Canonical Ubuntu Linux Linux Operating System

libcurl Credential Exposure via CURLINFO_EFFECTIVE_URL
CVE-2026-94266 - October 20, 2026

libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did.

Stack Overflow in libcurl via Deeply Nested MIME Structure
CVE-2026-92391 - October 20, 2026

A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within `curl_mime_free` leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process.

curl anti-clobbering bypass via early hints (CVE-2026-92390)
CVE-2026-92390 - October 20, 2026

When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an `ETag` header is processed before `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S) server to overwrite an existing local file specified in the `Content-Disposition` header despite the presence of the `-J` non-overwrite constraint.

libcurl TFTP State Machine Mis-Validation Enables Mixed-Mode TFTP Attack
CVE-2026-92389 - October 20, 2026

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode, prompting libcurl to consume and transmit data from the handle's persistent `CURLOPT_READDATA` pointer - including data remaining from unrelated prior operations, such as an HTTP POST request executed on a reused handle.

libcurl FTP wildcard LIST leads to heap use-after-free & type confusion
CVE-2026-92388 - October 20, 2026

When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while changing only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.

libcurl Timeout Bypass via Omitted Control-Response in FTP/IMAP/POP3/SMTP
CVE-2026-92387 - October 20, 2026

By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle.

curl Cookie Jar Exceeded Length Vulnerability (CVE-2026-92386)
CVE-2026-92386 - October 20, 2026

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` silently aborts parsing prematurely upon encountering the too long line, ignoring all subsequent valid cookies in the file.

libcurl Host Key Validation Bug: Key Mismatch Treated as Missing Key
CVE-2026-87865 - October 20, 2026

When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.

CURL: HSTS max-age overflow truncates cache on 64-bit systems
CVE-2026-87863 - October 20, 2026

An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss.

curl IMAP APPEND CRLF overflow allows command injection
CVE-2026-87864 - October 20, 2026

Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within the authenticated session.

curl HSTS includeSubDomains parent entry drop causes HTTP downgrade
CVE-2026-87862 - October 20, 2026

Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.

HTTP Proxy Tricking libcurl into Credential Leakage via 401 WWW-Authenticate
CVE-2026-86414 - October 20, 2026

An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`.

Curl Cookie Jar Empty on Subsequent Calls via Malicious Server
CVE-2026-86412 - October 20, 2026

A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains.

CURL Vulnerability: SSH Host Verification Ignored on Redirect (SFTP/SCP)
CVE-2026-86410 - October 20, 2026

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect.

libcurl SigV4 Auth Leakage via CURLOPT_AWS_SIGV4 NULL
CVE-2026-86409 - October 20, 2026

Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL isset next, leaking state information.

util-linux 2.41.3: parse_dos_extended int overflow bypass (false partition)
CVE-2026-53615 8 - High - October 14, 2026

util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.

Integer Overflow or Wraparound

util-linux mount SUID race: unprotected bind-mount (2.39.12.41.4/2.42.1)
CVE-2026-53614 7 - High - October 14, 2026

util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged user to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.

Improper Privilege Management

Root Priv Esc via fstab 'user' Mount in util-linux 2.172.42.4
CVE-2026-53613 7 - High - October 14, 2026

util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.

TOCTTOU

util-linux SUID mount escalation via renameat2 race (2.39-2.41.4, 2.42-2.42.1)
CVE-2026-53612 7 - High - October 14, 2026

util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.

TOCTTOU

NGINX Http3 proxied request data injection via proxy_request_buffering
CVE-2026-95101 5.3 - Medium - October 14, 2026

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject data in the proxied request.  There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Encoding Error

NGINX SSL Session Ticket Key Rotation Bypass via ssl_session_cache
CVE-2026-97629 6.5 - Medium - October 14, 2026

Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates. Impact This vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Use of Uninitialized Resource

NGINX Heap Buffer Overflow via Regex Capture in Map Directive
CVE-2026-93479 8.1 - High - October 14, 2026

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact:  This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Heap-based Buffer Overflow

Nginx core mod UAF from SSI with AIO enabled
CVE-2026-97205 8.1 - High - October 14, 2026

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing include virtual commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Dangling pointer

NGINX Heap Buffer Overflow via $request_filename in Alias Rewrite
CVE-2026-15176 8.1 - High - October 14, 2026

A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Heap-based Buffer Overflow

OpenVPN 2.6.0-2.6.22 UAF in TLS Session Promotion (CVE-2026-84471)
CVE-2026-84471 7.2 - High - October 14, 2026

The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.

Dangling pointer

Curl HTTP/2 RST_STREAM UAF during upload
CVE-2026-92392 8.1 - High - October 14, 2026

During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.

Dangling pointer

Squid 3.3.0.17.5.9: HTTP/1.1 Transfer-Encoding Request Smuggling
CVE-2026-61642 7.7 - High - October 13, 2026

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (`src/HttpHeader.cc`) accepted the bare` Transfer-Encoding:` identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.

HTTP Request Smuggling

NTFS-3G <2026.7.7: OOB Read in ntfs_fix_file_name() via readlink
CVE-2026-46571 5.5 - Medium - October 07, 2026

In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information in ntfs-3g process memory by crafting a malicious NTFS image. The out-of-bounds read is triggered by a readlink on a corrupted file.

Out-of-bounds Read

NTFS-3G <2026.7.7 heap BOF in ntfs_ib_cut_tail() libntfs-3g/index.c
CVE-2026-46572 7.4 - High - October 07, 2026

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_cut_tail() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a specially crafted directory.

