{"id":"CVE-2026-40170","aliases":["ALPINE-CVE-2026-40170","ALSA-2026:22963","ALSA-2026:25049","DEBIAN-CVE-2026-40170","EUVD-2026-23302","GHSA-f523-465f-8c8f","RHSA-2026:22963","RHSA-2026:25049","RHSA-2026:9113","RLSA-2026:22963","RLSA-2026:25049","SUSE-SU-2026:22368-1","SUSE-SU-2026:22565-1","SUSE-SU-2026:2633-1","SUSE-SU-2026:2647-1","SUSE-SU-2026:2695-1","SUSE-SU-2026:3929-1","SUSE-SU-2026:3930-1","UBUNTU-CVE-2026-40170","USN-8300-1","openSUSE-SU-2026:10621-1","openSUSE-SU-2026:10884-1","openSUSE-SU-2026:11121-1","openSUSE-SU-2026:21058-1","openSUSE-SU-2026:21236-1"],"status":"published","title":"ngtcp2 has a qlog transport parameter serialization stack buffer overflow","description":"ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport parameters during the QUIC handshake to cause writes beyond the buffer boundary, resulting in a stack buffer overflow. This affects deployments that enable the qlog callback and process untrusted peer transport parameters. This issue has been fixed in version 1.22.1. If developers are unable to immediately upgrade, they can disable the qlog on client.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00776,"percentile":0.56107,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120","CWE-121"],"published":"2026-04-16T21:34:07Z","modified":"2026-10-29T11:32:33Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"ngtcp2","fixed_in":["1.5.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"ngtcp2","fixed_in":["1.9.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"ngtcp2","fixed_in":["1.12.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"ngtcp2","fixed_in":["1.22.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"ngtcp2","fixed_in":["1.22.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"ngtcp2","fixed_in":["0.12.1+dfsg-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ngtcp2","fixed_in":["1.11.0-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ngtcp2","fixed_in":["1.22.1-1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"ngtcp2","fixed_in":["0:1.22.1-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"ngtcp2-crypto-gnutls","fixed_in":["0:1.22.1-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"ngtcp2-crypto-gnutls-devel","fixed_in":["0:1.22.1-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"ngtcp2-crypto-ossl","fixed_in":["0:1.22.1-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"ngtcp2-crypto-ossl-devel","fixed_in":["0:1.22.1-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"ngtcp2-devel","fixed_in":["0:1.22.1-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"ngtcp2-doc","fixed_in":["0:1.22.1-1.hum1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ngtcp2","fixed_in":["0.1.0+dfsg-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"ngtcp2","fixed_in":["0.12.1+dfsg-1+deb12u1build0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"ngtcp2","fixed_in":["1.11.0-1+deb13u1build0.25.10.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"ngtcp2","fixed_in":["1.16.0-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ngtcp2","fixed_in":["1.22.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"ngtcp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"ngtcp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"ngtcp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"ngtcp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"ngtcp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ldb-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libldb-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libnetapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libnetapi-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libsmbclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libsmbclient-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libwbclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libwbclient-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3-ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3-samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3-samba-dc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3-samba-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"samba-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"samba-client-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"samba-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"samba-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"samba-common-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"samba-dc-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"samba-dcerpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"samba-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"samba-gpupdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"samba-krb5-printing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"samba-ldb-ldap-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"samba-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"samba-pidl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"samba-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"samba-test-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"samba-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"samba-usershares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"samba-vfs-iouring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"samba-winbind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"samba-winbind-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"samba-winbind-krb5-locator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"samba-winbind-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"samba-winexe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ldb-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libldb-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libnetapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libnetapi-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libsmbclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libsmbclient-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libwbclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libwbclient-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-samba-dc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-samba-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"samba-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"samba-client-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"samba-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"samba-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"samba-common-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"samba-dc-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"samba-dcerpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"samba-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"samba-gpupdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"samba-krb5-printing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"samba-ldb-ldap-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"samba-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"samba-pidl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"samba-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"samba-test-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"samba-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"samba-usershares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"samba-vfs-iouring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"samba-winbind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"samba-winbind-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"samba-winbind-krb5-locator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"samba-winbind-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"samba-winexe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Debian:12","package":"ngtcp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1+dfsg-1+deb12u1"}]}],"versions":["0.12.1+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"ngtcp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-1+deb13u1"}]}],"versions":["1.11.