Skip to content

Security updates#419

Merged
thalassemia merged 1 commit into
masterfrom
security-updates
May 12, 2026
Merged

Security updates#419
thalassemia merged 1 commit into
masterfrom
security-updates

Conversation

@github-actions
Copy link
Copy Markdown
Contributor

@github-actions github-actions Bot commented May 12, 2026

Security Vulnerability Report

Generated on: 2026-05-12 00:52:41

Summary

Found vulnerabilities in 2 packages requiring updates.

Package Upgrades Overview

Package Current Version Recommended Version Vulnerabilities
biopython 1.85 Unknown 1
urllib3 2.6.3 2.7.0 2

Detailed Vulnerability Information

biopython (v1.85)

Vulnerability ID Fix Versions Aliases
CVE-2025-68463 GHSA-x3vf-39hj-gxr4

urllib3 (v2.6.3)

Vulnerability ID Fix Versions Aliases
CVE-2026-44431 2.7.0 GHSA-qccp-gfcp-xxvc
CVE-2026-44432 2.7.0 GHSA-mf9v-mfxr-j63j

Recommended Actions

  1. Review the vulnerability details above.
  2. Close and reopen this PR to trigger CI/CD tests.
  3. Approve and merge the PR if everything looks good.

This report was generated automatically. Please verify all upgrades before applying.

@thalassemia thalassemia reopened this May 12, 2026
@thalassemia thalassemia added the long ci PR nearly ready to merge so run longer CI tests label May 12, 2026
@github-actions
Copy link
Copy Markdown
Contributor Author

github-actions Bot commented May 12, 2026

🔍 Vulnerabilities of vecoli:latest

📦 Image Reference vecoli:latest
digestsha256:43b12e5ea8fe6423f12be622e19bb2d906db43fa72306643bbda9aa15bec2e2a
vulnerabilitiescritical: 0 high: 6 medium: 9 low: 95 unspecified: 8
platformlinux/amd64
size959 MB
packages905
📦 Base Image debian:13-slim
also known as
  • 13.4-slim
  • trixie-20260421-slim
  • trixie-slim
digestsha256:e18da95f66066b7c5fa31491b524e83121271eca59a3d140f4906c8d0a090367
vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
critical: 0 high: 4 medium: 1 low: 2 unspecified: 7gnutls28 3.8.9-3+deb13u2 (deb)

pkg:deb/debian/gnutls28@3.8.9-3%2Bdeb13u2?os_distro=trixie&os_name=debian&os_version=13

high : CVE--2026--33846

Affected range>0
Fixed versionNot Fixed
EPSS Score0.075%
EPSS Percentile22nd percentile
Description

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.

high : CVE--2026--33845

Affected range>0
Fixed versionNot Fixed
EPSS Score0.046%
EPSS Percentile14th percentile
Description

A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.

high : CVE--2026--42011

Affected range>0
Fixed versionNot Fixed
EPSS Score0.021%
EPSS Percentile6th percentile
Description

A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.

high : CVE--2026--42010

Affected range>0
Fixed versionNot Fixed
EPSS Score0.150%
EPSS Percentile35th percentile
Description

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.

medium : CVE--2026--3833

Affected range>0
Fixed versionNot Fixed
EPSS Score0.086%
EPSS Percentile25th percentile
Description

A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels, specifically for dNSName (DNS) or rfc822Name (email) constraints within excludedSubtrees or permittedSubtrees. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.

low : CVE--2026--3832

Affected range>0
Fixed versionNot Fixed
EPSS Score0.030%
EPSS Percentile9th percentile
Description

A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP) response during a TLS handshake. Due to a logic error in how gnutls processes multi-record OCSP responses, a client with OCSP verification enabled may incorrectly accept a revoked server certificate, potentially leading to a compromise of trust.

low : CVE--2011--3389

Affected range>0
Fixed versionNot Fixed
EPSS Score3.832%
EPSS Percentile88th percentile
Description

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

unspecified : CVE--2026--5419

Affected range>0
Fixed versionNot Fixed
Description

unspecified : CVE--2026--5260

Affected range>0
Fixed versionNot Fixed
Description

unspecified : CVE--2026--42015

Affected range>0
Fixed versionNot Fixed
Description

unspecified : CVE--2026--42014

Affected range>0
Fixed versionNot Fixed
Description

unspecified : CVE--2026--42013

Affected range>0
Fixed versionNot Fixed
Description

unspecified : CVE--2026--42012

Affected range>0
Fixed versionNot Fixed
Description

unspecified : CVE--2026--42009

Affected range>0
Fixed versionNot Fixed
Description
critical: 0 high: 1 medium: 0 low: 0 nghttp2 1.64.0-1.1 (deb)

pkg:deb/debian/nghttp2@1.64.0-1.1?os_distro=trixie&os_name=debian&os_version=13

high : CVE--2026--27135

Affected range>0
Fixed versionNot Fixed
EPSS Score0.024%
EPSS Percentile7th percentile
Description

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API nghttp2_session_terminate_session or nghttp2_session_terminate_session2 is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.

critical: 0 high: 1 medium: 0 low: 0 rustls-webpki 0.103.12 (cargo)

pkg:cargo/rustls-webpki@0.103.12

high 7.5: GHSA--82j2--j2ch--gfr8 Out-of-bounds Read

Affected range<0.103.13
Fixed version0.103.13
CVSS Score7.5
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description

Summary

bit_string_flags() in src/der.rs panics with an index-out-of-bounds when given a BIT STRING whose content is exactly [0x00] (one byte: zero padding bits, zero data bytes). This is reachable through the public API BorrowedCertRevocationList::from_der() via the issuingDistributionPoint CRL extension.

Precondition: CRL checking is opt-in in rustls-webpki. This vulnerability affects only applications that explicitly pass RevocationOptions to verify_for_usage() and load CRL bytes from a source the attacker can influence. The default rustls configuration (no RevocationOptions) is not affected.

AI disclosure: This report was prepared with AI assistance (Claude). The vulnerability was discovered by differential fuzzing against a formally-verified Rust oracle. All technical claims have been independently verified against the live source code before submission.

