3-29.amzn2023.0.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-84233","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-10-10","epss":0.00197,"percentile":0.08602},{"cve":"CVE-2026-84233","date":"2026-10-10","epss":0.00194,"percentile":0.08345}],"risk":0.14775000000000002,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3125.html","description":"A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious tarball. (CVE-2026-78367)A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability. (CVE-2026-84233)"},"relatedVulnerabilities":[{"id":"CVE-2026-78367","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78367","cwe":"CWE-94","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78367","date":"2026-10-10","epss":0.00197,"percentile":0.08602}],"urls":["https://access.redhat.com/security/cve/CVE-2026-78367","https://bugzilla.redhat.com/show_bug.cgi?id=2521857","https://github.com/rpm-software-management/rpm/issues/4314"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78367","description":"A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb)."},{"id":"CVE-2026-84233","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84233","cwe":"CWE-78","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-84233","date":"2026-10-10","epss":0.00194,"percentile":0.08345}],"urls":["https://access.redhat.com/errata/RHSA-2026:66637","https://access.redhat.com/security/cve/CVE-2026-84233","https://bugzilla.redhat.com/show_bug.cgi?id=2478409"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84233","description":"A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability."}]},{"artifact":{"id":"db4fd84c37830fe8","cpes":["cpe:2.3:a:amazonlinux:expat:2.6.3-1.amzn2023.0.6:*:*:*:*:*:*:*","cpe:2.3:a:expat:expat:2.6.3-1.amzn2023.0.6:*:*:*:*:*:*:*"],"name":"expat","purl":"pkg:rpm/amzn/expat@2.6.3-1.amzn2023.0.6?arch=x86_64&distro=amzn-2023&upstream=expat-2.6.3-1.amzn2023.0.6.src.rpm","type":"rpm","version":"2.6.3-1.amzn2023.0.6","language":"","licenses":["MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:fae7516be161dd7b75539487dbdd190ad7811e3177436d8c27328e8d0710a964","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.8.3-1.amzn2023.0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-2157","versionConstraint":"< 2.8.3-1.amzn2023.0.1 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"expat","version":"0:2.6.3-1.amzn2023.0.6"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-2157","fix":{"state":"fixed","versions":["2.8.3-1.amzn2023.0.1"],"available":[{"date":"2026-09-14","kind":"advisory","version":"2.8.3-1.amzn2023.0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-50219","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-56131","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-56404","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-56405","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-56408","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-56409","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-56410","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-56411","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-56412","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2026-66046","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-76957","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-50219","date":"2026-10-10","epss":0.00181,"percentile":0.07069},{"cve":"CVE-2026-56131","date":"2026-10-10","epss":0.00175,"percentile":0.06461},{"cve":"CVE-2026-56404","date":"2026-10-10","epss":0.0013,"percentile":0.02271},{"cve":"CVE-2026-56405","date":"2026-10-10","epss":0.00125,"percentile":0.01949},{"cve":"CVE-2026-56408","date":"2026-10-10","epss":0.00125,"percentile":0.01949},{"cve":"CVE-2026-56409","date":"2026-10-10","epss":0.00119,"percentile":0.01655},{"cve":"CVE-2026-56410","date":"2026-10-10","epss":0.00129,"percentile":0.02205},{"cve":"CVE-2026-56411","date":"2026-10-10","epss":0.00129,"percentile":0.02205},{"cve":"CVE-2026-56412","date":"2026-10-10","epss":0.00179,"percentile":0.06848},{"cve":"CVE-2026-66046","date":"2026-10-10","epss":0.00742,"percentile":0.53345},{"cve":"CVE-2026-76957","date":"2026-10-10","epss":0.00107,"percentile":0.01064}],"risk":0.13575,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-2157.html","description":"libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur, (CVE-2026-50219)libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation). (CVE-2026-56131)libexpat before 2.8.2 has an integer overflow in addBinding. (CVE-2026-56404)libexpat before 2.8.2 has an integer overflow in getAttributeId. (CVE-2026-56405)libexpat before 2.8.2 has an integer overflow in copyString. (CVE-2026-56408)xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used. (CVE-2026-56409)xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId. (CVE-2026-56410)xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations. (CVE-2026-56411)libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219. (CVE-2026-56412)Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options. (CVE-2026-66046)libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412. (CVE-2026-76957)"},"relatedVulnerabilities":[{"id":"CVE-2026-50219","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.9,"impactScore":3.4,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50219","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-50219","date":"2026-10-10","epss":0.00181,"percentile":0.07069}],"urls":["https://github.com/libexpat/libexpat/pull/1246"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50219","description":"libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,"},{"id":"CVE-2026-56131","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56131","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56131","date":"2026-10-10","epss":0.00175,"percentile":0.06461}],"urls":["https://github.com/libexpat/libexpat/pull/1267"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56131","description":"libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation)."