SB2026081995 - Multiple vulnerabilities in Meinberg LANTIME firmware
Published: August 19, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 59 vulnerabilities.
1) Integer overflow (CVE-ID: CVE-2026-32316)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow in the "jvp_string_append" and "jvp_string_copy_replace_bad" functions. A remote attacker can pass specially crafted data to the application, trigger integer overflow and cause a denial of service condition on the target system.
2) Insufficiently protected credentials (CVE-ID: CVE-2026-8926)
CWE-ID: CWE-522 - Insufficiently Protected Credentials
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to use credentials intended for another user.
The vulnerability exists due to insufficiently protected credentials in .netrc credential handling when processing a URL that specifies a username without a password. A remote user can supply a URL with a username that has no matching .netrc entry to use credentials intended for another user.
This issue occurs only when curl is configured to use a .netrc file and the target host has credentials stored for a different user.
3) Authentication Bypass by Capture-replay (CVE-ID: CVE-2026-11856)
CWE-ID: CWE-294 - Authentication Bypass by Capture-replay
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authentication by replaying Digest authentication state.
The vulnerability exists due to authentication bypass by capture-replay in libcurl Digest authentication handling when reusing the same handle for a second transfer to a different HTTP origin. A remote attacker can receive a request containing an Authorization header intended for another origin to bypass authentication by replaying Digest authentication state.
The issue affects libcurl but not the curl command line tool. The leaked header does not reveal the other origin, and the exposed state allows replay only for the exact path of the captured request.
4) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-11586)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the WebSocket auto-PONG handling when processing rapid sequential WebSocket PING frames from a server. A remote attacker can send rapid sequential PING frames to cause a denial of service.
This issue affects both libcurl and the curl command line tool.
5) Improper Certificate Validation (CVE-ID: CVE-2026-11564)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass certificate trust restrictions.
The vulnerability exists due to improper certificate validation in libcurl connection reuse logic when reusing an easy handle after switching from native CA trust to custom CA material. A remote attacker can present a TLS certificate trusted by the native platform store to bypass certificate trust restrictions.
This issue applies to builds that use Native CA by default on Apple operating systems or Windows, and affects the OpenSSL, GnuTLS, Schannel, and Rustls TLS backends.
6) Infinite loop (CVE-ID: CVE-2026-11352)
CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a loop with an unreachable exit condition in the QUIC UDP receive function when processing zero-length UDP datagrams from a connected HTTP/3 server. A remote attacker can continuously stream empty datagrams to cause a denial of service.
This issue only triggers on platforms featuring the recvmmsg() function call.
7) Use-after-free (CVE-ID: CVE-2026-10536)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in libcurl HTTP/2 stream-dependency handling when resetting and cleaning up an easy handle configured with HTTP/2 stream dependencies. A local user can invoke curl_easy_reset() and then curl_easy_cleanup() on such a handle to cause a denial of service.
The issue only affects libcurl and requires use of the rarely used HTTP/2 stream-dependency options CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E.
8) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-9547)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a man-in-the-middle attack.
The vulnerability exists due to improper validation of certificate with host mismatch in the CURLOPT_SSH_KEYFUNCTION callback when validating SSH host keys for SCP:// or SFTP:// transfers. A remote attacker can present a host key type that does not match the key type already recorded for the host in the known_hosts file to perform a man-in-the-middle attack.
Only libcurl-based applications built with the libssh backend and using the callback are vulnerable. The curl command line tool is not affected.
9) Information disclosure (CVE-ID: CVE-2026-9546)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to exposure of sensitive information in the libcurl HTTP Referer header handling when processing subsequent HTTP requests after CURLOPT_REFERER is cleared with NULL. A remote attacker can receive a subsequent request that erroneously includes a previously configured Referer header to disclose sensitive information.
This issue affects libcurl and does not affect the curl command line tool.
10) Information disclosure (CVE-ID: CVE-2026-9545)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to exposure of sensitive information in libcurl HTTP/3 handling when reusing a cached SSL session with early data enabled after the original server is replaced by an impostor machine. A remote attacker can replace the server with an impostor machine and cause libcurl to send request bytes before certificate verification failure is enforced to disclose sensitive information.
This issue is specific to HTTP/3 with the ngtcp2 + nghttp3 backend and requires SSL session caching to remain enabled and TLS early data to be enabled.
11) Use-after-free (CVE-ID: CVE-2026-9080)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in the libcurl socket callback handling when calling curl_easy_pause() within the CURLMOPT_SOCKETFUNCTION callback. A local user can invoke the affected callback sequence to cause a denial of service.
This issue affects libcurl and does not affect the curl command line tool.
12) Insufficiently protected credentials (CVE-ID: CVE-2026-9079)
CWE-ID: CWE-522 - Insufficiently Protected Credentials
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose proxy authentication credentials.
The vulnerability exists due to insufficiently protected credentials in libcurl proxy authentication handling when clearing proxy authentication credentials. A remote user can reuse a handle after changing proxy credentials to disclose proxy authentication credentials.
The issue affects libcurl and does not affect the curl command line tool.
13) Authentication Bypass by Primary Weakness (CVE-ID: CVE-2026-8932)
CWE-ID: CWE-305 - Authentication Bypass by Primary Weakness
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass client certificate authentication.
The vulnerability exists due to authentication bypass by primary weakness in libcurl connection reuse logic when reusing a previously established connection after changing mTLS client certificate settings. A remote user can reuse a connection with mismatched client certificate configuration to bypass client certificate authentication.
The issue affects libcurl and does not affect the curl command line tool.
14) Authentication Bypass by Capture-replay (CVE-ID: CVE-2026-8927)
CWE-ID: CWE-294 - Authentication Bypass by Capture-replay
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to impersonate the client to another proxy.
The vulnerability exists due to authentication bypass by capture-replay in libcurl proxy authentication state handling when reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration. A remote user can receive a leaked Proxy-Authorization header on a subsequent request to impersonate the client to another proxy.
The issue affects libcurl and does not affect the curl command line tool.
15) Double free (CVE-ID: CVE-2026-8925)
CWE-ID: CWE-415 - Double Free
CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to double free in the SASL authentication logic when processing SASL authentication with a malicious server response. A remote user can influence server behavior to trigger the double free and cause a denial of service.
Only builds using libgsasl are vulnerable, and the issue can be triggered over IMAP, POP3, and SMTP.
16) Uncontrolled Recursion (CVE-ID: CVE-2026-33947)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to uncontrolled recursion in the "jv_setpath()", "jv_getpath()" and "delpaths_sorted()" functions in src/jv_aux.c. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
17) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-8924)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper cookie domain validation in cookie parsing logic when processing a cookie with a trailing-dot domain for a trailing-dot hostname. A remote attacker can send a specially crafted HTTP response that sets a super cookie to disclose sensitive information.
This issue is exploitable through both libcurl and the curl command line tool, and it bypasses the Public Suffix List check.
18) Exposure of Data Element to Wrong Session (CVE-ID: CVE-2026-8458)
CWE-ID: CWE-488 - Exposure of Data Element to Wrong Session
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to expose data to the wrong session.
The vulnerability exists due to exposure of data element to wrong session in libcurl connection reuse logic when reusing Negotiate-authenticated connections across different services. A remote user can issue a request that wrongfully reuses an existing authenticated connection to expose data to the wrong session.
The issue only occurs when using the same hostname, port number, and credentials, and when the previous connection remains alive in the connection pool.
19) Improper Certificate Validation (CVE-ID: CVE-2026-8286)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass TLS certificate validation.
The vulnerability exists due to improper certificate validation in connection reuse logic for STARTTLS-enabled protocol handling when reusing an existing live connection for a new transfer. A remote attacker can cause a transfer to reuse a connection with mismatched TLS settings to bypass TLS certificate validation.
This affects transfers using IMAP, POP3, SMTP, FTP, or LDAP schemes that begin in cleartext and are upgraded to TLS with STARTTLS.
20) Protection mechanism failure (CVE-ID: CVE-2026-50219)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory corruption.
The vulnerability exists due to missing control flow integrity checks in XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, and XML_ParserReset when these functions are called reentrantly from bindings or callbacks. A remote attacker can trigger unsafe parser API calls to cause memory corruption.
The issue is described as relevant to language bindings.
21) Protection mechanism failure (CVE-ID: CVE-2026-56131)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory corruption.
The vulnerability exists due to missing control flow integrity checks in XML_ResumeParser when it is called from a handler. A remote attacker can trigger a handler-driven call to XML_ResumeParser to cause memory corruption.