Details

bit_string_flags() in src/der.rs reads the content of named-bit BIT
STRINGs (KeyUsage, ReasonFlags, etc.). Its input guard:

if padding_bits > 7 || (raw_bits.is_empty() && padding_bits != 0) {
    return Err(Error::BadDer);
}
let last_byte = raw_bits[raw_bits.len() - 1];  // ← crash

misses the case padding_bits == 0 && raw_bits.is_empty().
When a BIT STRING has content [0x00] (one padding-bits byte set to zero, no data bytes):

  • padding_bits = 0x00 — passes the > 7 check ✓
  • raw_bits = [] — passes is_empty() && != 0 check ✓ (because 0 != 0 is false)
  • raw_bits.len() - 1 = 0usize - 1 = underflow → usize::MAX
  • raw_bits[usize::MAX] → panic

Debug: thread 'main' panicked: attempt to subtract with overflow
Release: thread 'main' panicked: index out of bounds: the len is 0
but the index is 18446744073709551615

PoC

Cargo.toml:

[dependencies]
rustls-webpki = "0.102.8"   # also reproduces on 0.103.12

src/main.rs:

fn main() {
    let crl: &[u8] = &[
        0x30, 0x65, 0x30, 0x50, 0x02, 0x01, 0x01, 0x30, 0x0d, 0x06, 0x09,
        0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00,
        0x30, 0x0c, 0x31, 0x0a, 0x30, 0x08, 0x06, 0x03, 0x55, 0x04, 0x03,
        0x13, 0x01, 0x41, 0x17, 0x0d, 0x32, 0x30, 0x30, 0x31, 0x30, 0x31,
        0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x17, 0x0d, 0x32, 0x31,
        0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a,
        0xa0, 0x10, 0x30, 0x0e, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x1c,
        0x04, 0x05, 0x30, 0x03, 0x83, 0x01, 0x00, 0x30, 0x0d, 0x06, 0x09,
        0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00,
        0x03, 0x02, 0x00, 0x00,
    ];
    // Panics — never returns
    let _ = webpki::BorrowedCertRevocationList::from_der(crl);
}

output:

thread 'main' panicked at src/der.rs:...
index out of bounds: the len is 0 but the index is 18446744073709551615

Trigger

a0 10            -- cRLExtensions [0] EXPLICIT
  30 0e          -- SEQUENCE OF Extension
    30 0c        -- Extension SEQUENCE
      06 03 55 1d 1c   -- OID 2.5.29.28 (id-ce-issuingDistributionPoint)
      04 05            -- OCTET STRING (extnValue)
        30 03          -- IssuingDistributionPoint SEQUENCE
          83 01 00     -- [3] onlySomeReasons: BIT STRING, len=1, content=0x00
                       --   padding_bits=0, data=[]  ← TRIGGER

Impact

  • Who is affected:
    Applications that (1) use rustls-webpki with CRL
    revocation checking explicitly enabled via RevocationOptions, and (2)
    load CRL bytes from a source an attacker can influence.
  • Attack paths:
    • mTLS server (most realistic): An attacker obtains any certificate from a CA that permits custom CDP URLs — common in enterprise PKI. They set the CDP to a server they control, serve the 103-byte crafted CRL, and connect to the target. The server fetches the attacker's CRL during the handshake and panics. No MITM required.
    • TLS client with server-cert CRL checking: An attacker who can MITM an HTTP CRL distribution point (ARP/DNS poisoning on a local network) serves the crafted CRL in place of the legitimate one.
critical: 0 high: 0 medium: 2 low: 3 krb5 1.21.3-5 (deb)

pkg:deb/debian/krb5@1.21.3-5?os_distro=trixie&os_name=debian&os_version=13

medium : CVE--2026--40356

Affected range>0
Fixed versionNot Fixed
EPSS Score0.099%
EPSS Percentile27th percentile
Description

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.

medium : CVE--2026--40355

Affected range>0
Fixed versionNot Fixed
EPSS Score0.099%
EPSS Percentile27th percentile
Description

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.

low : CVE--2024--26461

Affected range>0
Fixed versionNot Fixed
EPSS Score0.062%
EPSS Percentile19th percentile
Description

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.

low : CVE--2024--26458

Affected range>0
Fixed versionNot Fixed
EPSS Score0.250%
EPSS Percentile48th percentile
Description

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.

low : CVE--2018--5709

Affected range>0
Fixed versionNot Fixed
EPSS Score1.504%
EPSS Percentile81st percentile
Description

An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.

critical: 0 high: 0 medium: 2 low: 0 pip 26.0.1 (pypi)

pkg:pypi/pip@26.0.1

medium 5.3: CVE--2026--6357 Inclusion of Functionality from Untrusted Control Sphere

Affected range<26.1
Fixed version26.1
CVSS Score5.3
CVSS VectorCVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS Score0.016%
EPSS Percentile4th percentile
Description

pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.

medium 4.6: CVE--2026--3219 Unrestricted Upload of File with Dangerous Type

Affected range<=26.0.1
Fixed versionNot Fixed
CVSS Score4.6
CVSS VectorCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS Score0.017%
EPSS Percentile4th percentile
Description

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.

critical: 0 high: 0 medium: 1 low: 1 tar 1.35+dfsg-3.1 (deb)

pkg:deb/debian/tar@1.35%2Bdfsg-3.1?os_distro=trixie&os_name=debian&os_version=13

medium : CVE--2025--45582

Affected range>=1.35+dfsg-3.1
Fixed versionNot Fixed
EPSS Score0.130%
EPSS Percentile32nd percentile
Description

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which "tar xf" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages).

Disputed tar issue, works as documented per upstream:
https://lists.gnu.org/archive/html/bug-tar/2025-08/msg00012.html
https://github.com/i900008/vulndb/blob/main/Gnu_tar_vuln.md

low : CVE--2005--2541

Affected range>0
Fixed versionNot Fixed
EPSS Score3.763%
EPSS Percentile88th percentile
Description

Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.

