{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [], "removed": [], "diff": [ "curl", "libcurl4t64", "openssh-client", "openssh-server", "openssh-sftp-server", "python3-distupgrade", "python3-jwt", "python3-urllib3", "snapd", "tzdata", "ubuntu-release-upgrader-core" ] } }, "diff": { "deb": [ { "name": "curl", "from_version": { "source_package_name": "curl", "source_package_version": "8.18.0-1ubuntu2.7", "version": "8.18.0-1ubuntu2.7" }, "to_version": { "source_package_name": "curl", "source_package_version": "8.18.0-1ubuntu2.8", "version": "8.18.0-1ubuntu2.8" }, "cves": [ { "cve": "CVE-2026-107928", "url": "https://ubuntu.com/security/CVE-2026-107928", "cve_description": "When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent greater than the number of bytes it was given to send. GnuTLS does that after a blocked send.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-107929", "url": "https://ubuntu.com/security/CVE-2026-107929", "cve_description": "When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86409", "url": "https://ubuntu.com/security/CVE-2026-86409", "cve_description": "Setting `CURLOPT_AWS_SIGV4` to NULL does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL is set next, leaking state information.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86410", "url": "https://ubuntu.com/security/CVE-2026-86410", "cve_description": "A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect. This means `--knownhosts`, `--hostpubsha256`, and `--hostpubmd5` are never installed when the initial URL is HTTPS. If `--location` and `--proto-redir +sftp` is used and the server returns a `Location: sftp://example.com` redirect, the SFTP connection proceeds without any of the user's requested SSH host verification methods.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86412", "url": "https://ubuntu.com/security/CVE-2026-86412", "cve_description": "A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86414", "url": "https://ubuntu.com/security/CVE-2026-86414", "cve_description": "A HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87862", "url": "https://ubuntu.com/security/CVE-2026-87862", "cve_description": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87863", "url": "https://ubuntu.com/security/CVE-2026-87863", "cve_description": "An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87864", "url": "https://ubuntu.com/security/CVE-2026-87864", "cve_description": "Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87865", "url": "https://ubuntu.com/security/CVE-2026-87865", "cve_description": "When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92386", "url": "https://ubuntu.com/security/CVE-2026-92386", "cve_description": "When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` will silently abort parsing prematurely upon encountering the oversized line, ignoring all subsequent valid cookies in the file.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92387", "url": "https://ubuntu.com/security/CVE-2026-92387", "cve_description": "By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92388", "url": "https://ubuntu.com/security/CVE-2026-92388", "cve_description": "When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while reconfiguring only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92389", "url": "https://ubuntu.com/security/CVE-2026-92389", "cve_description": "libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92390", "url": "https://ubuntu.com/security/CVE-2026-92390", "cve_description": "When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92391", "url": "https://ubuntu.com/security/CVE-2026-92391", "cve_description": "A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-94266", "url": "https://ubuntu.com/security/CVE-2026-94266", "cve_description": "libcurl could accidentally return a URL for curl_easy_getinfo's `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did. The curl tool exposes the same information using the command line option `--write-out '%{url_effective}'`. This credential leak can happen when curl retrieves credentials from a `.netrc` file.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92392", "url": "https://ubuntu.com/security/CVE-2026-92392", "cve_description": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.", "cve_priority": "high", "cve_public_date": "2026-10-14 08:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-107928", "url": "https://ubuntu.com/security/CVE-2026-107928", "cve_description": "When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent greater than the number of bytes it was given to send. GnuTLS does that after a blocked send.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-107929", "url": "https://ubuntu.com/security/CVE-2026-107929", "cve_description": "When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86409", "url": "https://ubuntu.com/security/CVE-2026-86409", "cve_description": "Setting `CURLOPT_AWS_SIGV4` to NULL does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL is set next, leaking state information.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86410", "url": "https://ubuntu.com/security/CVE-2026-86410", "cve_description": "A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect. This means `--knownhosts`, `--hostpubsha256`, and `--hostpubmd5` are never installed when the initial URL is HTTPS. If `--location` and `--proto-redir +sftp` is used and the server returns a `Location: sftp://example.com` redirect, the SFTP connection proceeds without any of the user's requested SSH host verification methods.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86412", "url": "https://ubuntu.com/security/CVE-2026-86412", "cve_description": "A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86414", "url": "https://ubuntu.com/security/CVE-2026-86414", "cve_description": "A HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87862", "url": "https://ubuntu.com/security/CVE-2026-87862", "cve_description": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87863", "url": "https://ubuntu.com/security/CVE-2026-87863", "cve_description": "An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87864", "url": "https://ubuntu.com/security/CVE-2026-87864", "cve_description": "Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87865", "url": "https://ubuntu.com/security/CVE-2026-87865", "cve_description": "When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92386", "url": "https://ubuntu.com/security/CVE-2026-92386", "cve_description": "When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` will silently abort parsing prematurely upon encountering the oversized line, ignoring all subsequent valid cookies in the file.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92387", "url": "https://ubuntu.com/security/CVE-2026-92387", "cve_description": "By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92388", "url": "https://ubuntu.com/security/CVE-2026-92388", "cve_description": "When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while reconfiguring only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92389", "url": "https://ubuntu.com/security/CVE-2026-92389", "cve_description": "libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92390", "url": "https://ubuntu.com/security/CVE-2026-92390", "cve_description": "When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92391", "url": "https://ubuntu.com/security/CVE-2026-92391", "cve_description": "A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-94266", "url": "https://ubuntu.com/security/CVE-2026-94266", "cve_description": "libcurl could accidentally return a URL for curl_easy_getinfo's `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did. The curl tool exposes the same information using the command line option `--write-out '%{url_effective}'`. This credential leak can happen when curl retrieves credentials from a `.netrc` file.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92392", "url": "https://ubuntu.com/security/CVE-2026-92392", "cve_description": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.", "cve_priority": "high", "cve_public_date": "2026-10-14 08:17:00 UTC" } ], "log": [ "", " [ Charles Cochran ]", " * SECURITY UPDATE: Out-of-bounds read in GnuTLS send path.", " - debian/patches/CVE-2026-107928.patch: reject a gnutls_record_send()", " return value larger than the length given in lib/vtls/gtls.c.", " - CVE-2026-107928", " * SECURITY UPDATE: Improper connection reuse with CURLOPT_INTERFACE.", " - debian/patches/CVE-2026-107929.patch: include the CURLOPT_INTERFACE", " binding in the connection reuse match in lib/cf-socket.c, lib/setopt.c,", " lib/url.c, lib/urldata.h.", " - CVE-2026-107929", " * SECURITY UPDATE: Information exposure from stale AWS SigV4 authentication.", " - debian/patches/CVE-2026-86409.patch: clear CURLAUTH_AWS_SIGV4 when", " CURLOPT_AWS_SIGV4 is set to NULL in lib/setopt.c, tests/data/test1978,", " tests/libtest/lib1978.c.", " - CVE-2026-86409", " * SECURITY UPDATE: Missing SSH host verification when redirected to SFTP/SCP.", " - debian/patches/CVE-2026-86410.patch: always set the SSH host verification", " options, falling back to ~/.ssh/known_hosts in src/config2setopts.c.", " - CVE-2026-86410", " * SECURITY UPDATE: Cookie jar data loss from an unloadable cookie.", " - debian/patches/CVE-2026-86412.patch: ignore individual cookie errors,", " except out of memory, when loading a cookie jar in lib/cookie.c.", " - CVE-2026-86412", " * SECURITY UPDATE: Credential exposure to an HTTP proxy in CONNECT.", " - debian/patches/CVE-2026-86414.patch: do not react to 401 responses to a", " CONNECT request in lib/cf-h1-proxy.c, lib/cf-h2-proxy.c,", " tests/data/Makefile.am, tests/data/test2173.", " - CVE-2026-86414", " * SECURITY UPDATE: Improper handling of HSTS entries on load.", " - debian/patches/CVE-2026-87862.patch: match only the exact host, not", " parent domains, when removing duplicates while loading an HSTS file in", " lib/hsts.c, tests/data/Makefile.am, tests/data/test3109.", " - CVE-2026-87862", " * SECURITY UPDATE: Data loss from out-of-range HSTS max-age.", " - debian/patches/CVE-2026-87863.patch: cap max-age to two years and skip", " entries whose expiry cannot be formatted in