UbuntuUpdates.org

Bugs addressed in recent updates

All Launchpad Ubuntu Debian CVE

Origin Bug number Title Packages
CVE CVE-2026-1801 A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the so libsoup2.4 libsoup3 libsoup3 libsoup2.4 libsoup2.4 libsoup2.4 libsoup2.4 libsoup3 libsoup3 libsoup2.4 libsoup2.4 libsoup2.4
CVE CVE-2026-87766 A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via bubblewrap bubblewrap bubblewrap bubblewrap bubblewrap bubblewrap
Launchpad 2159565 [SRU] Fix port-naming formatting regression in ALSA sequencer bridge pipewire pipewire
CVE CVE-2026-56389 GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration var bison bison bison bison bison bison
Launchpad 2150053 [SRU] Ensure brcmfmac firmware present in dracut initrd ubuntu-raspi-settings
CVE CVE-2026-18649 A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good1.0
Launchpad 2167436 CPU throttled to 400MHz on Dell AIO QB24250 thermald
Launchpad 2158525 mysql root account locked out after upgrade to 26.04 ubuntu-release-upgrader ubuntu-release-upgrader
CVE CVE-2026-85522 A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file sr valkey valkey
CVE CVE-2026-63639 Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream valkey valkey
CVE CVE-2026-56684 Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pendin valkey valkey
Launchpad 2158643 [SRU] lxc: incorrect free() of cap_to_text() result in ambient caps setup causes intermittent startup failure lxc lxc
Launchpad 2069523 click 0.5.2-2ubuntu4 fails to install on Ubuntu 24.04 LTS click
Launchpad 2163501 [SRU] Mesa 25.2.8 disabled legacy `bind_wayland_display` code path mesa mesa
CVE CVE-2026-69249 python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, whe python-cryptography python-cryptography
CVE CVE-2026-69248 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an inte python-cryptography python-cryptography
CVE CVE-2026-69247 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, python-cryptography python-cryptography
CVE CVE-2026-39113 Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05c sqlite3 sqlite3 sqlite3 sqlite3 sqlite3 sqlite3 sqlite3 sqlite3 sqlite3 sqlite3 sqlite3 sqlite3
Launchpad 2167438 [SRU] Neutron gazpacho stable releases neutron neutron
Launchpad 2150273 [SRU] SSH fails on IPA-joined systems when logging in with an alternative UPN suffix openssh openssh



About   -   Send Feedback to @ubuntu_updates