This is intended behaviour, after all tar is an archiving tool and you
need to give -p as a command line flag

critical: 0 high: 0 medium: 1 low: 1 astral-tokio-tar 0.6.0 (cargo)

pkg:cargo/astral-tokio-tar@0.6.0

medium 6.6: GHSA--fp55--jw48--c537 Improper Input Validation

Affected range<=0.6.0
Fixed version0.6.1
CVSS Score6.6
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Description

Impact

Versions of astral-tokio-tar prior to 0.6.1 contain a PAX header interpretation bug that allows manipulated entries to be made selectively visible or invisible during extraction with astral-tokio-tar versus other tar implementations. An attacker could use this differential to smuggle unexpected files onto a victim's filesystem.

See GHSA-j5gw-2vrg-8fgx for a similar desynchronization bug in astral-tokio-tar.

Patches

Versions 0.6.1 and newer of astral-tokio-tar address this differential.

Workarounds

Users are advised to upgrade to version 0.6.1 or newer to address this advisory.

There is no workaround other than upgrading. Users should experience no breaking changes as a result of the upgrade.

Resources

  • GHSA-j5gw-2vrg-8fgx is a similar PAX desynchronization bug

Attribution

low 2.7: GHSA--xx64--wwv2--hcqq UNIX Symbolic Link (Symlink) Following

Affected range<=0.6.0
Fixed version0.6.1
CVSS Score2.7
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Description

Impact

In versions 0.6.0 and earlier of astral-tokio-tar, the unpack_in API could inadvertently modify the permissions of external (i.e. non-archive) directories outside of the archive. An attacker could use this to contrite a tar archive that maliciously changes directory permissions outside of its intended hierarchy. This flaw only affects directories; individual file permissions cannot be modified via it.

See GHSA-j4xf-2g29-59ph for the equivalent flaw in the tar crate.

Patches

Versions 0.6.1 and newer of astral-tokio-tar use fs::symlink_metdata rather than fs::metadata, avoiding the traversal.

Workarounds

Users are advised to upgrade to version 0.6.1 or newer to address this advisory.

Users should experience no breaking changes as a result of the patch above.

Resources

  • GHSA-j4xf-2g29-59ph for the original tar vulnerability

Attribution

critical: 0 high: 0 medium: 1 low: 0 rsa 0.9.10 (cargo)

pkg:cargo/rsa@0.9.10

medium 5.9: CVE--2023--49092

Affected range>=0.0.0-0
Fixed versionNot Fixed
CVSS Score5.9
CVSS VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score0.734%
EPSS Percentile73rd percentile
Description

Impact

Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key.

Patches

No patch is yet available, however work is underway to migrate to a fully constant-time implementation.

Workarounds

The only currently available workaround is to avoid using the rsa crate in settings where attackers are able to observe timing information, e.g. local use on a non-compromised computer is fine.

References

This vulnerability was discovered as part of the "Marvin Attack", which revealed several implementations of RSA including OpenSSL had not properly mitigated timing sidechannel attacks.

critical: 0 high: 0 medium: 1 low: 0 biopython 1.85 (pypi)

pkg:pypi/biopython@1.85

medium 4.9: CVE--2025--68463 Improper Restriction of XML External Entity Reference

Affected range<=1.86
Fixed versionNot Fixed
CVSS Score4.9
CVSS VectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L
EPSS Score0.074%
EPSS Percentile22nd percentile
Description

Bio.Entrez in Biopython through 1.86 allows doctype XXE.

critical: 0 high: 0 medium: 0 low: 54 binutils 2.44-3 (deb)

pkg:deb/debian/binutils@2.44-3?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2026--6846

Affected range>0
Fixed versionNot Fixed
EPSS Score0.020%
EPSS Percentile6th percentile
Description

A flaw was found in binutils. A heap-buffer-overflow vulnerability exists when processing a specially crafted XCOFF (Extended Common Object File Format) object file during linking. A local attacker could trick a user into processing this malicious file, which could lead to arbitrary code execution, allowing the attacker to run unauthorized commands, or cause a denial of service, making the system unavailable.

low : CVE--2026--6845

Affected range>0
Fixed versionNot Fixed
EPSS Score0.005%
EPSS Percentile0th percentile
Description

A flaw was found in binutils, specifically within the readelf utility. This vulnerability allows a local attacker to cause a Denial of Service (DoS) by tricking a user into processing a specially crafted Executable and Linkable Format (ELF) file. The exploitation of this flaw can lead to the system becoming unresponsive due to excessive resource consumption or a program crash.

low : CVE--2026--6844

Affected range>0
Fixed versionNot Fixed
EPSS Score0.019%
EPSS Percentile5th percentile
Description

A flaw was found in the readelf utility of the binutils package. A local attacker could exploit two Denial of Service (DoS) vulnerabilities by providing a specially crafted Executable and Linkable Format (ELF) file. One vulnerability, a resource exhaustion (CWE-400), can lead to an out-of-memory condition. The other, a null pointer dereference (CWE-476), can cause a segmentation fault. Both issues can result in the readelf utility becoming unresponsive or crashing, leading to a denial of service.

low : CVE--2026--4647

Affected range>0
Fixed versionNot Fixed
EPSS Score0.004%
EPSS Percentile0th percentile
Description

A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.

low : CVE--2026--3442

Affected range>0
Fixed versionNot Fixed
EPSS Score0.006%
EPSS Percentile0th percentile
Description

A flaw was found in GNU Binutils. This vulnerability, a heap-based buffer overflow, specifically an out-of-bounds read, exists in the bfd linker component. An attacker could exploit this by convincing a user to process a specially crafted malicious XCOFF object file. Successful exploitation may lead to the disclosure of sensitive information or cause the application to crash, resulting in an application level denial of service.

low : CVE--2026--3441

Affected range>0
Fixed versionNot Fixed
EPSS Score0.006%
EPSS Percentile0th percentile
Description

A flaw was found in GNU Binutils. This heap-based buffer overflow vulnerability, specifically an out-of-bounds read in the bfd linker, allows an attacker to gain access to sensitive information. By convincing a user to process a specially crafted XCOFF object file, an attacker can trigger this flaw, potentially leading to information disclosure or an application level denial of service.