lib/hsts.c,", " tests/data/Makefile.am, tests/data/test1862.", " - CVE-2026-87863", " * SECURITY UPDATE: Command injection in IMAP APPEND with CURLOPT_CRLF.", " - debian/patches/CVE-2026-87864.patch: reject APPEND when CRLF conversion", " makes the upload size unknown in lib/imap.c.", " - CVE-2026-87864", " * SECURITY UPDATE: Improper host key verification with libssh2 hashed", " known_hosts.", " - debian/patches/CVE-2026-87865.patch: match hashed known_hosts entries by", " host before accepting them as found in lib/vssh/libssh2.c.", " - CVE-2026-87865", " * SECURITY UPDATE: Cookie jar parsing abort on over-long cookie lines.", " - debian/patches/CVE-2026-92386.patch: accept cookie jar lines slightly", " longer than MAX_COOKIE_LINE so that a full cookie fits in lib/cookie.c.", " - CVE-2026-92386", " * SECURITY UPDATE: Denial of service from unbounded response reading in FTP,", " IMAP, POP3 and SMTP.", " - debian/patches/CVE-2026-92387.patch: add a maximum loop counter to", " Curl_pp_readresp in lib/pingpong.c.", " - CVE-2026-92387", " * SECURITY UPDATE: Use after free in FTP wildcard matching.", " - debian/patches/CVE-2026-92388-1.patch: stop overwriting set.write_func", " and set.out in lib/cw-out.c, lib/ftp.h, lib/ftp.c, lib/ftplistparser.c,", " lib/ftplistparser.h.", " - debian/patches/CVE-2026-92388-2.patch: only use the list parser in the", " CURLWC_MATCHING state in lib/ftplistparser.c.", " - CVE-2026-92388", " * SECURITY UPDATE: Information exposure from TFTP transfer direction", " confusion.", " - debian/patches/CVE-2026-92389.patch: return CURLE_TFTP_ILLEGAL when a", " server response does not match the transfer direction in lib/tftp.c.", " - CVE-2026-92389", " * SECURITY UPDATE: Improper file overwrite protection with", " --remote-header-name.", " - debian/patches/CVE-2026-92390.patch: buffer headers until the remote", " filename is selected in src/tool_cb_hdr.c, tests/data/Makefile.am,", " tests/data/test3037, tests/data/test3038.", " - CVE-2026-92390", " * SECURITY UPDATE: Stack overflow from deeply nested MIME structures.", " - debian/patches/CVE-2026-92391.patch: free MIME handles non-recursively in", " curl_mime_free in lib/mime.c, tests/data/Makefile.am,", " tests/libtest/Makefile.inc, tests/data/test3595, tests/libtest/lib3595.c.", " - CVE-2026-92391", " * SECURITY UPDATE: Credential exposure in CURLINFO_EFFECTIVE_URL.", " - debian/patches/CVE-2026-94266.patch: return a copy of the URL without", " credentials for CURLINFO_EFFECTIVE_URL in lib/getinfo.c, lib/transfer.c,", " lib/url.c, lib/urldata.h, tests/data/Makefile.am, tests/data/test1876.", " - CVE-2026-94266", "", " [ Marc Deslauriers ]", " * SECURITY UPDATE: HTTP/2 upload Use-After-Free", " - debian/patches/CVE-2026-92392.patch: multi: adjust the cleanup order in", " multi_done in lib/multi.c.", " - CVE-2026-92392", "" ], "package": "curl", "version": "8.18.0-1ubuntu2.8", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Tue, 13 Oct 2026 08:01:28 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libcurl4t64", "from_version": { "source_package_name": "curl", "source_package_version": "8.18.0-1ubuntu2.7", "version": "8.18.0-1ubuntu2.7" }, "to_version": { "source_package_name": "curl", "source_package_version": "8.18.0-1ubuntu2.8", "version": "8.18.0-1ubuntu2.8" }, "cves": [ { "cve": "CVE-2026-107928", "url": "https://ubuntu.com/security/CVE-2026-107928", "cve_description": "When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent greater than the number of bytes it was given to send. GnuTLS does that after a blocked send.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-107929", "url": "https://ubuntu.com/security/CVE-2026-107929", "cve_description": "When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86409", "url": "https://ubuntu.com/security/CVE-2026-86409", "cve_description": "Setting `CURLOPT_AWS_SIGV4` to NULL does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL is set next, leaking state information.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86410", "url": "https://ubuntu.com/security/CVE-2026-86410", "cve_description": "A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect. This means `--knownhosts`, `--hostpubsha256`, and `--hostpubmd5` are never installed when the initial URL is HTTPS. If `--location` and `--proto-redir +sftp` is used and the server returns a `Location: sftp://example.com` redirect, the SFTP connection proceeds without any of the user's requested SSH host verification methods.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86412", "url": "https://ubuntu.com/security/CVE-2026-86412", "cve_description": "A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86414", "url": "https://ubuntu.com/security/CVE-2026-86414", "cve_description": "A HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87862", "url": "https://ubuntu.com/security/CVE-2026-87862", "cve_description": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87863", "url": "https://ubuntu.com/security/CVE-2026-87863", "cve_description": "An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87864", "url": "https://ubuntu.com/security/CVE-2026-87864", "cve_description": "Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87865", "url": "https://ubuntu.com/security/CVE-2026-87865", "cve_description": "When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92386", "url": "https://ubuntu.com/security/CVE-2026-92386", "cve_description": "When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` will silently abort parsing prematurely upon encountering the oversized line, ignoring all subsequent valid cookies in the file.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92387", "url": "https://ubuntu.com/security/CVE-2026-92387", "cve_description": "By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92388", "url": "https://ubuntu.com/security/CVE-2026-92388", "cve_description": "When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while reconfiguring only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92389", "url": "https://ubuntu.com/security/CVE-2026-92389", "cve_description": "libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92390", "url": "https://ubuntu.com/security/CVE-2026-92390", "cve_description": "When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92391", "url": "https://ubuntu.com/security/CVE-2026-92391", "cve_description": "A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-94266", "url": "https://ubuntu.com/security/CVE-2026-94266", "cve_description": "libcurl could accidentally return a URL for curl_easy_getinfo's `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did. The curl tool exposes the same information using the command line option `--write-out '%{url_effective}'`. This credential leak can happen when curl retrieves credentials from a `.netrc` file.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92392", "url": "https://ubuntu.com/security/CVE-2026-92392", "cve_description": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.", "cve_priority": "high", "cve_public_date": "2026-10-14 08:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-107928", "url": "https://ubuntu.com/security/CVE-2026-107928", "cve_description": "When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when `gnutls_record_send()` returns a number of bytes sent greater than the number of bytes it was given to send. GnuTLS does that after a blocked send.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-107929", "url": "https://ubuntu.com/security/CVE-2026-107929", "cve_description": "When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86409", "url": "https://ubuntu.com/security/CVE-2026-86409", "cve_description": "Setting `CURLOPT_AWS_SIGV4` to NULL does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL is set next, leaking state information.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86410", "url": "https://ubuntu.com/security/CVE-2026-86410", "cve_description": "A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect. This means `--knownhosts`, `--hostpubsha256`, and `--hostpubmd5` are never installed when the initial URL is HTTPS. If `--location` and `--proto-redir +sftp` is used and the server returns a `Location: sftp://example.com` redirect, the SFTP connection proceeds without any of the user's requested SSH host verification methods.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86412", "url": "https://ubuntu.com/security/CVE-2026-86412", "cve_description": "A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-86414", "url": "https://ubuntu.com/security/CVE-2026-86414", "cve_description": "A HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87862", "url": "https://ubuntu.com/security/CVE-2026-87862", "cve_description": "Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87863", "url": "https://ubuntu.com/security/CVE-2026-87863", "cve_description": "An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87864", "url": "https://ubuntu.com/security/CVE-2026-87864", "cve_description": "Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-87865", "url": "https://ubuntu.com/security/CVE-2026-87865", "cve_description": "When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92386", "url": "https://ubuntu.com/security/CVE-2026-92386", "cve_description": "When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` will silently abort parsing prematurely upon encountering the oversized line, ignoring all subsequent valid cookies in the file.