NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.

Remediation

Upgrade Debian:11 curl to version 7.74.0-1.3+deb11u8 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-27533
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/
• https://hackerone.com/reports/1891474
• https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/
• https://security.gentoo.org/glsa/202310-12
• https://security.netapp.com/advisory/ntap-20230420-0011/
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html
• https://cert-portal.siemens.com/productcert/html/ssa-943925.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde () character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /2/foo while accessing a server with a specific user.

Remediation

Upgrade Debian:11 curl to version 7.74.0-1.3+deb11u8 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-27534
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html
• https://cert-portal.siemens.com/productcert/html/ssa-806742.html
• https://cert-portal.siemens.com/productcert/html/ssa-943925.html
• https://hackerone.com/reports/1892351
• https://lists.debian.org/debian-lts-announce/2024/03/msg00016.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/
• https://security.gentoo.org/glsa/202310-12
• https://security.netapp.com/advisory/ntap-20230420-0012/

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5 package and not the krb5 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."

Remediation

Upgrade Debian:11 krb5 to version 1.18.3-6+deb11u3 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-42898
• https://bugzilla.samba.org/show_bug.cgi?id=15203
• https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c
• https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583
• https://security.gentoo.org/glsa/202309-06
• https://security.gentoo.org/glsa/202310-06
• https://security.netapp.com/advisory/ntap-20230216-0008/
• https://security.netapp.com/advisory/ntap-20230223-0001/
• https://web.mit.edu/kerberos/advisories/
• https://web.mit.edu/kerberos/krb5-1.19/
• https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt
• https://www.samba.org/samba/security/CVE-2022-42898.html
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.

Remediation

There is no fixed version for Debian:11 libssh2.

References

• https://security-tracker.debian.org/tracker/CVE-2026-66032
• https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0
• https://github.com/libssh2/libssh2/pull/2180
• https://www.vulncheck.com/advisories/libssh2-double-free-heap-corruption-via-sftp-open

NVD Description

Note: Versions mentioned in the description apply only to the upstream libwebp package and not the libwebp package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

Remediation

Upgrade Debian:11 libwebp to version 0.6.1-2.1+deb11u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-4863
• https://www.vicarius.io/vsociety/posts/zero-day-webp-vulnerability-cve-2023-4863
• http://www.openwall.com/lists/oss-security/2023/09/21/4
• http://www.openwall.com/lists/oss-security/2023/09/22/1
• http://www.openwall.com/lists/oss-security/2023/09/22/3
• http://www.openwall.com/lists/oss-security/2023/09/22/4
• http://www.openwall.com/lists/oss-security/2023/09/22/5
• http://www.openwall.com/lists/oss-security/2023/09/22/6
• http://www.openwall.com/lists/oss-security/2023/09/22/7
• http://www.openwall.com/lists/oss-security/2023/09/22/8
• http://www.openwall.com/lists/oss-security/2023/09/26/1
• http://www.openwall.com/lists/oss-security/2023/09/26/7
• http://www.openwall.com/lists/oss-security/2023/09/28/1
• http://www.openwall.com/lists/oss-security/2023/09/28/2
• http://www.openwall.com/lists/oss-security/2023/09/28/4
• https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/
• https://blog.isosceles.com/the-webp-0day/
• https://bugzilla.suse.com/show_bug.cgi?id=1215231
• https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
• https://crbug.com/1479274
• https://en.bandisoft.com/honeyview/history/
• https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a
• https://github.com/webmproject/libwebp/releases/tag/v1.3.2
• https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html
• https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html
• https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863
• https://news.ycombinator.com/item?id=37478403
• https://security.gentoo.org/glsa/202309-05
• https://security.gentoo.org/glsa/202401-10
• https://security.netapp.com/advisory/ntap-20230929-0011/
• https://sethmlarson.dev/security-developer-in-residence-weekly-report-16
• https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/
• https://www.bentley.com/advisories/be-2023-0001/
• https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/
• https://www.debian.org/security/2023/dsa-5496
• https://www.debian.org/security/2023/dsa-5497
• https://www.debian.org/security/2023/dsa-5498
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4863
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://github.com/caoweiquan322/NotEnough

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxpm package and not the libxpm package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH environment variable.

Remediation

Upgrade Debian:11 libxpm to version 1:3.5.12-1.1~deb11u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-4883
• https://bugzilla.redhat.com/show_bug.cgi?id=2160213
• https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/515294bb8023a45ff91669
• https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9
• https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html
• https://lists.x.org/archives/xorg-announce/2023-January/003312.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxslt package and not the libxslt package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Remediation

Upgrade Debian:11 libxslt to version 1.1.34-4+deb11u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-30560
• https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop.html
• https://crbug.com/1219209
• https://lists.debian.org/debian-lts-announce/2022/09/msg00010.html
• https://security.gentoo.org/glsa/202310-23
• https://www.debian.org/security/2022/dsa-5216

NVD Description

Note: Versions mentioned in the description apply only to the upstream tiff package and not the tiff package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesBytes() at /libtiff/tools/tiffcrop.c:3215.

Remediation

Upgrade Debian:11 tiff to version 4.2.0-1+deb11u4 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-25434
• https://gitlab.com/libtiff/libtiff/-/issues/519

NVD Description

Note: Versions mentioned in the description apply only to the upstream tiff package and not the tiff package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 227500897dfb07fb7d27f7aa570050e62617e3be. It is recommended to apply a patch to fix this issue. The identifier VDB-213549 was assigned to this vulnerability.

Remediation

Upgrade Debian:11 tiff to version 4.2.0-1+deb11u3 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-3970
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53137
• https://gitlab.com/libtiff/libtiff/-/commit/227500897dfb07fb7d27f7aa570050e62617e3be
• https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html
• https://oss-fuzz.com/download?testcase_id=5738253143900160
• https://security.netapp.com/advisory/ntap-20221215-0009/
• https://support.apple.com/kb/HT213841
• https://support.apple.com/kb/HT213843
• https://vuldb.com/?id.213549

NVD Description

Note: Versions mentioned in the description apply only to the upstream tiff package and not the tiff package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file.

By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.

Remediation

Upgrade Debian:11 tiff to version 4.2.0-1+deb11u7 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2025-9900
• https://access.redhat.com/security/cve/CVE-2025-9900
• https://bugzilla.redhat.com/show_bug.cgi?id=2392784
• https://access.redhat.com/errata/RHSA-2025:17651
• https://access.redhat.com/errata/RHSA-2025:17675
• https://access.redhat.com/errata/RHSA-2025:17710
• https://access.redhat.com/errata/RHSA-2025:17738
• https://access.redhat.com/errata/RHSA-2025:17739
• https://access.redhat.com/errata/RHSA-2025:17740
• https://access.redhat.com/errata/RHSA-2025:19113
• https://access.redhat.com/errata/RHSA-2025:19156
• https://access.redhat.com/errata/RHSA-2025:19276
• https://lists.debian.org/debian-lts-announce/2025/09/msg00031.html
• http://www.openwall.com/lists/oss-security/2025/09/26/3
• https://access.redhat.com/errata/RHSA-2025:19906
• https://gitlab.com/libtiff/libtiff/-/issues/704
• https://gitlab.com/libtiff/libtiff/-/merge_requests/732
• https://libtiff.gitlab.io/libtiff/releases/v4.7.1.html
• https://access.redhat.com/errata/RHSA-2025:19947
• https://access.redhat.com/errata/RHSA-2025:20956
• https://access.redhat.com/errata/RHSA-2025:20998
• https://access.redhat.com/errata/RHSA-2025:21061
• https://access.redhat.com/errata/RHSA-2025:21062
• https://access.redhat.com/errata/RHSA-2025:21060
• https://access.redhat.com/errata/RHSA-2025:21407
• https://access.redhat.com/errata/RHSA-2025:21506
• https://access.redhat.com/errata/RHSA-2025:21507
• https://access.redhat.com/errata/RHSA-2025:21508
• https://access.redhat.com/errata/RHSA-2025:21994
• https://access.redhat.com/errata/RHSA-2025:23078
• https://access.redhat.com/errata/RHSA-2025:23079
• https://access.redhat.com/errata/RHSA-2025:23080
• https://access.redhat.com/errata/RHSA-2026:0001
• https://access.redhat.com/errata/RHSA-2026:0078
• https://access.redhat.com/errata/RHSA-2026:0076
• https://access.redhat.com/errata/RHSA-2026:0077
• https://access.redhat.com/errata/RHSA-2026:3461
• https://access.redhat.com/errata/RHSA-2026:3462
• https://access.redhat.com/errata/RHSA-2026:7504
• https://github.com/SexyShoelessGodofWar/LibTiff-4.7.0-Write-What-Where?tab=readme-ov-file

NVD Description

Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.

S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.

A template derived from untrusted input can read heap memory past the buffer and return it to the caller.

Remediation

There is no fixed version for Debian:11 perl.

References

• https://security-tracker.debian.org/tracker/CVE-2026-57432
• https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch
• https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch
• http://www.openwall.com/lists/oss-security/2026/07/13/6

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure.

This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior.