low : CVE--2025--8225

Affected range>0
Fixed versionNot Fixed
EPSS Score0.033%
EPSS Percentile10th percentile
Description

A vulnerability was found in GNU Binutils 2.44 and classified as problematic. This issue affects the function process_debug_info of the file binutils/dwarf.c of the component DWARF Section Handler. The manipulation leads to memory leak. Attacking locally is a requirement. The identifier of the patch is e51fdff7d2e538c0e5accdd65649ac68e6e0ddd4. It is recommended to apply a patch to fix this issue.

low : CVE--2025--7546

Affected range>0
Fixed versionNot Fixed
EPSS Score0.064%
EPSS Percentile20th percentile
Description

A vulnerability, which was classified as problematic, has been found in GNU Binutils 2.45. Affected by this issue is the function bfd_elf_set_group_contents of the file bfd/elf.c. The manipulation leads to out-of-bounds write. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The name of the patch is 41461010eb7c79fee7a9d5f6209accdaac66cc6b. It is recommended to apply a patch to fix this issue.

low : CVE--2025--7545

Affected range>0
Fixed versionNot Fixed
EPSS Score0.069%
EPSS Percentile21st percentile
Description

A vulnerability classified as problematic was found in GNU Binutils 2.45. Affected by this vulnerability is the function copy_section of the file binutils/objcopy.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is named 08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944. It is recommended to apply a patch to fix this issue.

low : CVE--2025--69652

Affected range>0
Fixed versionNot Fixed
EPSS Score0.022%
EPSS Percentile6th percentile
Description

GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an abort (SIGABRT) when processing a crafted ELF binary with malformed DWARF abbrev or debug information. Due to incomplete state cleanup in process_debug_info(), an invalid debug_info_p state may propagate into DWARF attribute parsing routines. When certain malformed attributes result in an unexpected data length of zero, byte_get_little_endian() triggers a fatal abort. No evidence of memory corruption or code execution was observed; the impact is limited to denial of service.

low : CVE--2025--69651

Affected range>0
Fixed versionNot Fixed
EPSS Score0.007%
EPSS Percentile1st percentile
Description

GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an invalid pointer free when processing a crafted ELF binary with malformed relocation or symbol data. If dump_relocations returns early due to parsing errors, the internal all_relocations array may remain partially uninitialized. Later, process_got_section_contents() may attempt to free an invalid r_symbol pointer, triggering memory corruption checks in glibc and causing the program to terminate with SIGABRT. No evidence of further memory corruption or code execution was observed; the impact is limited to denial of service. NOTE: this is disputed by third parties because the observed behavior occurred only in pre-release code and did not affect any tagged version.

low : CVE--2025--69650

Affected range>0
Fixed versionNot Fixed
EPSS Score0.149%
EPSS Percentile35th percentile
Description

GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. As a result, process_got_section_contents() may pass an uninitialized r_symbol pointer to free(), leading to a double free and terminating the program with SIGABRT. No evidence of exploitable memory corruption or code execution was observed; the impact is limited to denial of service. NOTE: this is disputed by third parties because the observed behavior occurred only in pre-release code and did not affect any tagged version.

low : CVE--2025--69649

Affected range>0
Fixed versionNot Fixed
EPSS Score0.045%
EPSS Percentile14th percentile
Description

GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into display_relocations(), resulting in a segmentation fault (SIGSEGV) and abrupt termination. No evidence of memory corruption beyond the null pointer dereference, nor any possibility of code execution, was observed.

low : CVE--2025--69648

Affected range>0
Fixed versionNot Fixed
EPSS Score0.022%
EPSS Percentile6th percentile
Description

GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF .debug_rnglists data. A logic flaw in the DWARF parsing path causes readelf to repeatedly print the same warning message without making forward progress, resulting in a non-terminating output loop that requires manual interruption. No evidence of memory corruption or code execution was observed.

low : CVE--2025--69647

Affected range>0
Fixed versionNot Fixed
EPSS Score0.024%
EPSS Percentile7th percentile
Description

GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF loclists data. A logic flaw in the DWARF parsing code can cause readelf to repeatedly print the same table output without making forward progress, resulting in an unbounded output loop that never terminates unless externally interrupted. A local attacker can trigger this behavior by supplying a malicious input file, causing excessive CPU and I/O usage and preventing readelf from completing its analysis.

low : CVE--2025--69646

Affected range>0
Fixed versionNot Fixed
EPSS Score0.005%
EPSS Percentile0th percentile
Description

Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug_rnglists data. A logic error in the handling of the debug_rnglists header can cause objdump to repeatedly print the same warning message and fail to terminate, resulting in an unbounded logging loop until the process is interrupted. The issue was observed in binutils 2.44. A local attacker can exploit this vulnerability by supplying a malicious input file, leading to excessive CPU and I/O usage and preventing completion of the objdump analysis.

low : CVE--2025--69645

Affected range>0
Fixed versionNot Fixed
EPSS Score0.006%
EPSS Percentile0th percentile
Description

Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.

low : CVE--2025--69644

Affected range>0
Fixed versionNot Fixed
EPSS Score0.006%
EPSS Percentile0th percentile
Description

An issue was discovered in Binutils before 2.46. The objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed debug information. A logic flaw in the handling of DWARF location list headers can cause objdump to enter an unbounded loop and produce endless output until manually interrupted. This issue affects versions prior to the upstream fix and allows a local attacker to cause excessive resource consumption by supplying a malicious input file.

low : CVE--2025--66866

Affected range>0
Fixed versionNot Fixed
EPSS Score0.035%
EPSS Percentile10th percentile
Description

An issue was discovered in function d_abi_tags in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.

  • binutils (unimportant)
    binutils not covered by security support and most certainly bogus since they
    were assigned for a very old binutils release

low : CVE--2025--66865

Affected range>0
Fixed versionNot Fixed
EPSS Score0.174%
EPSS Percentile38th percentile
Description

An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.

  • binutils (unimportant)
    binutils not covered by security support and most certainly bogus since they
    were assigned for a very old binutils release

low : CVE--2025--66864

Affected range>0
Fixed versionNot Fixed
EPSS Score0.122%
EPSS Percentile31st percentile
Description

An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.