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"ngtcp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1-1"}]}],"versions":["1.11.0-1","1.12.0-1~exp1","1.15.1-1","1.16.0-1","1.16.0-1~bpo13+1","1.16.0-1~bpo13+2","1.16.0-1~exp1","1.21.0-1","1.22.1-1~bpo13+1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"ctdb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"ldb-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libldb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libnetapi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libsmbclient-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libwbclient-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3-ldb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3-samba-dc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3-samba-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-client-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-client-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-common-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-common-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-dc-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-dcerpc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-gpupdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-krb5-printing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-krb5-printing-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-ldb-ldap-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-test-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-test-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-vfs-iouring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-vfs-iouring-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-winbind-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-winbind-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-winbind-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-winbind-krb5-locator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-winbind-krb5-locator-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-winbind-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-winexe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-winexe-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"ldb-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libnetapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libsmbclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libwbclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3-ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3-samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3-samba-dc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-client-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-common-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-dc-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-dcerpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-ldb-ldap-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-usershares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-winbind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-winbind-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libldb-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libnetapi-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libsmbclient-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libwbclient-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3-samba-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-pidl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"samba-test-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ctdb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ldb-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libldb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libnetapi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libsmbclient-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libwbclient-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-ldb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-samba-dc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-samba-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-client-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-client-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-common-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-common-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-dc-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-dcerpc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-gpupdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-krb5-printing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-krb5-printing-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-ldb-ldap-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-test-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-test-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-vfs-iouring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-vfs-iouring-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-winbind-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-winbind-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-winbind-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-winbind-krb5-locator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-winbind-krb5-locator-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-winbind-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-winexe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"samba-winexe-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"ctdb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"ldb-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"ldb-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libldb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libnetapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libnetapi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libsmbclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libsmbclient-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libwbclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libwbclient-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"python3-ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"python3-ldb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"python3-samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"python3-samba-dc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"python3-samba-dc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"python3-samba-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-client-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-client-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-client-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-common-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-common-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-common-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-dc-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-dc-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-dcerpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-dcerpc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-krb5-printing-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-ldb-ldap-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-ldb-ldap-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-test-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-test-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-usershares","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-vfs-iouring-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-winbind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-winbind-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-winbind-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-winbind-krb5-locator-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-winbind-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-winbind-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"samba-winexe-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"ctdb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"ldb-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libldb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libldb-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libnetapi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libnetapi-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libsmbclient-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libsmbclient-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libwbclient-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libwbclient-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3-ldb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3-samba-dc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3-samba-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"python3-samba-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"samba-client-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"samba-client-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"samba-common-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"samba-common-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"samba-dc-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"samba-dcerpc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"samba-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"samba-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"samba-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"samba-krb5-printing-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"samba-ldb-ldap-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"samba-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"samba-pidl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"samba-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"samba-test-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"samba-test-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"samba-test-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"samba-vfs-iouring-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"samba-winbind-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"samba-winbind-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"samba-winbind-krb5-locator-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"samba-winbind-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"samba-winexe-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"ctdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"ctdb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"ldb-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"libldb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"libnetapi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"libsmbclient-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"libwbclient-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"python3-ldb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"python3-samba-dc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"python3-samba-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"samba-client-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"samba-client-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"samba-common-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"samba-common-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"samba-dc-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"samba-dcerpc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"samba-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"samba-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"samba-krb5-printing-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"samba-ldb-ldap-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"samba-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"samba-test-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"samba-test-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"samba-vfs-iouring-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"samba-winbind-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"samba-winbind-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"samba-winbind-krb5-locator-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"samba-winbind-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"samba-winexe-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ngtcp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ngtcp2-crypto-gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ngtcp2-crypto-gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ngtcp2-crypto-ossl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ngtcp2-crypto-ossl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ngtcp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ngtcp2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.1-1.hum1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-109.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.23.5-10.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.0-160000.1.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.0-160000.1.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.18.0-160000.1.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.18.0-160000.1.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.17.0-150700.15.11.1"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.0-150600.13.18.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.0-150600.13.18.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.0-150700.3.12.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.20.2-150600.3.21.1"}]}],"bundled":35},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.20.2-150600.3.21.1"}]}],"bundled":35},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.20.2-150500.11.30.1"}]}],"bundled":35},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.20.2-150500.11.30.1"}]}],"bundled":35},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.20.2-150500.11.30.1"}]}],"bundled":35},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.20.2-150500.11.30.1"}]}],"bundled":35},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ngtcp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.0+dfsg-1ubuntu0.1~esm1"}]}],"versions":["0~20210905-1","0.1.0+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ngtcp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1+dfsg-1+deb12u1build0.24.04.1"}]}],"versions":["0.12.1+dfsg-1","0.12.1+dfsg-1build1","0.12.1+dfsg-1build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ngtcp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-1+deb13u1build0.25.10.1"}]}],"versions":["1.11.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ngtcp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-1ubuntu0.1"}]}],"versions":["1.11.0-1","1.16.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ngtcp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.0+dfsg-1ubuntu0.1~esm1"}]}],"versions":["0~20210905-1","0.1.0+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ngtcp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1+dfsg-1+deb12u1build0.24.04.1"}]}],"versions":["0.12.1+dfsg-1","0.12.1+dfsg-1build1","0.12.1+dfsg-1build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ngtcp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-1+deb13u1build0.25.10.1"}]}],"versions":["1.11.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ngtcp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-1ubuntu0.1"}]}],"versions":["1.11.0-1","1.16.