This issue is described as a hole in the fix for CVE-2026-50219.
22) Out-of-bounds write (CVE-ID: CVE-2026-56132)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory corruption.
The vulnerability exists due to an out-of-bounds write in doProlog when processing scaffolding index data. A remote attacker can supply crafted XML input to cause memory corruption.
23) Integer overflow (CVE-ID: CVE-2026-56403)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory corruption.
The vulnerability exists due to an integer overflow in storeAtts when parsing XML attributes. A remote attacker can supply crafted XML input to cause memory corruption.
24) Integer overflow (CVE-ID: CVE-2026-56404)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory corruption.
The vulnerability exists due to an integer overflow in addBinding when processing XML data. A remote attacker can supply crafted XML input to cause memory corruption.
25) Integer overflow (CVE-ID: CVE-2026-56405)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory corruption.
The vulnerability exists due to an integer overflow in getAttributeId when parsing XML attributes. A remote attacker can supply crafted XML input to cause memory corruption.
26) Integer overflow (CVE-ID: CVE-2026-56406)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory corruption.
The vulnerability exists due to an integer overflow in XML_ParseBuffer when parsing buffered XML input. A remote attacker can supply crafted XML input to cause memory corruption.
27) Integer overflow (CVE-ID: CVE-2026-56407)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory corruption.
The vulnerability exists due to an integer overflow in textLen handling when parsing XML data. A remote attacker can supply crafted XML input to cause memory corruption.
28) Integer overflow (CVE-ID: CVE-2026-56408)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory corruption.
The vulnerability exists due to an integer overflow in copyString when copying string data. A remote attacker can supply crafted XML input to cause memory corruption.
29) Protection mechanism failure (CVE-ID: CVE-2026-56412)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory corruption.
The vulnerability exists due to missing control flow integrity checks in doCdataSection when handling XML_TOK_DATA_CHARS callbacks. A remote attacker can trigger unsafe handler calls to cause memory corruption.
This issue is described as a hole in the fix for CVE-2026-50219.
30) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-45446)
CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to forge empty messages with arbitrary additional authenticated data.
The vulnerability exists due to incorrect tag processing in the AES-GCM-SIV and AES-SIV provider implementations when decrypting messages with empty ciphertext and supplied additional authenticated data. A remote attacker can send a crafted message with empty ciphertext and a forged tag to forge empty messages with arbitrary additional authenticated data.
The issue is reachable only in applications that implement their own protocol with the EVP interface and skip the ciphertext update when a message with empty ciphertext arrives.
31) Improper Null Termination (CVE-ID: CVE-2026-33948)
CWE-ID: CWE-170 - Improper Null Termination
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to embedded-NUL truncation in jq CLI JSON input path. A remote attacker can cause validation bypass on the system.
32) Use-after-free (CVE-ID: CVE-2026-45447)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to use-after-free in the PKCS7_verify() function when processing a specially crafted PKCS#7 or S/MIME signed message during PKCS#7 signature verification. A remote attacker can send a specially crafted signed message to execute arbitrary code.
Applications using the CMS APIs for this processing are not affected.
33) Out-of-bounds read (CVE-ID: CVE-2026-39979)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to a boundary condition in the "jv_parse_sized()" function. A remote attacker can trigger an out-of-bounds read error and read contents of memory on the system or perform a denial of service (DoS) attack.
34) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-40164)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to inefficient algorithmic complexity within hardcoded MurmurHash3 seed. A remote attacker can cause a denial of service condition on the target system.
35) Uncontrolled Recursion (CVE-ID: CVE-2026-40612)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in jv_contains when processing deeply nested arrays or objects through contains() or inside(). A local user can supply a specially crafted nested input structure to cause a denial of service.
In libjq embedded in larger applications, exploitation may corrupt adjacent memory on systems without stack guard pages or with heap-allocated thread stacks.
36) Improper Neutralization of Null Byte or NUL Character (CVE-ID: CVE-2026-41256)
CWE-ID: CWE-158 - Improper Neutralization of Null Byte or NUL Character
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass intended jq program integrity checks.
The vulnerability exists due to improper neutralization of null byte or NUL character in the top-level jq program compilation path when loading a jq program from a file with -f. A remote attacker can supply a crafted filter file containing an embedded NUL byte to bypass intended jq program integrity checks.
