Skip to content
← All tracked CVEs

Updated 10:00

Medium severity

Medium45d SLA

Our service-level agreement (SLA) gives a medium vulnerability a fix within 45 days of publication. 446 CVEs are tracked here: open, or fixed in the last 30 days.

Status
CVEStatusSummaryReleaseClock startedDeadlineFixedTime to fix
Fixed within SLADeferred split queue race during migration makes dst visible early, triggering WARN and folio losssecure-packages-rollingJun 19, 2026Aug 3, 2026Jul 30, 202641 days
Fixed within SLAmm/damon: damos_walk and kdamond exit race causes deadlock with infinite request waitsecure-packages-rollingJun 19, 2026Aug 3, 2026Jul 30, 202641 days
Fixed within SLAASoC nau8821: Unloading driver with pending jdet_work causes kernel crashsecure-packages-rollingJun 17, 2026Aug 1, 2026Jul 30, 202643 days
Fixed within SLAgfs2_fill_super leaks kernel threads and quota bitmap on read-write transition failuresecure-packages-rollingJun 17, 2026Aug 1, 2026Jul 30, 202643 days
Fixed within SLAKVM nSVM: Ignored CR3 load failure on nested #VMEXIT causes corrupted vCPU statesecure-packages-26.05Jun 19, 2026Aug 3, 2026Jul 30, 202642 days
Fixed within SLADeferred split queue race during folio migration marks dst partially mapped, triggers WARNsecure-packages-26.05Jun 19, 2026Aug 3, 2026Jul 30, 202642 days
Fixed within SLAdamos_walk vs kdamond_fn exit race leads unhandled requests and indefinite wait deadlocksecure-packages-26.05Jun 19, 2026Aug 3, 2026Jul 30, 202642 days
Fixed within SLAUnloading snd_soc_nau8821 while jdet_work pending triggers kernel crashsecure-packages-26.05Jun 17, 2026Aug 1, 2026Jul 30, 202643 days
Fixed within SLALinux GFS2 gfs2_fill_super error-path memory leaks: kthreads and quota bitmap on RW transitionsecure-packages-26.05Jun 17, 2026Aug 1, 2026Jul 30, 202643 days
Fixed within SLAUnbound 1.20–1.25.1 counter not decremented in serve-expired discard-timeout; clients droppedsecure-packages-rollingJul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound ≤1.25.1 heap overflow processing absent second name in multi-dname RDATA (SOA) during DNSSEC validationsecure-packages-rollingJul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound 1.22-1.25.1 DoQ remote crash: libngtcp2 assert via -1 application error on STREAM_DATA_BLOCKEDsecure-packages-rollingJul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound 1.7.0–1.25.1 DNSCrypt cert/key count mismatch causes unauthenticated UDP-triggered crashsecure-packages-rollingJul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLARemote Unbound 1.10.0–1.25.1 crash DoS with serve-expired + respip CNAME override, NULL derefsecure-packages-rollingJul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound 1.25.0–1.25.1 respip/dns64 shallow view-name copy corrupts memory under pressuresecure-packages-rollingJul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound <=1.25.1: 0.0.0.0/::0 glue triggers unwanted-reply threshold DoS cache flushessecure-packages-rollingJul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound 1.7.0–1.25.1 accepts BOGUS XFR primary hostname, enabling spoofed zone/RPZ takeoversecure-packages-rollingJul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound respip/RPZ ignores DNSSEC status, rewriting BOGUS A/AAAA to INSECURE spoofable redirectssecure-packages-rollingJul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound DoT TLS server name dangling pointer during handshake triggers crash/DoS (1.15–1.25.1)secure-packages-rollingJul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound 1.22.0–1.25.1 bypasses max-global-quota via deeply nested DNSSEC query amplificationsecure-packages-rollingJul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAlibunbound up to 1.25.1 crash: unwanted-reply-threshold triggers disallowed libworker_alloc_cleanup callsecure-packages-rollingJul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAHeap buffer overflow in audiofile 0.3.6 FilePOSIX::read triggers DoS via crafted WAV (sfconvert)secure-packages-rollingJun 15, 2026Jul 30, 2026Jul 29, 202644 days
