{"id":"CVE-2026-31323","aliases":["SUSE-SU-2026:3099-1","openSUSE-SU-2026:11143-1","openSUSE-SU-2026:21301-1"],"status":"published","title":"Security update for dash","description":"This update for dash fixes the following issues\n\n- CVE-2026-31323: arithmetic expansion evaluating INTMAX_MIN / -1 can lead to a signed integer overflow and a denial of\n  service (bsc#1269494).","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-06-29T00:00:00Z","modified":"2026-07-18T08:45:08Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"dash","fixed_in":["0.5.11.2-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"dash","fixed_in":["0.5.13.4-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"dash","fixed_in":["0.5.12-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"dash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.11.2-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.13.4-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.12-160000.3.1"}]}]}],"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263099-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1269494","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31323","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1178978","tags":["report"]}],"sources":{"osv":[{"id":"openSUSE-SU-2026:11143-1","title":"dash-0.5.13.4-1.1 on GA media","description":"These are all security issues fixed in the dash-0.5.13.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-29T00:00:00Z","modified":"2026-06-30T09:15:06.295179623Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21301-1","title":"Security update for dash","description":"This update for dash fixes the following issues\n\n- CVE-2026-31323: Fix CVE-2026-31323 INTMAX_MIN / -1 overflow (bsc#1269494).\n- executes code even when noexec (\"-n\") is specified (bsc#1178978).\n","status":"published","published":"2026-07-10T11:52:15Z","modified":"2026-07-13T18:24:58.659354476Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:3099-1","title":"Security update for dash","description":"This update for dash fixes the following issues\n\n- CVE-2026-31323: arithmetic expansion evaluating INTMAX_MIN / -1 can lead to a signed integer overflow and a denial of\n  service (bsc#1269494).\n","status":"published","published":"2026-07-17T11:40:36Z","modified":"2026-07-18T08:45:08.635762362Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}