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ngtcp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.23.8+git.477.f78166bceed-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.17.0-1.1"}]}],"bundled":21},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.0-160000.1.1"}]}],"bundled":26},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.18.0-160000.1.1"}]}],"bundled":21}],"products":[{"vendor":"ngtcp2","product":"ngtcp2"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"tatsuhiro-t","product":"ngtcp2"}],"references":[{"url":"https://github.com/ngtcp2/ngtcp2/security/advisories/GHSA-f523-465f-8c8f","tags":["x_refsource_CONFIRM","exploit","Exploit","Mitigation","Patch","Vendor Advisory","advisory","article","report"]},{"url":"https://github.com/ngtcp2/ngtcp2/commit/708a7640c1f48fb8ffb540c4b8ea5b4c1dfb8ee5","tags":["x_refsource_MISC","Patch","fix","article"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/17/12","tags":["Exploit","Mailing List","Mitigation","Patch","Third Party Advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40170","tags":["vdb-entry","x_refsource_REDHAT","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2459061","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40170.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22963","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25049","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9113","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-40170","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1933","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2340","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3012","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4408","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4480","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447317","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447318","tags":["report"]},{"url":"https://bugzilla.redhat.com/2447319","tags":["report"]},{"url":"https://bugzilla.redhat.com/2452232","tags":["report"]},{"url":"https://bugzilla.redhat.com/2459061","tags":["report"]},{"url":"https://bugzilla.redhat.com/2479762","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-22963.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-25049.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40170.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40170","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-40170","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447317","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447318","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447319","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452232","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479762","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22963.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1933","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1933","tags":["advisory"]},{"url":"https://bugzilla.samba.org/show_bug.cgi?id=15992","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2340","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2340","tags":["advisory"]},{"url":"https://bugzilla.samba.org/show_bug.cgi?id=15997","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3012","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3012","tags":["advisory"]},{"url":"https://bugzilla.samba.org/show_bug.cgi?id=16003","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4408","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4408","tags":["advisory"]},{"url":"https://bugzilla.samba.org/show_bug.cgi?id=16034","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4480","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4480","tags":["advisory"]},{"url":"https://bugzilla.samba.org/show_bug.cgi?id=16033","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40170","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25049.json","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9113.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:22963","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:25049","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622368-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1256576","tags":["report"]},{"url":"https://bugzilla.suse.com/1259853","tags":["report"]},{"url":"https://bugzilla.suse.com/1260455","tags":["report"]},{"url":"https://bugzilla.suse.com/1260462","tags":["report"]},{"url":"https://bugzilla.suse.com/1260463","tags":["report"]},{"url":"https://bugzilla.suse.com/1260480","tags":["report"]},{"url":"https://bugzilla.suse.com/1260482","tags":["report"]},{"url":"https://bugzilla.suse.com/1260494","tags":["report"]},{"url":"https://bugzilla.suse.com/1262274","tags":["report"]},{"url":"https://bugzilla.suse.com/1266318","tags":["report"]},{"url":"https://bugzilla.suse.com/1268097","tags":["report"]},{"url":"https://bugzilla.suse.com/1268477","tags":["report"]},{"url":"https://bugzilla.suse.com/1268479","tags":["report"]},{"url":"https://bugzilla.suse.com/1268481","tags":["report"]},{"url":"https://bugzilla.suse.com/1268482","tags":["report"]},{"url":"https://bugzilla.suse.com/1268554","tags":["report"]},{"url":"https://bugzilla.suse.com/1268555","tags":["report"]},{"url":"https://bugzilla.suse.com/1268592","tags":["report"]},{"url":"https://bugzilla.suse.com/1268593","tags":["report"]},{"url":"https://bugzilla.suse.com/1268598","tags":["report"]},{"url":"https://bugzilla.suse.com/1268605","tags":["report"]},{"url":"https://bugzilla.suse.com/1268606","tags":["report"]},{"url":"https://bugzilla.suse.com/1268608","tags":["report"]},{"url":"https://bugzilla.suse.com/1268609","tags":["report"]},{"url":"https://bugzilla.suse.com/1268611","tags":["report"]},{"url":"https://bugzilla.suse.com/1268618","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9679","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622565-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268478","tags":["report"]},{"url":"https://bugzilla.suse.com/1268480","tags":["report"]},{"url":"https://bugzilla.suse.com/1269825","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9678","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262633-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262647-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262695-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263929-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236258","tags":["report"]},{"url":"https://bugzilla.suse.com/1256848","tags":["report"]},{"url":"https://bugzilla.suse.com/1272882","tags":["report"]},{"url":"https://bugzilla.suse.com/1272941","tags":["report"]},{"url":"https://bugzilla.suse.com/1272942","tags":["report"]},{"url":"https://bugzilla.suse.com/1272943","tags":["report"]},{"url":"https://bugzilla.suse.com/1272944","tags":["report"]},{"url":"https://bugzilla.suse.com/1272945","tags":["report"]},{"url":"https://bugzilla.suse.com/1272947","tags":["report"]},{"url":"https://bugzilla.suse.com/1272948","tags":["report"]},{"url":"https://bugzilla.suse.com/1272949","tags":["report"]},{"url":"https://bugzilla.suse.com/1272950","tags":["report"]},{"url":"https://bugzilla.suse.com/1272951","tags":["report"]},{"url":"https://bugzilla.suse.com/1273591","tags":["report"]},{"url":"https://bugzilla.suse.com/1273593","tags":["report"]},{"url":"https://bugzilla.suse.com/1277587","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69192","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263930-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-40170","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8300-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4480","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-40170","title":"ngtcp2 has a qlog transport parameter serialization stack buffer overflow","description":"ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport parameters during the QUIC handshake to cause writes beyond the buffer boundary, resulting in a stack buffer overflow. This affects deployments that enable the qlog callback and process untrusted peer transport parameters. This issue has been fixed in version 1.22.1. If