{"id":"CVE-2026-44605","aliases":["AZL-94665","DEBIAN-CVE-2026-44605","EUVD-2026-53565","GHSA-jgh7-mh2q-3476","OESA-2026-3099","RHSA-2026:33507","SUSE-SU-2026:23192-1","SUSE-SU-2026:23204-1","SUSE-SU-2026:23787-1","SUSE-SU-2026:23796-1","SUSE-SU-2026:3600-1","SUSE-SU-2026:4457-1","UBUNTU-CVE-2026-44605","openSUSE-SU-2026:11193-1","openSUSE-SU-2026:21856-1"],"status":"published","title":"Rpm: heap buffer overflow in ndb slot table parsing","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00178,"percentile":0.07501,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2026-07-01T10:19:37Z","modified":"2026-11-06T18:40:34Z","fixes":[{"ecosystem":"Azure Linux:3","package":"rpm","fixed_in":["4.18.2-2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"rpm","fixed_in":["4.18.2-37.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"rpm","fixed_in":["4.18.2-37.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"rpm","fixed_in":["4.15.1-64.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"rpm","fixed_in":["4.17.0-50.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"rpm","fixed_in":["4.18.2-37.oe2403sp1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"python3-rpm","fixed_in":["0:6.0.1-6.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rpm","fixed_in":["0:6.0.1-6.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rpm-apidocs","fixed_in":["0:6.0.1-6.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rpm-build","fixed_in":["0:6.0.1-6.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rpm-build-libs","fixed_in":["0:6.0.1-6.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rpm-cron","fixed_in":["0:6.0.1-6.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rpm-devel","fixed_in":["0:6.0.1-6.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rpm-libs","fixed_in":["0:6.0.1-6.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rpm-plugin-audit","fixed_in":["0:6.0.1-6.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rpm-plugin-dbus-announce","fixed_in":["0:6.0.1-6.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rpm-plugin-fapolicyd","fixed_in":["0:6.0.1-6.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rpm-plugin-fsverity","fixed_in":["0:6.0.1-6.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rpm-plugin-ima","fixed_in":["0:6.0.1-6.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rpm-plugin-prioreset","fixed_in":["0:6.0.1-6.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rpm-plugin-selinux","fixed_in":["0:6.0.1-6.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rpm-plugin-syslog","fixed_in":["0:6.0.1-6.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rpm-plugin-systemd-inhibit","fixed_in":["0:6.0.1-6.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rpm-plugin-unshare","fixed_in":["0:6.0.1-6.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rpm-sign","fixed_in":["0:6.0.1-6.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rpm-sign-libs","fixed_in":["0:6.0.1-6.2.hum1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"python-rpm","fixed_in":["4.18.0-slfo.1.1_3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"rpm","fixed_in":["4.18.0-slfo.1.1_3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"python-rpm","fixed_in":["4.18.0-8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"rpm","fixed_in":["4.18.0-8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"python-rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"rpm-ndb","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"python-rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"rpm-ndb","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"python-rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"rpm-ndb","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"rpm-ndb","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"rpm-ndb","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"rpm-ndb","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python-rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python-rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python-rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python-rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python-rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python-rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"rpm","fixed_in":["4.14.3-150400.59.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"python-rpm","fixed_in":["4.14.3-150300.58.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"rpm","fixed_in":["4.14.3-150300.58.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"rpm-ndb","fixed_in":["4.14.3-150300.58.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.2-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0+dfsg-1","4.18.0+dfsg-1+deb12u1","4.18.2+dfsg-1","4.18.2+dfsg-1.1~exp1","4.18.2+dfsg-2","4.18.2+dfsg-2.1","4.18.2+dfsg-2.1~exp1","4.19.1.1+dfsg-1","4.19.1.1+dfsg-1~exp","4.20.0+dfsg-1","4.20.0+dfsg-2","4.20.0+dfsg-3","4.20.0+dfsg-4","4.20.1+dfsg-1","4.20.1+dfsg-2","4.20.1+dfsg-3","6.0.0-1","6.0.0-2","6.0.1-1","6.1.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.1+dfsg-3","6.0.0-1","6.0.0-2","6.0.1-1","6.1.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.1+dfsg-3","6.0.0-1","6.0.0-2","6.0.1-1","6.1.0-1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.2-37.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.2-37.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.1-64.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.0-50.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.2-37.oe2403sp1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1-6.