User interaction is required to run jq with the crafted filter file.
37) Integer overflow (CVE-ID: CVE-2026-41257)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to integer overflow in stack_reallocate in the jq VM stack when processing deeply nested generator forks. A local user can supply crafted jq input to trigger signed integer overflow and abort the process to cause a denial of service.
In the observed case, the wrapped allocation size causes memory allocation failure and process abort. A small positive truncation may also lead to a wild memmove write before the buffer.
38) Out-of-bounds write (CVE-ID: CVE-2026-43894)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds write in decNumber D2U() macro in decNumberFromString when processing an extremely large decimal string via tonumber. A remote attacker can supply a specially crafted number string to cause a denial of service.
The issue is triggered by signed integer overflow and is reachable through tonumber on a string built via the multiplication operator rather than through raw JSON number parsing.
39) Improper Neutralization of Null Byte or NUL Character (CVE-ID: CVE-2026-43895)
CWE-ID: CWE-158 - Improper Neutralization of Null Byte or NUL Character
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to compromise the target system.
The vulnerability exists due to improper neutralization of null byte or NUL character in src/linker.c. A local user can cause the target application to load a different module or JSON data file than the one approved by the policy layer.
40) Uncontrolled Recursion (CVE-ID: CVE-2026-43896)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to uncontrolled recursion in the "jv_object_merge_recursive()" function in src/jv.c. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
41) Uncontrolled Recursion (CVE-ID: CVE-2026-44777)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in jq module loader when processing mutually including modules through the -L / include mechanism. A remote attacker can provide a valid pair of mutually including modules to cause a denial of service.
Exploitation requires jq to run against attacker-influenced programs or attacker-influenced module search paths.
42) Stack-based buffer overflow (CVE-ID: CVE-2026-47770)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to stack-based buffer overflow in deep structural equality when parsing input. A local user can supply specially crafted input to cause a denial of service.
43) Out-of-bounds write (CVE-ID: CVE-2026-49839)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds write in the --rawfile handling in jv_load_file() when processing an attacker-controlled file. A remote attacker can supply a crafted oversized file to cause a denial of service.
User interaction is required to process the crafted file, and the heap-buffer-overflow occurs in assertion-disabled builds after a handled \"String too long\" error is reused as a string state.
44) Integer overflow (CVE-ID: CVE-2026-54679)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service or execute arbitrary code.
The vulnerability exists due to integer overflow leading to a heap-based buffer overflow in jvp_string_append when appending data to strings on 32-bit systems. A local user can supply crafted input that triggers oversized string growth calculations to cause a denial of service or execute arbitrary code.
Only 32-bit systems are affected.
45) Input validation error (CVE-ID: CVE-2026-34182)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass integrity validation.
The vulnerability exists due to improper input validation in CMS AuthEnvelopedData processing when decrypting crafted AuthEnvelopedData containers. A remote attacker can send a specially crafted CMS message to bypass integrity validation.
In some cases, if the application exposes decryption success or failure, the issue can be used as an oracle to obtain key-equivalent functionality for the content-encryption key.
46) NULL pointer dereference (CVE-ID: CVE-2026-39956)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to jq _strindices missing runtime type checks. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack or gain access to sensitive information.
47) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-34183)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled memory allocation in the QUIC PATH_CHALLENGE handler when processing floods of PATH_CHALLENGE frames. A remote attacker can send a flood of PATH_CHALLENGE frames to cause a denial of service.
The issue affects applications acting as a QUIC client or server.
48) NULL pointer dereference (CVE-ID: CVE-2026-42764)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to NULL pointer dereference in QUIC server initial packet handling when processing an initial packet with an invalid or expired token. A remote attacker can send a crafted initial packet to cause a denial of service.
The issue is reachable only when address validation is disabled, such as when SSL_LISTENER_FLAG_NO_VALIDATE is used with SSL_new_listener().
49) Improper Initialization (CVE-ID: CVE-2026-45445)
CWE-ID: CWE-665 - Improper Initialization
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to forge arbitrary ciphertext.
The vulnerability exists due to improper initialization in the AES-OCB EVP_Cipher() one-shot path when processing AES-OCB operations through the public EVP_Cipher() interface. A local user can invoke the one-shot API on an AES-OCB context to forge arbitrary ciphertext.
Only applications that combine AES-OCB with the EVP_Cipher() one-shot API are affected; applications using the documented streaming AEAD API are not affected.