developers are unable to immediately upgrade, they can disable the qlog on client.","status":"published","published":"2026-04-16T21:34:07.61Z","modified":"2026-07-15T01:01:24.15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-121","CWE-120"],"updated_at":"2026-11-02T13:43:22.599321Z"}],"euvd":[{"id":"EUVD-2026-23302","description":"ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport parameters during the QUIC handshake to cause writes beyond the buffer boundary, resulting in a stack buffer overflow. This affects deployments that enable the qlog callback and process untrusted peer transport parameters. This issue has been fixed in version 1.22.1. If developers are unable to immediately upgrade, they can disable the qlog on client.","status":"published","published":"2026-04-16T21:34:07Z","modified":"2026-07-15T01:01:24Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:56.47701Z"}],"nvd":[{"id":"CVE-2026-40170","description":"ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport parameters during the QUIC handshake to cause writes beyond the buffer boundary, resulting in a stack buffer overflow. This affects deployments that enable the qlog callback and process untrusted peer transport parameters. This issue has been fixed in version 1.22.1. If developers are unable to immediately upgrade, they can disable the qlog on client.","status":"published","published":"2026-04-16T22:16:38.22Z","modified":"2026-07-15T02:21:03.22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-121","CWE-120"],"updated_at":"2026-11-02T14:12:15.120927Z"}],"osv":[{"id":"ALPINE-CVE-2026-40170","description":"ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport parameters during the QUIC handshake to cause writes beyond the buffer boundary, resulting in a stack buffer overflow. This affects deployments that enable the qlog callback and process untrusted peer transport parameters. This issue has been fixed in version 1.22.1. If developers are unable to immediately upgrade, they can disable the qlog on client.","status":"published","published":"2026-04-16T22:16:38.22Z","modified":"2026-10-01T02:17:49.2749152Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"CVE-2026-40170","title":"ngtcp2 has a qlog transport parameter serialization stack buffer overflow","description":"ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport parameters during the QUIC handshake to cause writes beyond the buffer boundary, resulting in a stack buffer overflow. This affects deployments that enable the qlog callback and process untrusted peer transport parameters. This issue has been fixed in version 1.22.1. If developers are unable to immediately upgrade, they can disable the qlog on client.","status":"published","published":"2026-04-16T21:34:07.61Z","modified":"2026-10-28T11:13:03.245956072Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:45:03.040464Z"},{"id":"DEBIAN-CVE-2026-40170","description":"ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport parameters during the QUIC handshake to cause writes beyond the buffer boundary, resulting in a stack buffer overflow. This affects deployments that enable the qlog callback and process untrusted peer transport parameters. This issue has been fixed in version 1.22.1. If developers are unable to immediately upgrade, they can disable the qlog on client.","status":"published","published":"2026-04-16T22:16:38.22Z","modified":"2026-10-01T03:02:39.295356045Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"RHSA-2026:22963","title":"Red Hat Security Advisory: samba security update","status":"published","published":"2026-06-04T10:08:10Z","modified":"2026-10-16T10:13:30Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:25049","title":"Red Hat Security Advisory: samba security update","status":"published","published":"2026-06-11T10:09:04Z","modified":"2026-10-16T10:13:59Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:9113","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-22T10:11:11Z","modified":"2026-10-06T10:31:10.442898351Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2026:22963","title":"Critical: samba security update","description":"Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.\n\nSecurity Fix(es):\n\n* samba: Missing access check on reparse point operations (CVE-2026-1933)\n\n* samba: vfs_worm does not block directory modification (CVE-2026-2340)\n\n* samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)\n\n* samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)\n\n* ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)\n\n* samba: Remote Code Execution in SAMR (CVE-2026-4408)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-11T12:05:12.507415Z","modified":"2026-06-11T12:30:10.959800755Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:25049","title":"Critical: samba security update","description":"Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.\n\nSecurity Fix(es):\n\n* samba: Missing access check on reparse point operations (CVE-2026-1933)\n\n* samba: vfs_worm does not block directory modification (CVE-2026-2340)\n\n* samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)\n\n* samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)\n\n* ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)\n\n* samba: Remote Code Execution in SAMR (CVE-2026-4408)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-13T00:03:17.085789Z","modified":"2026-06-13T00:30:04.786801385Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"UBUNTU-CVE-2026-40170","description":"ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport parameters during the QUIC handshake to cause writes beyond the buffer boundary, resulting in a stack buffer overflow. This affects deployments that enable the qlog callback and process untrusted peer transport parameters. This issue has been fixed in version 1.22.1. If developers are unable to immediately upgrade, they can disable the qlog on client.","status":"published","published":"2026-04-16T22:16:00Z","modified":"2026-06-30T18:18:00.138168808Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"ALSA-2026:22963","title":"Critical: samba security update","description":"Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.  \n\nSecurity Fix(es):  \n\n  * samba: Missing access check on reparse point operations (CVE-2026-1933)\n  * samba: vfs_worm does not block directory modification (CVE-2026-2340)\n  * samba: group policy certificate enrollment uses \u003chttp://\u003e without validation (CVE-2026-3012)\n  * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)\n  * ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)\n  * samba: Remote Code Execution in SAMR (CVE-2026-4408)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-03T00:00:00Z","modified":"2026-10-29T11:30:24.155530859Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:25049","title":"Critical: samba security update","description":"Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.  \n\nSecurity Fix(es):  \n\n  * samba: Missing access check on reparse point operations (CVE-2026-1933)\n  * samba: vfs_worm does not block directory modification (CVE-2026-2340)\n  * samba: group policy certificate enrollment uses \u003chttp://\u003e without validation (CVE-2026-3012)\n  * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480)\n  * ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170)\n  * samba: Remote Code Execution in SAMR (CVE-2026-4408)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-10T00:00:00Z","modified":"2026-10-29T11:32:33.958424297Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"openSUSE-SU-2026:10621-1","title":"libngtcp2-16-1.22.1-1.1 on GA media","description":"These are all security issues fixed in the libngtcp2-16-1.22.