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1-6.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rpm-apidocs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1-6.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rpm-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1-6.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rpm-build-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1-6.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rpm-cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1-6.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rpm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1-6.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rpm-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1-6.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rpm-plugin-audit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1-6.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rpm-plugin-dbus-announce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1-6.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rpm-plugin-fapolicyd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1-6.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rpm-plugin-fsverity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1-6.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rpm-plugin-ima","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1-6.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rpm-plugin-prioreset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1-6.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rpm-plugin-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1-6.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rpm-plugin-syslog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1-6.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rpm-plugin-systemd-inhibit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1-6.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rpm-plugin-unshare","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1-6.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rpm-sign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1-6.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rpm-sign-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1-6.2.hum1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"python-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-slfo.1.1_3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-slfo.1.1_3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"python-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0-8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"rpm-plugin-imaevmsign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"rpm-plugin-imaevmsign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"python-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"rpm-plugin-imaevmsign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"python-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"rpm-ndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"python-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"rpm-ndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"python-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"rpm-ndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"rpm-ndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"rpm-ndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"rpm-ndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150400.59.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"python-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150300.58.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150300.58.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"rpm-ndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.3-150300.58.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.11.1-2","4.11.1-3","4.11.1-3ubuntu0.1","4.11.1-3ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.0.1+dfsg1-3build2","4.12.0.1+dfsg1-3build3","4.12.0.1+dfsg1-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.0.2+dfsg1-2build2","4.14.0+dfsg1-2","4.14.1+dfsg1-2","4.14.1+dfsg1-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.14.2.1+dfsg1-1","4.14.2.1+dfsg1-1build1","4.14.2.1+dfsg1-1build2","4.14.2.1+dfsg1-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.16.1.2+dfsg1-3ubuntu1","4.16.1.2+dfsg1-3ubuntu3","4.17.0+dfsg1-1","4.17.0+dfsg1-3","4.17.0+dfsg1-4","4.17.0+dfsg1-4build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0+dfsg-1build1","4.18.0+dfsg-1build2","4.18.2+dfsg-1","4.18.2+dfsg-2","4.18.2+dfsg-2.1build1","4.18.2+dfsg-2.1build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.1+dfsg-1","4.20.1+dfsg-2","4.20.1+dfsg-2build1","4.20.1+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.1-1build1","6.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.1+dfsg-3","6.0.0-2","6.0.1-1","6.0.1-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.1-8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"rpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"rpm-plugin-imaevmsign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.1-160000.3.1"}]}],"bundled":2}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:33507","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44605","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482481","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44605","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-jgh7-mh2q-3476"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-44605","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3099","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33507.