  • binutils (unimportant)
    binutils not covered by security support and most certainly bogus since they
    were assigned for a very old binutils release

low : CVE--2025--66863

Affected range>0
Fixed versionNot Fixed
EPSS Score0.174%
EPSS Percentile38th percentile
Description

An issue was discovered in function d_discriminator in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.

  • binutils (unimportant)
    binutils not covered by security support and most certainly bogus since they
    were assigned for a very old binutils release

low : CVE--2025--66862

Affected range>0
Fixed versionNot Fixed
EPSS Score0.128%
EPSS Percentile32nd percentile
Description

A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.

  • binutils (unimportant)
    binutils not covered by security support and most certainly bogus since they
    were assigned for a very old binutils release

low : CVE--2025--66861

Affected range>0
Fixed versionNot Fixed
EPSS Score0.042%
EPSS Percentile13th percentile
Description

An issue was discovered in function d_unqualified_name in file cp-demangle.c in BinUtils 2.26 allowing attackers to cause a denial of service via crafted PE file.

  • binutils (unimportant)
    binutils not covered by security support and most certainly bogus since they
    were assigned for a very old binutils release

low : CVE--2025--5245

Affected range>0
Fixed versionNot Fixed
EPSS Score0.084%
EPSS Percentile24th percentile
Description

A vulnerability classified as critical has been found in GNU Binutils up to 2.44. This affects the function debug_type_samep of the file /binutils/debug.c of the component objdump. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.

low : CVE--2025--5244

Affected range>0
Fixed versionNot Fixed
EPSS Score0.081%
EPSS Percentile24th percentile
Description

A vulnerability was found in GNU Binutils up to 2.44. It has been rated as critical. Affected by this issue is the function elf_gc_sweep of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.45 is able to address this issue. It is recommended to upgrade the affected component.

low : CVE--2025--3198

Affected range>0
Fixed versionNot Fixed
EPSS Score0.068%
EPSS Percentile21st percentile
Description

A vulnerability has been found in GNU Binutils 2.43/2.44 and classified as problematic. Affected by this vulnerability is the function display_info of the file binutils/bucomm.c of the component objdump. The manipulation leads to memory leak. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named ba6ad3a18cb26b79e0e3b84c39f707535bbc344d. It is recommended to apply a patch to fix this issue.

low : CVE--2025--11840

Affected range>0
Fixed versionNot Fixed
EPSS Score0.028%
EPSS Percentile8th percentile
Description

A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing a manipulation can lead to out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. This patch is called 16357. It is best practice to apply a patch to resolve this issue.

low : CVE--2025--11839

Affected range>0
Fixed versionNot Fixed
EPSS Score0.023%
EPSS Percentile6th percentile
Description

A security flaw has been discovered in GNU Binutils 2.45. Impacted is the function tg_tag_type of the file prdbg.c. Performing a manipulation results in unchecked return value. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks.

low : CVE--2025--1182

Affected range>0
Fixed versionNot Fixed
EPSS Score0.104%
EPSS Percentile28th percentile
Description

A vulnerability, which was classified as critical, was found in GNU Binutils 2.43. Affected is the function bfd_elf_reloc_symbol_deleted_p of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The patch is identified as b425859021d17adf62f06fb904797cf8642986ad. It is recommended to apply a patch to fix this issue.

low : CVE--2025--1181

Affected range>0
Fixed versionNot Fixed
EPSS Score0.117%
EPSS Percentile30th percentile
Description

A vulnerability classified as critical was found in GNU Binutils 2.43. This vulnerability affects the function _bfd_elf_gc_mark_rsec of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 931494c9a89558acb36a03a340c01726545eef24. It is recommended to apply a patch to fix this issue.

low : CVE--2025--1180

Affected range>0
Fixed versionNot Fixed
EPSS Score0.082%
EPSS Percentile24th percentile
Description

A vulnerability classified as problematic has been found in GNU Binutils 2.43. This affects the function _bfd_elf_write_section_eh_frame of the file bfd/elf-eh-frame.c of the component ld. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.

low : CVE--2025--1178

Affected range>0
Fixed versionNot Fixed
EPSS Score0.120%
EPSS Percentile30th percentile
Description

A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. Affected by this vulnerability is the function bfd_putl64 of the file libbfd.c of the component ld. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 75086e9de1707281172cc77f178e7949a4414ed0. It is recommended to apply a patch to fix this issue.

low : CVE--2025--1176

Affected range>0
Fixed versionNot Fixed
EPSS Score0.213%
EPSS Percentile44th percentile
Description

A vulnerability was found in GNU Binutils 2.43 and classified as critical. This issue affects the function _bfd_elf_gc_mark_rsec of the file elflink.c of the component ld. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The patch is named f9978defb6fab0bd8583942d97c112b0932ac814. It is recommended to apply a patch to fix this issue.

low : CVE--2025--1153

Affected range>0
Fixed versionNot Fixed
EPSS Score0.083%
EPSS Percentile24th percentile
Description

A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44. Affected by this vulnerability is the function bfd_set_format of the file format.c. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 2.45 is able to address this issue. The identifier of the patch is 8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150. It is recommended to upgrade the affected component.

low : CVE--2025--1152

Affected range>0
Fixed versionNot Fixed
EPSS Score0.048%
EPSS Percentile15th percentile
Description

A vulnerability classified as problematic has been found in GNU Binutils 2.43. Affected is the function xstrdup of the file xstrdup.c of the component ld. The manipulation leads to memory leak. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master."

low : CVE--2025--1151

Affected range>0
Fixed versionNot Fixed
EPSS Score0.048%
EPSS Percentile15th percentile
Description

A vulnerability was found in GNU Binutils 2.43. It has been rated as problematic. This issue affects the function xmemdup of the file xmemdup.c of the component ld. The manipulation leads to memory leak. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master."

low : CVE--2025--1150

Affected range>0
Fixed versionNot Fixed
EPSS Score0.048%
EPSS Percentile15th percentile
Description

