OESA-2026-1348

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-1348
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-1348.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2026-1348
Upstream
Published
2026-02-13T13:15:49Z
Modified
2026-02-13T14:00:21.683936Z
Summary
munge security update
Details

MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating and validating credentials. It is designed to be highly scalable for use in an HPC cluster environment. It allows a process to authenticate the UID and GID of another local or remote process within a group of hosts having common users and groups. These hosts form a security realm that is defined by a shared cryptographic key. Clients within this security realm can create and validate credentials without the use of root privileges, reserved ports, or platform-specific methods.

Security Fix(es):

MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged (the MUNGE authentication daemon) to leak cryptographic key material from process memory. With the leaked key material, the attacker could forge arbitrary MUNGE credentials to impersonate any user (including root) to services that rely on MUNGE for authentication. The vulnerability allows a buffer overflow by sending a crafted message with an oversized address length field, corrupting munged's internal state and enabling extraction of the MAC subkey used for credential verification. This vulnerability is fixed in 0.5.18.(CVE-2026-25506)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:20.03-LTS-SP4
munge

Package

Name
munge
Purl
pkg:rpm/openEuler/munge&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.5.14-2.oe2003sp4

Ecosystem specific 

{
    "aarch64": [
        "munge-0.5.14-2.oe2003sp4.aarch64.rpm",
        "munge-debuginfo-0.5.14-2.oe2003sp4.aarch64.rpm",
        "munge-debugsource-0.5.14-2.oe2003sp4.aarch64.rpm",
        "munge-devel-0.5.14-2.oe2003sp4.aarch64.rpm",
        "munge-libs-0.5.14-2.oe2003sp4.aarch64.rpm"
    ],
    "src": [
        "munge-0.5.14-2.oe2003sp4.src.rpm"
    ],
    "x86_64": [
        "munge-0.5.14-2.oe2003sp4.x86_64.rpm",
        "munge-debuginfo-0.5.14-2.oe2003sp4.x86_64.rpm",
        "munge-debugsource-0.5.14-2.oe2003sp4.x86_64.rpm",
        "munge-devel-0.5.14-2.oe2003sp4.x86_64.rpm",
        "munge-libs-0.5.14-2.oe2003sp4.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-1348.json"
openEuler:22.03-LTS-SP4
munge

Package

Name
munge
Purl
pkg:rpm/openEuler/munge&distro=openEuler-22.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.5.14-2.oe2203sp4

Ecosystem specific 

{
    "aarch64": [
        "munge-0.5.14-2.oe2203sp4.aarch64.rpm",
        "munge-debuginfo-0.5.14-2.oe2203sp4.aarch64.rpm",
        "munge-debugsource-0.5.14-2.oe2203sp4.aarch64.rpm",
        "munge-devel-0.5.14-2.oe2203sp4.aarch64.rpm",
        "munge-libs-0.5.14-2.oe2203sp4.aarch64.rpm"
    ],
    "src": [
        "munge-0.5.14-2.oe2203sp4.src.rpm"
    ],
    "x86_64": [
        "munge-0.5.14-2.oe2203sp4.x86_64.rpm",
        "munge-debuginfo-0.5.14-2.oe2203sp4.x86_64.rpm",
        "munge-debugsource-0.5.14-2.oe2203sp4.x86_64.rpm",
        "munge-devel-0.5.14-2.oe2203sp4.x86_64.rpm",
        "munge-libs-0.5.14-2.oe2203sp4.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-1348.json"
openEuler:24.03-LTS
munge

Package

Name
munge
Purl
pkg:rpm/openEuler/munge&distro=openEuler-24.03-LTS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.5.15-2.oe2403sp3