},{"id":"CVE-2026-56404","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56404","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56404","date":"2026-10-10","epss":0.0013,"percentile":0.02271}],"urls":["https://github.com/libexpat/libexpat/pull/1249"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56404","description":"libexpat before 2.8.2 has an integer overflow in addBinding."},{"id":"CVE-2026-56405","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56405","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56405","date":"2026-10-10","epss":0.00125,"percentile":0.01949}],"urls":["https://github.com/libexpat/libexpat/pull/1251"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56405","description":"libexpat before 2.8.2 has an integer overflow in getAttributeId."},{"id":"CVE-2026-56408","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56408","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56408","date":"2026-10-10","epss":0.00125,"percentile":0.01949}],"urls":["https://github.com/libexpat/libexpat/commit/16e2efd867ea8567ffa012210b52ef5918e20817"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56408","description":"libexpat before 2.8.2 has an integer overflow in copyString."},{"id":"CVE-2026-56409","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":5.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56409","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56409","date":"2026-10-10","epss":0.00119,"percentile":0.01655}],"urls":["https://github.com/libexpat/libexpat/pull/1259"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56409","description":"xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used."},{"id":"CVE-2026-56410","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56410","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56410","date":"2026-10-10","epss":0.00129,"percentile":0.02205}],"urls":["https://github.com/libexpat/libexpat/pull/1252"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56410","description":"xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId."},{"id":"CVE-2026-56411","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56411","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56411","date":"2026-10-10","epss":0.00129,"percentile":0.02205}],"urls":["https://github.com/libexpat/libexpat/pull/1263"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56411","description":"xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations."},{"id":"CVE-2026-56412","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.9,"impactScore":3.4,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56412","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-56412","date":"2026-10-10","epss":0.00179,"percentile":0.06848}],"urls":["https://github.com/libexpat/libexpat/pull/1278"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56412","description":"libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219."},{"id":"CVE-2026-66046","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66046","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66046","date":"2026-10-10","epss":0.00742,"percentile":0.53345}],"urls":["https://github.com/libexpat/libexpat/pull/1321","https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66046","description":"Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options."},{"id":"CVE-2026-76957","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76957","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-76957","date":"2026-10-10","epss":0.00107,"percentile":0.01064}],"urls":["https://github.com/libexpat/libexpat/pull/1322","https://github.com/libexpat/libexpat/pull/1329"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76957","description":"libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412."}]},{"artifact":{"id":"e4b33c1eb66a7e2a","cpes":["cpe:2.3:a:amazonlinux:pcre2:10.40-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2:10.40-1.amzn2023.0.3:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:rpm/amzn/pcre2@10.40-1.amzn2023.0.3?arch=x86_64&distro=amzn-2023&upstream=pcre2-10.40-1.amzn2023.0.3.src.rpm","type":"rpm","version":"10.40-1.amzn2023.0.3","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:fae7516be161dd7b75539487dbdd190ad7811e3177436d8c27328e8d0710a964","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"10.40-1.amzn2023.0.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3119","versionConstraint":"< 10.40-1.amzn2023.0.4 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"pcre2","version":"0:10.40-1.amzn2023.0.3"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3119","fix":{"state":"fixed","versions":["10.40-1.amzn2023.0.4"],"available":[{"date":"2026-09-29","kind":"advisory","version":"10.40-1.amzn2023.0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-89161","cwe":"CWE-590","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89161","date":"2026-10-10","epss":0.00126,"percentile":0.02044}],"risk":0.09450000000000001,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3119.html","description":"In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur. (CVE-2026-89161)"},"relatedVulnerabilities":[{"id":"CVE-2026-89161","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.9,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89161","cwe":"CWE-590","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89161","date":"2026-10-10","epss":0.00126,"percentile":0.02044}],"urls":["https://github.com/PCRE2Project/pcre2/pull/937","https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89161","description":"In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur."}]},{"artifact":{"id":"1d8e822edb17a6bf","cpes":["cpe:2.3:a:pcre2-syntax:pcre2-syntax:10.40-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2-syntax:pcre2_syntax:10.40-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2-syntax:10.40-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2_syntax:pcre2_syntax:10.40-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:pcre2-syntax:10.40-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:pcre2_syntax:10.40-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2-syntax:10.40-1.amzn2023.0.3:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre2_syntax:10.40-1.amzn2023.0.3:*:*:*:*:*:*:*"],"name":"pcre2-syntax","purl":"pkg:rpm/amzn/pcre2-syntax@10.40-1.amzn2023.0.3?arch=noarch&distro=amzn-2023&upstream=pcre2-10.40-1.amzn2023.0.3.src.rpm","type":"rpm","version":"10.40-1.amzn2023.0.3","language":"","licenses":["BSD"],"metadata":{"epoch":null,"architecture":"noarch","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:fae7516be161dd7b75539487dbdd190ad7811e3177436d8c27328e8d0710a964","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2","version":"10.40-1.amzn2023.0.3"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"10.40-1.amzn2023.0.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3119","versionConstraint":"< 10.40-1.amzn2023.0.4 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"pcre2-syntax","version":"0:10.40-1.amzn2023.0.3"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"10.40-1.amzn2023.0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3119","versionConstraint":"< 10.40-1.amzn2023.0.4 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"pcre2","version":"10.40-1.amzn2023.0.3"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3119","fix":{"state":"fixed","versions":["10.40-1.amzn2023.0.4"],"available":[{"date":"2026-09-29","kind":"advisory","version":"10.40-1.amzn2023.0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-89161","cwe":"CWE-590","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89161","date":"2026-10-10","epss":0.00126,"percentile":0.02044}],"risk":0.09450000000000001,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3119.html","description":"In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur. (CVE-2026-89161)"},"relatedVulnerabilities":[{"id":"CVE-2026-89161","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.9,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89161","cwe":"CWE-590","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89161","date":"2026-10-10","epss":0.00126,"percentile":0.02044}],"urls":["https://github.com/PCRE2Project/pcre2/pull/937","https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89161","description":"In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur."}]},{"artifact":{"id":"fb61acc7c937a429","cpes":["cpe:2.3:a:amazonlinux:systemd:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd:252.23-12.amzn2023:*:*:*:*:*:*:*"],"name":"systemd","purl":"pkg:rpm/amzn/systemd@252.23-12.amzn2023?arch=x86_64&distro=amzn-2023&upstream=systemd-252.23-12.amzn2023.src.rpm","type":"rpm","version":"252.23-12.amzn2023","language":"","licenses":["LGPLv2+ and MIT and GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:fae7516be161dd7b75539487dbdd190ad7811e3177436d8c27328e8d0710a964","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"252.23-13.amzn2023"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3117","versionConstraint":"< 252.23-13.amzn2023 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"systemd","version":"0:252.23-12.amzn2023"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3117","fix":{"state":"fixed","versions":["252.23-13.amzn2023"],"available":[{"date":"2026-09-29","kind":"advisory","version":"252.23-13.amzn2023"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-16742","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-16742","cwe":"CWE-347","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16742","date":"2026-10-10","epss":0.00057,"percentile":0.00004}],"risk":0.042749999999999996,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3117.html","description":"systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user (CVE-2026-16742)"},"relatedVulnerabilities":[{"id":"CVE-2026-16742","cvss":[{"type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16742","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-16742","cwe":"CWE-347","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16742","date":"2026-10-10","epss":0.00057,"percentile":0.00004}],"urls":["https://github.com/systemd/systemd/security/advisories/GHSA-jm29-p7hh-vjhv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16742","description":"systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user"}]},{"artifact":{"id":"397d727fedf2d60f","cpes":["cpe:2.3:a:systemd-libs:systemd-libs:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:systemd-libs:systemd_libs:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:systemd_libs:systemd-libs:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:systemd_libs:systemd_libs:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:systemd-libs:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:systemd_libs:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-libs:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_libs:252.23-12.amzn2023:*:*:*:*:*:*:*"],"name":"systemd-libs","purl":"pkg:rpm/amzn/systemd-libs@252.23-12.amzn2023?arch=x86_64&distro=amzn-2023&upstream=systemd-252.23-12.amzn2023.src.rpm","type":"rpm","version":"252.23-12.amzn2023","language":"","licenses":["LGPLv2+ and MIT"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:fae7516be161dd7b75539487dbdd190ad7811e3177436d8c27328e8d0710a964","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"systemd","version":"252.23-12.amzn2023"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"252.23-13.amzn2023"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3117","versionConstraint":"< 252.23-13.amzn2023 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"systemd-libs","version":"0:252.23-12.amzn2023"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"252.23-13.amzn2023"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3117","versionConstraint":"< 252.23-13.amzn2023 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"systemd","version":"252.23-12.amzn2023"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3117","fix":{"state":"fixed","versions":["252.23-13.amzn2023"],"available":[{"date":"2026-09-29","kind":"advisory","version":"252.23-13.amzn2023"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-16742","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-16742","cwe":"CWE-347","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16742","date":"2026-10-10","epss":0.00057,"percentile":0.00004}],"risk":0.042749999999999996,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3117.html","description":"systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user (CVE-2026-16742)"},"relatedVulnerabilities":[{"id":"CVE-2026-16742","cvss":[{"type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16742","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-16742","cwe":"CWE-347","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16742","date":"2026-10-10","epss":0.00057,"percentile":0.00004}],"urls":["https://github.com/systemd/systemd/security/advisories/GHSA-jm29-p7hh-vjhv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16742","description":"systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user"}]},{"artifact":{"id":"00ba7d569a0c81ad","cpes":["cpe:2.3:a:systemd-networkd:systemd-networkd:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:systemd-networkd:systemd_networkd:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:systemd_networkd:systemd-networkd:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:systemd_networkd:systemd_networkd:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:systemd-networkd:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:systemd_networkd:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-networkd:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_networkd:252.23-12.amzn2023:*:*:*:*:*:*:*"],"name":"systemd-networkd","purl":"pkg:rpm/amzn/systemd-networkd@252.23-12.amzn2023?arch=x86_64&distro=amzn-2023&upstream=systemd-252.23-12.amzn2023.src.rpm","type":"rpm","version":"252.23-12.amzn2023","language":"","licenses":["LGPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:fae7516be161dd7b75539487dbdd190ad7811e3177436d8c27328e8d0710a964","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"systemd","version":"252.23-12.amzn2023"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"252.23-13.amzn2023"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3117","versionConstraint":"< 252.23-13.amzn2023 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"systemd-networkd","version":"0:252.23-12.amzn2023"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"252.23-13.amzn2023"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3117","versionConstraint":"< 252.23-13.amzn2023 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"systemd","version":"252.23-12.amzn2023"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3117","fix":{"state":"fixed","versions":["252.23-13.amzn2023"],"available":[{"date":"2026-09-29","kind":"advisory","version":"252.23-13.amzn2023"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-16742","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-16742","cwe":"CWE-347","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16742","date":"2026-10-10","epss":0.00057,"percentile":0.00004}],"risk":0.042749999999999996,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3117.html","description":"systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user (CVE-2026-16742)"},"relatedVulnerabilities":[{"id":"CVE-2026-16742","cvss":[{"type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16742","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-16742","cwe":"CWE-347","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16742","date":"2026-10-10","epss":0.00057,"percentile":0.00004}],"urls":["https://github.com/systemd/systemd/security/advisories/GHSA-jm29-p7hh-vjhv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16742","description":"systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user"}]},{"artifact":{"id":"da4b48c3f4b95be3","cpes":["cpe:2.3:a:amazonlinux:systemd-pam:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:systemd_pam:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:systemd-pam:systemd-pam:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:systemd-pam:systemd_pam:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:systemd_pam:systemd-pam:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:systemd_pam:systemd_pam:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-pam:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_pam:252.23-12.amzn2023:*:*:*:*:*:*:*"],"name":"systemd-pam","purl":"pkg:rpm/amzn/systemd-pam@252.23-12.amzn2023?arch=x86_64&distro=amzn-2023&upstream=systemd-252.23-12.amzn2023.src.rpm","type":"rpm","version":"252.23-12.amzn2023","language":"","licenses":["LGPLv2+ and MIT and GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:fae7516be161dd7b75539487dbdd190ad7811e3177436d8c27328e8d0710a964","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"systemd","version":"252.23-12.amzn2023"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"252.23-13.amzn2023"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3117","versionConstraint":"< 252.23-13.amzn2023 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"systemd-pam","version":"0:252.23-12.amzn2023"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"252.23-13.amzn2023"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3117","versionConstraint":"< 252.23-13.amzn2023 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"systemd","version":"252.23-12.amzn2023"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3117","fix":{"state":"fixed","versions":["252.23-13.amzn2023"],"available":[{"date":"2026-09-29","kind":"advisory","version":"252.23-13.amzn2023"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-16742","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-16742","cwe":"CWE-347","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16742","date":"2026-10-10","epss":0.00057,"percentile":0.00004}],"risk":0.042749999999999996,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3117.html","description":"systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user (CVE-2026-16742)"},"relatedVulnerabilities":[{"id":"CVE-2026-16742","cvss":[{"type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16742","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-16742","cwe":"CWE-347","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16742","date":"2026-10-10","epss":0.00057,"percentile":0.00004}],"urls":["https://github.com/systemd/systemd/security/advisories/GHSA-jm29-p7hh-vjhv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16742","description":"systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user"}]},{"artifact":{"id":"6527305b1161c563","cpes":["cpe:2.3:a:systemd-resolved:systemd-resolved:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:systemd-resolved:systemd_resolved:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:systemd_resolved:systemd-resolved:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:systemd_resolved:systemd_resolved:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:systemd-resolved:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:amazonlinux:systemd_resolved:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-resolved:252.23-12.amzn2023:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_resolved:252.23-12.amzn2023:*:*:*:*:*:*:*"],"name":"systemd-resolved","purl":"pkg:rpm/amzn/systemd-resolved@252.23-12.amzn2023?arch=x86_64&distro=amzn-2023&upstream=systemd-252.23-12.amzn2023.src.rpm","type":"rpm","version":"252.23-12.amzn2023","language":"","licenses":["LGPLv2+ and MIT and GPLv2+"],"metadata":{"epoch":null,"architecture":"x86_64","modularityLabel":""},"locations":[{"path":"/var/lib/rpm/rpmdb.sqlite","layerID":"sha256:fae7516be161dd7b75539487dbdd190ad7811e3177436d8c27328e8d0710a964","accessPath":"/var/lib/rpm/rpmdb.sqlite","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"systemd","version":"252.23-12.amzn2023"}],"metadataType":"RpmMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"252.23-13.amzn2023"},"type":"exact-direct-match","found":{"vulnerabilityID":"ALAS2023-2026-3117","versionConstraint":"< 252.23-13.amzn2023 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"systemd-resolved","version":"0:252.23-12.amzn2023"},"namespace":"amazon:distro:amazonlinux:2023"}},{"fix":{"suggestedVersion":"252.23-13.amzn2023"},"type":"exact-indirect-match","found":{"vulnerabilityID":"ALAS2023-2026-3117","versionConstraint":"< 252.23-13.amzn2023 (rpm)"},"matcher":"rpm-matcher","searchedBy":{"distro":{"type":"amazonlinux","version":"2023"},"package":{"name":"systemd","version":"252.23-12.amzn2023"},"namespace":"amazon:distro:amazonlinux:2023"}}],"vulnerability":{"id":"ALAS2023-2026-3117","fix":{"state":"fixed","versions":["252.23-13.amzn2023"],"available":[{"date":"2026-09-29","kind":"advisory","version":"252.23-13.amzn2023"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-16742","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-16742","cwe":"CWE-347","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16742","date":"2026-10-10","epss":0.00057,"percentile":0.00004}],"risk":0.042749999999999996,"urls":[],"severity":"High","namespace":"amazon:distro:amazonlinux:2023","advisories":[],"dataSource":"https://alas.aws.amazon.com/AL2023/ALAS2023-2026-3117.html","description":"systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user (CVE-2026-16742)"},"relatedVulnerabilities":[{"id":"CVE-2026-16742","cvss":[{"type":"Secondary","source":"98a521c5-3a3e-4e2b-bc27-002067e0463c","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16742","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-16742","cwe":"CWE-347","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16742","date":"2026-10-10","epss":0.00057,"percentile":0.00004}],"urls":["https://github.com/systemd/systemd/security/advisories/GHSA-jm29-p7hh-vjhv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16742","description":"systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user"}]}],"grade":"F","score":"0.00","as_of":"2026-10-12T18:26:13.069Z","grype_db_version":"2026-10-11T06:30:42.000Z"}