A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. This vulnerability affects the function bfd_malloc of the file libbfd.c of the component ld. The manipulation leads to memory leak. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master."

low : CVE--2025--11495

Affected range>0
Fixed versionNot Fixed
EPSS Score0.030%
EPSS Percentile9th percentile
Description

A vulnerability was determined in GNU Binutils 2.45. The affected element is the function elf_x86_64_relocate_section of the file elf64-x86-64.c of the component Linker. This manipulation causes heap-based buffer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0. To fix this issue, it is recommended to deploy a patch.

low : CVE--2025--11494

Affected range>0
Fixed versionNot Fixed
EPSS Score0.039%
EPSS Percentile12th percentile
Description

A vulnerability was found in GNU Binutils 2.45. Impacted is the function _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is identified as b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a. A patch should be applied to remediate this issue.

low : CVE--2025--1149

Affected range>0
Fixed versionNot Fixed
EPSS Score0.048%
EPSS Percentile15th percentile
Description

A vulnerability was found in GNU Binutils 2.43. It has been classified as problematic. This affects the function xstrdup of the file libiberty/xmalloc.c of the component ld. The manipulation leads to memory leak. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master."

low : CVE--2025--1148

Affected range>0
Fixed versionNot Fixed
EPSS Score0.072%
EPSS Percentile22nd percentile
Description

A vulnerability was found in GNU Binutils 2.43 and classified as problematic. Affected by this issue is the function link_order_scan of the file ld/ldelfgen.c of the component ld. The manipulation leads to memory leak. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master."

low : CVE--2025--1147

Affected range>0
Fixed versionNot Fixed
EPSS Score0.067%
EPSS Percentile21st percentile
Description

A vulnerability has been found in GNU Binutils 2.43 and classified as problematic. Affected by this vulnerability is the function __sanitizer::internal_strlen of the file binutils/nm.c of the component nm. The manipulation of the argument const leads to buffer overflow. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.

low : CVE--2025--11414

Affected range>0
Fixed versionNot Fixed
EPSS Score0.030%
EPSS Percentile9th percentile
Description

A vulnerability was determined in GNU Binutils 2.45. Affected by this vulnerability is the function get_link_hash_entry of the file bfd/elflink.c of the component Linker. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.46 addresses this issue. Patch name: aeaaa9af6359c8e394ce9cf24911fec4f4d23703. It is advisable to upgrade the affected component.

low : CVE--2025--11413

Affected range>0
Fixed versionNot Fixed
EPSS Score0.028%
EPSS Percentile8th percentile
Description

A vulnerability was found in GNU Binutils 2.45. Affected is the function elf_link_add_object_symbols of the file bfd/elflink.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 2.46 is able to address this issue. The patch is identified as 72efdf166aa0ed72ecc69fc2349af6591a7a19c0. Upgrading the affected component is advised.

low : CVE--2025--11412

Affected range>0
Fixed versionNot Fixed
EPSS Score0.030%
EPSS Percentile9th percentile
Description

A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Linker. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 047435dd988a3975d40c6626a8f739a0b2e154bc. To fix this issue, it is recommended to deploy a patch.

low : CVE--2025--11083

Affected range>0
Fixed versionNot Fixed
EPSS Score0.027%
EPSS Percentile8th percentile
Description

A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended to deploy a patch. The code maintainer replied with "[f]ixed for 2.46".

low : CVE--2025--11082

Affected range>0
Fixed versionNot Fixed
EPSS Score0.023%
EPSS Percentile7th percentile
Description

A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ea1a0737c7692737a644af0486b71e4a392cbca8. A patch should be applied to remediate this issue. The code maintainer replied with "[f]ixed for 2.46".

low : CVE--2025--11081

Affected range>0
Fixed versionNot Fixed
EPSS Score0.030%
EPSS Percentile9th percentile
Description

A vulnerability was detected in GNU Binutils 2.45. This issue affects the function dump_dwarf_section of the file binutils/objdump.c. Performing manipulation results in out-of-bounds read. The attack is only possible with local access. The exploit is now public and may be used. The patch is named f87a66db645caf8cc0e6fc87b0c28c78a38af59b. It is suggested to install a patch to address this issue.

low : CVE--2021--32256

Affected range>0
Fixed versionNot Fixed
EPSS Score0.124%
EPSS Percentile31st percentile
Description

An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.36. It is a stack-overflow issue in demangle_type in rust-demangle.c.

low : CVE--2018--9996

Affected range>0
Fixed versionNot Fixed
EPSS Score0.385%
EPSS Percentile60th percentile
Description

An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demangle_template_value_parm, demangle_integral_value, and demangle_expression.

low : CVE--2018--20712

Affected range>0
Fixed versionNot Fixed
EPSS Score0.673%
EPSS Percentile71st percentile
Description

A heap-based buffer over-read exists in the function d_expression_1 in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31.1. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by c++filt.

low : CVE--2018--20673

Affected range>0
Fixed versionNot Fixed
EPSS Score0.093%
EPSS Percentile26th percentile
Description

The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, contains an integer overflow vulnerability (for "Create an array for saving the template argument values") that can trigger a heap-based buffer overflow, as demonstrated by nm.

low : CVE--2017--13716

Affected range>0
Fixed versionNot Fixed
EPSS Score0.237%
EPSS Percentile47th percentile
Description

The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd).

critical: 0 high: 0 medium: 0 low: 7 glibc 2.41-12+deb13u2 (deb)

pkg:deb/debian/glibc@2.41-12%2Bdeb13u2?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2019--9192

Affected range>0
Fixed versionNot Fixed
EPSS Score0.790%
EPSS Percentile74th percentile
Description

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\1\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern

low : CVE--2019--1010025

Affected range>0
Fixed versionNot Fixed
EPSS Score0.840%
EPSS Percentile75th percentile
Description

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability.

low : CVE--2019--1010024

Affected range>0
Fixed versionNot Fixed
EPSS Score0.634%
EPSS Percentile70th percentile
Description

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

low : CVE--2019--1010023

Affected range>0
Fixed versionNot Fixed
EPSS Score0.307%
EPSS Percentile54th percentile
Description

GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

low : CVE--2019--1010022

Affected range>0
Fixed versionNot Fixed
EPSS Score0.129%
EPSS Percentile32nd percentile
Description

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

low : CVE--2018--20796

Affected range>0
Fixed versionNot Fixed
EPSS Score1.492%
EPSS Percentile81st percentile
Description

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep.

low : CVE--2010--4756

Affected range>0
Fixed versionNot Fixed
EPSS Score0.394%
EPSS Percentile60th percentile
Description

The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.

