Aggregator

Zhang San, Ankit Prateek, Zhen Kong, SeungHyun Cho, Ryoma Nishioka, Keita Sode and Hyojae Lee discovered that Apache HTTP Server did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-46729) It was discovered that Apache HTTP Server did not correctly handle certain session cookies. A remote attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-47360) Zhen Kong discovered that Apache HTTP Server did not correctly handle certain forms of authentication. An unauthenticated remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-48005) Bartlomiej Dmitruk and Masumi Tanaka discovered that Apache HTTP Server did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-56153) Lucian Nitescu discovered that Apache HTTP Server did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-56449) It was discovered that Apache HTTP Server’s mod_rewrite module incorrectly handled memory when performing certain variable lookups. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 26.10. (CVE-2026-56154) Lucian Nitescu, Simon Kappel, and Gianluca Danesin discovered that Apache HTTP Server’s mod_http2 module incorrectly handled memory when processing certain HTTP/2 connections. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 26.10. (CVE-2026-57941) Juthawong Naisanguansee, Charles Vosburgh, Mike Read, and Ryoma Nishioka discovered that Apache HTTP Server’s mod_ssl module incorrectly handled certain expressions. An attacker could possibly use this issue to bypass intended access restrictions. This issue only affected Ubuntu 26.10. (CVE-2026-59797) 이지웅 discovered that Apache HTTP Server exposed WebDAV property information. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 26.10. (CVE-2026-58415) Zhen Kong and Charles Vosburgh discovered that Apache HTTP Server did not properly validate FTP server responses. A remote attacker could possibly use this issue to make a forward proxy connect to an arbitrary host. This issue only affected Ubuntu 26.10. (CVE-2026-63045) Hyojae Lee and Zhen Kong discovered that Apache HTTP Server incorrectly handled certain HTTP requests. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 26.10. (CVE-2026-63292) Lucian Nitescu and Zhen Kong discovered that Apache HTTP Server did not properly handle certain responses from backend servers. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-63686) Qing Xu discovered that Apache HTTP Server incorrectly interpreted HTTP responses from backend servers. A remote attacker could possibly use this issue to perform HTTP response smuggling attacks. This issue only affected Ubuntu 26.10. (CVE-2026-63718) Hyojae Lee discovered that Apache HTTP Server did not properly validate Digest authentication requests. A machine-in-the-middle attacker could possibly use this issue to bypass authentication. This issue only affected Ubuntu 26.10. (CVE-2026-73636) Zhen Kong and Darren Carreras discovered that Apache HTTP Server did not properly manage authentication requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-73637) Vlatko Kosturjak discovered that Apache HTTP Server did not properly enforce access restrictions for user directories. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 26.10. (CVE-2026-79768) Zhen Kong discovered that Apache HTTP Server did not properly handle certain WebDAV requests. An authenticated user could possibly use this issue to cause a denial of service or corrupt WebDAV property data. This issue only affected Ubuntu 26.10. (CVE-2026-93546)

FEDORA-2026-a971aa459f Packages in this update:

• ffmpeg-9.0.2-4.fc46
• openapv-1.1.3.0-1.fc46

Update description:

Latest OpenAPV release. Changes: https://github.com/AcademySoftwareFoundation/openapv/releases/tag/v1.1.3.0 . Includes FFmpeg rebuild against the new ABI.

Fixes CVE-2026-79113 .

USN-8890-1 fixed vulnerabilities in libsoup. Unfortunately, that update introduced a memory leak in the cookie jar and could introduce a regression. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-4271) It was discovered that libsoup incorrectly handled certain HTTPS proxy connections. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-5119) It was discovered that libsoup incorrectly parsed certain chunked HTTP requests. A remote attacker could possibly use this issue to bypass security controls. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-6324) It was discovered that libsoup incorrectly handled proxy authentication credentials. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-66339) It was discovered that libsoup incorrectly handled certain HTTP Range headers. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-77014, CVE-2026-77680) It was discovered that libsoup incorrectly handled certain HTTP/2 connections. A remote attacker could possibly use this issue to obtain sensitive information or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-85197) It was discovered that libsoup incorrectly handled certain HTTP/2 transfers. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-85534)

FEDORA-EPEL-2026-7928c100bf Packages in this update:

• perl-SQL-Abstract-2.000003-1.el10_4

Update description:

Update to perl-SQL-Abstact v2.000003.

