← All tracked CVEs
Updated 20:01
High severity
High15d SLAWe fix a high vulnerability within 15 days of publication, under our service-level agreement (SLA). We track 788 CVEs here: in progress, or fixed in the last 30 days.
| CVE | Status | Summary | Distribution | Fixed |
|---|---|---|---|---|
| Fixed | GHSA-pwgv-4x5q-6m9f: sqlparse parsing DoS: TokenList.__init__ O(n*depth) work on deeply nested SQL | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | GHSA-prg7-hcfm-mfcr: ReDoS via backreferenced dollar-quote and multiline comment regexes in sqlparse lexer | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | GHSA-mf9v-mfxr-j63j: urllib3 <2.7.0 may fully decompress on Brotli second read or drain_conn, causing resource exhaustion | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | GHSA-f2ff-p2ww-7p4p: sqlparse group_comments O(n^2) on comment-only input, bypasses token cap, causing DoS | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | GHSA-c8rr-9gxc-jprv: ujson.dumps integer overflow/underflow with large or negative indent leads crash/loop DoS | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | GHSA-836r-79rf-4m37: soupsieve CSS attribute VALUE regex catastrophic backtracking on unterminated quotes enables ReDoS | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | GHSA-2wc2-fm75-p42x: Soupsieve/Beautiful Soup CSS parser allocates unbounded memory for large comma-separated selectors causing DoS | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | libcurl+libpsl fails PSL enforcement: public-suffix host cookies become wildcard, leak cross-subdomains | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | libcurl wolfSSL with CA caching reinstalls cached store after SSL_CTX callback, accepting untrusted certificates | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | curl ignores Secure attribute if preceded by tab in Set-Cookie, sending cookie over HTTP | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | libcurl erroneously reuses HTTPS connections across different CURLSSLOPT_NATIVE_CA settings for same host | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | libcurl ignores CURLOPT_PINNEDPUBLICKEY when verification disabled and server presents no certificate | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | libcurl multi/OpenSSL 3: pooled TLS outlives easy handle, dangling libctx leads to UAF | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Soupsieve <2.8.4 regex catastrophic backtracking via unterminated attribute selector causes DoS | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | soupsieve pre-2.8.4 CSS selector parser unbounded memory allocation DoS via crafted selectors | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Use-after-free RCE in GStreamer rtpsbcdepay RTP payload handling (ZDI-CAN-29787) | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | GStreamer PNG parser heap overflow allows RCE via malicious PNG; user interaction required | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | GStreamer OGG parser stack-based buffer overflow allows remote code execution; user interaction required | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | GStreamer MRF parsing heap buffer overflow enables RCE via crafted file (ZDI-CAN-29608) | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | GStreamer MRF parser out-of-bounds write enables remote code execution (ZDI-CAN-29510) | secure-packages-26.05 | Sep 18, 2026 | |
| Fixed | Valkey clusterbus ping extension parsing out-of-bounds read causes crash | secure-packages-rolling | Sep 17, 2026 | |
| Fixed | Valkey Lua null-byte error handling bug allows response stream injection and cross-user data tampering | secure-packages-rolling | Sep 17, 2026 | |
