JLSEC-2026-757
- Source
- https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-757.md
- Import Source
- https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-757.json
- JSON Data
- https://api.osv.dev/v1/vulns/JLSEC-2026-757
- Upstream
- Published
- 2026-07-14T21:41:35.775Z
- Modified
- 2026-07-14T21:50:11.431670289Z
- Severity
-
- 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Use-after-free in PQC hybrid key-share handling. This is an incomplete-fix follow-up to CVE-2026...
- Details
-
Use-after-free in PQC hybrid key-share handling. This is an incomplete-fix follow-up to CVE-2026-5460 (released in 5.9.1): a malicious TLS 1.3 server sending a truncated PQC hybrid KeyShare can still trigger the error cleanup path to operate on freed memory.
- Database specific
{ "sources": [ { "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7531", "database_specific": { "status": "Analyzed" }, "imported": "2026-07-14T21:22:49.637Z", "published": "2026-06-25T20:17:17.763Z", "id": "CVE-2026-7531", "modified": "2026-06-26T16:53:58.953Z", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-7531" }, { "html_url": "https://github.com/advisories/GHSA-w9rp-wwm2-fwmr", "imported": "2026-07-14T21:23:09.128Z", "published": "2026-06-25T21:31:31Z", "id": "GHSA-w9rp-wwm2-fwmr", "modified": "2026-06-26T18:33:51Z", "url": "https://api.github.com/advisories/GHSA-w9rp-wwm2-fwmr" }, { "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-39554", "imported": "2026-07-14T21:22:51.269Z", "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-39554", "id": "EUVD-2026-39554", "modified": "2026-06-26T13:17:13Z", "published": "2026-06-25T20:01:16Z" } ], "license": "CC-BY-4.0" }- References