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44605","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623192-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1269584","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44605","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623204-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623787-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218459","tags":["report"]},{"url":"https://bugzilla.suse.com/1253139","tags":["report"]},{"url":"https://bugzilla.suse.com/1259215","tags":["report"]},{"url":"https://bugzilla.suse.com/1268747","tags":["report"]},{"url":"https://bugzilla.suse.com/1269150","tags":["report"]},{"url":"https://bugzilla.suse.com/1269571","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44604","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623796-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263600-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1240054","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264457-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-44605","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-44605","title":"Rpm: heap buffer overflow in ndb slot table parsing","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable.","status":"published","published":"2026-08-05T17:29:27.189Z","modified":"2026-11-06T18:40:34.705Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-06T19:59:20.130638Z"}],"euvd":[{"id":"EUVD-2026-53565","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable.","status":"published","published":"2026-08-05T17:29:27Z","modified":"2026-11-06T18:40:34Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T20:06:05.664912Z"}],"ghsa":[{"id":"GHSA-jgh7-mh2q-3476","title":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap...","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable.","status":"published","published":"2026-08-05T18:31:40Z","modified":"2026-08-05T18:31:49Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:10:07.926015Z"}],"nvd":[{"id":"CVE-2026-44605","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable.","status":"published","published":"2026-08-05T18:17:11.173Z","modified":"2026-11-06T19:17:50.757Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-06T22:02:12.917468Z"}],"osv":[{"id":"DEBIAN-CVE-2026-44605","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable.","status":"published","published":"2026-08-05T18:17:11.173Z","modified":"2026-11-07T09:47:38.33269468Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-07T10:14:19.880839Z"},{"id":"OESA-2026-3099","title":"rpm security update","description":"The RPM Package Manager (RPM) is a powerful package management system capability as below\r\n\r\nSecurity Fix(es):\n\nA heap-based buffer overflow vulnerability was found in RPM\u0026apos;s NDB (New Database) backend in the lib/backend/ndb/rpmpkg.c file. This vulnerability is classified as critical and could affect confidentiality, integrity, and availability of the system.(CVE-2026-44605)","status":"published","published":"2026-07-24T11:11:59Z","modified":"2026-08-18T01:21:21.389393547Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:33507","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-01T10:19:37Z","modified":"2026-10-17T10:12:15Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"UBUNTU-CVE-2026-44605","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable.","status":"published","published":"2026-08-05T18:17:00Z","modified":"2026-10-17T12:58:20.989344538Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:26.396868Z"},{"id":"AZL-94665","title":"CVE-2026-44605 affecting package rpm for versions less than 4.18.2-2","description":"A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable.","status":"published","published":"2026-08-05T18:17:11Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"openSUSE-SU-2026:11193-1","title":"librpmbuild10-4.20.1-8.1 on GA media","description":"These are all security issues fixed in the librpmbuild10-4.20.1-8.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-06T00:00:00Z","modified":"2026-07-07T08:30:08.096757735Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21856-1","title":"Security update for rpm","description":"This update for rpm fixes the following issues:\n\nChanges in rpm:\n\n- split imaevmsign plugin into a multibuild flavor\n\nChanges in rpm:\n\n- Add Requires: (rpm-plugin-selinux if selinux-policy)\n- harden ndb code [bsc#1269584] [CVE-2026-44605]\n- split all plugins into subpackages\n  * this allows for an easy way to get rid of a plugin, it's also\n    what other distributions do\n- make the imaevmsign plugin build in a multibuild flavor\n- rpm2archive: use size 0 for hardlinked files as bnew versions of\n  gnu tar reject non-zero sizes [bsc#1269150]\n- backport fix for add_sysuser macro [bsc#1269571]\n- backport rpmuncompress security fix [bsc#1268747] [CVE-2026-44604]\n- switch from rpmpgp_legacy to libpgpr\n  * multiple bug fixes, support for v5 and v6 signatures\n- turn on imaevm file signature support and move the imaevm code\n  that needs the libimaevm library into a plugin. Put this\n  plugin into a new \"rpm-imaevmsign\" subpackage. [jsc#PED-7246]\n- Fix \"unexpected EOF\" when using rpmbuild to install ELF binaries\n  due to syntax error in /usr/lib/rpm/brp-strip. (boo#1259215)\n- Remove /var/lib/rpm migration scripting, retain an error if old\n  location is found\n- Use systemd-tmpfiles to create \u0026 maintain /var/lib/rpm symlink\n  (boo#1253139)\n- flush scriptlet notification messages in --runposttrans\n  * needed to fix leaking tmp files [bsc#1218459]\n  * added \"rpm_flushes_runposttrans\" provides for libzypp\n","status":"published","published":"2026-09-16T14:28:22Z","modified":"2026-09-17T18:23:13.841578988Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23192-1","title":"Security update for rpm","description":"This update for rpm fixes the following issue:\n\n- CVE-2026-44605: heap buffer overflow in NDB database backend due to unchecked 32-bit arithmetic when parsing the slot\n  table (bsc#1269584).