Bugs addressed in recent updates
| Origin | Bug number | Title | Packages |
|---|---|---|---|
| CVE | CVE-2026-67409 | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Co | rabbitmq-server rabbitmq-server |
| CVE | CVE-2026-67404 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, When no CA bundle is available, ssl_option | rabbitmq-server |
| CVE | CVE-2026-67239 | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificat | rabbitmq-server rabbitmq-server |
| CVE | CVE-2026-67238 | RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ET | rabbitmq-server rabbitmq-server |
| CVE | CVE-2026-67237 | RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization heade | rabbitmq-server |
| CVE | CVE-2026-67236 | RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is_authorized/2 to set an auth cookie | rabbitmq-server rabbitmq-server |
| CVE | CVE-2026-67235 | RabbitMQ is a messaging and streaming broker. Prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15, The content-header BodySize (a uint64) was | rabbitmq-server rabbitmq-server |
| CVE | CVE-2026-67232 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 s | rabbitmq-server rabbitmq-server |
| CVE | CVE-2026-67231 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify_f | rabbitmq-server rabbitmq-server |
| CVE | CVE-2026-66079 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (lis | rabbitmq-server rabbitmq-server |
| CVE | CVE-2026-66077 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which <%= ... % | rabbitmq-server rabbitmq-server |
| CVE | CVE-2026-66070 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 returned the bare reflected Origin | rabbitmq-server rabbitmq-server |
| CVE | CVE-2026-26081 | HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected. | haproxy haproxy |
| CVE | CVE-2026-26080 | HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are a | haproxy haproxy |
| Launchpad | 2170901 | datalad FTBFS: setup.py develop tries to download keyrings.alt from PyPI | datalad |
| Launchpad | 2120577 | arctica-greeter FTBFS in Plucky | arctica-greeter |
| Launchpad | 2163156 | autopkgtest failure in containers due to swap file | nbd |
| Launchpad | 2168948 | gdebi FTBFS: setup.py passes Debian version (0.9.5.8build1) to setuptools, which rejects it as invalid PEP 440 | gdebi |
| Launchpad | 2170260 | Loupe profile needs to allow GVFS accesses | apparmor apparmor |
| Launchpad | 2170242 | Fix loupe profile nits identified in 6.0.0~alpha1-0ubuntu4 review | apparmor apparmor |
About
-
Send Feedback to @ubuntu_updates