Remediation

Upgrade Debian:11 gnutls28 to version 3.7.1-5+deb11u8 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2025-32988
• https://access.redhat.com/security/cve/CVE-2025-32988
• https://bugzilla.redhat.com/show_bug.cgi?id=2359622
• https://access.redhat.com/errata/RHSA-2025:16115
• https://access.redhat.com/errata/RHSA-2025:16116
• https://access.redhat.com/errata/RHSA-2025:17348
• https://access.redhat.com/errata/RHSA-2025:17361
• https://access.redhat.com/errata/RHSA-2025:17415
• https://access.redhat.com/errata/RHSA-2025:19088
• https://lists.debian.org/debian-lts-announce/2025/08/msg00005.html
• http://www.openwall.com/lists/oss-security/2025/07/11/3
• https://access.redhat.com/errata/RHSA-2025:17181
• https://access.redhat.com/errata/RHSA-2025:22529
• https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html
• https://access.redhat.com/errata/RHSA-2026:7477
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system.

Remediation

Upgrade Debian:11 gnutls28 to version 3.7.1-5+deb11u8 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2025-32990
• https://access.redhat.com/security/cve/CVE-2025-32990
• https://bugzilla.redhat.com/show_bug.cgi?id=2359620
• https://access.redhat.com/errata/RHSA-2025:16115
• https://access.redhat.com/errata/RHSA-2025:16116
• https://access.redhat.com/errata/RHSA-2025:17348
• https://access.redhat.com/errata/RHSA-2025:17361
• https://access.redhat.com/errata/RHSA-2025:17415
• https://access.redhat.com/errata/RHSA-2025:19088
• https://lists.debian.org/debian-lts-announce/2025/08/msg00005.html
• http://www.openwall.com/lists/oss-security/2025/07/11/3
• https://access.redhat.com/errata/RHSA-2025:17181
• https://access.redhat.com/errata/RHSA-2025:22529
• https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html
• https://access.redhat.com/errata/RHSA-2026:7477

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.

Remediation

Upgrade Debian:11 gnutls28 to version 3.7.1-5+deb11u10 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-5260
• https://access.redhat.com/security/cve/CVE-2026-5260
• https://bugzilla.redhat.com/show_bug.cgi?id=2467450
• https://access.redhat.com/errata/RHSA-2026:20611
• https://access.redhat.com/errata/RHSA-2026:20613
• https://access.redhat.com/errata/RHSA-2026:20612
• https://access.redhat.com/errata/RHSA-2026:13274
• https://access.redhat.com/errata/RHSA-2026:26319
• https://access.redhat.com/errata/RHSA-2026:26409
• https://access.redhat.com/errata/RHSA-2026:29197
• https://access.redhat.com/errata/RHSA-2026:30004
• https://access.redhat.com/errata/RHSA-2026:30849
• https://access.redhat.com/errata/RHSA-2026:30850
• https://access.redhat.com/errata/RHSA-2026:32962
• https://access.redhat.com/errata/RHSA-2026:33125
• https://access.redhat.com/errata/RHSA-2026:40762
• https://access.redhat.com/errata/RHSA-2026:41921
• https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-10
• https://access.redhat.com/errata/RHSA-2026:58981
• https://access.redhat.com/errata/RHSA-2026:57483
• https://access.redhat.com/errata/RHSA-2026:56853
• https://access.redhat.com/errata/RHSA-2026:59831
• https://access.redhat.com/errata/RHSA-2026:60019
• https://access.redhat.com/errata/RHSA-2026:67837
• https://access.redhat.com/errata/RHSA-2026:72502
• https://access.redhat.com/errata/RHSA-2026:74674
• https://access.redhat.com/errata/RHSA-2026:82304
• https://access.redhat.com/errata/RHSA-2026:82322
• https://access.redhat.com/errata/RHSA-2026:82347
• https://access.redhat.com/errata/RHSA-2026:82354
• https://access.redhat.com/errata/RHSA-2026:82372
• https://access.redhat.com/errata/RHSA-2026:82857
• https://access.redhat.com/errata/RHSA-2026:82888
• https://access.redhat.com/errata/RHSA-2026:77320
• https://access.redhat.com/errata/RHSA-2026:82811

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.

Remediation

Upgrade Debian:11 gnutls28 to version 3.7.1-5+deb11u10 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-42013
• https://access.redhat.com/security/cve/CVE-2026-42013
• https://bugzilla.redhat.com/show_bug.cgi?id=2467448
• https://access.redhat.com/errata/RHSA-2026:20611
• https://access.redhat.com/errata/RHSA-2026:20613
• https://access.redhat.com/errata/RHSA-2026:20612
• https://access.redhat.com/errata/RHSA-2026:13274
• https://access.redhat.com/errata/RHSA-2026:26319
• https://access.redhat.com/errata/RHSA-2026:26409
• https://access.redhat.com/errata/RHSA-2026:29197
• https://access.redhat.com/errata/RHSA-2026:30004
• https://access.redhat.com/errata/RHSA-2026:30849
• https://access.redhat.com/errata/RHSA-2026:30850
• https://access.redhat.com/errata/RHSA-2026:32962
• https://access.redhat.com/errata/RHSA-2026:33125
• https://access.redhat.com/errata/RHSA-2026:40762
• https://access.redhat.com/errata/RHSA-2026:41921
• https://access.redhat.com/errata/RHSA-2026:43575
• https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-8
• https://access.redhat.com/errata/RHSA-2026:58981
• https://access.redhat.com/errata/RHSA-2026:57483
• https://access.redhat.com/errata/RHSA-2026:56853
• https://access.redhat.com/errata/RHSA-2026:59831
• https://access.redhat.com/errata/RHSA-2026:60019
• https://access.redhat.com/errata/RHSA-2026:72502
• https://access.redhat.com/errata/RHSA-2026:74674
• https://access.redhat.com/errata/RHSA-2026:82304
• https://access.redhat.com/errata/RHSA-2026:82322
• https://access.redhat.com/errata/RHSA-2026:82347
• https://access.redhat.com/errata/RHSA-2026:82354
• https://access.redhat.com/errata/RHSA-2026:82372
• https://access.redhat.com/errata/RHSA-2026:82857
• https://access.redhat.com/errata/RHSA-2026:82888

NVD Description

Note: Versions mentioned in the description apply only to the upstream nginx package and not the nginx package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart.

Impact: This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Remediation

There is no fixed version for Debian:11 nginx.

References

• https://security-tracker.debian.org/tracker/CVE-2026-60005
• https://my.f5.com/manage/s/article/K000162100

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).

Remediation

Upgrade Debian:11 curl to version 7.74.0-1.3+deb11u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-22576
• https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
• https://security.gentoo.org/glsa/202212-01
• https://security.netapp.com/advisory/ntap-20220609-0008/
• https://www.debian.org/security/2022/dsa-5197
• https://cert-portal.siemens.com/productcert/html/ssa-146325.html
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html
• https://hackerone.com/reports/1526328

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

Remediation

Upgrade Debian:11 expat to version 2.2.10-2+deb11u4 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-40674
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSVZN3IJ6OCPSJL7AEX3ZHSHAHFOGESK/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J2IGJNHFV53PYST7VQV3T4NHVYAMXA36/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LQB6FJAM5YQ35SF5B2MN25Y2FX56EOEZ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2ZKEPGFCZ7R6DRVH3K6RBJPT42ZBEG/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XCGBVQQ47URGJAZWHCISHDWF6QBTV2LE/
• https://github.com/libexpat/libexpat/pull/629
• https://github.com/libexpat/libexpat/pull/640
• https://lists.debian.org/debian-lts-announce/2022/09/msg00029.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSVZN3IJ6OCPSJL7AEX3ZHSHAHFOGESK/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J2IGJNHFV53PYST7VQV3T4NHVYAMXA36/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LQB6FJAM5YQ35SF5B2MN25Y2FX56EOEZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2ZKEPGFCZ7R6DRVH3K6RBJPT42ZBEG/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCGBVQQ47URGJAZWHCISHDWF6QBTV2LE/
• https://security.gentoo.org/glsa/202209-24
• https://security.gentoo.org/glsa/202211-06
• https://security.netapp.com/advisory/ntap-20221028-0008/
• https://www.debian.org/security/2022/dsa-5236
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html
• https://cert-portal.siemens.com/productcert/html/ssa-558014.html
• https://cert-portal.siemens.com/productcert/html/ssa-892048.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream freetype package and not the freetype package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.

Remediation

Upgrade Debian:11 freetype to version 2.10.4+dfsg-1+deb11u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2025-27363
• https://www.facebook.com/security/advisories/cve-2025-27363
• http://www.openwall.com/lists/oss-security/2025/03/13/1
• http://www.openwall.com/lists/oss-security/2025/03/13/11
• http://www.openwall.com/lists/oss-security/2025/03/13/12
• http://www.openwall.com/lists/oss-security/2025/03/13/2
• http://www.openwall.com/lists/oss-security/2025/03/13/3
• http://www.openwall.com/lists/oss-security/2025/03/13/8
• http://www.openwall.com/lists/oss-security/2025/03/14/1
• http://www.openwall.com/lists/oss-security/2025/03/14/2
• http://www.openwall.com/lists/oss-security/2025/03/14/3
• http://www.openwall.com/lists/oss-security/2025/03/14/4
• http://www.openwall.com/lists/oss-security/2025/05/06/3
• https://lists.debian.org/debian-lts-announce/2025/03/msg00030.html
• https://source.android.com/docs/security/bulletin/2025-05-01
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27363
• http://www.openwall.com/lists/oss-security/2026/04/16/5
• http://www.openwall.com/lists/oss-security/2026/04/19/3
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://github.com/tin-z/CVE-2025-27363

NVD Description

Note: Versions mentioned in the description apply only to the upstream libpng1.6 package and not the libpng1.6 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55.