Heap-based Buffer Overflow

Heap Overflow in ntfs-3g before 2026.7.7 (ntfs_index_walk_down) via SUID root
CVE-2026-46570 8.1 - High - October 07, 2026

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file metadata.

Heap-based Buffer Overflow

NTFS-3G <2026.7.7 Heap Buffer Overflow in ntfs_ib_copy_tail()
CVE-2026-46569 7.7 - High - October 07, 2026

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_copy_tail(), in libntfs-3g/index.c, that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file.

Heap-based Buffer Overflow

NTFS-3G <=2026.7.7 Heap Buffer Overflow in ntfscat
CVE-2026-42616 7.8 - High - October 07, 2026

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c that allows an attacker to corrupt heap memory in the ntfscat binary by crafting a malicious NTFS image. The overflow is triggered by reading a file.

Heap-based Buffer Overflow

NTFS-3G <2026.7.7 heap ble in ntfs_ir_to_ib() SUID binary
CVE-2026-42617 7.1 - High - October 07, 2026

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file.

Heap-based Buffer Overflow

NTFS-3G<2026.7.7 Heap Buffer Overflow in ntfs_decompress()
CVE-2026-42618 7.1 - High - October 07, 2026

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file.

Heap-based Buffer Overflow

YAML Perl Module <1.27_001: glob injection allows arbitrary code exec
CVE-2019-25777 7.3 - High - October 05, 2026

YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or YAML's own load options. A perl/glob document that sets $YAML::LoadCode or $YAML::UseCode turns on code loading, which is off by default, for every later Load() in the process. A perl/code document is then passed to a string eval, so an attacker who supplies two documents to separate Load() calls in one process can execute arbitrary Perl code.

Improper Control of Dynamically-Identified Variables

YAML <1.30 (Perl) DESTROY RCE via yaml_loader
CVE-2017-20285 9.1 - Critical - October 05, 2026

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY does depends on the classes the process has loaded. With File::Temp::Dir from core Perl, it can delete a directory tree the document names.

Marshaling, Unmarshaling

Apache HTTP Server: NULL pointer deref in mod_xml2enc before 2.4.69
CVE-2026-63686 7.5 - High - October 01, 2026

A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to upgrade to version 2.4.69, which fixes this issue.

NULL Pointer Dereference

Apache HTTP Server 2.4.68 mod_dav_fs Integer Overflow via PROPPATCH
CVE-2026-93546 8.8 - High - October 01, 2026

Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.

Integer Overflow or Wraparound

Apache HTTP Server 2.4.x Path Equivalence in mod_userdir (UserDir)
CVE-2026-79768 5.3 - Medium - October 01, 2026

Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

Single Dot Directory

UAF in Apache HTTP Server 2.4 mod_auth_digest before 2.4.69
CVE-2026-73637 7.3 - High - October 01, 2026

Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0. Users are recommended to upgrade to version 2.4.69, which fixes this issue.

Dangling pointer

Apache HTTP Server 2.4.x AuthDigestNonceLifetime 0 Bypass via Capture-Replay MITM
CVE-2026-73636 8.1 - High - October 01, 2026

Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0. Users are recommended to upgrade to version 2.4.69, which fixes this issue.

Authentication Bypass by Capture-replay

Apache HTTP Server 2.4.30-2.4.68 Response Smuggling via mod_proxy_uwsgi
CVE-2026-63718 7.5 - High - October 01, 2026

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.68.

HTTP Request Smuggling

Apache HTTP 2.4.68 Buffer Overflow via Host Header > 8192 in mod_vhost_alias
CVE-2026-63292 7.5 - High - October 01, 2026

Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default. Users are recommended to upgrade to version 2.4.69, which fixes this issue.

Stack Overflow

Improper FTP PASV Validation in mod_proxy_ftp (Apache HTTP Server) <2.4.69
CVE-2026-63045 7.5 - High - October 01, 2026

Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response. Users are recommended to upgrade to version 2.4.69, which fixes this issue.

Authorization

Apache HTTP Server 2.4.0-2.4.68 mod_dav_fs State File Disclosure
CVE-2026-58415 5.3 - Medium - October 01, 2026

Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

Files or Directories Accessible to External Parties

U-Boot <2026.10-rc5 OOB read in dhcp6_parse_options via DHCPv6
CVE-2026-74225 7.1 - High - September 29, 2026

U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the bootloader.

Memory Corruption

U-Boot <2026.10-rc5 Use-After-Free in httpc_recv_cb() lwIP wget
CVE-2026-74222 8.8 - High - September 29, 2026

U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERR_BUF instead of ERR_ABRT, causing the TCP input path to access released memory and crash the bootloader.

Dangling pointer

U-Boot <=2026.10-rc5 NFS Readlink Buffer Overflow
CVE-2026-74221 8.8 - High - September 29, 2026

U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.

Signed to Unsigned Conversion Error

U-Boot <2026.10-rc5 Buffer Overflow in nfs_read_reply()
CVE-2026-74220 8.8 - High - September 29, 2026

U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the destination buffer, crashing the bootloader or corrupting memory.

Signed to Unsigned Conversion Error

U-Boot <2026.10-rc3 IP_DEFRAG OOBW in __net_defragment()
CVE-2026-71971 8.8 - High - September 29, 2026

U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bounds write vulnerability in the __net_defragment() function in net/net.c. Remote attackers can send a crafted IP fragment with non-zero offset and More-Fragments flag set during netboot to corrupt adjacent memory and crash the bootloader.

Memory Corruption