| Fixed | PYSEC-2026-1998: urllib3 ≤2.5.0 unbounded decompression chain enables resource exhaustion via chained Content-Encoding | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | PYSEC-2026-1996: urllib3 ≤2.6.2 decompresses redirect bodies during streaming, enabling decompression bombs and resource exhaustion | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | PYSEC-2026-1994: Resource exhaustion via over-decompression in urllib3 streaming compressed responses (<=2.5.0) | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | GHSA-qccp-gfcp-xxvc: urllib3 pre-2.7.0 ProxyManager.connection_from_url urlopen forwards sensitive headers on cross-origin redirects | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | GHSA-gm62-xv2j-4w53: urllib3 ≤2.5.0 unbounded content-encoding chain allows CPU and memory exhaustion DoS | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | GHSA-38jv-5279-wg99: urllib3 decompresses redirect bodies with preload_content=False, ignoring read limits; decompression bomb risk | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | GHSA-2xpw-w6gg-jr37: urllib3 <=2.5.0 streaming decompression over-decodes compressed responses, causing excessive CPU/memory usage | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | PYSEC-2026-3457: pyasn1 <0.6.4 REAL float conversion CPU/memory exhaustion via huge exponents in encoded data | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | PYSEC-2026-3456: pyasn1 <0.6.4 BER/CER/DER OID quadratic-time decode/encode enables DoS with many arcs | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | PYSEC-2026-3455: pyasn1 <0.6.4 BER/CER/DER decoder unbounded long-form tag parsing causes DoS and ValueError | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | PYSEC-2026-2263: Decoding ASN.1 deeply nested indefinite-length SEQUENCE/SET triggers DoS in pyasn1 <0.6.3 | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | GHSA-m4p7-r5rc-7g4j: pyasn1 BER/CER/DER decoder unbounded tag IDs cause quadratic CPU and unhandled ValueError | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | GHSA-jr27-m4p2-rc6r: pyasn1 BER decoder DoS via uncontrolled recursion on deeply nested indefinite SEQUENCE/SET causing RecursionError/OOM | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | GHSA-hm4w-wwcw-mr6r: pyasn1 Real float conversion DoS from untrusted ASN.1 REAL with huge exponent | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | GHSA-8ppf-4f7h-5ppj: pyasn1 OID/Relative-OID BER/CER/DER encode/decode quadratic by arcs, causing DoS | secure-packages-25.11 | Sep 16, 2026 | |
| Fixed | secure-packages-25.11 | Sep 16, 2026 | ||
| Fixed | RISC-V: Uninitialized cregs overwrite pt_regs after copyin failure, corrupting registers/leaking stack | secure-packages-25.11 | Sep 15, 2026 | |
| Fixed | ebtables lacked two-stage removal, exposing partially initialized table via racy ops assignment | secure-packages-25.11 | Sep 15, 2026 | |
| Fixed | Core ebtables init race: sockopts exposed globally before initialization completes | secure-packages-25.11 | Sep 15, 2026 | |
| Fixed | Linux kernel netfs_read_folio() fails to wait on writeback, misinterpreting dirty flag and folio->private | secure-packages-25.11 | Sep 15, 2026 | |
| Fixed | OpenSSL CMP fails to type-check protectionAlg; invalid cast triggers NULL deref DoS | secure-packages-26.05 | Sep 15, 2026 | |
| Fixed | OpenSSL QUIC retains ACK-only packet metadata, causing unbounded memory growth and DoS risk. | secure-packages-26.05 | Sep 15, 2026 | |
| Fixed | OpenSSL CMS_decrypt AES-WRAP-PAD unwrap mis-sized buffer causes 8-byte out-of-bounds heap write | secure-packages-26.05 | Sep 15, 2026 | |
| Fixed | OpenSSL DTLS buffers entire read buffers for future-epoch handshake records, causing memory amplification DoS | secure-packages-26.05 | Sep 15, 2026 | |
| Fixed | NULL-pointer dereference in RPK-only TLS configs upon signature_algorithms_cert extension, causing DoS | secure-packages-26.05 | Sep 15, 2026 | |
| Fixed | PYSEC-2026-3072: ReDoS via catastrophic backtracking in soupsieve attribute value regex on unterminated quotes | secure-packages-25.11 | Sep 15, 2026 | |
| Fixed | PYSEC-2026-3071: Soupsieve unbounded memory allocation parsing large comma-separated selectors enables DoS via amplification | secure-packages-25.11 | Sep 15, 2026 | |
| Fixed | GHSA-836r-79rf-4m37: soupsieve CSS selector parser ReDoS: catastrophic backtracking on unterminated quoted attribute value | secure-packages-25.11 | Sep 15, 2026 |