\n","status":"published","published":"2026-08-18T17:42:12Z","modified":"2026-08-26T18:23:31.187141955Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23204-1","title":"Security update for rpm","description":"This update for rpm fixes the following issue:\n\n- CVE-2026-44605: heap buffer overflow in NDB database backend due to unchecked 32-bit arithmetic when parsing the slot\n  table (bsc#1269584).\n","status":"published","published":"2026-08-17T19:48:21Z","modified":"2026-08-26T18:23:31.681642122Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23787-1","title":"Security update for rpm","description":"This update for rpm fixes the following issues:\n\nChanges in rpm:\n\n- split imaevmsign plugin into a multibuild flavor\n\nChanges in rpm:\n\n- Add Requires: (rpm-plugin-selinux if selinux-policy)\n- harden ndb code [bsc#1269584] [CVE-2026-44605]\n- split all plugins into subpackages\n  * this allows for an easy way to get rid of a plugin, it's also\n    what other distributions do\n- make the imaevmsign plugin build in a multibuild flavor\n- rpm2archive: use size 0 for hardlinked files as bnew versions of\n  gnu tar reject non-zero sizes [bsc#1269150]\n- backport fix for add_sysuser macro [bsc#1269571]\n- backport rpmuncompress security fix [bsc#1268747] [CVE-2026-44604]\n- switch from rpmpgp_legacy to libpgpr\n  * multiple bug fixes, support for v5 and v6 signatures\n- turn on imaevm file signature support and move the imaevm code\n  that needs the libimaevm library into a plugin. Put this\n  plugin into a new \"rpm-imaevmsign\" subpackage. [jsc#PED-7246]\n- Fix \"unexpected EOF\" when using rpmbuild to install ELF binaries\n  due to syntax error in /usr/lib/rpm/brp-strip. (boo#1259215)\n- Remove /var/lib/rpm migration scripting, retain an error if old\n  location is found\n- Use systemd-tmpfiles to create \u0026 maintain /var/lib/rpm symlink\n  (boo#1253139)\n- flush scriptlet notification messages in --runposttrans\n  * needed to fix leaking tmp files [bsc#1218459]\n  * added \"rpm_flushes_runposttrans\" provides for libzypp\n","status":"published","published":"2026-09-16T14:30:37Z","modified":"2026-09-27T18:23:12.078882283Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23796-1","title":"Security update for rpm","description":"This update for rpm fixes the following issues:\n\nChanges in rpm:\n\n- split imaevmsign plugin into a multibuild flavor\n\nChanges in rpm:\n\n- Add Requires: (rpm-plugin-selinux if selinux-policy)\n- harden ndb code [bsc#1269584] [CVE-2026-44605]\n- split all plugins into subpackages\n  * this allows for an easy way to get rid of a plugin, it's also\n    what other distributions do\n- make the imaevmsign plugin build in a multibuild flavor\n- rpm2archive: use size 0 for hardlinked files as bnew versions of\n  gnu tar reject non-zero sizes [bsc#1269150]\n- backport fix for add_sysuser macro [bsc#1269571]\n- backport rpmuncompress security fix [bsc#1268747] [CVE-2026-44604]\n- switch from rpmpgp_legacy to libpgpr\n  * multiple bug fixes, support for v5 and v6 signatures\n- turn on imaevm file signature support and move the imaevm code\n  that needs the libimaevm library into a plugin. Put this\n  plugin into a new \"rpm-imaevmsign\" subpackage. [jsc#PED-7246]\n- Fix \"unexpected EOF\" when using rpmbuild to install ELF binaries\n  due to syntax error in /usr/lib/rpm/brp-strip. (boo#1259215)\n- Remove /var/lib/rpm migration scripting, retain an error if old\n  location is found\n- Use systemd-tmpfiles to create \u0026 maintain /var/lib/rpm symlink\n  (boo#1253139)\n- flush scriptlet notification messages in --runposttrans\n  * needed to fix leaking tmp files [bsc#1218459]\n  * added \"rpm_flushes_runposttrans\" provides for libzypp\n","status":"published","published":"2026-09-16T14:30:37Z","modified":"2026-09-27T18:23:12.682337023Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3600-1","title":"Security update for rpm","description":"This update for rpm fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-44605: heap buffer overflow in NDB database backend due to unchecked 32-bit arithmetic when parsing the slot\n  table (bsc#1269584).\n\nOther updates and bugfixes:\n\n- Fix `libelf` handle not being closed, resulting in build errors when using a NFS buildroot (bsc#1240054).\n","status":"published","published":"2026-08-12T12:00:35Z","modified":"2026-08-13T09:30:12.505784141Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4457-1","title":"Security update for rpm","description":"This update for rpm fixes the following issue:\n\nSecurity issues fixed:\n\n- CVE-2026-44605: heap buffer overflow in NDB database backend due to unchecked 32-bit arithmetic when parsing the slot\n  table (bsc#1269584).\n\nOther updates and bugfixes:\n\n- Fix `libelf` handle not being closed, resulting in build errors when using a NFS buildroot (bsc#1240054).\n","status":"published","published":"2026-10-05T10:50:23Z","modified":"2026-10-05T18:00:05.542804097Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}