In particular this addresses: CVE-2026-121265.

FEDORA-EPEL-2026-2411b76275 Packages in this update:

• perl-SQL-Abstract-2.000003-1.el9

Update description:

Update to perl-SQL-Abstact v2.000003.

In particular this addresses: CVE-2026-121265.

FEDORA-EPEL-2026-df17a88ba1 Packages in this update:

• perl-SQL-Abstract-2.000003-1.el10_3

Update description:

Update to perl-SQL-Abstact v2.000003.

In particular this addresses: CVE-2026-121265.

FEDORA-EPEL-2026-c542d5caff Packages in this update:

• perl-SQL-Abstract-2.000003-1.el10_2

Update description:

Update to perl-SQL-Abstact v2.000003.

In particular this addresses: CVE-2026-121265.

FEDORA-2026-d015d281d3 Packages in this update:

• sgx-pccs-1.27-2.fc43

Update description:

Update to 1.27 release, and update NPM module dependencies

FEDORA-2026-bf0e682c10 Packages in this update:

• strongswan-6.1.0-2.fc43

Update description:

Update to 6.1.0 for CVE-2026-78123, CVE-2026-78124, CVE-2026-78126, CVE-2026-78127, CVE-2026-78129, CVE-2026-78130, CVE-2026-78131, CVE-2026-78132, CVE-2026-78133, CVE-2026-78134 and CVE-2026-78135

FEDORA-2026-357d4a65d4 Packages in this update:

• strongswan-6.1.0-1.fc44

Update description:

Update to 6.1.0 for CVE-2026-78123, CVE-2026-78124, CVE-2026-78126, CVE-2026-78127, CVE-2026-78129, CVE-2026-78130, CVE-2026-78131, CVE-2026-78132, CVE-2026-78133, CVE-2026-78134 and CVE-2026-78135

FEDORA-2026-7277fc13ac Packages in this update:

• sgx-pccs-1.27-2.fc44

Update description:

Update to 1.27 release, and update NPM module dependencies

It was discovered that the Security component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83374) It was discovered that the JSSE component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83376) It was discovered that the Compiler component of OpenJDK 21 did not correctly authorize users. An unauthenticated remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-83378) It was discovered that the JAAS component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83380) It was discovered that the Security component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-83381) It was discovered that the JDBC component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83387) It was discovered that the Networking component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service or modify sensitive data. (CVE-2026-83395) It was discovered that the JAXP component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-83400) It was discovered that the JAXP component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-87290) It was discovered that the Networking component of OpenJDK 21 did not correctly authorize users. An unauthenticated remote attacker could possibly use this issue to read sensitive data. (CVE-2026-87291) It was discovered that the Networking component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87292) It was discovered that the Security component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-87294) It was discovered that the JAXP component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87367) It was discovered that the Networking component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91332) It was discovered that the Security component of OpenJDK 21 did not correctly authorize users. An unauthenticated remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91333) It was discovered that the ImageIO component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91334) It was discovered that the AWT component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91335) It was discovered that the JSSE component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91373) It was discovered that the Serviceability component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91374) It was discovered that the Libraries component of OpenJDK 21 did not correctly authenticate users. A local attacker could possibly use this issue to modify sensitive data. (CVE-2026-91375) It was discovered that the JDK tools component of OpenJDK 21 did not correctly authenticate users. A local attacker could possibly use this issue to modify sensitive data. (CVE-2026-91379) It was discovered that the Utility component of OpenJDK 21 did not correctly authorize users. A local attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91380) It was discovered that the Networking component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91394) It was discovered that the Serviceability component of OpenJDK 21 did not correctly authorize users. A local attacker could possibly use this issue to cause a denial of service or modify sensitive data. (CVE-2026-91397) It was discovered that the Networking component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91398) It was discovered that the Sound component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91400) It was discovered that the JSSE component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91403) It was discovered that the Libraries component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91410) It was discovered that the 2D component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or read or modify sensitive data. (CVE-2026-91415) It was discovered that the ImageIO component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91418) It was discovered that the Networking component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91451, CVE-2026-91452) It was discovered that the Lightweight HTTP Server component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91453) It was discovered that the JSSE component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91461) It was discovered that the JGSS component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91462) It was discovered that the JGSS component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91463, CVE-2026-91464) It was discovered that the Compiler component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91487) It was discovered that the Libraries component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-101516) It was discovered that the Security component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-114820) In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: https://openjdk.org/groups/vulnerability/advisories/2026-10-20 https://openjdk.org/groups/vulnerability/advisories/2026-10-21 https://openjdk.org/groups/vulnerability/advisories/2026-10-24