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92387", "url": "https://ubuntu.com/security/CVE-2026-92387", "cve_description": "By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92388", "url": "https://ubuntu.com/security/CVE-2026-92388", "cve_description": "When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while reconfiguring only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92389", "url": "https://ubuntu.com/security/CVE-2026-92389", "cve_description": "libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92390", "url": "https://ubuntu.com/security/CVE-2026-92390", "cve_description": "When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92391", "url": "https://ubuntu.com/security/CVE-2026-92391", "cve_description": "A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-94266", "url": "https://ubuntu.com/security/CVE-2026-94266", "cve_description": "libcurl could accidentally return a URL for curl_easy_getinfo's `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did. The curl tool exposes the same information using the command line option `--write-out '%{url_effective}'`. This credential leak can happen when curl retrieves credentials from a `.netrc` file.", "cve_priority": "low", "cve_public_date": "2026-10-14 06:00:00 UTC" }, { "cve": "CVE-2026-92392", "url": "https://ubuntu.com/security/CVE-2026-92392", "cve_description": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.", "cve_priority": "high", "cve_public_date": "2026-10-14 08:17:00 UTC" } ], "log": [ "", " [ Charles Cochran ]", " * SECURITY UPDATE: Out-of-bounds read in GnuTLS send path.", " - debian/patches/CVE-2026-107928.patch: reject a gnutls_record_send()", " return value larger than the length given in lib/vtls/gtls.c.", " - CVE-2026-107928", " * SECURITY UPDATE: Improper connection reuse with CURLOPT_INTERFACE.", " - debian/patches/CVE-2026-107929.patch: include the CURLOPT_INTERFACE", " binding in the connection reuse match in lib/cf-socket.c, lib/setopt.c,", " lib/url.c, lib/urldata.h.", " - CVE-2026-107929", " * SECURITY UPDATE: Information exposure from stale AWS SigV4 authentication.", " - debian/patches/CVE-2026-86409.patch: clear CURLAUTH_AWS_SIGV4 when", " CURLOPT_AWS_SIGV4 is set to NULL in lib/setopt.c, tests/data/test1978,", " tests/libtest/lib1978.c.", " - CVE-2026-86409", " * SECURITY UPDATE: Missing SSH host verification when redirected to SFTP/SCP.", " - debian/patches/CVE-2026-86410.patch: always set the SSH host verification", " options, falling back to ~/.ssh/known_hosts in src/config2setopts.c.", " - CVE-2026-86410", " * SECURITY UPDATE: Cookie jar data loss from an unloadable cookie.", " - debian/patches/CVE-2026-86412.patch: ignore individual cookie errors,", " except out of memory, when loading a cookie jar in lib/cookie.c.", " - CVE-2026-86412", " * SECURITY UPDATE: Credential exposure to an HTTP proxy in CONNECT.", " - debian/patches/CVE-2026-86414.patch: do not react to 401 responses to a", " CONNECT request in lib/cf-h1-proxy.c, lib/cf-h2-proxy.c,", " tests/data/Makefile.am, tests/data/test2173.", " - CVE-2026-86414", " * SECURITY UPDATE: Improper handling of HSTS entries on load.", " - debian/patches/CVE-2026-87862.patch: match only the exact host, not", " parent domains, when removing duplicates while loading an HSTS file in", " lib/hsts.c, tests/data/Makefile.am, tests/data/test3109.", " - CVE-2026-87862", " * SECURITY UPDATE: Data loss from out-of-range HSTS max-age.", " - debian/patches/CVE-2026-87863.patch: cap max-age to two years and skip", " entries whose expiry cannot be formatted in lib/hsts.c,", " tests/data/Makefile.am, tests/data/test1862.", " - CVE-2026-87863", " * SECURITY UPDATE: Command injection in IMAP APPEND with CURLOPT_CRLF.", " - debian/patches/CVE-2026-87864.patch: reject APPEND when CRLF conversion", " makes the upload size unknown in lib/imap.c.", " - CVE-2026-87864", " * SECURITY UPDATE: Improper host key verification with libssh2 hashed", " known_hosts.", " - debian/patches/CVE-2026-87865.patch: match hashed known_hosts entries by", " host before accepting them as found in lib/vssh/libssh2.c.", " - CVE-2026-87865", " * SECURITY UPDATE: Cookie jar parsing abort on over-long cookie lines.", " - debian/patches/CVE-2026-92386.patch: accept cookie jar lines slightly", " longer than MAX_COOKIE_LINE so that a full cookie fits in lib/cookie.c.", " - CVE-2026-92386", " * SECURITY UPDATE: Denial of service from unbounded response reading in FTP,", " IMAP, POP3 and SMTP.", " - debian/patches/CVE-2026-92387.patch: add a maximum loop counter to", " Curl_pp_readresp in lib/pingpong.c.", " - CVE-2026-92387", " * SECURITY UPDATE: Use after free in FTP wildcard matching.", " - debian/patches/CVE-2026-92388-1.patch: stop overwriting set.write_func", " and set.out in lib/cw-out.c, lib/ftp.h, lib/ftp.c, lib/ftplistparser.c,", " lib/ftplistparser.h.", " - debian/patches/CVE-2026-92388-2.patch: only use the list parser in the", " CURLWC_MATCHING state in lib/ftplistparser.c.", " - CVE-2026-92388", " * SECURITY UPDATE: Information exposure from TFTP transfer direction", " confusion.", " - debian/patches/CVE-2026-92389.patch: return CURLE_TFTP_ILLEGAL when a", " server response does not match the transfer direction in lib/tftp.c.", " - CVE-2026-92389", " * SECURITY UPDATE: Improper file overwrite protection with", " --remote-header-name.", " - debian/patches/CVE-2026-92390.patch: buffer headers until the remote", " filename is selected in src/tool_cb_hdr.c, tests/data/Makefile.am,", " tests/data/test3037, tests/data/test3038.", " - CVE-2026-92390", " * SECURITY UPDATE: Stack overflow from deeply nested MIME structures.", " - debian/patches/CVE-2026-92391.patch: free MIME handles non-recursively in", " curl_mime_free in lib/mime.c, tests/data/Makefile.am,", " tests/libtest/Makefile.inc, tests/data/test3595, tests/libtest/lib3595.c.", " - CVE-2026-92391", " * SECURITY UPDATE: Credential exposure in CURLINFO_EFFECTIVE_URL.", " - debian/patches/CVE-2026-94266.patch: return a copy of the URL without", " credentials for CURLINFO_EFFECTIVE_URL in lib/getinfo.c, lib/transfer.c,", " lib/url.c, lib/urldata.h, tests/data/Makefile.am, tests/data/test1876.", " - CVE-2026-94266", "", " [ Marc Deslauriers ]", " * SECURITY UPDATE: HTTP/2 upload Use-After-Free", " - debian/patches/CVE-2026-92392.patch: multi: adjust the cleanup order in", " multi_done in lib/multi.c.", " - CVE-2026-92392", "" ], "package": "curl", "version": "8.18.0-1ubuntu2.8", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Tue, 13 Oct 2026 08:01:28 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-client", "from_version": { "source_package_name": "openssh", "source_package_version": "1:10.2p1-2ubuntu3.7", "version": "1:10.2p1-2ubuntu3.7" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:10.2p1-2ubuntu3.8", "version": "1:10.2p1-2ubuntu3.8" }, "cves": [ { "cve": "CVE-2026-106552", "url": "https://ubuntu.com/security/CVE-2026-106552", "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106553", "url": "https://ubuntu.com/security/CVE-2026-106553", "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106555", "url": "https://ubuntu.com/security/CVE-2026-106555", "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106582", "url": "https://ubuntu.com/security/CVE-2026-106582", "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106583", "url": "https://ubuntu.com/security/CVE-2026-106583", "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.", "cve_priority": "medium", "cve_public_date": "2026-10-07 00:17:00 UTC" }, { "cve": "CVE-2026-106584", "url": "https://ubuntu.com/security/CVE-2026-106584", "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106585", "url": "https://ubuntu.com/security/CVE-2026-106585", "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106586", "url": "https://ubuntu.com/security/CVE-2026-106586", "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106587", "url": "https://ubuntu.com/security/CVE-2026-106587", "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.", "cve_priority": "medium", "cve_public_date": "2026-10-06 22:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-106552", "url": "https://ubuntu.com/security/CVE-2026-106552", "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106553", "url": "https://ubuntu.com/security/CVE-2026-106553", "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106555", "url": "https://ubuntu.com/security/CVE-2026-106555", "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106582", "url": "https://ubuntu.com/security/CVE-2026-106582", "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106583", "url": "https://ubuntu.com/security/CVE-2026-106583", "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.", "cve_priority": "medium", "cve_public_date": "2026-10-07 00:17:00 UTC" }, { "cve": "CVE-2026-106584", "url": "https://ubuntu.com/security/CVE-2026-106584", "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106585", "url": "https://ubuntu.com/security/CVE-2026-106585", "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106586", "url": "https://ubuntu.com/security/CVE-2026-106586", "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106587", "url": "https://ubuntu.com/security/CVE-2026-106587", "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.", "cve_priority": "medium", "cve_public_date": "2026-10-06 22:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: sftp directory traversal", " - debian/patches/CVE-2026-106552-pre1.patch: upstream: similar to scp, fix", " implicit destination path selection in sftp.c.", " - debian/patches/CVE-2026-106552.patch: upstream: sftp: be stricter in", " accepting paths returned by the in sftp-client.c, sftp.c.", " - CVE-2026-106552", " * SECURITY UPDATE: incorrect GSSAPIAuthentication auth persistence", " - debian/patches/CVE-2026-106553-1.patch: upstream: Reset GSSAPI client", " state before authentication in auth2.c, gss-serv.c, monitor.c, ssh-gss.h.", " - debian/patches/CVE-2026-106553-2.patch: upstream: Only store GSSAPI creds", " when authn succeeds in gss-serv.c, ssh-gss.h.", " - debian/patches/CVE-2026-106553-3.patch: upstream:", " ssh_gssapi_cleanup_global_client() needs a prototype in gss-serv.c, ssh-", " gss.h.", " - CVE-2026-106553", " - CVE-2026-106555", " * SECURITY UPDATE: incorrect use of LZ77 dictionary coder", " - debian/patches/CVE-2026-106582.patch: upstream: Disable LZ77 dictionary", " coder to avoid a potential in packet.c.", " - CVE-2026-106582", " * SECURITY UPDATE: invalid chars in command-line username", " - debian/patches/CVE-2026-106583-1.patch: upstream: Further restrict the", " characters allowed in a command-line in readconf.c.", " - debian/patches/CVE-2026-106583-2.patch: upstream: Add test for", " proxycommand percent expansions. in regress/percent.sh.", " - debian/patches/CVE-2026-106583-3.patch: avoid ksh-ism in regress test in", " regress/percent.sh.", " - CVE-2026-106583", " * SECURITY UPDATE: incorrect cert expiry in ssh-keygen", " - debian/patches/CVE-2026-106584.patch: upstream: Correct handling of DST", " when converting dates in misc.c.", " - CVE-2026-106584", " * SECURITY UPDATE: missing maximum packet length check", " - debian/patches/CVE-2026-106585.patch: upstream: Check that compressed", " payloads don't inflate beyond the in packet.c.", " - CVE-2026-106585", " * SECURITY UPDATE: incorrect restrict keyword usage in tunnel forwarding", " - debian/patches/CVE-2026-106586-1.patch: upstream: Propagate", " authorized_keys \"resrict\" keyword in auth-options.c.", " - debian/patches/CVE-2026-106586-2.patch: upstream: correctly check", " sshauthopt->restricted merging in regress/unittests/authopt/tests.c.", " - debian/patches/CVE-2026-106586-3.patch: upstream: simpler in", " regress/unittests/authopt/tests.c.", " - CVE-2026-106586", " * SECURITY UPDATE: \"none\" value confusion in options", " - debian/patches/CVE-2026-106587.patch: upstream: Correctly handle some", " options that accept \"none\" in servconf.c.", " - CVE-2026-106587", "" ], "package": "openssh", "version": "1:10.2p1-2ubuntu3.8", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 08 Oct 2026 12:36:04 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-server", "from_version": { "source_package_name": "openssh", "source_package_version": "1:10.2p1-2ubuntu3.7", "version": "1:10.2p1-2ubuntu3.7" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:10.2p1-2ubuntu3.8", "version": "1:10.2p1-2ubuntu3.8" }, "cves": [ { "cve": "CVE-2026-106552", "url": "https://ubuntu.com/security/CVE-2026-106552", "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106553", "url": "https://ubuntu.com/security/CVE-2026-106553", "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106555", "url": "https://ubuntu.com/security/CVE-2026-106555", "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106582", "url": "https://ubuntu.com/security/CVE-2026-106582", "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106583", "url": "https://ubuntu.com/security/CVE-2026-106583", "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.", "cve_priority": "medium", "cve_public_date": "2026-10-07 00:17:00 UTC" }, { "cve": "CVE-2026-106584", "url": "https://ubuntu.com/security/CVE-2026-106584", "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106585", "url": "https://ubuntu.com/security/CVE-2026-106585", "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106586", "url": "https://ubuntu.com/security/CVE-2026-106586", "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106587", "url": "https://ubuntu.com/security/CVE-2026-106587", "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.", "cve_priority": "medium", "cve_public_date": "2026-10-06 22:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-106552", "url": "https://ubuntu.com/security/CVE-2026-106552", "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106553", "url": "https://ubuntu.com/security/CVE-2026-106553", "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106555", "url": "https://ubuntu.com/security/CVE-2026-106555", "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106582", "url": "https://ubuntu.com/security/CVE-2026-106582", "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106583", "url": "https://ubuntu.com/security/CVE-2026-106583", "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.", "cve_priority": "medium", "cve_public_date": "2026-10-07 00:17:00 UTC" }, { "cve": "CVE-2026-106584", "url": "https://ubuntu.com/security/CVE-2026-106584", "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106585", "url": "https://ubuntu.com/security/CVE-2026-106585", "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106586", "url": "https://ubuntu.com/security/CVE-2026-106586", "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106587", "url": "https://ubuntu.com/security/CVE-2026-106587", "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.", "cve_priority": "medium", "cve_public_date": "2026-10-06 22:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: sftp directory traversal", " - debian/patches/CVE-2026-106552-pre1.patch: upstream: similar to scp, fix", " implicit destination path selection in sftp.c.", " - debian/patches/CVE-2026-106552.patch: upstream: sftp: be stricter in", " accepting paths returned by the in sftp-client.c, sftp.c.", " - CVE-2026-106552", " * SECURITY UPDATE: incorrect GSSAPIAuthentication auth persistence", " - debian/patches/CVE-2026-106553-1.patch: upstream: Reset GSSAPI client", " state before authentication in auth2.c, gss-serv.c, monitor.c, ssh-gss.h.", " - debian/patches/CVE-2026-106553-2.patch: upstream: Only store GSSAPI creds", " when authn succeeds in gss-serv.c, ssh-gss.h.", " - debian/patches/CVE-2026-106553-3.patch: upstream:", " ssh_gssapi_cleanup_global_client() needs a prototype in gss-serv.c, ssh-", " gss.h.", " - CVE-2026-106553", " - CVE-2026-106555", " * SECURITY UPDATE: incorrect use of LZ77 dictionary coder", " - debian/patches/CVE-2026-106582.patch: upstream: Disable LZ77 dictionary", " coder to avoid a potential in packet.c.", " - CVE-2026-106582", " * SECURITY UPDATE: invalid chars in command-line username", " - debian/patches/CVE-2026-106583-1.patch: upstream: Further restrict the", " characters allowed in a command-line in readconf.c.", " - debian/patches/CVE-2026-106583-2.patch: upstream: Add test for", " proxycommand percent expansions. in regress/percent.sh.", " - debian/patches/CVE-2026-106583-3.patch: avoid ksh-ism in regress test in", " regress/percent.sh.", " - CVE-2026-106583", " * SECURITY UPDATE: incorrect cert expiry in ssh-keygen", " - debian/patches/CVE-2026-106584.patch: upstream: Correct handling of DST", " when converting dates in misc.c.", " - CVE-2026-106584", " * SECURITY UPDATE: missing maximum packet length check", " - debian/patches/CVE-2026-106585.patch: upstream: Check that compressed", " payloads don't inflate beyond the in packet.c.", " - CVE-2026-106585", " * SECURITY UPDATE: incorrect restrict keyword usage in tunnel forwarding", " - debian/patches/CVE-2026-106586-1.patch: upstream: Propagate", " authorized_keys \"resrict\" keyword in auth-options.c.", " - debian/patches/CVE-2026-106586-2.patch: upstream: correctly check", " sshauthopt->restricted merging in regress/unittests/authopt/tests.c.", " - debian/patches/CVE-2026-106586-3.patch: upstream: simpler in", " regress/unittests/authopt/tests.c.", " - CVE-2026-106586", " * SECURITY UPDATE: \"none\" value confusion in options", " - debian/patches/CVE-2026-106587.patch: upstream: Correctly handle some", " options that accept \"none\" in servconf.c.", " - CVE-2026-106587", "" ], "package": "openssh", "version": "1:10.2p1-2ubuntu3.8", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 08 Oct 2026 12:36:04 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssh-sftp-server", "from_version": { "source_package_name": "openssh", "source_package_version": "1:10.2p1-2ubuntu3.7", "version": "1:10.2p1-2ubuntu3.7" }, "to_version": { "source_package_name": "openssh", "source_package_version": "1:10.2p1-2ubuntu3.8", "version": "1:10.2p1-2ubuntu3.8" }, "cves": [ { "cve": "CVE-2026-106552", "url": "https://ubuntu.com/security/CVE-2026-106552", "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106553", "url": "https://ubuntu.com/security/CVE-2026-106553", "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106555", "url": "https://ubuntu.com/security/CVE-2026-106555", "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106582", "url": "https://ubuntu.com/security/CVE-2026-106582", "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106583", "url": "https://ubuntu.com/security/CVE-2026-106583", "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.", "cve_priority": "medium", "cve_public_date": "2026-10-07 00:17:00 UTC" }, { "cve": "CVE-2026-106584", "url": "https://ubuntu.com/security/CVE-2026-106584", "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106585", "url": "https://ubuntu.com/security/CVE-2026-106585", "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106586", "url": "https://ubuntu.com/security/CVE-2026-106586", "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106587", "url": "https://ubuntu.com/security/CVE-2026-106587", "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.", "cve_priority": "medium", "cve_public_date": "2026-10-06 22:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-106552", "url": "https://ubuntu.com/security/CVE-2026-106552", "cve_description": "In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106553", "url": "https://ubuntu.com/security/CVE-2026-106553", "cve_description": "In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106555", "url": "https://ubuntu.com/security/CVE-2026-106555", "cve_description": "In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106582", "url": "https://ubuntu.com/security/CVE-2026-106582", "cve_description": "In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 \"Crossing the Streams\" findings.