  • glibc (unimportant)
  • eglibc (unimportant)
    That's standard POSIX behaviour implemented by (e)glibc. Applications using
    glob need to impose limits for themselves
critical: 0 high: 0 medium: 0 low: 5 openldap 2.6.10+dfsg-1 (deb)

pkg:deb/debian/openldap@2.6.10%2Bdfsg-1?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2026--22185

Affected range>0
Fixed versionNot Fixed
EPSS Score0.027%
EPSS Percentile8th percentile
Description

OpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and including 0.9.14, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.

low : CVE--2020--15719

Affected range>0
Fixed versionNot Fixed
EPSS Score0.216%
EPSS Percentile44th percentile
Description

libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.

low : CVE--2017--17740

Affected range>0
Fixed versionNot Fixed
EPSS Score6.138%
EPSS Percentile91st percentile
Description

contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.

low : CVE--2017--14159

Affected range>0
Fixed versionNot Fixed
EPSS Score0.111%
EPSS Percentile29th percentile
Description

slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill cat /pathname" command, as demonstrated by openldap-initscript.

low : CVE--2015--3276

Affected range>0
Fixed versionNot Fixed
EPSS Score2.575%
EPSS Percentile86th percentile
Description

The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.

  • openldap (unimportant)
    Debian builds with GNUTLS, not NSS
critical: 0 high: 0 medium: 0 low: 4 curl 8.14.1-2+deb13u2 (deb)

pkg:deb/debian/curl@8.14.1-2%2Bdeb13u2?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2025--15224

Affected range>0
Fixed versionNot Fixed
EPSS Score0.098%
EPSS Percentile27th percentile
Description

When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.

low : CVE--2025--15079

Affected range>0
Fixed versionNot Fixed
EPSS Score0.047%
EPSS Percentile14th percentile
Description

When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file.

low : CVE--2025--14017

Affected range>0
Fixed versionNot Fixed
EPSS Score0.010%
EPSS Percentile1st percentile
Description

When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.

low : CVE--2025--10966

Affected range>0
Fixed versionNot Fixed
EPSS Score0.026%
EPSS Percentile7th percentile
Description

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.

critical: 0 high: 0 medium: 0 low: 4 systemd 257.9-1~deb13u1 (deb)

pkg:deb/debian/systemd@257.9-1~deb13u1?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2023--31439

Affected range>0
Fixed versionNot Fixed
EPSS Score0.125%
EPSS Percentile31st percentile
Description

An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

low : CVE--2023--31438

Affected range>0
Fixed versionNot Fixed
EPSS Score0.134%
EPSS Percentile32nd percentile
Description

An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

low : CVE--2023--31437

Affected range>0
Fixed versionNot Fixed
EPSS Score0.170%
EPSS Percentile38th percentile
Description

An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

low : CVE--2013--4392

Affected range>0
Fixed versionNot Fixed
EPSS Score0.042%
EPSS Percentile13th percentile
Description

systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.

critical: 0 high: 0 medium: 0 low: 2 coreutils 9.7-3 (deb)

pkg:deb/debian/coreutils@9.7-3?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2025--5278

Affected range>0
Fixed versionNot Fixed
EPSS Score0.130%
EPSS Percentile32nd percentile
Description

A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.

low : CVE--2017--18018

Affected range>0
Fixed versionNot Fixed
EPSS Score0.056%
EPSS Percentile17th percentile
Description

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

critical: 0 high: 0 medium: 0 low: 2 sqlite3 3.46.1-7+deb13u1 (deb)

pkg:deb/debian/sqlite3@3.46.1-7%2Bdeb13u1?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2025--70873

Affected range>0
Fixed versionNot Fixed
EPSS Score0.050%
EPSS Percentile15th percentile
Description

An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.

low : CVE--2021--45346

Affected range>0
Fixed versionNot Fixed
EPSS Score0.271%
EPSS Percentile50th percentile
Description

A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect.

critical: 0 high: 0 medium: 0 low: 2 util-linux 2.41-5 (deb)

pkg:deb/debian/util-linux@2.41-5?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2025--14104

Affected range>0
Fixed versionNot Fixed
EPSS Score0.006%
EPSS Percentile0th percentile
Description

A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the setpwnam() function, affecting SUID (Set User ID) login-utils utilities writing to the password database.

low : CVE--2022--0563

Affected range>0
Fixed versionNot Fixed
EPSS Score0.025%
EPSS Percentile7th percentile
Description

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

critical: 0 high: 0 medium: 0 low: 1 bash-completion 1:2.16.0-7 (deb)

pkg:deb/debian/bash-completion@1%3A2.16.0-7?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2018--7738

Affected range>0
Fixed versionNot Fixed
EPSS Score0.070%
EPSS Percentile21st percentile
Description

In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.

critical: 0 high: 0 medium: 0 low: 1 unzip 6.0-29 (deb)

pkg:deb/debian/unzip@6.0-29?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2021--4217

Affected range>0
Fixed versionNot Fixed
EPSS Score0.195%
EPSS Percentile41st percentile
Description

A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.

critical: 0 high: 0 medium: 0 low: 1 perl 5.40.1-6 (deb)

pkg:deb/debian/perl@5.40.1-6?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2011--4116

Affected range>0
Fixed versionNot Fixed
EPSS Score0.189%
EPSS Percentile40th percentile
Description

_is_safe in the File::Temp module for Perl does not properly handle symlinks.

critical: 0 high: 0 medium: 0 low: 1 apt 3.0.3 (deb)

pkg:deb/debian/apt@3.0.3?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2011--3374