Remediation

Upgrade Debian:11 libpng1.6 to version 1.6.37-3+deb11u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-25646
• https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88
• http://www.openwall.com/lists/oss-security/2026/02/09/7
• https://access.redhat.com/errata/RHSA-2026:10097
• https://access.redhat.com/errata/RHSA-2026:12274
• https://access.redhat.com/errata/RHSA-2026:14773
• https://access.redhat.com/errata/RHSA-2026:15087
• https://access.redhat.com/errata/RHSA-2026:16174
• https://access.redhat.com/errata/RHSA-2026:17596
• https://access.redhat.com/errata/RHSA-2026:3031
• https://access.redhat.com/errata/RHSA-2026:3405
• https://access.redhat.com/errata/RHSA-2026:3551
• https://access.redhat.com/errata/RHSA-2026:3573
• https://access.redhat.com/errata/RHSA-2026:3574
• https://access.redhat.com/errata/RHSA-2026:3575
• https://access.redhat.com/errata/RHSA-2026:3576
• https://access.redhat.com/errata/RHSA-2026:3577
• https://access.redhat.com/errata/RHSA-2026:3968
• https://access.redhat.com/errata/RHSA-2026:3969
• https://access.redhat.com/errata/RHSA-2026:4221
• https://access.redhat.com/errata/RHSA-2026:4222
• https://access.redhat.com/errata/RHSA-2026:4306
• https://access.redhat.com/errata/RHSA-2026:4501
• https://access.redhat.com/errata/RHSA-2026:4728
• https://access.redhat.com/errata/RHSA-2026:4729
• https://access.redhat.com/errata/RHSA-2026:4730
• https://access.redhat.com/errata/RHSA-2026:4731
• https://access.redhat.com/errata/RHSA-2026:4732
• https://access.redhat.com/errata/RHSA-2026:4756
• https://access.redhat.com/errata/RHSA-2026:5606
• https://access.redhat.com/errata/RHSA-2026:6439
• https://access.redhat.com/errata/RHSA-2026:6445
• https://access.redhat.com/errata/RHSA-2026:6466
• https://access.redhat.com/errata/RHSA-2026:6467
• https://access.redhat.com/errata/RHSA-2026:6468
• https://access.redhat.com/errata/RHSA-2026:6469
• https://access.redhat.com/errata/RHSA-2026:6553
• https://access.redhat.com/errata/RHSA-2026:6732
• https://access.redhat.com/errata/RHSA-2026:7032
• https://access.redhat.com/errata/RHSA-2026:7033
• https://access.redhat.com/errata/RHSA-2026:7034
• https://access.redhat.com/errata/RHSA-2026:7035
• https://access.redhat.com/errata/RHSA-2026:7036
• https://access.redhat.com/errata/RHSA-2026:7239
• https://access.redhat.com/errata/RHSA-2026:7243
• https://access.redhat.com/errata/RHSA-2026:8746
• https://access.redhat.com/errata/RHSA-2026:8747
• https://access.redhat.com/errata/RHSA-2026:8748
• https://access.redhat.com/errata/RHSA-2026:9254
• https://access.redhat.com/errata/RHSA-2026:9255
• https://access.redhat.com/errata/RHSA-2026:9683
• https://access.redhat.com/errata/RHSA-2026:9686
• https://access.redhat.com/errata/RHSA-2026:9687
• https://access.redhat.com/errata/RHSA-2026:9689
• https://access.redhat.com/security/cve/CVE-2026-25646
• https://bugzilla.redhat.com/show_bug.cgi?id=2438542
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25646.json
• https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3

NVD Description

Note: Versions mentioned in the description apply only to the upstream nginx package and not the nginx package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Remediation

There is no fixed version for Debian:11 nginx.

References

• https://security-tracker.debian.org/tracker/CVE-2026-42533
• https://my.f5.com/manage/s/article/K000162097
• https://github.com/imbas007/CVE-2026-42533

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side.

Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code.

However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate usage.

By far the most common deployment of DANE is in SMTP MTAs for which RFC7672 recommends that clients treat as 'unusable' any TLSA records that have the PKIX certificate usages. These SMTP (or other similar) clients are not vulnerable to this issue. Conversely, any clients that support only the PKIX usages, and ignore the DANE-TA(2) usage are also not vulnerable.

The client would also need to be communicating with a server that publishes a TLSA RRset with both types of TLSA records.

No FIPS modules are affected by this issue, the problem code is outside the FIPS module boundary.

Remediation

Upgrade Debian:11 openssl to version 1.1.1w-0+deb11u7 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-28387
• https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b
• https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe
• https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3
• https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7
• https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177
• https://openssl-library.org/news/secadv/20260407.txt
• https://cert-portal.siemens.com/productcert/html/ssa-032379.html
• https://cert-portal.siemens.com/productcert/html/ssa-265688.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.

Remediation

Upgrade Debian:11 perl to version 5.32.1-4+deb11u4 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-31484
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BM6UW55CNFUTNGD5ZRKGUKKKFDJGMFHL/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LEGCEOKFJVBJ2QQ6S2H4NAEWTUERC7SB/
• http://www.openwall.com/lists/oss-security/2023/04/29/1
• http://www.openwall.com/lists/oss-security/2023/05/03/3
• http://www.openwall.com/lists/oss-security/2023/05/03/5
• http://www.openwall.com/lists/oss-security/2023/05/07/2
• https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/
• https://github.com/andk/cpanpm/pull/175
• https://lists.debian.org/debian-lts-announce/2024/10/msg00017.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BM6UW55CNFUTNGD5ZRKGUKKKFDJGMFHL/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LEGCEOKFJVBJ2QQ6S2H4NAEWTUERC7SB/
• https://metacpan.org/dist/CPAN/changes
• https://security.netapp.com/advisory/ntap-20240621-0007/
• https://www.openwall.com/lists/oss-security/2023/04/18/14

NVD Description

Note: Versions mentioned in the description apply only to the upstream e2fsprogs package and not the e2fsprogs package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.

Remediation

Upgrade Debian:11 e2fsprogs to version 1.46.2-2+deb11u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-1304
• https://access.redhat.com/errata/RHSA-2022:7720
• https://access.redhat.com/errata/RHSA-2022:8361
• https://access.redhat.com/security/cve/CVE-2022-1304
• https://lists.debian.org/debian-lts-announce/2024/10/msg00001.html
• https://security.netapp.com/advisory/ntap-20241122-0010/
• https://bugzilla.redhat.com/show_bug.cgi?id=2069726
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html
• https://cert-portal.siemens.com/productcert/html/ssa-419740.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.

Remediation

There is no fixed version for Debian:11 expat.

References

• https://security-tracker.debian.org/tracker/CVE-2026-76957
• https://github.com/libexpat/libexpat/pull/1322
• https://github.com/libexpat/libexpat/pull/1329

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.

Remediation

Upgrade Debian:11 glibc to version 2.31-13+deb11u4 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-3999
• https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=23e0e8f5f1fb5ed150253d986ecccdc90c2dcd5e
• https://access.redhat.com/errata/RHSA-2022:0896
• https://access.redhat.com/security/cve/CVE-2021-3999
• https://bugzilla.redhat.com/show_bug.cgi?id=2024637
• https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
• https://security.netapp.com/advisory/ntap-20221104-0001/
• https://sourceware.org/bugzilla/show_bug.cgi?id=28769
• https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=23e0e8f5f1fb5ed150253d986ecccdc90c2dcd5e
• https://www.openwall.com/lists/oss-security/2022/01/24/4
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html
• https://cert-portal.siemens.com/productcert/html/ssa-831302.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

Remediation

Upgrade Debian:11 glibc to version 2.31-13+deb11u7 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-4911
• http://packetstormsecurity.com/files/174986/glibc-ld.so-Local-Privilege-Escalation.html
• http://packetstormsecurity.com/files/176288/Glibc-Tunables-Privilege-Escalation.html
• http://seclists.org/fulldisclosure/2023/Oct/11
• http://www.openwall.com/lists/oss-security/2023/10/03/2
• http://www.openwall.com/lists/oss-security/2023/10/03/3
• http://www.openwall.com/lists/oss-security/2023/10/05/1
• http://www.openwall.com/lists/oss-security/2023/10/13/11
• http://www.openwall.com/lists/oss-security/2023/10/14/3
• http://www.openwall.com/lists/oss-security/2023/10/14/5
• http://www.openwall.com/lists/oss-security/2023/10/14/6
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4DBUQRRPB47TC3NJOUIBVWUGFHBJAFDL/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFG4P76UHHZEWQ26FWBXG76N2QLKKPZA/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAQWHTSVOCOZ5K6KPIWKRT3JX4RTZUR/
• https://security.gentoo.org/glsa/202310-03
• https://security.netapp.com/advisory/ntap-20231013-0006/
• https://www.debian.org/security/2023/dsa-5514
• https://access.redhat.com/errata/RHBA-2024:2413
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4911
• https://www.exploit-db.com/exploits/52479
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html
• https://cert-portal.siemens.com/productcert/html/ssa-794697.html
• https://cert-portal.siemens.com/productcert/html/ssa-831302.html
• https://access.redhat.com/errata/RHSA-2023:5453
• https://access.redhat.com/errata/RHSA-2023:5454
• https://access.redhat.com/errata/RHSA-2023:5455
• https://access.redhat.com/errata/RHSA-2023:5476
• https://access.redhat.com/errata/RHSA-2024:0033
• https://access.redhat.com/security/cve/CVE-2023-4911
• https://bugzilla.redhat.com/show_bug.cgi?id=2238352
• https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt
• https://www.qualys.com/cve-2023-4911/
• https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2023/CVE-2023-4911.yaml
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://github.com/KernelKrise/CVE-2023-4911

NVD Description

Note: Versions mentioned in the description apply only to the upstream libpng1.6 package and not the libpng1.6 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings on 16-bit systems. This vulnerability is fixed in 1.6.54.