Ecosystem specific 

{
    "aarch64": [
        "munge-0.5.15-2.oe2403.aarch64.rpm",
        "munge-debuginfo-0.5.15-2.oe2403.aarch64.rpm",
        "munge-debugsource-0.5.15-2.oe2403.aarch64.rpm",
        "munge-devel-0.5.15-2.oe2403.aarch64.rpm",
        "munge-libs-0.5.15-2.oe2403.aarch64.rpm",
        "munge-0.5.15-2.oe2403sp1.aarch64.rpm",
        "munge-debuginfo-0.5.15-2.oe2403sp1.aarch64.rpm",
        "munge-debugsource-0.5.15-2.oe2403sp1.aarch64.rpm",
        "munge-devel-0.5.15-2.oe2403sp1.aarch64.rpm",
        "munge-libs-0.5.15-2.oe2403sp1.aarch64.rpm",
        "munge-0.5.15-2.oe2403sp2.aarch64.rpm",
        "munge-debuginfo-0.5.15-2.oe2403sp2.aarch64.rpm",
        "munge-debugsource-0.5.15-2.oe2403sp2.aarch64.rpm",
        "munge-devel-0.5.15-2.oe2403sp2.aarch64.rpm",
        "munge-libs-0.5.15-2.oe2403sp2.aarch64.rpm",
        "munge-0.5.15-2.oe2403sp3.aarch64.rpm",
        "munge-debuginfo-0.5.15-2.oe2403sp3.aarch64.rpm",
        "munge-debugsource-0.5.15-2.oe2403sp3.aarch64.rpm",
        "munge-devel-0.5.15-2.oe2403sp3.aarch64.rpm",
        "munge-libs-0.5.15-2.oe2403sp3.aarch64.rpm"
    ],
    "src": [
        "munge-0.5.15-2.oe2403.src.rpm",
        "munge-0.5.15-2.oe2403sp1.src.rpm",
        "munge-0.5.15-2.oe2403sp2.src.rpm",
        "munge-0.5.15-2.oe2403sp3.src.rpm"
    ],
    "x86_64": [
        "munge-0.5.15-2.oe2403.x86_64.rpm",
        "munge-debuginfo-0.5.15-2.oe2403.x86_64.rpm",
        "munge-debugsource-0.5.15-2.oe2403.x86_64.rpm",
        "munge-devel-0.5.15-2.oe2403.x86_64.rpm",
        "munge-libs-0.5.15-2.oe2403.x86_64.rpm",
        "munge-0.5.15-2.oe2403sp1.x86_64.rpm",
        "munge-debuginfo-0.5.15-2.oe2403sp1.x86_64.rpm",
        "munge-debugsource-0.5.15-2.oe2403sp1.x86_64.rpm",
        "munge-devel-0.5.15-2.oe2403sp1.x86_64.rpm",
        "munge-libs-0.5.15-2.oe2403sp1.x86_64.rpm",
        "munge-0.5.15-2.oe2403sp2.x86_64.rpm",
        "munge-debuginfo-0.5.15-2.oe2403sp2.x86_64.rpm",
        "munge-debugsource-0.5.15-2.oe2403sp2.x86_64.rpm",
        "munge-devel-0.5.15-2.oe2403sp2.x86_64.rpm",
        "munge-libs-0.5.15-2.oe2403sp2.x86_64.rpm",
        "munge-0.5.15-2.oe2403sp3.x86_64.rpm",
        "munge-debuginfo-0.5.15-2.oe2403sp3.x86_64.rpm",
        "munge-debugsource-0.5.15-2.oe2403sp3.x86_64.rpm",
        "munge-devel-0.5.15-2.oe2403sp3.x86_64.rpm",
        "munge-libs-0.5.15-2.oe2403sp3.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-1348.json"
openEuler:24.03-LTS-SP1
munge

Package

Name
munge
Purl
pkg:rpm/openEuler/munge&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.5.15-2.oe2403sp1

Ecosystem specific 

{
    "aarch64": [
        "munge-0.5.15-2.oe2403sp1.aarch64.rpm",
        "munge-debuginfo-0.5.15-2.oe2403sp1.aarch64.rpm",
        "munge-debugsource-0.5.15-2.oe2403sp1.aarch64.rpm",
        "munge-devel-0.5.15-2.oe2403sp1.aarch64.rpm",
        "munge-libs-0.5.15-2.oe2403sp1.aarch64.rpm"
    ],
    "src": [
        "munge-0.5.15-2.oe2403sp1.src.rpm"
    ],
    "x86_64": [
        "munge-0.5.15-2.oe2403sp1.x86_64.rpm",
        "munge-debuginfo-0.5.15-2.oe2403sp1.x86_64.rpm",
        "munge-debugsource-0.5.15-2.oe2403sp1.x86_64.rpm",
        "munge-devel-0.5.15-2.oe2403sp1.x86_64.rpm",
        "munge-libs-0.5.15-2.oe2403sp1.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-1348.json"
openEuler:24.03-LTS-SP2
munge

Package

Name
munge
Purl
pkg:rpm/openEuler/munge&distro=openEuler-24.03-LTS-SP2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.5.15-2.oe2403sp2

Ecosystem specific 

{
    "aarch64": [
        "munge-0.5.15-2.oe2403sp2.aarch64.rpm",
        "munge-debuginfo-0.5.15-2.oe2403sp2.aarch64.rpm",
        "munge-debugsource-0.5.15-2.oe2403sp2.aarch64.rpm",
        "munge-devel-0.5.15-2.oe2403sp2.aarch64.rpm",
        "munge-libs-0.5.15-2.oe2403sp2.aarch64.rpm"
    ],
    "src": [
        "munge-0.5.15-2.oe2403sp2.src.rpm"
    ],
    "x86_64": [
        "munge-0.5.15-2.oe2403sp2.x86_64.rpm",
        "munge-debuginfo-0.5.15-2.oe2403sp2.x86_64.rpm",
        "munge-debugsource-0.5.15-2.oe2403sp2.x86_64.rpm",
        "munge-devel-0.5.15-2.oe2403sp2.x86_64.rpm",
        "munge-libs-0.5.15-2.oe2403sp2.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-1348.json"
openEuler:24.03-LTS-SP3
munge

Package

Name
munge
Purl
pkg:rpm/openEuler/munge&distro=openEuler-24.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.5.15-2.oe2403sp3

Ecosystem specific 

{
    "aarch64": [
        "munge-0.5.15-2.oe2403sp3.aarch64.rpm",
        "munge-debuginfo-0.5.15-2.oe2403sp3.aarch64.rpm",
        "munge-debugsource-0.5.15-2.oe2403sp3.aarch64.rpm",
        "munge-devel-0.5.15-2.oe2403sp3.aarch64.rpm",
        "munge-libs-0.5.15-2.oe2403sp3.aarch64.rpm"
    ],
    "src": [
        "munge-0.5.15-2.oe2403sp3.src.rpm"
    ],
    "x86_64": [
        "munge-0.5.15-2.oe2403sp3.x86_64.rpm",
        "munge-debuginfo-0.5.15-2.oe2403sp3.x86_64.rpm",
        "munge-debugsource-0.5.15-2.oe2403sp3.x86_64.rpm",
        "munge-devel-0.5.15-2.oe2403sp3.x86_64.rpm",
        "munge-libs-0.5.15-2.oe2403sp3.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-1348.json"