CLSA-2026-1778003565
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1778003565.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1778003565
- Upstream
- Published
- 2026-05-05T17:52:50Z
- Modified
- 2026-06-04T09:47:38.300963951Z
- Summary
- Fix CVE(s): CVE-2026-40684, CVE-2026-40685, CVE-2026-40687
- Details
-
- SECURITY UPDATE: out-of-bounds read in DNS reverse-lookup escape
decoding when running against musl libc
- debian/patches/CVE-2026-40684.patch: harden stringcopydnsdomain() to consume 1, 2, or 3 digits incrementally instead of indexing past the input string when fewer than 3 digits follow a backslash escape
- CVE-2026-40684
- SECURITY UPDATE: out-of-bounds heap write in JSON dewrap on malformed
header value ending in a trailing backslash
- debian/patches/CVE-2026-40685.patch: only skip a backslash in dewrap() when followed by a non-NUL character
- CVE-2026-40685
- SECURITY UPDATE: SPA authenticator out-of-bounds write and
uninitialised-heap information disclosure
- debian/patches/CVE-2026-40687.patch: zero the spabase64to_bits() output buffer to plug the infoleak; replace assert()-based length guards in unicodeToString(), strToUnicode(), and toString() with explicit length clamping to prevent OOB writes
- CVE-2026-40687
- SECURITY UPDATE: out-of-bounds read in DNS reverse-lookup escape
decoding when running against musl libc
- References