FEDORA-2026-069bc15d81 Packages in this update:

• sgx-pccs-1.27-2.fc45

Update description:

Update to 1.27 release, and update NPM module dependencies

It was discovered that the Security component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83374) It was discovered that the JSSE component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83376) It was discovered that the JAAS component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83380) It was discovered that the Security component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-83381) It was discovered that the JDBC component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83387) It was discovered that the Networking component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service or modify sensitive data. (CVE-2026-83395) It was discovered that the JAXP component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-83400) It was discovered that the JAXP component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-87290) It was discovered that the Networking component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87292) It was discovered that the Security component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-87294) It was discovered that the JAXP component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87367) It was discovered that the Networking component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91332) It was discovered that the ImageIO component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91334) It was discovered that the AWT component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91335) It was discovered that the JSSE component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91373) It was discovered that the Serviceability component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91374) It was discovered that the Libraries component of OpenJDK 17 did not correctly authenticate users. A local attacker could possibly use this issue to modify sensitive data. (CVE-2026-91375) It was discovered that the JDK tools component of OpenJDK 17 did not correctly authenticate users. A local attacker could possibly use this issue to modify sensitive data. (CVE-2026-91379) It was discovered that the Utility component of OpenJDK 17 did not correctly authorize users. A local attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91380) It was discovered that the 2D component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or modify sensitive data. (CVE-2026-91382) It was discovered that the Networking component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91394) It was discovered that the Serviceability component of OpenJDK 17 did not correctly authorize users. A local attacker could possibly use this issue to cause a denial of service or modify sensitive data. (CVE-2026-91397) It was discovered that the Networking component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91398) It was discovered that the Sound component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91400) It was discovered that the JSSE component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91403) It was discovered that the Libraries component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91410) It was discovered that the 2D component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or read or modify sensitive data. (CVE-2026-91415) It was discovered that the ImageIO component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91418) It was discovered that the Networking component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91451, CVE-2026-91452) It was discovered that the Lightweight HTTP Server component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91453) It was discovered that the JSSE component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91461) It was discovered that the JGSS component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91462) It was discovered that the JGSS component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91463, CVE-2026-91464) It was discovered that the Compiler component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91487) It was discovered that the Libraries component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-101516) It was discovered that the Security component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-114820) In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: https://openjdk.org/groups/vulnerability/advisories/2026-10-20 https://openjdk.org/groups/vulnerability/advisories/2026-10-21 https://openjdk.org/groups/vulnerability/advisories/2026-10-24

Christian Herdtweck discovered that Fetchmail incorrectly handled certain long log messages. A remote attacker could possibly use this issue to cause Fetchmail to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-36386) It was discovered that the Fetchmail SMTP client incorrectly handled certain status code messages. An attacker controlling a malicious server could possibly use this issue to cause Fetchmail to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2025-61962) Tristan Madani discovered that Fetchmail incorrectly handled certain NTLM authentication challenges. A remote attacker could possibly use this issue to cause Fetchmail to crash, resulting in a denial of service, or possibly execute arbitrary code. The default compiler options for affected releases should reduce the vulnerability to a denial of service. (CVE-2026-94184)

Alex Thomas discovered that libheif incorrectly handled certain HEIF images. An attacker could possibly use this issue to execute arbitrary code if a user or automated system were tricked into opening a specially crafted file.

