SB2026092004 - Fedora EPEL 10.4 update for nextcloud
Published: September 20, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2026-48988)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the smartquotes rule when processing user-supplied markdown with the typographer option enabled. A remote attacker can submit a markdown input containing many consecutive quotation marks to cause a denial of service.
Only applications that render user-supplied markdown with typographer: true are vulnerable.
2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-82562)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the qs parser when processing bracket-key comma-separated query string or form body input with comma: true. A remote attacker can supply a specially crafted parameter to cause a denial of service.
A single parameter can materialize an arbitrarily large array, and the issue occurs because bracket-key input can bypass configured arrayLimit and throwOnLimitExceeded checks.
3) Uncaught Exception (CVE-ID: CVE-2026-82417)
CWE-ID: CWE-248 - Uncaught Exception
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an uncaught exception in utils.isBuffer in qs.stringify when processing parsed query string data during a parse-to-stringify round-trip. A remote attacker can send a specially crafted query string to cause a denial of service.
The issue is reachable when qs.parse preserves constructor and isBuffer as own properties, such as with plainObjects: true or allowPrototypes: true.
4) Cross-site scripting (CVE-ID: CVE-2026-75838)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to execute arbitrary JavaScript in the application's origin.
The vulnerability exists due to cross-site scripting in _sanitizeElements() when sanitizing attacker-supplied HTML with IN_PLACE enabled and an element-removal hook detaches the current node. A remote user can supply crafted HTML containing a descendant resource element with an event handler to execute arbitrary JavaScript in the application's origin.
User interaction is required to render the sanitized content, and exploitation requires the non-default IN_PLACE configuration together with a hook that removes a containing element.
Remediation
Install update from vendor's website.