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106583", "url": "https://ubuntu.com/security/CVE-2026-106583", "cve_description": "In ssh in OpenSSH before 10.6, a $ or \\ character can occur in a command-line username, leading to injection.", "cve_priority": "medium", "cve_public_date": "2026-10-07 00:17:00 UTC" }, { "cve": "CVE-2026-106584", "url": "https://ubuntu.com/security/CVE-2026-106584", "cve_description": "In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106585", "url": "https://ubuntu.com/security/CVE-2026-106585", "cve_description": "In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106586", "url": "https://ubuntu.com/security/CVE-2026-106586", "cve_description": "In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.", "cve_priority": "medium", "cve_public_date": "2026-10-06 21:17:00 UTC" }, { "cve": "CVE-2026-106587", "url": "https://ubuntu.com/security/CVE-2026-106587", "cve_description": "In sshd in OpenSSH before 10.6, the value \"none\" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.", "cve_priority": "medium", "cve_public_date": "2026-10-06 22:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: sftp directory traversal", " - debian/patches/CVE-2026-106552-pre1.patch: upstream: similar to scp, fix", " implicit destination path selection in sftp.c.", " - debian/patches/CVE-2026-106552.patch: upstream: sftp: be stricter in", " accepting paths returned by the in sftp-client.c, sftp.c.", " - CVE-2026-106552", " * SECURITY UPDATE: incorrect GSSAPIAuthentication auth persistence", " - debian/patches/CVE-2026-106553-1.patch: upstream: Reset GSSAPI client", " state before authentication in auth2.c, gss-serv.c, monitor.c, ssh-gss.h.", " - debian/patches/CVE-2026-106553-2.patch: upstream: Only store GSSAPI creds", " when authn succeeds in gss-serv.c, ssh-gss.h.", " - debian/patches/CVE-2026-106553-3.patch: upstream:", " ssh_gssapi_cleanup_global_client() needs a prototype in gss-serv.c, ssh-", " gss.h.", " - CVE-2026-106553", " - CVE-2026-106555", " * SECURITY UPDATE: incorrect use of LZ77 dictionary coder", " - debian/patches/CVE-2026-106582.patch: upstream: Disable LZ77 dictionary", " coder to avoid a potential in packet.c.", " - CVE-2026-106582", " * SECURITY UPDATE: invalid chars in command-line username", " - debian/patches/CVE-2026-106583-1.patch: upstream: Further restrict the", " characters allowed in a command-line in readconf.c.", " - debian/patches/CVE-2026-106583-2.patch: upstream: Add test for", " proxycommand percent expansions. in regress/percent.sh.", " - debian/patches/CVE-2026-106583-3.patch: avoid ksh-ism in regress test in", " regress/percent.sh.", " - CVE-2026-106583", " * SECURITY UPDATE: incorrect cert expiry in ssh-keygen", " - debian/patches/CVE-2026-106584.patch: upstream: Correct handling of DST", " when converting dates in misc.c.", " - CVE-2026-106584", " * SECURITY UPDATE: missing maximum packet length check", " - debian/patches/CVE-2026-106585.patch: upstream: Check that compressed", " payloads don't inflate beyond the in packet.c.", " - CVE-2026-106585", " * SECURITY UPDATE: incorrect restrict keyword usage in tunnel forwarding", " - debian/patches/CVE-2026-106586-1.patch: upstream: Propagate", " authorized_keys \"resrict\" keyword in auth-options.c.", " - debian/patches/CVE-2026-106586-2.patch: upstream: correctly check", " sshauthopt->restricted merging in regress/unittests/authopt/tests.c.", " - debian/patches/CVE-2026-106586-3.patch: upstream: simpler in", " regress/unittests/authopt/tests.c.", " - CVE-2026-106586", " * SECURITY UPDATE: \"none\" value confusion in options", " - debian/patches/CVE-2026-106587.patch: upstream: Correctly handle some", " options that accept \"none\" in servconf.c.", " - CVE-2026-106587", "" ], "package": "openssh", "version": "1:10.2p1-2ubuntu3.8", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 08 Oct 2026 12:36:04 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-distupgrade", "from_version": { "source_package_name": "ubuntu-release-upgrader", "source_package_version": "1:26.04.25", "version": "1:26.04.25" }, "to_version": { "source_package_name": "ubuntu-release-upgrader", "source_package_version": "1:26.04.27", "version": "1:26.04.27" }, "cves": [], "launchpad_bugs_fixed": [ 2156727, 2156727 ], "changes": [ { "cves": [], "log": [ "", " * DistUpgradeQuirks: prevent the selected display manager from being removed", " on Ubuntu Budgie systems (LP: #2156727)", "" ], "package": "ubuntu-release-upgrader", "version": "1:26.04.27", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2156727 ], "author": "Simon Johnsson ", "date": "Mon, 28 Sep 2026 16:32:47 +0200" }, { "cves": [], "log": [ "", " * DistUpgradeQuirks: mark dracut for install if", " ubuntu-budgie-desktop-minimal is installed (LP: #2156727):", " - This fixes an issue where the meta-package would not upgrade,", " potentially leading the system without an active display manager as sddm", " would be removed as an obsolete package.", "" ], "package": "ubuntu-release-upgrader", "version": "1:26.04.26", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2156727 ], "author": "Simon Johnsson ", "date": "Mon, 15 Jun 2026 11:04:53 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-jwt", "from_version": { "source_package_name": "pyjwt", "source_package_version": "2.10.1-4ubuntu1.1", "version": "2.10.1-4ubuntu1.1" }, "to_version": { "source_package_name": "pyjwt", "source_package_version": "2.10.1-4ubuntu1.2", "version": "2.10.1-4ubuntu1.2" }, "cves": [ { "cve": "CVE-2026-102266", "url": "https://ubuntu.com/security/CVE-2026-102266", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As a result, an attacker signs an HMAC token with the same zero-length key accepted by PyJWT. Consequently, forged token can carry arbitrary authenticated claims. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102267", "url": "https://ubuntu.com/security/CVE-2026-102267", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102268", "url": "https://ubuntu.com/security/CVE-2026-102268", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102271", "url": "https://ubuntu.com/security/CVE-2026-102271", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102272", "url": "https://ubuntu.com/security/CVE-2026-102272", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102273", "url": "https://ubuntu.com/security/CVE-2026-102273", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-102266", "url": "https://ubuntu.com/security/CVE-2026-102266", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As a result, an attacker signs an HMAC token with the same zero-length key accepted by PyJWT. Consequently, forged token can carry arbitrary authenticated claims. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102267", "url": "https://ubuntu.com/security/CVE-2026-102267", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, forwarded credentials may be disclosed or verification keys may be substituted. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102268", "url": "https://ubuntu.com/security/CVE-2026-102268", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102271", "url": "https://ubuntu.com/security/CVE-2026-102271", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102272", "url": "https://ubuntu.com/security/CVE-2026-102272", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" }, { "cve": "CVE-2026-102273", "url": "https://ubuntu.com/security/CVE-2026-102273", "cve_description": "PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric algorithms and passes a public JWK container as the raw key. As a result, public asymmetric key material is accepted as the HMAC secret. Consequently, an attacker who knows the public key can forge a token with arbitrary authenticated claims. This issue is fixed in version 2.14.0.", "cve_priority": "medium", "cve_public_date": "2026-09-28 21:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Inconsistent HMAC key validation in HMACAlgorithm", " - debian/patches/CVE-2026-102266.patch: Validate PyJWK HMAC keys", " consistently in jwt/api_jws.py, tests/test_api_jws.py.", " - CVE-2026-102266", " * SECURITY UPDATE: Unvalidated HTTP redirect traversal in PyJWKClient", " - debian/patches/CVE-2026-102267.patch: Reject redirects in PyJWKClient", " fetches in jwt/jwks_client.py, tests/test_jwks_client.py.", " - CVE-2026-102267", " * SECURITY UPDATE: Algorithm confusion via whitespace and line-break evasion", " in is_pem_format", " - debian/patches/CVE-2026-102268.patch: fix: reject loader-accepted PEM", " variants in jwt/utils.py, tests/test_algorithms.py.", " - CVE-2026-102268", " * SECURITY UPDATE: Algorithm confusion via DER-encoded public key bytes in ", " HMACAlgorithm.prepare_key", " - debian/patches/CVE-2026-102271.patch: fix: reject DER public keys as ", " HMAC secrets in jwt/algorithms.py, tests/test_algorithms.py.", " - CVE-2026-102271", " * SECURITY UPDATE: Key inspection bypass via UTF-8 Byte Order Mark (BOM) in", " HMACAlgorithm.prepare_key", " - debian/patches/CVE-2026-102272.patch: Reject encoded JWKs as HMAC keys", " in jwt/algorithms.py, tests/test_algorithms.py.", " - CVE-2026-102272", " * SECURITY UPDATE: Key-type spoofing via nested JWK container structures in ", " HMACAlgorithm.prepare_key", " - debian/patches/CVE-2026-102273.patch: fix: reject public JWK container", " HMAC keys in jwt/algorithms.py, tests/test_algorithms.py.", " - CVE-2026-102273", "" ], "package": "pyjwt", "version": "2.10.1-4ubuntu1.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Hurman ", "date": "Thu, 08 Oct 2026 15:18:48 +0800" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-urllib3", "from_version": { "source_package_name": "python-urllib3", "source_package_version": "2.6.3-1ubuntu1.1", "version": "2.6.3-1ubuntu1.1" }, "to_version": { "source_package_name": "python-urllib3", "source_package_version": "2.6.3-1ubuntu1.2", "version": "2.6.3-1ubuntu1.2" }, "cves": [ { "cve": "CVE-2026-97687", "url": "https://ubuntu.com/security/CVE-2026-97687", "cve_description": "urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.", "cve_priority": "medium", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-97688", "url": "https://ubuntu.com/security/CVE-2026-97688", "cve_description": "urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue occurs when an untrusted server sends a chunked Deflate response whose decoded body exceeds a positive finite chunk size and whose encoded body has trailing bytes, specifically a response with Transfer-Encoding: chunked and Content-Encoding: deflate, content decoding enabled, and the positive finite amt=N streaming chunk size. The attack mechanism is that a malicious server returns a compressed chunked response with trailing bytes after the Deflate stream. The impact is excessive CPU usage and a request that does not complete, and network read timeouts do not interrupt the loop because no further socket read occurs. This issue is fixed in version 2.8.0.", "cve_priority": "medium", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-97689", "url": "https://ubuntu.com/security/CVE-2026-97689", "cve_description": "urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.", "cve_priority": "medium", "cve_public_date": "2026-09-29 16:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-97687", "url": "https://ubuntu.com/security/CVE-2026-97687", "cve_description": "urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.", "cve_priority": "medium", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-97688", "url": "https://ubuntu.com/security/CVE-2026-97688", "cve_description": "urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue occurs when an untrusted server sends a chunked Deflate response whose decoded body exceeds a positive finite chunk size and whose encoded body has trailing bytes, specifically a response with Transfer-Encoding: chunked and Content-Encoding: deflate, content decoding enabled, and the positive finite amt=N streaming chunk size. The attack mechanism is that a malicious server returns a compressed chunked response with trailing bytes after the Deflate stream. The impact is excessive CPU usage and a request that does not complete, and network read timeouts do not interrupt the loop because no further socket read occurs. This issue is fixed in version 2.8.0.", "cve_priority": "medium", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-97689", "url": "https://ubuntu.com/security/CVE-2026-97689", "cve_description": "urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.", "cve_priority": "medium", "cve_public_date": "2026-09-29 16:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Improper Certificate Validation", " - debian/patches/CVE-2026-97687-2.patch: Fix `proxy_ssl_context`", " ignored for HTTPS forwarding proxies", " - debian/patches/CVE-2026-97687-1.patch: Isolate HTTPS proxy TLS", " settings from target TLS", " - CVE-2026-97687", " * SECURITY UPDATE: Denial of Service", " - debian/patches/CVE-2026-97688.patch: Prevent an infinite loop", " when decoding Deflate responses", " - debian/patches/CVE-2026-97689.patch: Bound chunk-size line reads", " to prevent memory exhaustion DoS", " - CVE-2026-97688", " - CVE-2026-97689", "" ], "package": "python-urllib3", "version": "2.6.3-1ubuntu1.2", "urgency": "medium", "distributions": "resolute-security", "launchpad_bugs_fixed": [], "author": "Bruce Cable ", "date": "Tue, 13 Oct 2026 10:58:42 +1100" } ], "notes": null, "is_version_downgrade": false }, { "name": "snapd", "from_version": { "source_package_name": "snapd", "source_package_version": "2.76.3+ubuntu26.04", "version": "2.76.3+ubuntu26.04" }, "to_version": { "source_package_name": "snapd", "source_package_version": "2.77.1+ubuntu26.04.2", "version": "2.77.1+ubuntu26.04.2" }, "cves": [ { "cve": "CVE-2024-5300", "url": "https://ubuntu.com/security/CVE-2024-5300", "cve_description": "An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/. On systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application's sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns \"complete\" user records—including sensitive hashed user passwords from /etc/shadow—when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments.", "cve_priority": "medium", "cve_public_date": "2026-07-21 15:16:00 UTC" }, { "cve": "CVE-2026-3888", "url": "https://ubuntu.com/security/CVE-2026-3888", "cve_description": "Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.", "cve_priority": "high", "cve_public_date": "2026-03-17 14:16:00 UTC" }, { "cve": "CVE-2024-5300", "url": "https://ubuntu.com/security/CVE-2024-5300", "cve_description": "An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/. On systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application's sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns \"complete\" user records—including sensitive hashed user passwords from /etc/shadow—when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments.", "cve_priority": "medium", "cve_public_date": "2026-07-21 15:16:00 UTC" }, { "cve": "CVE-2026-3888", "url": "https://ubuntu.com/security/CVE-2026-3888", "cve_description": "Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.", "cve_priority": "high", "cve_public_date": "2026-03-17 14:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2158102, 2072331, 2110510, 2143934, 2160691, 2161982, 2158301, 2159940, 2157692, 2067006, 2157692, 2067006, 2154498, 2147606, 2148544, 2139213, 2125344, 2150683, 2152908, 1966067, 2110368, 2110368, 2144666, 2146337, 2147207 ], "changes": [ { "cves": [], "log": [ "", " * New upstream release, LP: #2158102", " - Fix undo of unlink-component after its snap revision was discarded", " - interfaces: power-control | allow reading all battery state files", " - fix 26.04+ snapd deb versioning", "" ], "package": "snapd", "version": "2.77.1+ubuntu26.04.2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2158102 ], "author": "Ernest Lotter ", "date": "Wed, 02 Sep 2026 14:39:12 +0200" }, { "cves": [], "log": [ "", " - Account for differences in names of the binaries in the snapd FIPS", " build", " - Add code to calculate canonical subject name hash", " - Add commands for debugging or accessing snap mount namespaces", " - Add helpers for listing and iterating device mediation groups", " - Add package ebpf with helpers wrapping eBPF exposed objects with", " dependency on github.com/cilium/ebpf", " - Add secondary prerequisites task that acts as the synchronization", " point, which ensures that a snap's prerequisites are available", " before it's installed", " - Add support for shell conditional syntax in envs", " - Added /usr/share/{man,help,info} to system-packages-doc", " - asserts: add validation-sets confdb-schema builtin", " - asserts: ensure that compatibility labels are strings", " - asserts: extend on-classic constraints to accept \"distro/variant\",", " \"distro/*\", and \"distro/\" under a new snap-declaration format 7", " - asserts: validate serial in newDeviceIDFromString", " - Bump github.com/canonical/go-efilib to v1.8.0 to include fixes for", " efivars probe", " - confdb: add validation-sets handler and fix data loss when writing", " to new schemas or accounts", " - confdb: fix bug on reading uneven lists", " - confdb: literal subkeys are sorted after placeholders", " - confdb: run observe-view-* hooks after commit", " - confdb: support Encode/Decode for builtins", " - confdb: support sign-only external keypair backends", " - core-initrd: add missing libbpf and systemd dlopen dependencies,", " and increase mount burst", " - Drop task logs for delayed effects", " - During snap removal, clear-snap task errors early if there are", " user mounts in snap data dirs", " - Enable reverts to trigger a seed refresh", " - Ensure profiles are setup before running prepare-{slot, plug}*", " hooks", " - Ensure that prereqs created by initial refresh run before create-", " recovery-system", " - Exclude Georgian from translation linting", " - experimental features: graduate layouts, classic-preserves-xdg-", " runtime-dir, refresh-app-awareness, and dbus-activation features", " - experimental features: warn when setting graduated or default-", " enabled experimental features and do not store settings for", " graduated features", " - Expose individual certs as well as c_rehash emulation", " - Extend autogen with explicit --sysconfdir", " - External keypair manager: add shared external key manager", " implementation", " - External keypair manager: refactor GPG and external keypair", " managers to use extKeypairMgrImpl", " - External keypair manager: support external OPENPGP signing in", " ExternalKeypairManager", " - FDE: add post install actions API", " - FDE: add reprovision API", " - FDE: add reprovision recovery key generation API", " - FDE: add reseal check after snapd refresh", " - FDE: allow reprovision without factory reset", " - FDE: change makebootable part of the boot package to not take", " install observers as parameters", " - FDE: extend storage-encrypted system information", " - FDE: make reprovision only seal", " - FDE: remove all tmp keyslots on error", " - FDE: remove check for unchanged authentication options", " - FDE: run post install checks during auto repair", " - Filter seed-refresh based on model and seed presence", " - Fix failing snap remove when there are snapctl created mounts", " under snap global data dirs", " - Fix postNotices to validate before locking state", " - Guard the ensure check from running on classic", " - Implement remodeling fully in terms of updates", " - Implement ShutDown for HookManager", " - Include variables SNAP_APP_NAME, and when applicable", " SNAP_APP_COMMON_ID, SNAP_APP_DESKTOP_FILE and SNAP_APP_BUS_NAME in", " snap application environments", " - interfaces: add xdg-portal-permission-store interface", " - interfaces: allow gtk css in subdirectories", " - interfaces: allow systemd networkd link property changes via D-Bus", " - interfaces: allow the systemd networkctl command", " - interfaces: allow Wine to execute files accessed via the Document", " Portal", " - interfaces: apparmor-observe | add interface", " - interfaces: attempt to fix content with parallel installs", " - interfaces: devlxd | fix access for LXD containers", " - interfaces: docker | allow connecting to system-wide docker on", " classic", " - interfaces: grant default access to memory.high in a snap's cgroup", " - interfaces: iscsi-initiator | allow access to /var/lib/iscsi/nodes", " - interfaces: kernel-sched-ext-control | add the kernel sched-ext", " control interface implementation", " - interfaces: make polkit and upower implicit on Core systems only", " - interfaces: open-iscsi | add missing state paths", " - interfaces: opengl | expose wsl libraries", " - interfaces: u2f-devices | add atkey PID and relative VID support", " - List dir contents on failure to remove snap base data dir", " - List non-snapctl mounts in snap data dirs", " - LP: #2072331 Validate map keys in JSON config values", " - LP: #2110510 Interfaces: allow reading of /proc/self/smaps_rollup", " - LP: #2143934 Interfaces: network-control, network-manager | allow", " missing resolve1 link setters", " - LP: #2160691 Security logging: strip trailing whitespace from", " audit netlink message payload", " - LP: #2161982 Interfaces: vsock | add interface for VM guest", " services", " - Make arguments of debug mount-namespace consistent with other", " debug commands", " - Make bootloader logging less verbose", " - Make cert manager garbage check run after symlink migration", " - Make secondary prerequisite synchronization task handle same-", " change retries", " - mkversion.sh: do describe in worktrees too", " - multi-entry snapd: merge snap and snapd binaries", " - multi-entry snapd: move debug device-cgroup