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-26T00:00:00Z","modified":"2026-04-27T08:15:14.336765Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:10884-1","title":"ctdb-4.23.8+git.477.f78166bceed-1.1 on GA media","description":"These are all security issues fixed in the ctdb-4.23.8+git.477.f78166bceed-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-28T00:00:00Z","modified":"2026-05-29T08:15:06.442947296Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11121-1","title":"corepack24-24.17.0-1.1 on GA media","description":"These are all security issues fixed in the corepack24-24.17.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-25T00:00:00Z","modified":"2026-06-26T08:15:07.591549835Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21058-1","title":"Security update for nodejs22","description":"This update for nodejs22 fixes the following issues\n\nUpdate to 22.23.0:\n\n- CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response\n  delivery (bsc#1268479).\n- CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted `spec.rawSpec`\n  value can lead to DoS (bsc#1266318).\n- CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).\n- CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header\n  (bsc#1268481).\n- CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths\n  and can cause a denial of service (bsc#1256576).\n- CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).\n- CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).\n- CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).\n- CVE-2026-21715: permission model bypass in realpathSync.native can allow file existence disclosure (bsc#1260482).\n- CVE-2026-21716: promise-based FileHandle methods can be used to modify file permissions and ownership (bsc#1260462).\n- CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).\n- CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).\n- CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).\n- CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path misvalidation\n  (bsc#1268554).\n- CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to\n  resolver and verifier hostname normalization mismatch (bsc#1268593).\n- CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).\n- CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname\n  matching (bsc#1268605).\n- CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver\n  bindings (bsc#1268606).\n- CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).\n- CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).\n- CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to\n  unauthorized connections (bsc#1268608).\n- CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).\n- CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n","status":"published","published":"2026-06-25T13:50:58Z","modified":"2026-06-30T18:24:37.973780169Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21236-1","title":"Security update for nodejs24","description":"This update for nodejs24 fixes the following issues\n\nUpdate to version 24.18.0 (bsc#1269825).\n\nSecurity issues fixed:\n\n- CVE-2026-2581: undici: denial of service due to uncontrolled resource consumption (bsc#1268480).\n- CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery\n  (bsc#1268479).\n- CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted `spec.rawSpec`\n  value can lead to DoS (bsc#1266318).\n- CVE-2026-9678: undici: information disclosure due to improper `cache-control` header parsing (bsc#1268478).\n- CVE-2026-9679: undici: HTTP header injection via `Set-Cookie` percent-decoding (bsc#1268477).\n- CVE-2026-11525: undici: weakening of cookie `SameSite` policy due to incorrect parsing of `Set-Cookie` header\n  (bsc#1268481).\n- CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-40170: ngtcp2: qlog `parameters_set` stack buffer overflow (bsc#1262274).\n- CVE-2026-42338: ip-address: cross-site scripting due to improper HTML escaping of untrusted input (bsc#1268097).\n- CVE-2026-48615: proxy credentials leaked in `ERR_PROXY_TUNNEL` error message (bsc#1268598).\n- CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path misvalidation\n  (bsc#1268554).\n- CVE-2026-48618: unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due to\n  resolver and verifier hostname normalization mismatch (bsc#1268593).\n- CVE-2026-48619: unbounded memory growth in `node:http2` clients via attacker-controlled `ORIGIN` frames (bsc#1268618).\n- CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive\n  hostname matching (bsc#1268605).\n- CVE-2026-48930: `embedded-nul` hostnames can lead to silent authority rebinding due to `c-string` truncation in\n  resolver bindings (bsc#1268606).\n- CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in `http.Agent` (bsc#1268611).\n- CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).\n- CVE-2026-48934: TLS host identity verification bypass via session reuse with different `servername` leads to\n  unauthorized connections (bsc#1268608).\n- CVE-2026-48935: permission model bypass via `FileHandle.utimes()` in the `promises` API (bsc#1268609).\n- CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n\nOther updates and bugfixes:\n- Version 24.18.0:\n  - doc: update `blockList` stability status to release candidate\n  - fs: support caller-supplied `readFile()` buffers\n  - http: close pre-request sockets in `closeIdleConnections`\n  - loader: implement package maps\n  - net: support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive`\n  - tls: add `certificateCompression` option\n  - vfs: dispatch `node:fs/promises` to mounted VFS instances\n  - vfs: add minimal `node:vfs` subsystem\n- For changes in older versions, see https://github.com/nodejs/node/releases.\n- Remove `update-alternatives` from scriptlets if not available.\n- Explicitly `BuildRequire` `update-alternatives` and mark it as being used in post/postun.\n- Add `-fno-lifetime-dse` to `CXXFLAGS` to avoid parallel/test-snapshot-reproducible testsuite failure with GCC 16.\n","status":"published","published":"2026-07-06T20:22:33Z","modified":"2026-07-09T10:00:10.896109389Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22368-1","title":"Security update for nodejs22","description":"This update for nodejs22 fixes the following issues\n\nUpdate to 22.23.0:\n\n- CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response\n  delivery (bsc#1268479).\n- CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted `spec.rawSpec`\n  value can lead to DoS (bsc#1266318).\n- CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).\n- CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header\n  (bsc#1268481).\n- CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths\n  and can cause a denial of service (bsc#1256576).\n- CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).\n- CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).\n- CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).\n- CVE-2026-21715: permission model bypass in realpathSync.native can allow file existence disclosure (bsc#1260482).\n- CVE-2026-21716: promise-based FileHandle methods can be used to modify file permissions and ownership (bsc#1260462).\n- CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).\n- CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).\n- CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).\n- CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path misvalidation\n  (bsc#1268554).\n- CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to\n  resolver and verifier hostname normalization mismatch (bsc#1268593).\n- CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).\n- CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname\n  matching (bsc#1268605).\n- CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver\n  bindings (bsc#1268606).\n- CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).\n- CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).\n- CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to\n  unauthorized connections (bsc#1268608).