Fixed within SLAUnbound 1.20–1.25 misconfigured serve-expired discard-timeout fails counter decrement, drops duplicate clientssecure-packages-26.05Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound ≤1.25.1 heap overflow canonicalizing RRSIG-covered PX/RP/MINFO/SOA with missing second namesecure-packages-26.05Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnauthenticated DoQ client crashes Unbound 1.22–1.25.1 via libngtcp2 assertion from -1 errorsecure-packages-26.05Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound 1.7.0–1.25.1 DNSCrypt DoS from cert/secret mismatch; 0xdb-triggered UDP crashsecure-packages-26.05Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound 1.10.0–1.25.1 DoS: serve-expired with respip/RPZ CNAME triggers NULL pointer crashsecure-packages-26.05Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound 1.25.0–1.25.1 subquery shallow view-name copy risks memory corruption with respip/dns64secure-packages-26.05Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound ≤1.25.1 DoS: 0.0.0.0/::0 glue with unwanted-reply-threshold triggers endless cache flushessecure-packages-26.05Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound 1.7.0–1.25.1 accepts bogus RPZ primary, enabling spoofed XFR and policy takeoversecure-packages-26.05Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound ≤1.25.1 respip before validator ignores DNSSEC, rewriting BOGUS A/AAAA INSECURE, enabling poisoning.secure-packages-26.05Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound DoT TLS handshake use-after-free leads to daemon crash (1.15.0–1.25.1)secure-packages-26.05Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound 1.22–1.25.1 upstream packets per query exceed max-global-quota for deep DNSSEC namessecure-packages-26.05Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAlibunbound <=1.25.1 aborts when unwanted-reply-threshold invokes disallowed libworker_alloc_cleanupsecure-packages-26.05Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound respip with response-ip/RPZ ignores DNSSEC; rewrites BOGUS A/AAAA to operator IP as INSECUREsecure-packages-25.11Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound 1.10.0–1.25.1 crash: serve-expired with respip/RPZ CNAME causes NULL dereference DoSsecure-packages-25.11Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound 1.22.0–1.25.1 exceeds max-global-quota on deeply nested DNSSEC query, bypassing amplification limitssecure-packages-25.11Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound 1.22–1.25.1 DoQ: unauth client aborts process via libngtcp2 assertion failuresecure-packages-25.11Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound 1.20.0–1.25.1 serve-expired misconfig causes discard-timeout counter leak, silently dropping duplicate clientssecure-packages-25.11Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLANLnet Labs Unbound ≤1.25.1 heap overflow canonicalizing RRSIG-covered multi-dname RDATA missing second namesecure-packages-25.11Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound 1.7.0–1.25.1 DNSCrypt DoS from misconfigured extra certs, crafted UDPsecure-packages-25.11Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound 1.25.0–1.25.1 shallow view-name copy causes memory corruption with subqueries under jostlesecure-packages-25.11Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound 1.7.0-1.25.1 accepts bogus primary hostname for XFR, enabling RPZ takeoversecure-packages-25.11Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUnbound ≤1.25.1 DoS: 0.0.0.0/::0 glue triggers unwanted-reply-threshold cache flush loopsecure-packages-25.11Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAlibunbound <=1.25.1 terminates when unwanted-reply-threshold triggers; libworker_alloc_cleanup missing allowlistsecure-packages-25.11Jul 27, 2026Sep 10, 2026Jul 29, 20262 days
Fixed within SLAUse-after-free in Unbound DoT TLS server name causes crash during handshakesecure-packages-25.11Jul 27, 2026Sep 10, 2026Jul 29, 20262 days