Remediation

Upgrade Debian:11 libpng1.6 to version 1.6.37-3+deb11u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-22801
• https://github.com/pnggroup/libpng/security/advisories/GHSA-vgjq-8cw5-ggw8

NVD Description

Note: Versions mentioned in the description apply only to the upstream libx11 package and not the libx11 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This flaw allows a local user to trigger an integer overflow and execute arbitrary code with elevated privileges.

Remediation

Upgrade Debian:11 libx11 to version 2:1.7.2-1+deb11u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-43787
• http://www.openwall.com/lists/oss-security/2024/01/24/9
• https://jfrog.com/blog/xorg-libx11-vulns-cve-2023-43786-cve-2023-43787-part-two/
• https://security.netapp.com/advisory/ntap-20231103-0006/
• https://access.redhat.com/errata/RHSA-2024:2145
• https://access.redhat.com/errata/RHSA-2024:2973
• https://access.redhat.com/security/cve/CVE-2023-43787
• https://bugzilla.redhat.com/show_bug.cgi?id=2242254
• https://lists.debian.org/debian-lts-announce/2023/10/msg00005.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.

Remediation

Upgrade Debian:11 libxml2 to version 2.9.10+dfsg-6.7+deb11u6 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-49043
• https://github.com/php/php-src/issues/17467
• https://gitlab.gnome.org/GNOME/libxml2/-/commit/5a19e21605398cef6a8b1452477a8705cb41562b
• https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.

Remediation

Upgrade Debian:11 libxml2 to version 2.9.10+dfsg-6.7+deb11u3 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-40304
• http://seclists.org/fulldisclosure/2022/Dec/21
• http://seclists.org/fulldisclosure/2022/Dec/24
• http://seclists.org/fulldisclosure/2022/Dec/25
• http://seclists.org/fulldisclosure/2022/Dec/26
• http://seclists.org/fulldisclosure/2022/Dec/27
• https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b
• https://gitlab.gnome.org/GNOME/libxml2/-/tags
• https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3
• https://security.netapp.com/advisory/ntap-20221209-0003/
• https://support.apple.com/kb/HT213531
• https://support.apple.com/kb/HT213533
• https://support.apple.com/kb/HT213534
• https://support.apple.com/kb/HT213535
• https://support.apple.com/kb/HT213536
• https://cert-portal.siemens.com/productcert/html/ssa-337522.html
• https://cert-portal.siemens.com/productcert/html/ssa-341067.html
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html
• https://cert-portal.siemens.com/productcert/html/ssa-556635.html
• https://cert-portal.siemens.com/productcert/html/ssa-625862.html
• https://cert-portal.siemens.com/productcert/html/ssa-769027.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxslt package and not the libxslt package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes.

Remediation

Upgrade Debian:11 libxslt to version 1.1.34-4+deb11u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2024-55549
• https://gitlab.gnome.org/GNOME/libxslt/-/issues/127
• https://lists.debian.org/debian-lts-announce/2025/03/msg00015.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxslt package and not the libxslt package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.

Remediation

Upgrade Debian:11 libxslt to version 1.1.34-4+deb11u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2025-24855
• https://gitlab.gnome.org/GNOME/libxslt/-/issues/128
• https://lists.debian.org/debian-lts-announce/2025/03/msg00015.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.

Remediation

Upgrade Debian:11 ncurses to version 6.2+20201114-2+deb11u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-29491
• http://ncurses.scripts.mit.edu/?p=ncurses.git;a=commit;h=eb51b1ea1f75a0ec17c9c5937cb28df1e8eeec56
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/
• http://ncurses.scripts.mit.edu/?p=ncurses.git%3Ba=commit%3Bh=eb51b1ea1f75a0ec17c9c5937cb28df1e8eeec56
• http://www.openwall.com/lists/oss-security/2023/04/19/10
• http://www.openwall.com/lists/oss-security/2023/04/19/11
• https://lists.debian.org/debian-lts-announce/2023/12/msg00004.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/
• https://security.netapp.com/advisory/ntap-20230517-0009/
• https://support.apple.com/kb/HT213843
• https://support.apple.com/kb/HT213844
• https://support.apple.com/kb/HT213845
• https://www.openwall.com/lists/oss-security/2023/04/12/5
• https://www.openwall.com/lists/oss-security/2023/04/13/4
• https://cert-portal.siemens.com/productcert/html/ssa-202008.html
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream pam package and not the pam package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.

Remediation

Upgrade Debian:11 pam to version 1.4.0-9+deb11u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2025-6020
• https://access.redhat.com/security/cve/CVE-2025-6020
• https://bugzilla.redhat.com/show_bug.cgi?id=2372512
• http://www.openwall.com/lists/oss-security/2025/06/17/1
• https://access.redhat.com/errata/RHSA-2025:9526
• https://access.redhat.com/errata/RHSA-2025:10024
• https://access.redhat.com/errata/RHSA-2025:10027
• https://access.redhat.com/errata/RHSA-2025:10180
• https://access.redhat.com/errata/RHSA-2025:10354
• https://access.redhat.com/errata/RHSA-2025:10357
• https://access.redhat.com/errata/RHSA-2025:10358
• https://access.redhat.com/errata/RHSA-2025:10359
• https://access.redhat.com/errata/RHSA-2025:10361
• https://access.redhat.com/errata/RHSA-2025:10362
• https://access.redhat.com/errata/RHSA-2025:10735
• https://access.redhat.com/errata/RHSA-2025:10823
• https://access.redhat.com/errata/RHSA-2025:11386
• https://access.redhat.com/errata/RHSA-2025:11487
• https://access.redhat.com/errata/RHSA-2025:14557
• https://access.redhat.com/errata/RHSA-2025:15099
• https://access.redhat.com/errata/RHSA-2025:15709
• https://access.redhat.com/errata/RHSA-2025:15828
• https://access.redhat.com/errata/RHSA-2025:15827
• https://access.redhat.com/errata/RHSA-2025:16524
• https://access.redhat.com/errata/RHSA-2025:18219
• https://lists.debian.org/debian-lts-announce/2025/09/msg00021.html
• https://access.redhat.com/errata/RHSA-2025:17181
• https://access.redhat.com/errata/RHSA-2025:20181
• https://access.redhat.com/errata/RHSA-2025:21885
• https://access.redhat.com/errata/RHSA-2025:22019
• https://access.redhat.com/errata/RHSA-2026:0934
• https://github.com/linux-pam/linux-pam/security/advisories/GHSA-f9p8-gjr4-j9gx
• https://cert-portal.siemens.com/productcert/html/ssa-577017.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

CPAN 2.28 allows Signature Verification Bypass.

Remediation

Upgrade Debian:11 perl to version 5.32.1-4+deb11u4 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-16156
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SD6RYOJII7HRJ6WVORFNVTYNOFY5JDXN/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SZ32AJIV4RHJMLWLU5QULGKMMIHYOMDC/
• https://lists.debian.org/debian-lts-announce/2024/10/msg00017.html
• http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
• https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SD6RYOJII7HRJ6WVORFNVTYNOFY5JDXN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZ32AJIV4RHJMLWLU5QULGKMMIHYOMDC/
• https://metacpan.org/pod/distribution/CPAN/scripts/cpan

NVD Description

Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.

Remediation

Upgrade Debian:11 perl to version 5.32.1-4+deb11u3 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-47038
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GNEEWAACXQCEEAKSG7XX2D5YDRWLCIZJ/
• https://perldoc.perl.org/perl5382delta#CVE-2023-47038-Write-past-buffer-end-via-illegal-user-defined-Unicode-property
• https://github.com/Perl/perl5/commit/12c313ce49b36160a7ca2e9b07ad5bd92ee4a010
• https://github.com/Perl/perl5/commit/7047915eef37fccd93e7cd985c29fe6be54650b6
• https://github.com/Perl/perl5/commit/ff1f9f59360afeebd6f75ca1502f5c3ebf077da3
• https://github.com/aquasecurity/trivy/discussions/8400
• https://ubuntu.com/security/CVE-2023-47100
• https://www.suse.com/security/cve/CVE-2023-47100.html
• https://access.redhat.com/errata/RHSA-2024:2228
• https://access.redhat.com/errata/RHSA-2024:3128
• https://access.redhat.com/security/cve/CVE-2023-47038
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1056746
• https://bugzilla.redhat.com/show_bug.cgi?id=2249523
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UMDZZ4SCEW6FRWZDMXGAKZ35THTAWFG6/

NVD Description

Note: Versions mentioned in the description apply only to the upstream tiff package and not the tiff package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.