implementation file", " under cmd/snapd/cli", " - multi-entry snapd: move snap-gpio-helper sources around before", " transitioning to multi-entry dispatch", " - multi-entry snapd: move snapd-apparmor sources to a dedicated tool", " location", " - multi-entry snapd: move source files around in preparation for", " snapd/snap merge", " - multi-entry snapd: move the snap-preseed sources around in", " preparation", " - multi-entry snapd: move the sources of snapctl and snap-exec in", " preparation for the multi-entry dispatch", " - Never create seed refresh tasks during a remodel", " - packaging: assign a default label for /tmp/snap-private-tmp and", " set it during installation", " - packaging: build deb with Go 1.23 for noble and jammy, Go 1.22 for", " focal", " - packaging: drop SNAP_TAGS", " - packaging: drop symlinks for opensuse 15.5/15.6 packaging", " - packaging: fix service startup during install and session-agent", " socket handling on Ubuntu 26.04+", " - packaging: fix stderr redirection", " - packaging: restore gbp.conf output directory for Ubuntu 26.04", " builds", " - packaging: switch to apparmor 5.x with 5 ABI", " - packaging: update bundled AppArmor to 5.0.2 and accept the 5.0 ABI", " when running as deb", " - packaging: use a relative symlink for snapctl and update steam-", " support udev rules", " - Preserve component in hook security tags", " - Prevent removal of seed-refresh snaps when seed-refresh is enabled", " - Refactor base-declaration into 1st class builtin assertion", " - Refactor how the is-originating-from-snap-command advisory check", " works", " - Refactor prerequisites task handler to enable proper seed-refresh", " integration", " - Reintroduce fdstore helpers", " - remote device management: add task to validate request messages", " - remote device management: apply management messages, queue", " response messages, and improve sequencing and redelivery handling", " - Remove osutil unused AtomicWriteFollow flag", " - Remove xerrors dependency", " - Reuse existing seed-refresh implementation for free during single-", " path installation", " - Rework how SnapSetup.SnapPath is used", " - seccomp: allow rseq_slice_yield", " - security logging: add seclog API for administrative actions and", " token create/remove events", " - security logging: add security logging for adding, updating and", " removing a snapd user", " - Set target hostname from install-mode", " - snap-confine: improve loading of BPF programs, retry on failures", " to collect verifier logs", " - snap-confine: use profile and flags= in snap-confine and snap-", " update-ns' AppArmor profiles", " - snap-confine: work around kernel mnt_ns_loop() ordering bug on", " 6.18.x", " - snap: add debug command for listing currently mediated devices for", " a given snap", " - snap: fix self-managed cgroup support checks", " - snap: report hidden file access for paths allowed by home when", " prompting is active", " - snap: report read-only file access for paths allowed by system-", " package-doc", " - snapctl async support: add --format json to snap tasks to be", " consistent with snapctl", " - snapctl async support: add snapctl tasks command", " - snapctl async support: async feature negotiation between snap", " client and daemon", " - snapctl async support: fix snapctl is-ready exit codes", " - snapctl async support: re-enable snapctl async functionality", " - snapshots: restore preserves snapctl created mounts", " - snapshots: save excludes all mount points", " - Support ca-certificate.crt only systems like core26", " - Turn on quota-groups by default", " - Use 0755 for certificate generation directories", " - Use CreateTemp for NewAtomicFile tmp file creation", " - Verify cached downloads in the do path and detect obvious", " corruption", "" ], "package": "snapd", "version": "2.77+ubuntu26.04", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2072331, 2110510, 2143934, 2160691, 2161982 ], "author": "Sergio Cazzolato ", "date": "Fri, 24 Jul 2026 20:45:05 -0300" }, { "cves": [], "log": [ "", " * New upstream release, LP: #2158301", " - FDE: support keyboard configuration at install-time for first-boot", " - FDE: re-enable passphrases/PINs at install-time", " - FDE: require volumes authentication if HWROT is missing", " - FDE: bump secboot to rev 457b03a16d19", " - FDE: use new secboot API for reprovision TPM", " - Cross-distro: modify SELinux policy to use", " init_named_socket_activation() for allowing systemd to start snapd", " through socket activation", " - packaging: make sure that usr/bin/snap is built with correct build", " tags on debian sid", " - Ensure profiles are setup before running prepare-{slot, plug}*", " hooks", "" ], "package": "snapd", "version": "2.76.3", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2158301 ], "author": "Katie May ", "date": "Tue, 07 Jul 2026 10:06:48 +0200" }, { "cves": [], "log": [ "", " * New upstream release, LP: #2159940", " - interfaces: steam-support, docker-support | fix mountinfo denial", "" ], "package": "snapd", "version": "2.76.2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2159940 ], "author": "Katie May ", "date": "Tue, 07 Jul 2026 08:38:51 +0200" }, { "cves": [ { "cve": "CVE-2024-5300", "url": "https://ubuntu.com/security/CVE-2024-5300", "cve_description": "An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/. On systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application's sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns \"complete\" user records—including sensitive hashed user passwords from /etc/shadow—when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments.", "cve_priority": "medium", "cve_public_date": "2026-07-21 15:16:00 UTC" }, { "cve": "CVE-2026-3888", "url": "https://ubuntu.com/security/CVE-2026-3888", "cve_description": "Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.", "cve_priority": "high", "cve_public_date": "2026-03-17 14:16:00 UTC" } ], "log": [ "", " * New upstream release, LP: #2157692", " - LP: #2067006 CVE-2024-5300", " - CVE-2026-3888", "" ], "package": "snapd", "version": "2.76.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2157692, 2067006 ], "author": "Ernest Lotter ", "date": "Thu, 25 Jun 2026 13:09:05 +0200" }, { "cves": [ { "cve": "CVE-2024-5300", "url": "https://ubuntu.com/security/CVE-2024-5300", "cve_description": "An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/. On systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application's sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns \"complete\" user records—including sensitive hashed user passwords from /etc/shadow—when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments.", "cve_priority": "medium", "cve_public_date": "2026-07-21 15:16:00 UTC" }, { "cve": "CVE-2026-3888", "url": "https://ubuntu.com/security/CVE-2026-3888", "cve_description": "Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.", "cve_priority": "high", "cve_public_date": "2026-03-17 14:16:00 UTC" } ], "log": [ "", " * New upstream release, LP: #2157692", " - LP: #2067006 CVE-2024-5300", " - CVE-2026-3888", " - SNAPDENG-36017", "" ], "package": "snapd", "version": "2.76.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2157692, 2067006 ], "author": "Ernest Lotter ", "date": "Sat, 20 Jun 2026 10:27:54 +0200" }, { "cves": [], "log": [ "", " * New upstream release, LP: #2154498", " - assertions: add helper for validating integrity data", " - assertions: drop incorrect/non-standard Ed25519 support", " - confdb: allow only API admin read access to confdb secrets", " - confdb: block concurrent confdb accesses", " - confdb: block concurrent snapctl accesses to configuration", " database", " - confdb: check for ephemeral data when missing save-view hook on", " commit", " - confdb: ignore not-found errors in confdb-schema refreshes", " - confdb: support --wait-for timeouts when accessing confdb", " - core-initrd: add group referenced in udev rules", " - core-initrd: add libbpf dependency to initramfs", " - core-initrd: add missing libbpf dependency in 24.04 packaging", " - core-initrd: ensure audio is a system group", " - core-initrd: fix /boot/uboot mount with u-boot env in dedicated", " partition", " - core-initrd: increase mount burst from 5 to 128 for faster boot", " - core-initrd: sync partition udev rules with the ones in core-base", " - core-initrd: sync with latest upload to snappy-dev PPA", " - core-initrd: synchronize changelogs with latest PPA upload", " - core-initrd: update changelog with latest PPA upload", " - core-initrd: add nfnetlink module to fix nf netlink", " socket speed regression (Ubuntu Core only)", " - cross-distro: allow snapd to manipulate systemd unit files in", " SELinux policy", " - cross-distro: FIPS bootstrap and dispatch via snap-fips-dispatch", " - desktop: fix common ID selection with multiple desktop plugs", " - FDE: allow user mode on core in secboot TPM handling", " - FDE: bump go-efilib dependency", " - FDE: bump secboot to rev cdcb64992e54 for FDE fixes", " - FDE: deprecate check-pin/passphrase API endpoints", " - LP: #2147606 FDE: give inactive state on classic", " - FDE: improve tracing for OP-TEE probing", " - FDE: move auto-repair logic to overlord/fdestate and provide state", " - FDE: update secboot for TPM/FDE bug fixes including Intel HAP and", " recovery key parsing", " - FDE: use any primary key matching digest when adding a keyslot", " - FDE: use ignore action for preinstall check in VM", " - interfaces: bluez | drop explicit deny send_destination in D-Bus", " configuration", " - interfaces: conditionally deny /proc/self/mountinfo to suppress Go", " 1.25+ denials", " - interfaces: custom-device | fix for-device validation panic on", " non-string value", " - interfaces: disallow auto-connect to parallel installs", " - interfaces: docker | make plug implicit on classic systems", " - interfaces: ignore errors in disconnect hooks during explicit snap", " disconnect", " - interfaces: mediatek-accel | add plug interface base declaration", " - interfaces: microceph-support | suppress noisy sudo denial audit", " logs", " - interfaces: podman | add new interface for podman socket access", " - interfaces: pulseaudio | fix security tag syntax inconsistency", " - interfaces: raw-usb | allow USB device enumeration on Fairphone 5", " with NexDock", " - interfaces: restore auto-connections on failed refresh undo", " - LP: #2148544 interfaces: bool-file | support deep SoC sysfs paths", " for LED brightness", " - LP: #2139213 packaging: make Ubuntu 16.04 packaging dep17", " compliant", " - packaging: add cross-distro build script and instructions", " - packaging: add openSUSE 16.0 spread support", " - packaging: Debian build improvements", " - packaging: default openSUSE to /var/lib/snapd/snap and sync from", " downstream", " - packaging: drop transitional packages only for Ubuntu 26.04", " (Resolute)", " - packaging: fix Launchpad FIPS build detection for snapd-fips job", " - packaging: refactor and clean up snapd.mk, standardize test-data", " directories", " - packaging: switch to golang-github-chai2010-gettext-go-dev", " - packaging: update bundled AppArmor 4.1.7 (snapd snap only)", " - prompting: escape paths in prompt constraints", " - prompting: improve API error handling and validation", " - prompting: improve error message when no handler service is", " present", " - prompting: re-enable the prompting notice backend", " - prompting: respond with full user-allowed permission set", " - prompting: validate permissions while unmarshalling", " - remote device management: implement dispatch-mgmt-messages task", " with sequencing support", " - LP: #2125344 snap: avoid empty channel forwarding message", " - LP: #2150683 snap: clarify snap install help text for --classic", " and --devmode", " - LP: #2152908 snap: print complex attributes in snap interface", " --attrs output", " - snap: add run-inhibit hint and inhibit info when a snap is", " disabled", " - snap: allow removing a snap and its base at the same time", " - snap: display detailed component information in snap info", " - snap: extend AlreadyInstalledError to multiple snaps and", " components", " - snap: extend set-quota command options description with accepted", " value formats", " - snap: implement snap delta command for computing snap deltas", " - snap: improve consistency for snap install when some snaps are", " already installed", " - snap: show hint in snap list that a snap has components", " - snap-confine: allow inheriting unix sockets from snaps", " - snap-confine: allow linking to libm in AppArmor profile", " - snap-confine: fix out-of-bounds read in mountinfo parser for", " partial escape sequences", " - snap-confine: harden bpffs mount with nosuid, nodev, noexec flags", " - snap-confine: remove experimental persistent per-user mount", " namespace feature", " - snap-confine: set FD_CLOEXEC on file descriptors returned by BPF", " helpers", " - snap-confine: support transparent_hugepage in AppArmor profile", " - snap-confine: use strchr after NUL-terminating in infofile parser", " - snap-update-ns: switch to a multi-pass process for constructing", " and updating mount namespaces", " - RemoveMountUnitFile now unmounts even if mount unit file is", " missing", " - Add explicit mount phase during single-reboot refresh to fix undo", " of kernel refreshes", " - Add security audit logging subsystem", " - Add base prioritized AppArmmor snippets for strictly confined or", " jailed snaps", " - Allow openshell snap to use experimental daemon-scope: user", " - Allow configuring mount unit options based on filesystem type", " - Allow equals signs in uevent values in netlink parser", " - Also bind-mount directories modified by kmod backend during", " preseed", " - Clean up potentially corrupted files during snap download undo", " - Complete the bootloader environment implementation", " - Copy integrity data files during snap install", " - Create hook for seed refresh mode", " - Create removal tasks for old seed-refresh seeds", " - Dispatch systemctl commands asynchronously when calling Stop()", " - Ensure /tmp/.X11-unix created inside mount namespace has correct", " permissions", " - Ensure exclusive changes conflict with refresh/revert", " - Ensure existing snap confinement flags are not dropped when", " installing or removing components", " - Export ubuntu-boot-state filename constant from bootloader package", " - Fix duplicate removal of apps under $SNAP_MOUNT_DIR/bin", " - Fix integration between prerequisites task and seed-refresh mode", " - Fix split-refresh overwriting provided lane", " - Fix use of umask in GetListener for socket activation", " - Ignore net.ErrClosed during daemon shutdown", " - Implement ResolveValidationSetsEnforcementError in terms of one", " call", " - Improve snapctl install consistency when components are already", " installed", " - Inject seed creation tasks into snap refresh flow", " - Introduce system options for custom certificates on Ubuntu Core", " - Keep idle services with activation units stopped on reload", " - List snap components in snap-debug-info via debug-tools", " - Look at gadget.yaml instead of marker file to determine ubootpart", " usage", " - LP: #1966067 Skip redundant xdg-settings confirmation prompt when", " setting is already correct", " - LP: #2110368 Fix component installation for private snaps via", " snapctl", " - LP: #2110368 Fix download of private snap components by setting", " UserID", " - LP: #2144666 Fix mount namespace updates with synthetic bind", " mounts on same target paths", " - LP: #2146337 Improve handling of failed downloads and retain", " partial files for resume", " - LP: #2147207 Fix snap enable/disable cycle forgetting components", " - Make run-inhibit hint for kill-snap-apps task based on kill reason", " - Merge content-provider prerequisite updates into seed-refresh", " - Move SortServices into Backend.StartServices", " - Move state to client change conversion to ctlcmd package", " - Omit misleading \"try to refresh snapd\" suggestion for ISA-related", " errors", " - Only create link-component tasks when needed during refresh to", " existing revision", " - Reconfigure piboot bootloader on gadget refreshes to preserve", " os_prefix", " - Reduce the number of AppArmor profile regenerations during snap", " operations", " - Refactor seed-refresh ownership to devicestate", " - Regenerate certificate database on remodels", " - Remove obsolete FIXME comment in VersionCompare", " - Remove unused GenerateDmVerityData helper from snap/integrity", " - Rename and document error type for ISA assumes flags", " - Restart snapd from daemon.Stop to improve restart reliability", " - Restart stopped services on error in stopSnapServices for", " transactionality", " - Simplify certificate-db updates on model-base refresh/installs", " - Support racing Loop and Stop correctly in overlord", " - Support sending file descriptors to systemd via sd_notify", " - Unroll CPU-heavy recursive function in snap state handlers", " - Update seccomp syscalls list for kernel 7.1.0", " - Use change ID to prevent nested seed-refresh spawned by", " prerequisites", " - Validate content interface plug target directories exist for", " core26+ snaps", " - Validate layout paths exist in snap tree for snaps using bare or", " core26+", "" ], "package": "snapd", "version": "2.76", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2154498, 2147606, 2148544, 2139213, 2125344, 2150683, 2152908, 1966067, 2110368, 2110368, 2144666, 2146337, 2147207 ], "author": "Ernest Lotter ", "date": "Thu, 28 May 2026 20:00:16 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "tzdata", "from_version": { "source_package_name": "tzdata", "source_package_version": "2026c-0ubuntu0.26.04.1", "version": "2026c-0ubuntu0.26.04.1" }, "to_version": { "source_package_name": "tzdata", "source_package_version": "2026e-0ubuntu0.26.04.1", "version": "2026e-0ubuntu0.26.04.1" }, "cves": [], "launchpad_bugs_fixed": [ 2169125 ], "changes": [ { "cves": [], "log": [ "", " * New upstream release (LP: #2169125):", " - Canada’s Northwest Territories moved to permanent -06 on 2026-08-21 and", " will not fall back from -06 to -07 on 2026-11-01", " - Manitoba moves to permanent -05 on 2026-10-31 and will not fall back", " from -05 to -06 on 2026-11-01", " * Add autopkgtest test cases for 2026d and 2026e releases", " * Revert POSIX conformance of old SysV names EST5EDT, CST6CDT, MST7MDT and", " PST8PDT", " * Update the ICU timezone data to 2026e", " * Add autopkgtest test case for ICU timezone data 2026d and 2026e", "" ], "package": "tzdata", "version": "2026e-0ubuntu0.26.04.1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2169125 ], "author": "Benjamin Drung ", "date": "Mon, 05 Oct 2026 11:17:50 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "ubuntu-release-upgrader-core", "from_version": { "source_package_name": "ubuntu-release-upgrader", "source_package_version": "1:26.04.25", "version": "1:26.04.25" }, "to_version": { "source_package_name": "ubuntu-release-upgrader", "source_package_version": "1:26.04.27", "version": "1:26.04.27" }, "cves": [], "launchpad_bugs_fixed": [ 2156727, 2156727 ], "changes": [ { "cves": [], "log": [ "", " * DistUpgradeQuirks: prevent the selected display manager from being removed", " on Ubuntu Budgie systems (LP: #2156727)", "" ], "package": "ubuntu-release-upgrader", "version": "1:26.04.27", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2156727 ], "author": "Simon Johnsson ", "date": "Mon, 28 Sep 2026 16:32:47 +0200" }, { "cves": [], "log": [ "", " * DistUpgradeQuirks: mark dracut for install if", " ubuntu-budgie-desktop-minimal is installed (LP: #2156727):", " - This fixes an issue where the meta-package would not upgrade,", " potentially leading the system without an active display manager as sddm", " would be removed as an obsolete package.", "" ], "package": "ubuntu-release-upgrader", "version": "1:26.04.26", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2156727 ], "author": "Simon Johnsson ", "date": "Mon, 15 Jun 2026 11:04:53 +0200" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [], "snap": [] }, "removed": { "deb": [], "snap": [] }, "notes": "Changelog diff for Ubuntu 26.04 resolute image from release image serial 20261009 to 20261017", "from_series": "resolute", "to_series": "resolute", "from_serial": "20261009", "to_serial": "20261017", "from_manifest_filename": "release_manifest.previous", "to_manifest_filename": "manifest.current" }