Affected range>0
Fixed versionNot Fixed
EPSS Score1.509%
EPSS Percentile81st percentile
Description

It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.

critical: 0 high: 0 medium: 0 low: 1 jansson 2.14-2 (deb)

pkg:deb/debian/jansson@2.14-2?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2020--36325

Affected range>0
Fixed versionNot Fixed
EPSS Score0.659%
EPSS Percentile71st percentile
Description

An issue was discovered in Jansson through 2.13.1. Due to a parsing error in json_loads, there's an out-of-bounds read-access bug. NOTE: the vendor reports that this only occurs when a programmer fails to follow the API specification

critical: 0 high: 0 medium: 0 low: 1 rand 0.9.2 (cargo)

pkg:cargo/rand@0.9.2

low : GHSA--cq8v--f236--94qc Improper Input Validation

Affected range>=0.9.0
<0.9.3
Fixed version0.9.3
Description

It has been reported (by @lopopolo) that the rand library is unsound (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:

  • The log and thread_rng features are enabled
  • A custom logger is defined
  • The custom logger accesses rand::rng() (previously rand::thread_rng()) and calls any TryRng (previously RngCore) methods on ThreadRng
  • The ThreadRng (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
  • Trace-level logging is enabled or warn-level logging is enabled and the random source (the getrandom crate) is unable to provide a new seed

TryRng (previously RngCore) methods for ThreadRng use unsafe code to cast *mut BlockRng<ReseedingCore> to &mut BlockRng<ReseedingCore>. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of aliased mutable references is Undefined Behaviour, the behaviour of optimized builds is hard to predict.

critical: 0 high: 0 medium: 0 low: 1 shadow 1:4.17.4-2 (deb)

pkg:deb/debian/shadow@1%3A4.17.4-2?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2007--5686

Affected range>0
Fixed versionNot Fixed
EPSS Score0.322%
EPSS Percentile55th percentile
Description

initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.

  • shadow (unimportant)
    See #290803, on Debian LOG_UNKFAIL_ENAB in login.defs is set to no so
    unknown usernames are not recorded on login failures
critical: 0 high: 0 medium: 0 low: 1 openssl 3.5.5-1~deb13u2 (deb)

pkg:deb/debian/openssl@3.5.5-1~deb13u2?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2010--0928

Affected range>=3.2.1-3
Fixed versionNot Fixed
EPSS Score0.094%
EPSS Percentile26th percentile
Description

OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."

http://www.eecs.umich.edu/~valeria/research/publications/DATE10RSA.pdf
openssl/openssl#24540
Fault injection based attacks are not within OpenSSLs threat model according
to the security policy: https://www.openssl.org/policies/general/security-policy.html

critical: 0 high: 0 medium: 0 low: 0 unspecified: 1rkyv 0.8.15 (cargo)

pkg:cargo/rkyv@0.8.15

unspecified : RUSTSEC--2026--0122

Affected range>=0.8.0
<0.8.16
Fixed version0.8.16
Description

InlineVec::clear() and SerVec::clear() in rkyv were not panic-safe.
Both functions iterate over their elements and call drop_in_place on each,
updating self.len only after the loop. If an element's Drop implementation
panics during the loop, self.len is left at its original value.

A subsequent invocation of clear() on the same container then re-visits the
already-freed elements:

  • InlineVec::clear() is called again from InlineVec's own Drop
    implementation when the value is later dropped.
  • SerVec::clear() is called again by SerVec::with_capacity() after the
    user closure returns.

Impact

  • CWE-415 (Double Free): heap corruption when the element type is one that
    owns memory, such as Box<T> or Vec<T>
  • CWE-416 (Use-After-Free): memory corruption when an element is accessed
    following a caught panic

Both types of undefined behavior can be invoked in safe Rust, but only if
unwinding panics are enabled and std::panic::catch_unwind is used.

@github-actions
Copy link
Copy Markdown
Contributor Author

github-actions Bot commented May 12, 2026

Recommended fixes for image vecoli:latest

Base image is debian:13-slim

Name13.4-slim
Digestsha256:e18da95f66066b7c5fa31491b524e83121271eca59a3d140f4906c8d0a090367
Vulnerabilitiescritical: 0 high: 0 medium: 0 low: 0
Pushed3 weeks ago
Size30 MB
Packages111
OS13.4
The base image is also available under the supported tag(s): 13.4-slim, trixie-slim

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.
TagDetailsPushedVulnerabilities
13-slim
Newer image for same tag
Also known as:
  • 13.4-slim
  • trixie-slim
  • trixie-20260505-slim
 Benefits:
  • Same OS detected
  • Newer image for same tag
  • Minor OS version update
  • Tag was pushed more recently
  • Image has similar size
  • Image has same number of vulnerabilities
  • Image contains equal number of packages
  • Tag is using slim variant
Image details:
  • Size: 30 MB
  • OS: 13.4
 1 week ago



Change base image

TagDetailsPushedVulnerabilities
stable-slim
Tag is preferred tag
Also known as:
  • stable-20260505-slim
 Benefits:
  • Same OS detected
  • Tag is preferred tag
  • Tag was pushed more recently
  • Image has similar size
  • Image contains equal number of packages
  • Tag is using slim variant
  • stable-slim was pulled 46K times last month
Image details:
  • Size: 30 MB
  • Flavor: debian
  • OS: 12
  • Slim: ✅
 1 week ago



13
Tag is latest
Also known as:
  • 13.4
  • latest
  • trixie
  • trixie-20260505
 Benefits:
  • Same OS detected
  • Minor OS version update
  • Tag was pushed more recently
  • Tag is latest
  • Image contains equal number of packages
Image details:
  • Size: 49 MB
  • OS: 13.4
 1 week ago



@thalassemia thalassemia merged commit b237873 into master May 12, 2026
12 of 14 checks passed
@thalassemia thalassemia deleted the security-updates branch May 12, 2026 20:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@thalassemia thalassemia thalassemia approved these changes

Assignees

No one assigned

Labels

long ci PR nearly ready to merge so run longer CI tests

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@thalassemia