Remediation

Upgrade Debian:11 tiff to version 4.2.0-1+deb11u8 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-4775
• https://lists.debian.org/debian-lts-announce/2026/04/msg00016.html
• https://access.redhat.com/errata/RHSA-2026:33388
• https://access.redhat.com/errata/RHSA-2026:74674
• https://access.redhat.com/errata/RHSA-2026:12265
• https://access.redhat.com/errata/RHSA-2026:12271
• https://access.redhat.com/errata/RHSA-2026:14929
• https://access.redhat.com/errata/RHSA-2026:16055
• https://access.redhat.com/errata/RHSA-2026:19150
• https://access.redhat.com/errata/RHSA-2026:19363
• https://access.redhat.com/errata/RHSA-2026:19585
• https://access.redhat.com/errata/RHSA-2026:19586
• https://access.redhat.com/errata/RHSA-2026:19604
• https://access.redhat.com/errata/RHSA-2026:19608
• https://access.redhat.com/errata/RHSA-2026:19609
• https://access.redhat.com/errata/RHSA-2026:19657
• https://access.redhat.com/errata/RHSA-2026:19659
• https://access.redhat.com/errata/RHSA-2026:19702
• https://access.redhat.com/errata/RHSA-2026:20583
• https://access.redhat.com/errata/RHSA-2026:20585
• https://access.redhat.com/errata/RHSA-2026:20591
• https://access.redhat.com/errata/RHSA-2026:20592
• https://access.redhat.com/errata/RHSA-2026:24992
• https://access.redhat.com/errata/RHSA-2026:25096
• https://access.redhat.com/errata/RHSA-2026:25910
• https://access.redhat.com/errata/RHSA-2026:30078
• https://access.redhat.com/errata/RHSA-2026:30087
• https://access.redhat.com/errata/RHSA-2026:30088
• https://access.redhat.com/errata/RHSA-2026:30089
• https://access.redhat.com/errata/RHSA-2026:30349
• https://access.redhat.com/security/cve/CVE-2026-4775
• https://bugzilla.redhat.com/show_bug.cgi?id=2450768
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4775.json

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.

Remediation

Upgrade Debian:11 libxml2 to version 2.9.10+dfsg-6.7+deb11u6 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2025-24928
• https://gitlab.gnome.org/GNOME/libxml2/-/issues/847
• https://issues.oss-fuzz.com/issues/392687022
• https://security.netapp.com/advisory/ntap-20250321-0006/
• https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (--ssl-reqd on the command line orCURLOPT_USE_SSL set to CURLUSESSL_CONTROL or CURLUSESSL_ALL withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations withoutTLS contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

Remediation

Upgrade Debian:11 curl to version 7.74.0-1.3+deb11u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-22946
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/
• https://hackerone.com/reports/1334111
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://lists.debian.org/debian-lts-announce/2021/09/msg00022.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/
• http://seclists.org/fulldisclosure/2022/Mar/29
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/
• https://security.gentoo.org/glsa/202212-01
• https://security.netapp.com/advisory/ntap-20211029-0003/
• https://security.netapp.com/advisory/ntap-20220121-0008/
• https://support.apple.com/kb/HT213183
• https://www.debian.org/security/2022/dsa-5197
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://cert-portal.siemens.com/productcert/html/ssa-146325.html
• https://cert-portal.siemens.com/productcert/html/ssa-389290.html
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replaced with ASCII counterparts as part of the IDN conversion, e.g., using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop of U+002E (.). The earliest affected version is 7.77.0 2021-05-26.

Remediation

There is no fixed version for Debian:11 curl.

References

• https://security-tracker.debian.org/tracker/CVE-2022-42916
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/
• http://seclists.org/fulldisclosure/2023/Jan/19
• http://seclists.org/fulldisclosure/2023/Jan/20
• http://www.openwall.com/lists/oss-security/2022/12/21/1
• https://curl.se/docs/CVE-2022-42916.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/
• https://security.gentoo.org/glsa/202212-01
• https://security.netapp.com/advisory/ntap-20221209-0010/
• https://support.apple.com/kb/HT213604
• https://support.apple.com/kb/HT213605
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html
• https://cert-portal.siemens.com/productcert/html/ssa-892048.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) .. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

Remediation

There is no fixed version for Debian:11 curl.

References

• https://security-tracker.debian.org/tracker/CVE-2022-43551
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TVWZW5CNSJ7UYAF2BGSYAWAEXDJYUBHA/
• https://hackerone.com/reports/1755083
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TVWZW5CNSJ7UYAF2BGSYAWAEXDJYUBHA/
• https://security.gentoo.org/glsa/202310-12
• https://security.netapp.com/advisory/ntap-20230427-0007/
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html
• https://cert-portal.siemens.com/productcert/html/ssa-892048.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.

Remediation

Upgrade Debian:11 curl to version 7.74.0-1.3+deb11u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-27775
• https://security.gentoo.org/glsa/202212-01
• https://security.netapp.com/advisory/ntap-20220609-0008/
• https://www.debian.org/security/2022/dsa-5197
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html
• https://hackerone.com/reports/1546268

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.

Remediation

Upgrade Debian:11 curl to version 7.74.0-1.3+deb11u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-27782
• http://www.openwall.com/lists/oss-security/2023/03/20/6
• https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
• https://security.gentoo.org/glsa/202212-01
• https://security.netapp.com/advisory/ntap-20220609-0009/
• https://www.debian.org/security/2022/dsa-5197
• https://cert-portal.siemens.com/productcert/html/ssa-146325.html
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html
• https://hackerone.com/reports/1555796

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

libcurl provides the CURLOPT_CERTINFO option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.

Remediation

Upgrade Debian:11 curl to version 7.74.0-1.3+deb11u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-27781
• https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
• https://security.gentoo.org/glsa/202212-01
• https://security.netapp.com/advisory/ntap-20220609-0009/
• https://www.debian.org/security/2022/dsa-5197
• https://cert-portal.siemens.com/productcert/html/ssa-146325.html
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html
• https://hackerone.com/reports/1555441

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Remediation

There is no fixed version for Debian:11 expat.

References

• https://security-tracker.debian.org/tracker/CVE-2026-45186
• https://github.com/libexpat/libexpat/pull/1216
• http://www.openwall.com/lists/oss-security/2026/05/11/16
• https://access.redhat.com/errata/RHSA-2026:22715
• https://access.redhat.com/errata/RHSA-2026:22721
• https://access.redhat.com/errata/RHSA-2026:23230
• https://access.redhat.com/errata/RHSA-2026:26319
• https://access.redhat.com/errata/RHSA-2026:27201
• https://access.redhat.com/errata/RHSA-2026:29197
• https://access.redhat.com/security/cve/CVE-2026-45186
• https://bugzilla.redhat.com/show_bug.cgi?id=2468575
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45186.json
• https://access.redhat.com/errata/RHSA-2026:58981

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.

Remediation

There is no fixed version for Debian:11 expat.

References

• https://security-tracker.debian.org/tracker/CVE-2026-66046
• https://github.com/libexpat/libexpat/pull/1321
• https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

Remediation

Upgrade Debian:11 expat to version 2.2.10-2+deb11u6 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-52425
• https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/
• http://www.openwall.com/lists/oss-security/2024/03/20/5
• https://github.com/libexpat/libexpat/pull/789
• https://lists.debian.org/debian-lts-announce/2024/04/msg00006.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV/
• https://security.netapp.com/advisory/ntap-20240614-0003/
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html
• https://cert-portal.siemens.com/productcert/html/ssa-784301.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.

Remediation

Upgrade Debian:11 expat to version 2.2.10-2+deb11u5 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-43680
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AJ5VY2VYXE4WTRGQ6LMGLF6FV3SY37YE/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BY4OPSIB33ETNUXZY2UPZ4NGQ3OKDY4D/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DPQVIF6TOJNY2T3ZZETFKR4G34FFREBQ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FFCOMBSOJKLIKCGCJWHLJXO4EVYBG7AR/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IUJ2BULJTZ2BMSKQHB6US674P55UCWWS/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XG5XOOB7CD55CEE6OJYKSACSIMQ4RWQ6/
• http://www.openwall.com/lists/oss-security/2023/12/28/5
• http://www.openwall.com/lists/oss-security/2024/01/03/5
• https://github.com/libexpat/libexpat/issues/649
• https://github.com/libexpat/libexpat/pull/616
• https://github.com/libexpat/libexpat/pull/650
• https://lists.debian.org/debian-lts-announce/2022/10/msg00033.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AJ5VY2VYXE4WTRGQ6LMGLF6FV3SY37YE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BY4OPSIB33ETNUXZY2UPZ4NGQ3OKDY4D/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPQVIF6TOJNY2T3ZZETFKR4G34FFREBQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFCOMBSOJKLIKCGCJWHLJXO4EVYBG7AR/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUJ2BULJTZ2BMSKQHB6US674P55UCWWS/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XG5XOOB7CD55CEE6OJYKSACSIMQ4RWQ6/
• https://security.gentoo.org/glsa/202210-38
• https://security.netapp.com/advisory/ntap-20221118-0007/
• https://www.debian.org/security/2022/dsa-5266
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html
• https://cert-portal.siemens.com/productcert/html/ssa-892048.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

Remediation

Upgrade Debian:11 expat to version 2.2.10-2+deb11u6 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2024-45490
• https://github.com/libexpat/libexpat/issues/887
• https://github.com/libexpat/libexpat/pull/890
• https://security.netapp.com/advisory/ntap-20241018-0004/
• http://seclists.org/fulldisclosure/2024/Dec/10
• http://seclists.org/fulldisclosure/2024/Dec/12
• http://seclists.org/fulldisclosure/2024/Dec/6
• http://seclists.org/fulldisclosure/2024/Dec/7
• http://seclists.org/fulldisclosure/2024/Dec/8
• https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html
• https://cert-portal.siemens.com/productcert/html/ssa-613116.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream freetype package and not the freetype package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size.

