Bugs addressed in recent updates
| Origin | Bug number | Title | Packages |
|---|---|---|---|
| CVE | CVE-2026-34835 | Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Request parses the Host hea | ruby-rack |
| CVE | CVE-2026-34827 | Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Multipart::Parser#handle_mi | ruby-rack |
| CVE | CVE-2026-32762 | Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21 and 3.2.0 to before 3.2.6, Rack::Utils.forwarded_values parse | ruby-rack |
| CVE | CVE-2026-26962 | Rack is a modular Ruby web server interface. From version 3.2.0 to before version 3.2.6, Rack::Multipart::Parser unfolds folded multipart part header | ruby-rack |
| CVE | CVE-2026-91786 | A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dime | gnome-shell gnome-shell gnome-shell gnome-shell gnome-shell gnome-shell |
| CVE | CVE-2026-110602 | libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename and e | libmspack libmspack libmspack libmspack |
| CVE | CVE-2026-110354 | HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1. | haproxy haproxy haproxy haproxy haproxy haproxy haproxy haproxy |
| CVE | CVE-2026-110353 | HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 | haproxy haproxy haproxy haproxy haproxy haproxy haproxy haproxy |
| CVE | CVE-2026-12548 | A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_heade | libsoup3 libsoup3 libsoup3 libsoup3 libsoup2.4 libsoup3 libsoup3 libsoup2.4 libsoup2.4 libsoup2.4 |
| CVE | CVE-2026-12547 | SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes | libsoup3 libsoup3 libsoup3 libsoup3 libsoup2.4 libsoup3 libsoup3 libsoup2.4 libsoup2.4 libsoup2.4 |
| CVE | CVE-2026-103399 | A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer return | libsoup3 libsoup3 libsoup3 libsoup3 libsoup2.4 libsoup3 libsoup3 libsoup2.4 libsoup2.4 libsoup2.4 |
| CVE | CVE-2026-12478 | The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to- | libsoup3 libsoup3 libsoup3 libsoup3 libsoup3 libsoup3 |
| CVE | CVE-2026-102559 | A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray al | libsoup3 libsoup3 libsoup3 libsoup3 libsoup2.4 libsoup3 libsoup3 libsoup2.4 libsoup2.4 libsoup2.4 |
| CVE | CVE-2026-102557 | A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size aga | libsoup3 libsoup3 libsoup3 libsoup3 libsoup2.4 libsoup3 libsoup3 libsoup2.4 libsoup2.4 libsoup2.4 |
| CVE | CVE-2026-102560 | A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations us | libsoup3 libsoup3 libsoup3 libsoup3 libsoup2.4 libsoup3 libsoup3 libsoup2.4 libsoup2.4 libsoup2.4 |
| CVE | CVE-2026-102558 | A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an | libsoup3 libsoup3 libsoup3 libsoup3 libsoup2.4 libsoup3 libsoup3 libsoup2.4 libsoup2.4 libsoup2.4 |
| CVE | CVE-2026-10255 | A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is the function sell_stateme | libsoup3 libsoup3 libsoup3 libsoup3 libsoup2.4 libsoup3 libsoup3 libsoup2.4 libsoup2.4 libsoup2.4 |
| CVE | CVE-2026-102556 | A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray poin | libsoup3 libsoup3 libsoup3 libsoup3 libsoup2.4 libsoup3 libsoup3 libsoup2.4 libsoup2.4 libsoup2.4 |
| CVE | CVE-2026-102555 | A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when call | libsoup3 libsoup3 libsoup3 libsoup3 libsoup3 libsoup3 |
| CVE | CVE-2026-89162 | In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the ad | pcre2 pcre2 pcre2 pcre2 |
About
-
Send Feedback to @ubuntu_updates
