Bugs addressed in recent updates
| Origin | Bug number | Title | Packages |
|---|---|---|---|
| CVE | CVE-2026-6409 | A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input. Maliciously structured messages—spe | protobuf protobuf protobuf protobuf |
| Launchpad | 2170056 | 5.8.4 security tracking bug | xz-utils xz-utils xz-utils xz-utils xz-utils xz-utils xz-utils xz-utils |
| CVE | CVE-2026-61642 | Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a | squid squid squid squid |
| Launchpad | 2168847 | HWK SoC fails to boot with HWE 7.0 + linux-firmware 0ubuntu3.1 | linux-firmware-amd-graphics |
| CVE | CVE-2026-70194 | Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network. | dotnet11 |
| CVE | CVE-2026-85644 | XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference. The wrapper function XS::Parse::Infix generates for | libxs-parse-keyword-perl libxs-parse-keyword-perl |
| CVE | CVE-2026-102275 | PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected | pyjwt pyjwt pyjwt pyjwt |
| CVE | CVE-2026-102274 | PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malfor | pyjwt pyjwt pyjwt pyjwt |
| CVE | CVE-2026-101918 | PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected becau | pyjwt pyjwt pyjwt pyjwt |
| CVE | CVE-2026-101917 | PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses | pyjwt pyjwt pyjwt pyjwt |
| Launchpad | 2131303 | package base-files 13ubuntu10.2 failed to install/upgrade: new base-files package pre-installation script subprocess returned error exit status 1: /l | base-files |
| CVE | CVE-2026-96222 | Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. | dotnet8 dotnet8 |
| CVE | CVE-2026-96960 | Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network. | dotnet10 dotnet10 dotnet8 dotnet10 dotnet8 dotnet11 |
| CVE | CVE-2026-96959 | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. | dotnet10 dotnet10 dotnet8 dotnet10 dotnet8 dotnet11 |
| CVE | CVE-2026-96958 | Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. | dotnet10 dotnet10 dotnet8 dotnet10 dotnet8 dotnet11 |
| CVE | CVE-2026-96957 | Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network. | dotnet10 dotnet10 dotnet10 dotnet11 |
| CVE | CVE-2026-96238 | Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network. | dotnet10 dotnet10 dotnet8 dotnet10 dotnet8 dotnet11 |
| CVE | CVE-2026-96237 | Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network. | dotnet10 dotnet10 dotnet8 dotnet10 dotnet8 |
| CVE | CVE-2026-96236 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. | dotnet10 dotnet10 dotnet8 dotnet10 dotnet8 dotnet11 |
| CVE | CVE-2026-96233 | Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network. | dotnet10 dotnet10 dotnet8 dotnet10 dotnet8 dotnet11 |
About
-
Send Feedback to @ubuntu_updates