Remediation

Upgrade Debian:11 freetype to version 2.10.4+dfsg-1+deb11u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-27406
• http://freetype.com
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EFPNRKDLCXHZVYYQLQMP44UHLU32GA6Z/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FDU2FOEMCEF6WVR6ZBIH5MT5O7FAK6UP/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IWQ7IB2A75MEHM63WEUXBYEC7OR5SGDY/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYVC2NPKKXKP3TWJWG4ONYWNO6ZPHLA5/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCEMWCM46PKM4U5ENRASPKQD6JDOLKRU/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EFPNRKDLCXHZVYYQLQMP44UHLU32GA6Z/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FDU2FOEMCEF6WVR6ZBIH5MT5O7FAK6UP/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IWQ7IB2A75MEHM63WEUXBYEC7OR5SGDY/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYVC2NPKKXKP3TWJWG4ONYWNO6ZPHLA5/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TCEMWCM46PKM4U5ENRASPKQD6JDOLKRU/
• https://gitlab.freedesktop.org/freetype/freetype/-/issues/1140
• https://security.gentoo.org/glsa/202402-06

NVD Description

Note: Versions mentioned in the description apply only to the upstream freetype package and not the freetype package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request.

Remediation

Upgrade Debian:11 freetype to version 2.10.4+dfsg-1+deb11u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-27405
• http://freetype.com
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EFPNRKDLCXHZVYYQLQMP44UHLU32GA6Z/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FDU2FOEMCEF6WVR6ZBIH5MT5O7FAK6UP/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IWQ7IB2A75MEHM63WEUXBYEC7OR5SGDY/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYVC2NPKKXKP3TWJWG4ONYWNO6ZPHLA5/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCEMWCM46PKM4U5ENRASPKQD6JDOLKRU/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EFPNRKDLCXHZVYYQLQMP44UHLU32GA6Z/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FDU2FOEMCEF6WVR6ZBIH5MT5O7FAK6UP/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IWQ7IB2A75MEHM63WEUXBYEC7OR5SGDY/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYVC2NPKKXKP3TWJWG4ONYWNO6ZPHLA5/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TCEMWCM46PKM4U5ENRASPKQD6JDOLKRU/
• https://gitlab.freedesktop.org/freetype/freetype/-/issues/1139
• https://security.gentoo.org/glsa/202402-06

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verify function.

Remediation

Upgrade Debian:11 gnutls28 to version 3.7.1-5+deb11u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-2509
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6FL27JS3VM74YEQU7PGB62USO3KSBYZX/
• https://access.redhat.com/security/cve/CVE-2022-2509
• https://lists.debian.org/debian-lts-announce/2022/08/msg00002.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FL27JS3VM74YEQU7PGB62USO3KSBYZX/
• https://lists.gnupg.org/pipermail/gnutls-help/2022-July/004746.html
• https://www.debian.org/security/2022/dsa-5203
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.

Remediation

Upgrade Debian:11 gnutls28 to version 3.7.1-5+deb11u10 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-33846
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33846.json
• https://access.redhat.com/errata/RHSA-2026:72502
• https://access.redhat.com/errata/RHSA-2026:74674
• https://access.redhat.com/errata/RHSA-2026:82304
• https://access.redhat.com/errata/RHSA-2026:82322
• https://access.redhat.com/errata/RHSA-2026:82347
• https://access.redhat.com/errata/RHSA-2026:82354
• https://access.redhat.com/errata/RHSA-2026:82372
• https://access.redhat.com/errata/RHSA-2026:82857
• https://access.redhat.com/errata/RHSA-2026:82888
• https://access.redhat.com/errata/RHSA-2026:13274
• https://access.redhat.com/errata/RHSA-2026:20611
• https://access.redhat.com/errata/RHSA-2026:20612
• https://access.redhat.com/errata/RHSA-2026:20613
• https://access.redhat.com/errata/RHSA-2026:26319
• https://access.redhat.com/errata/RHSA-2026:26409
• https://access.redhat.com/errata/RHSA-2026:29197
• https://access.redhat.com/errata/RHSA-2026:30004
• https://access.redhat.com/errata/RHSA-2026:30849
• https://access.redhat.com/errata/RHSA-2026:30850
• https://access.redhat.com/errata/RHSA-2026:32962
• https://access.redhat.com/errata/RHSA-2026:33125
• https://access.redhat.com/errata/RHSA-2026:34372
• https://access.redhat.com/errata/RHSA-2026:36004
• https://access.redhat.com/errata/RHSA-2026:36005
• https://access.redhat.com/errata/RHSA-2026:36006
• https://access.redhat.com/errata/RHSA-2026:41921
• https://access.redhat.com/errata/RHSA-2026:56786
• https://access.redhat.com/errata/RHSA-2026:56853
• https://access.redhat.com/errata/RHSA-2026:56911
• https://access.redhat.com/errata/RHSA-2026:57402
• https://access.redhat.com/errata/RHSA-2026:57483
• https://access.redhat.com/errata/RHSA-2026:58981
• https://access.redhat.com/errata/RHSA-2026:59831
• https://access.redhat.com/errata/RHSA-2026:60019
• https://access.redhat.com/errata/RHSA-2026:65839
• https://access.redhat.com/security/cve/CVE-2026-33846
• https://bugzilla.redhat.com/show_bug.cgi?id=2450625

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.

Remediation

Upgrade Debian:11 gnutls28 to version 3.7.1-5+deb11u5 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2024-0567
• http://www.openwall.com/lists/oss-security/2024/01/19/3
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZEIOLORQ7N6WRPFXZSYDL2MC4LP7VFV/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GNXKVR5YNUEBNHAHM5GSYKBZX4W2HMN2/
• https://security.netapp.com/advisory/ntap-20240202-0011/
• https://access.redhat.com/errata/RHSA-2024:0533
• https://access.redhat.com/errata/RHSA-2024:1082
• https://access.redhat.com/errata/RHSA-2024:1383
• https://access.redhat.com/errata/RHSA-2024:2094
• https://access.redhat.com/security/cve/CVE-2024-0567
• https://bugzilla.redhat.com/show_bug.cgi?id=2258544
• https://gitlab.com/gnutls/gnutls/-/issues/1521
• https://lists.gnupg.org/pipermail/gnutls-help/2024-January/004841.html
• https://cert-portal.siemens.com/productcert/html/ssa-794697.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.

Remediation

Upgrade Debian:11 gnutls28 to version 3.7.1-5+deb11u5 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2024-0553
• http://www.openwall.com/lists/oss-security/2024/01/19/3
• https://lists.debian.org/debian-lts-announce/2024/02/msg00010.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZEIOLORQ7N6WRPFXZSYDL2MC4LP7VFV/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GNXKVR5YNUEBNHAHM5GSYKBZX4W2HMN2/
• https://security.netapp.com/advisory/ntap-20240202-0011/
• https://access.redhat.com/errata/RHSA-2024:0533
• https://access.redhat.com/errata/RHSA-2024:0627
• https://access.redhat.com/errata/RHSA-2024:0796
• https://access.redhat.com/errata/RHSA-2024:1082
• https://access.redhat.com/errata/RHSA-2024:1108
• https://access.redhat.com/errata/RHSA-2024:1383
• https://access.redhat.com/errata/RHSA-2024:2094
• https://access.redhat.com/security/cve/CVE-2024-0553
• https://bugzilla.redhat.com/show_bug.cgi?id=2258412
• https://gitlab.com/gnutls/gnutls/-/issues/1522
• https://lists.gnupg.org/pipermail/gnutls-help/2024-January/004841.html
• https://cert-portal.siemens.com/productcert/html/ssa-794697.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.