It was discovered that pyasn1 did not properly bound the size of long-form tag identifiers when parsing BER, CER, or DER encoded data. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-59884) It was discovered that pyasn1 processed OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-59885) It was discovered that pyasn1 incorrectly handled conversion of decoded REAL values to Python float types. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU and memory resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-59886) It was discovered that pyasn1 incorrectly handled tracking component types when decoding containers without a schema. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-119194) It was discovered that pyasn1 processed fragmented constructed strings and indefinite-length ANY values in quadratic time. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. This issue was only addressed in Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-119195) It was discovered that pyasn1 processed fragmented constructed BIT STRING values in quadratic time. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. (CVE-2026-119196) It was discovered that pyasn1 processed binary-encoded REAL values with large mantissas in quadratic time. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. (CVE-2026-119197)

It was discovered that the Security component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83374) It was discovered that the JSSE component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83376, CVE-2026-91461) It was discovered that the JAAS component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83380) It was discovered that the Security component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-83381, CVE-2026-87294) It was discovered that the JDBC component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83387) It was discovered that the Networking component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-83395) It was discovered that the JAXP component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-83400) It was discovered that the JAXP component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-87290) It was discovered that the Networking component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87292, CVE-2026-91451, CVE-2026-91452) It was discovered that the RMI component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-87293) It was discovered that the JAXP component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87367) It was discovered that the ImageIO component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91334) It was discovered that the AWT component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91335) It was discovered that the JSSE component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91373) It was discovered that the Serviceability component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91374) It was discovered that the Utility component of OpenJDK 8 did not correctly authorize users. A local attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91380) It was discovered that the 2D component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91381) It was discovered that the 2D component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91382) It was discovered that the Utility component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91395, CVE-2026-91396) It was discovered that the Serviceability component of OpenJDK 8 did not correctly authorize users. A local attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91397) It was discovered that the Networking component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91398) It was discovered that the Sound component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91400) It was discovered that the JSSE component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91403) It was discovered that the Libraries component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91410) It was discovered that the JGSS component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91411) It was discovered that the 2D component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to read or modify sensitive data. (CVE-2026-91415) It was discovered that the CORBA component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91417) It was discovered that the ImageIO component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91418) It was discovered that the Lightweight HTTP Server component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91453) It was discovered that the JGSS component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91462) It was discovered that the JGSS component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91463, CVE-2026-91464) It was discovered that the Security component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-114820) In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: https://openjdk.org/groups/vulnerability/advisories/2026-10-20 https://openjdk.org/groups/vulnerability/advisories/2026-10-21 https://openjdk.org/groups/vulnerability/advisories/2026-10-24

It was discovered that the Security component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83374) It was discovered that the JSSE component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83376, CVE-2026-91461) It was discovered that the JAAS component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83380) It was discovered that the Security component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-83381, CVE-2026-87294) It was discovered that the JDBC component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83387) It was discovered that the Networking component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-83395) It was discovered that the JAXP component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-83400) It was discovered that the JAXP component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-87290) It was discovered that the Networking component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87292, CVE-2026-91332, CVE-2026-91451, CVE-2026-91452) It was discovered that the JAXP component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87367) It was discovered that the ImageIO component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91334) It was discovered that the AWT component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91335) It was discovered that the JSSE component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91373) It was discovered that the Serviceability component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91374) It was discovered that the Libraries component of OpenJDK 11 did not correctly authenticate users. A local attacker could possibly use this issue to modify sensitive data. (CVE-2026-91375) It was discovered that the JDK tools component of OpenJDK 11 did not correctly authenticate users. A local attacker could possibly use this issue to modify sensitive data. (CVE-2026-91379) It was discovered that the Utility component of OpenJDK 11 did not correctly authorize users. A local attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91380) It was discovered that the 2D component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91382) It was discovered that the Networking component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91394) It was discovered that the Utility component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91395, CVE-2026-91396) It was discovered that the Serviceability component of OpenJDK 11 did not correctly authorize users. A local attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91397) It was discovered that the Networking component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91398) It was discovered that the Sound component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91400) It was discovered that the JSSE component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91403) It was discovered that the Libraries component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91410) It was discovered that the JGSS component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91411) It was discovered that the 2D component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to read or modify sensitive data. (CVE-2026-91415) It was discovered that the ImageIO component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91418) It was discovered that the Lightweight HTTP Server component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91453) It was discovered that the JGSS component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91462) It was discovered that the JGSS component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91463, CVE-2026-91464) It was discovered that the Compiler component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91487) It was discovered that the Security component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-114820) In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: https://openjdk.org/groups/vulnerability/advisories/2026-10-20 https://openjdk.org/groups/vulnerability/advisories/2026-10-21 https://openjdk.org/groups/vulnerability/advisories/2026-10-24

FEDORA-EPEL-2026-090b14f20e Packages in this update:

• afflib-3.7.23-2.el10_3

Update description:

Update to 3.7.23