50) Heap-based buffer overflow (CVE-ID: CVE-2026-7383)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to heap-based buffer overflow in ASN1_mbstring_copy() and ASN1_mbstring_ncopy() when converting attacker-controlled multibyte strings to Unicode output. A local user can supply extremely large crafted input to execute arbitrary code.
Triggering the issue requires direct use of ASN1_mbstring_copy() or ASN1_mbstring_ncopy(), or a custom string type registered via ASN1_STRING_TABLE_add(), with attacker-controlled input on the order of half a gigabyte or more.
51) Out-of-bounds read (CVE-ID: CVE-2026-9076)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds read in kek_unwrap_key() when processing attacker-supplied CMS password-based decryption data with a stream-mode KEK cipher. A remote attacker can send a specially crafted CMS message to cause a denial of service.
No password knowledge is required because the over-read occurs during the unwrap attempt before authentication succeeds.
52) Out-of-bounds read (CVE-ID: CVE-2026-34180)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to integer truncation in the ASN.1 decoder when parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length. A remote attacker can supply crafted ASN.1 input to disclose sensitive information.
The issue affects only 64-bit Unix and Unix-like platforms; 32-bit platforms and 64-bit Windows are not affected.
53) Input validation error (CVE-ID: CVE-2026-34181)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to impersonate a user.
The vulnerability exists due to improper input validation in PKCS#12 file processing for PBMAC1 integrity verification when processing unencrypted PKCS#12 files with a one-byte HMAC key. A remote attacker can submit a crafted PKCS#12 file to impersonate a user.
The forged file is accepted with a 1 in 256 probability.
54) NULL pointer dereference (CVE-ID: CVE-2026-42766)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to NULL pointer dereference in password-based CMS decryption when processing a specially crafted CMS message with an absent PasswordRecipientInfo.keyDerivationAlgorithm field. A remote attacker can send a specially crafted CMS message to cause a denial of service.
Applications that process password-encrypted CMS messages may be affected.
55) NULL pointer dereference (CVE-ID: CVE-2026-42767)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to NULL pointer dereference in CRMF EncryptedValue decryption when processing a crafted CMP response containing an EncryptedValue structure with an algorithm OID but no parameters field. A remote attacker can send a crafted CMP response to cause a denial of service.
The issue can be triggered by an attacker-controlled CMP server or a man-in-the-middle.
56) Observable discrepancy (CVE-ID: CVE-2026-42768)
CWE-ID: CWE-203 - Observable discrepancy
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to decrypt or sign messages with the victim's private RSA key.
The vulnerability exists due to observable discrepancy in error handling in CMS_decrypt() and PKCS7_decrypt() when processing attacker-supplied CMS or S/MIME messages and exposing decryption errors or output differences. A remote attacker can send crafted messages and observe the application's responses to decrypt or sign messages with the victim's private RSA key.
The attack requires the application to expose the error code and/or decryption output in a way that can be observed by the attacker.
57) Improper Certificate Validation (CVE-ID: CVE-2026-42769)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to replace the root CA certificate trusted by CMP clients.
The vulnerability exists due to improper certificate validation in OSSL_CMP_get1_rootCaKeyUpdate() when processing id-it-rootCaKeyUpdate CMP messages. A remote user can send a crafted CMP root CA key update message to replace the root CA certificate trusted by CMP clients.
Exploitation requires credentials that satisfy the CMP message protection checks.
58) Input validation error (CVE-ID: CVE-2026-42770)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to recover the victim's private key.
The vulnerability exists due to improper input validation in EVP_PKEY_derive_set_peer() when validating a DHX (X9.42) peer key using the peer-supplied q parameter for subgroup membership checks. A remote attacker can present a forged DHX peer key to recover the victim's private key.
The realistic attack surface is narrow and is principally limited to deployments using long-lived X9.42 DHX static keys with interactive protocols.
59) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-12064)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to connect to an unverified SSH remote host.
The vulnerability exists due to improper validation of certificate with host mismatch in the curl command line tool when processing a schemeless URL combined with --proto-default for sftp or scp. A remote attacker can present an SSH server in that connection flow to connect to an unverified SSH remote host.
This issue affects only the curl command line tool and does not affect other users of libcurl or the libcurl library itself.
Remediation
Install update from vendor's website.