Remediation

Upgrade Debian:11 gnutls28 to version 3.7.1-5+deb11u10 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-42009
• https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-2
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42009.json
• https://access.redhat.com/errata/RHSA-2026:72502
• https://access.redhat.com/errata/RHSA-2026:74674
• https://access.redhat.com/errata/RHSA-2026:82304
• https://access.redhat.com/errata/RHSA-2026:82322
• https://access.redhat.com/errata/RHSA-2026:82347
• https://access.redhat.com/errata/RHSA-2026:82354
• https://access.redhat.com/errata/RHSA-2026:82372
• https://access.redhat.com/errata/RHSA-2026:82857
• https://access.redhat.com/errata/RHSA-2026:82888
• https://access.redhat.com/errata/RHSA-2026:13274
• https://access.redhat.com/errata/RHSA-2026:20611
• https://access.redhat.com/errata/RHSA-2026:20612
• https://access.redhat.com/errata/RHSA-2026:20613
• https://access.redhat.com/errata/RHSA-2026:26319
• https://access.redhat.com/errata/RHSA-2026:26409
• https://access.redhat.com/errata/RHSA-2026:29197
• https://access.redhat.com/errata/RHSA-2026:29794
• https://access.redhat.com/errata/RHSA-2026:30004
• https://access.redhat.com/errata/RHSA-2026:30849
• https://access.redhat.com/errata/RHSA-2026:30850
• https://access.redhat.com/errata/RHSA-2026:32962
• https://access.redhat.com/errata/RHSA-2026:33125
• https://access.redhat.com/errata/RHSA-2026:34372
• https://access.redhat.com/errata/RHSA-2026:34764
• https://access.redhat.com/errata/RHSA-2026:34788
• https://access.redhat.com/errata/RHSA-2026:36004
• https://access.redhat.com/errata/RHSA-2026:36005
• https://access.redhat.com/errata/RHSA-2026:36006
• https://access.redhat.com/errata/RHSA-2026:40762
• https://access.redhat.com/errata/RHSA-2026:41921
• https://access.redhat.com/errata/RHSA-2026:56786
• https://access.redhat.com/errata/RHSA-2026:56853
• https://access.redhat.com/errata/RHSA-2026:56911
• https://access.redhat.com/errata/RHSA-2026:57483
• https://access.redhat.com/errata/RHSA-2026:58981
• https://access.redhat.com/errata/RHSA-2026:59831
• https://access.redhat.com/errata/RHSA-2026:60019
• https://access.redhat.com/errata/RHSA-2026:65839
• https://access.redhat.com/security/cve/CVE-2026-42009
• https://bugzilla.redhat.com/show_bug.cgi?id=2467279

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5 package and not the krb5 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.

Remediation

Upgrade Debian:11 krb5 to version 1.18.3-6+deb11u5 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2024-37370
• https://security.netapp.com/advisory/ntap-20241108-0007/
• https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef
• https://web.mit.edu/kerberos/www/advisories/
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5 package and not the krb5 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.

Remediation

Upgrade Debian:11 krb5 to version 1.18.3-6+deb11u8 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2026-40355
• https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f
• https://web.mit.edu/kerberos/advisories/
• https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html
• https://cert-portal.siemens.com/productcert/html/ssa-019113.html
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html
• https://cert-portal.siemens.com/productcert/html/ssa-457936.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgd2 package and not the libgd2 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is "The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.

Remediation

Upgrade Debian:11 libgd2 to version 2.3.0-2+deb11u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-40145
• https://github.com/libgd/libgd/commit/c5fd25ce0e48fd5618a972ca9f5e28d6d62006af
• https://github.com/libgd/libgd/issues/700
• https://github.com/libgd/libgd/pull/713

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_fetch(), the version 1 response parser reads a server-controlled comment_len value and advances the parse pointer without verifying sufficient bytes remain in the buffer, causing the out-of-bounds read to leak heap pointers from adjacent allocations defeating ASLR, followed by heap allocator state corruption when the error cleanup path frees an uninitialized pointer from a non-zeroed realloc() region.

Remediation

There is no fixed version for Debian:11 libssh2.

References

• https://security-tracker.debian.org/tracker/CVE-2026-66034
• https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99803cd898d9
• https://github.com/libssh2/libssh2/pull/2202
• https://www.vulncheck.com/advisories/libssh2-heap-out-of-bounds-read-via-publickey-subsystem

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

An issue was discovered in function _libssh2_packet_add in libssh2 1.10.0 allows attackers to access out of bounds memory.

Remediation

Upgrade Debian:11 libssh2 to version 1.9.0-2+deb11u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-22218
• https://github.com/libssh2/libssh2/pull/476
• https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html
• https://security.netapp.com/advisory/ntap-20231006-0002/
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream libtirpc package and not the libtirpc package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections.

Remediation

Upgrade Debian:11 libtirpc to version 1.3.1-1+deb11u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-46828
• http://git.linux-nfs.org/?p=steved/libtirpc.git;a=commit;h=86529758570cef4c73fb9b9c4104fdc510f701ed
• http://git.linux-nfs.org/?p=steved/libtirpc.git%3Ba=commit%3Bh=86529758570cef4c73fb9b9c4104fdc510f701ed
• https://lists.debian.org/debian-lts-announce/2022/08/msg00004.html
• https://security.gentoo.org/glsa/202210-33
• https://security.netapp.com/advisory/ntap-20221007-0004/
• https://www.debian.org/security/2022/dsa-5200
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html
• https://cert-portal.siemens.com/productcert/html/ssa-558014.html
• https://cert-portal.siemens.com/productcert/html/ssa-561322.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream libwebp package and not the libwebp package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.

Remediation

Upgrade Debian:11 libwebp to version 0.6.1-2.1+deb11u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-1999
• https://chromium.googlesource.com/webm/libwebp
• https://security.gentoo.org/glsa/202309-05

NVD Description

Note: Versions mentioned in the description apply only to the upstream libx11 package and not the libx11 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption.

Remediation

Upgrade Debian:11 libx11 to version 2:1.7.2-1+deb11u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-3138
• https://access.redhat.com/security/cve/CVE-2023-3138
• https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/304a654a0d57bf0f00d8998185f0360332cfa36c
• https://lists.x.org/archives/xorg-announce/2023-June/003406.html
• https://lists.x.org/archives/xorg-announce/2023-June/003407.html
• https://security.netapp.com/advisory/ntap-20231208-0008/

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

Remediation

Upgrade Debian:11 libxml2 to version 2.9.10+dfsg-6.7+deb11u3 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-40303
• http://seclists.org/fulldisclosure/2022/Dec/21
• http://seclists.org/fulldisclosure/2022/Dec/24
• http://seclists.org/fulldisclosure/2022/Dec/25
• http://seclists.org/fulldisclosure/2022/Dec/26
• http://seclists.org/fulldisclosure/2022/Dec/27
• https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0
• https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3
• https://security.netapp.com/advisory/ntap-20221209-0003/
• https://support.apple.com/kb/HT213531
• https://support.apple.com/kb/HT213533
• https://support.apple.com/kb/HT213534
• https://support.apple.com/kb/HT213535
• https://support.apple.com/kb/HT213536
• https://cert-portal.siemens.com/productcert/html/ssa-337522.html
• https://cert-portal.siemens.com/productcert/html/ssa-341067.html
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html
• https://cert-portal.siemens.com/productcert/html/ssa-556635.html
• https://cert-portal.siemens.com/productcert/html/ssa-625862.html
• https://cert-portal.siemens.com/productcert/html/ssa-769027.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.

Remediation

Upgrade Debian:11 libxml2 to version 2.9.10+dfsg-6.7+deb11u5 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-2309
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO/
• https://lists.debian.org/debian-lts-announce/2024/09/msg00021.html
• https://github.com/lxml/lxml/commit/86368e9cf70a0ad23cccd5ee32de847149af0c6f
• https://huntr.dev/bounties/8264e74f-edda-4c40-9956-49de635105ba
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO/
• https://security.gentoo.org/glsa/202208-06
• https://security.netapp.com/advisory/ntap-20220915-0006/

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.

Remediation

Upgrade Debian:11 libxml2 to version 2.9.10+dfsg-6.7+deb11u6 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2025-27113
• https://gitlab.gnome.org/GNOME/libxml2/-/issues/861
• https://security.netapp.com/advisory/ntap-20250306-0004/
• http://seclists.org/fulldisclosure/2025/Apr/13
• http://seclists.org/fulldisclosure/2025/Apr/10
• http://seclists.org/fulldisclosure/2025/Apr/11
• http://seclists.org/fulldisclosure/2025/Apr/12
• http://seclists.org/fulldisclosure/2025/Apr/4
• http://seclists.org/fulldisclosure/2025/Apr/5
• http://seclists.org/fulldisclosure/2025/Apr/8
• http://seclists.org/fulldisclosure/2025/Apr/9
• https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.

Remediation

Upgrade Debian:11 libxml2 to version 2.9.10+dfsg-6.7+deb11u7 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2025-32415
• https://lists.debian.org/debian-lts-announce/2025/04/msg00041.html
• https://gitlab.gnome.org/GNOME/libxml2/-/issues/890

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.

Remediation

Upgrade Debian:11 libxml2 to version 2.9.10+dfsg-6.7+deb11u8 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2025-6021
• https://access.redhat.com/errata/RHSA-2025:10630
• https://access.redhat.com/errata/RHSA-2025:10698
• https://access.redhat.com/errata/RHSA-2025:10699
• https://access.redhat.com/errata/RHSA-2025:11580
• https://access.redhat.com/errata/RHSA-2025:12098
• https://access.redhat.com/errata/RHSA-2025:12099
• https://access.redhat.com/errata/RHSA-2025:12199
• https://access.redhat.com/errata/RHSA-2025:12237
• https://access.redhat.com/errata/RHSA-2025:12239
• https://access.redhat.com/errata/RHSA-2025:12240
• https://access.redhat.com/errata/RHSA-2025:12241
• https://access.redhat.com/errata/RHSA-2025:13267
• https://access.redhat.com/errata/RHSA-2025:13289
• https://access.redhat.com/errata/RHSA-2025:13325
• https://access.redhat.com/errata/RHSA-2025:13335
• https://access.redhat.com/errata/RHSA-2025:13336
• https://access.redhat.com/errata/RHSA-2025:14059
• https://access.redhat.com/errata/RHSA-2025:14396
• https://access.redhat.com/errata/RHSA-2025:15308
• https://access.redhat.com/errata/RHSA-2025:15672
• https://access.redhat.com/security/cve/CVE-2025-6021
• https://bugzilla.redhat.com/show_bug.cgi?id=2372406
• https://access.redhat.com/errata/RHSA-2025:19020
• https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html
• https://access.redhat.com/errata/RHSA-2025:11673
• https://access.redhat.com/errata/RHSA-2026:7519
• https://cert-portal.siemens.com/productcert/html/ssa-032379.html
• https://gitlab.gnome.org/GNOME/libxml2/-/issues/926

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.