\n- CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).\n- CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n","status":"published","published":"2026-06-25T12:57:12Z","modified":"2026-07-02T18:24:14.173497112Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22565-1","title":"Security update for nodejs24","description":"This update for nodejs24 fixes the following issues\n\nUpdate to version 24.18.0 (bsc#1269825).\n\nSecurity issues fixed:\n\n- CVE-2026-2581: undici: denial of service due to uncontrolled resource consumption (bsc#1268480).\n- CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery\n  (bsc#1268479).\n- CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted `spec.rawSpec`\n  value can lead to DoS (bsc#1266318).\n- CVE-2026-9678: undici: information disclosure due to improper `cache-control` header parsing (bsc#1268478).\n- CVE-2026-9679: undici: HTTP header injection via `Set-Cookie` percent-decoding (bsc#1268477).\n- CVE-2026-11525: undici: weakening of cookie `SameSite` policy due to incorrect parsing of `Set-Cookie` header\n  (bsc#1268481).\n- CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-40170: ngtcp2: qlog `parameters_set` stack buffer overflow (bsc#1262274).\n- CVE-2026-42338: ip-address: cross-site scripting due to improper HTML escaping of untrusted input (bsc#1268097).\n- CVE-2026-48615: proxy credentials leaked in `ERR_PROXY_TUNNEL` error message (bsc#1268598).\n- CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path misvalidation\n  (bsc#1268554).\n- CVE-2026-48618: unicode dot separator handling can lead to TLS wildcard-depth authentication bypass due to\n  resolver and verifier hostname normalization mismatch (bsc#1268593).\n- CVE-2026-48619: unbounded memory growth in `node:http2` clients via attacker-controlled `ORIGIN` frames (bsc#1268618).\n- CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive\n  hostname matching (bsc#1268605).\n- CVE-2026-48930: `embedded-nul` hostnames can lead to silent authority rebinding due to `c-string` truncation in\n  resolver bindings (bsc#1268606).\n- CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in `http.Agent` (bsc#1268611).\n- CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).\n- CVE-2026-48934: TLS host identity verification bypass via session reuse with different `servername` leads to\n  unauthorized connections (bsc#1268608).\n- CVE-2026-48935: permission model bypass via `FileHandle.utimes()` in the `promises` API (bsc#1268609).\n- CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n\nOther updates and bugfixes:\n- Version 24.18.0:\n  - doc: update `blockList` stability status to release candidate\n  - fs: support caller-supplied `readFile()` buffers\n  - http: close pre-request sockets in `closeIdleConnections`\n  - loader: implement package maps\n  - net: support `TCP_KEEPINTVL` and `TCP_KEEPCNT` in `setKeepAlive`\n  - tls: add `certificateCompression` option\n  - vfs: dispatch `node:fs/promises` to mounted VFS instances\n  - vfs: add minimal `node:vfs` subsystem\n- For changes in older versions, see https://github.com/nodejs/node/releases.\n- Remove `update-alternatives` from scriptlets if not available.\n- Explicitly `BuildRequire` `update-alternatives` and mark it as being used in post/postun.\n- Add `-fno-lifetime-dse` to `CXXFLAGS` to avoid parallel/test-snapshot-reproducible testsuite failure with GCC 16.\n","status":"published","published":"2026-07-06T20:22:30Z","modified":"2026-07-15T18:24:11.41107748Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2633-1","title":"Security update for nodejs24","description":"This update for nodejs24 fixes the following issues\n\nUpdate to 24.17.0:\n\n- CVE-2026-2581: undici: Undici: Denial of Service due to uncontrolled resource consumption (bsc#1268480).\n- CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response\n  delivery (bsc#1268479).\n- CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted `spec.rawSpec`\n  value can lead to DoS (bsc#1266318).\n- CVE-2026-9678: undici: Undici: Information disclosure due to improper cache-control header parsing (bsc#1268478).\n- CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).\n- CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header\n  (bsc#1268481).\n- CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).\n- CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).\n- CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).\n- CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path misvalidation\n  (bsc#1268554).\n- CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to\n  resolver and verifier hostname normalization mismatch (bsc#1268593).\n- CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).\n- CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname\n  matching (bsc#1268605).\n- CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver\n  bindings (bsc#1268606).\n- CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).\n- CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).\n- CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to\n  unauthorized connections (bsc#1268608).\n- CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).\n- CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n","status":"published","published":"2026-06-25T13:34:12Z","modified":"2026-06-26T08:15:07.694943332Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2647-1","title":"Security update for nodejs22","description":"This update for nodejs22 fixes the following issues\n\nUpdate to 22.23.0:\n\n- CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response\n  delivery (bsc#1268479).\n- CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted `spec.rawSpec`\n  value can lead to DoS (bsc#1266318).\n- CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).\n- CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header\n  (bsc#1268481).\n- CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow (bsc#1262274).\n- CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).\n- CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message (bsc#1268598).\n- CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path misvalidation\n  (bsc#1268554).\n- CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to\n  resolver and verifier hostname normalization mismatch (bsc#1268593).\n- CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).\n- CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname\n  matching (bsc#1268605).\n- CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver\n  bindings (bsc#1268606).\n- CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).\n- CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).\n- CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to\n  unauthorized connections (bsc#1268608).\n- CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).\n- CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n","status":"published","published":"2026-06-26T10:34:05Z","modified":"2026-06-27T08:45:06.618615571Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2695-1","title":"Security update for nodejs22","description":"This update for nodejs22 fixes the following issues:\n\n- CVE-2026-48618: tls: normalize hostname for server identity checks (bsc#1268593).\n- CVE-2026-48933: crypto: guard WebCrypto cipher output length (bsc#1268592).\n- CVE-2026-48615: lib,test: redact proxy credentials in tunnel errors (bsc#1268598).\n- CVE-2026-48619: http2: cap originSet size to prevent unbounded memory growth (bsc#1268618).\n- CVE-2026-48928: tls: fix case-sensitive SNI context matching (bsc#1268605).\n- CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes (bsc#1268606).\n- CVE-2026-48934: tls: bind reusable sessions to authenticated host (bsc#1268608).\n- CVE-2026-48617: permission: handle process.chdir on writereport (bsc#1268554).\n- CVE-2026-48931: http: fix response queue poisoning in http.Agent (bsc#1268611).