Remediation

Upgrade Debian:11 libxml2 to version 2.9.10+dfsg-6.7+deb11u7 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2025-32414
• https://lists.debian.org/debian-lts-announce/2025/04/msg00041.html
• https://gitlab.gnome.org/GNOME/libxml2/-/issues/889

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.

Remediation

Upgrade Debian:11 libxml2 to version 2.9.10+dfsg-6.7+deb11u6 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2024-25062
• https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html
• https://security.netapp.com/advisory/ntap-20241018-0009/
• https://gitlab.gnome.org/GNOME/libxml2/-/issues/604
• https://gitlab.gnome.org/GNOME/libxml2/-/tags
• https://cert-portal.siemens.com/productcert/html/ssa-784301.html
• https://cert-portal.siemens.com/productcert/html/ssa-794697.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxpm package and not the libxpm package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library.

Remediation

Upgrade Debian:11 libxpm to version 1:3.5.12-1.1~deb11u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-44617
• https://bugzilla.redhat.com/show_bug.cgi?id=2160193
• https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/f80fa6ae47ad4a5beacb28
• https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9
• https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html
• https://lists.x.org/archives/xorg-announce/2023-January/003312.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxpm package and not the libxpm package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-file condition will not be detected, leading to an infinite loop and resulting in a Denial of Service in the application linked to the library.

Remediation

Upgrade Debian:11 libxpm to version 1:3.5.12-1.1~deb11u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-46285
• http://www.openwall.com/lists/oss-security/2023/10/03/1
• http://www.openwall.com/lists/oss-security/2023/10/03/10
• https://bugzilla.redhat.com/show_bug.cgi?id=2160092
• https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/a3a7c6dcc3b629d7650148
• https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9
• https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html
• https://lists.x.org/archives/xorg-announce/2023-January/003312.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxslt package and not the libxslt package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.

Remediation

Upgrade Debian:11 libxslt to version 1.1.34-4+deb11u3 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2025-7424
• https://access.redhat.com/security/cve/CVE-2025-7424
• https://bugzilla.redhat.com/show_bug.cgi?id=2379228
• https://lists.debian.org/debian-lts-announce/2025/09/msg00024.html
• http://seclists.org/fulldisclosure/2025/Aug/0
• http://seclists.org/fulldisclosure/2025/Jul/30
• http://seclists.org/fulldisclosure/2025/Jul/32
• http://seclists.org/fulldisclosure/2025/Jul/33
• http://seclists.org/fulldisclosure/2025/Jul/35
• http://seclists.org/fulldisclosure/2025/Jul/37
• http://www.openwall.com/lists/oss-security/2025/07/11/2
• https://gitlab.gnome.org/GNOME/libxslt/-/issues/139
• https://access.redhat.com/errata/RHBA-2025:12345
• https://access.redhat.com/errata/RHSA-2026:11015

NVD Description

Note: Versions mentioned in the description apply only to the upstream nghttp2 package and not the nghttp2 package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Remediation

Upgrade Debian:11 nghttp2 to version 1.43.0-1+deb11u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-44487
• https://chaos.social/@icing/111210915918780532
• https://github.com/hyperium/hyper/issues/3337
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/
• https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/
• http://www.openwall.com/lists/oss-security/2023/10/10/6
• http://www.openwall.com/lists/oss-security/2023/10/10/7
• https://github.com/grpc/grpc/releases/tag/v1.59.2
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-44487
• http://www.openwall.com/lists/oss-security/2025/08/13/6
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html
• https://cert-portal.siemens.com/productcert/html/ssa-341067.html
• https://cert-portal.siemens.com/productcert/html/ssa-784301.html
• https://cert-portal.siemens.com/productcert/html/ssa-832273.html
• https://cert-portal.siemens.com/productcert/html/ssa-915275.html
• http://www.openwall.com/lists/oss-security/2023/10/13/4
• http://www.openwall.com/lists/oss-security/2023/10/13/9
• http://www.openwall.com/lists/oss-security/2023/10/18/4
• http://www.openwall.com/lists/oss-security/2023/10/18/8
• http://www.openwall.com/lists/oss-security/2023/10/19/6
• http://www.openwall.com/lists/oss-security/2023/10/20/8
• https://access.redhat.com/security/cve/cve-2023-44487
• https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/
• https://aws.amazon.com/security/security-bulletins/AWS-2023-011/
• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
• https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/
• https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/
• https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack
• https://blog.vespa.ai/cve-2023-44487/
• https://bugzilla.proxmox.com/show_bug.cgi?id=4988
• https://bugzilla.redhat.com/show_bug.cgi?id=2242803
• https://bugzilla.suse.com/show_bug.cgi?id=1216123
• https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9
• https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/
• https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack
• https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125
• https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715
• https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve
• https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764
• https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088
• https://github.com/Azure/AKS/issues/3947
• https://github.com/Kong/kong/discussions/11741
• https://github.com/advisories/GHSA-qppj-fm5r-hxr3
• https://github.com/advisories/GHSA-vx74-f528-fxqg
• https://github.com/advisories/GHSA-xpw8-rcwv-8f8p
• https://github.com/akka/akka-http/issues/4323
• https://github.com/alibaba/tengine/issues/1872
• https://github.com/apache/apisix/issues/10320
• https://github.com/apache/httpd-site/pull/10
• https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113
• https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2
• https://github.com/apache/trafficserver/pull/10564
• https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487
• https://github.com/bcdannyboy/CVE-2023-44487
• https://github.com/caddyserver/caddy/issues/5877
• https://github.com/caddyserver/caddy/releases/tag/v2.7.5
• https://github.com/dotnet/announcements/issues/277
• https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73
• https://github.com/eclipse/jetty.project/issues/10679
• https://github.com/envoyproxy/envoy/pull/30055
• https://github.com/etcd-io/etcd/issues/16740
• https://github.com/facebook/proxygen/pull/466
• https://github.com/golang/go/issues/63417
• https://github.com/grpc/grpc-go/pull/6703
• https://github.com/h2o/h2o/pull/3291
• https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf
• https://github.com/haproxy/haproxy/issues/2312
• https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244
• https://github.com/junkurihara/rust-rpxy/issues/97
• https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1
• https://github.com/kazu-yamamoto/http2/issues/93
• https://github.com/kubernetes/kubernetes/pull/121120
• https://github.com/line/armeria/pull/5232
• https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632
• https://github.com/micrictor/http2-rst-stream
• https://github.com/microsoft/CBL-Mariner/pull/6381
• https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61
• https://github.com/nghttp2/nghttp2/pull/1961
• https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0
• https://github.com/ninenines/cowboy/issues/1615
• https://github.com/nodejs/node/pull/50121
• https://github.com/openresty/openresty/issues/930
• https://github.com/opensearch-project/data-prepper/issues/3474
• https://github.com/oqtane/oqtane.framework/discussions/3367
• https://github.com/projectcontour/contour/pull/5826
• https://github.com/tempesta-tech/tempesta/issues/1986
• https://github.com/varnishcache/varnish-cache/issues/3996
• https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo
• https://istio.io/latest/news/security/istio-security-2023-004/
• https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/
• https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q
• https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html
• https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html
• https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html
• https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html
• https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html
• https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html
• https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html
• https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html
• https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html
• https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html
• https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487
• https://my.f5.com/manage/s/article/K000137106
• https://netty.io/news/2023/10/10/4-1-100-Final.html
• https://news.ycombinator.com/item?id=37830987
• https://news.ycombinator.com/item?id=37830998
• https://news.ycombinator.com/item?id=37831062
• https://news.ycombinator.com/item?id=37837043
• https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/
• https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected
• https://security.gentoo.org/glsa/202311-09
• https://security.netapp.com/advisory/ntap-20231016-0001/
• https://security.netapp.com/advisory/ntap-20240426-0007/
• https://security.netapp.com/advisory/ntap-20240621-0006/
• https://security.netapp.com/advisory/ntap-20240621-0007/
• https://security.paloaltonetworks.com/CVE-2023-44487
• https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14
• https://ubuntu.com/security/CVE-2023-44487
• https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/
• https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
• https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event
• https://www.debian.org/security/2023/dsa-5521
• https://www.debian.org/security/2023/dsa-5522
• https://www.debian.org/security/2023/dsa-5540
• https://www.debian.org/security/2023/dsa-5549
• https://www.debian.org/security/2023/dsa-5558
• https://www.debian.org/security/2023/dsa-5570
• https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487
• https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/
• https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/
• https://www.openwall.com/lists/oss-security/2023/10/10/6
• https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack
• https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://github.com/threatlabindonesia/CVE-2023-44487-HTTP-2-Rapid-Reset-Exploit-PoC
• https://www.exploit-db.com/exploits/52426