\n- CVE-2026-48935: permission: disable FileHandle utimes with permission model (bsc#1268609).\n- CVE-2026-48937: http2: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n- CVE-2026-12151: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-6733: undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery ( bsc#1268479).\n- CVE-2026-9679: undici: vulnerable to HTTP header injection via Set-Cookie percent-decoding ( bsc#1268477).\n- CVE-2026-11525: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-40170: ngtcp2: qlog parameters_set stack buffer overflow. (bsc#1262274).\n- CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted `spec.rawSpec` ( bsc#1266318).\n- CVE-2026-42338: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).\n","status":"published","published":"2026-06-30T09:06:44Z","modified":"2026-07-01T09:45:06.071847973Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:3929-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\n- CVE-2025-22150: undici: predictable random values used when defining the boundary for a `multipart`/`form-data`\n  request (bsc#1236258).\n- CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery\n  (bsc#1268479).\n- CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted `spec.rawSpec`\n  value can lead to DoS (bsc#1266318).\n- CVE-2026-9679: undici: HTTP header injection via `Set-Cookie` percent-decoding (bsc#1268477).\n- CVE-2026-11525: undici: weakening of cookie `SameSite` policy due to incorrect parsing of `Set-Cookie` header\n  (bsc#1268481).\n- CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).\n- CVE-2026-16729: undici: `setCookie` function does not fully sanitize cookie attributes (bsc#1273591).\n- CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via `Content-Encoding` may lead to resource\n  exhaustion (bsc#1256848).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-40170: ngtcp2: qlog `parameters_set` stack buffer overflow (bsc#1262274).\n- CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).\n- CVE-2026-48615: proxy credentials leaked in `ERR_PROXY_TUNNEL` error message (bsc#1268598).\n- CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path misvalidation\n  (bsc#1268554).\n- CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to\n  resolver and verifier hostname normalization mismatch (bsc#1268593).\n- CVE-2026-48619: unbounded memory growth in `node:http2` clients via attacker-controlled `ORIGIN` frames (bsc#1268618).\n- CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname\n  matching (bsc#1268605).\n- CVE-2026-48930: `embedded-nul` hostnames can lead to silent authority rebinding due to `c-string` truncation in\n  resolver bindings (bsc#1268606).\n- CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in `http.Agent` (bsc#1268611).\n- CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).\n- CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to\n  unauthorized connections (bsc#1268608).\n- CVE-2026-48935: permission model bypass via `FileHandle.utimes()` in the `promises` API (bsc#1268609).\n- CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n- CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust-\n  boundary checks (bsc#1272882).\n- CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).\n- CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).\n- CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).\n- CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).\n- CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).\n- CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).\n- CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many `A` records (bsc#1272947).\n- CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).\n- CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).\n- CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).\n- CVE-2026-69192: ip-address: `Address4` decodes leading-zero octets as decimal while resolvers decode them as octal,\n  which allows for SSRF and trust-boundary bypass (bsc#1277587).\n","status":"published","published":"2026-09-03T07:18:06Z","modified":"2026-09-10T18:23:21.565514799Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3930-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\n- CVE-2025-22150: undici: predictable random values used when defining the boundary for a `multipart`/`form-data`\n  request (bsc#1236258).\n- CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery\n  (bsc#1268479).\n- CVE-2026-9496: pacote: excessive CPU consumption in `addGitSha` when processing a specially crafted `spec.rawSpec`\n  value can lead to DoS (bsc#1266318).\n- CVE-2026-9679: undici: HTTP header injection via `Set-Cookie` percent-decoding (bsc#1268477).\n- CVE-2026-11525: undici: weakening of cookie `SameSite` policy due to incorrect parsing of `Set-Cookie` header\n  (bsc#1268481).\n- CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).\n- CVE-2026-16729: undici: `setCookie` function does not fully sanitize cookie attributes (bsc#1273591).\n- CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via `Content-Encoding` may lead to resource\n  exhaustion (bsc#1256848).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-40170: ngtcp2: qlog `parameters_set` stack buffer overflow (bsc#1262274).\n- CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).\n- CVE-2026-48615: proxy credentials leaked in `ERR_PROXY_TUNNEL` error message (bsc#1268598).\n- CVE-2026-48617: permission model enforcement bypass via `process.report.writeReport()` path misvalidation\n  (bsc#1268554).\n- CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to\n  resolver and verifier hostname normalization mismatch (bsc#1268593).\n- CVE-2026-48619: unbounded memory growth in `node:http2` clients via attacker-controlled `ORIGIN` frames (bsc#1268618).\n- CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname\n  matching (bsc#1268605).\n- CVE-2026-48930: `embedded-nul` hostnames can lead to silent authority rebinding due to `c-string` truncation in\n  resolver bindings (bsc#1268606).\n- CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in `http.Agent` (bsc#1268611).\n- CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).\n- CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to\n  unauthorized connections (bsc#1268608).\n- CVE-2026-48935: permission model bypass via `FileHandle.utimes()` in the `promises` API (bsc#1268609).\n- CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).\n- CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust-\n  boundary checks (bsc#1272882).\n- CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).\n- CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).\n- CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).\n- CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).\n- CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).\n- CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).\n- CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many `A` records (bsc#1272947).\n- CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).\n- CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).\n- CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).\n- CVE-2026-69192: ip-address: `Address4` decodes leading-zero octets as decimal while resolvers decode them as octal,\n  which allows for SSRF and trust-boundary bypass (bsc#1277587).\n","status":"published","published":"2026-09-03T07:19:02Z","modified":"2026-09-10T18:23:17.854773396Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8300-1","title":"ngtcp2 vulnerability","description":"Zou Dikai discovered that ngtcp2 serialized peer transport parameters into\na fixed 1024-byte stack buffer without bounds checking. When qlog was\nenabled, a remote attacker could possibly use this issue to execute\narbitrary code.","status":"published","published":"2026-05-25T10:58:24Z","modified":"2026-06-30T18:16:25.402270673Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}