{"id":"CVE-2026-82373","aliases":["DEBIAN-CVE-2026-82373","MGASA-2026-0574","UBUNTU-CVE-2026-82373","openSUSE-SU-2026:11782-1"],"status":"published","title":"Updated znc package fixes security vulnerabilities","description":"Updated the old bundled vulnerable version of jQuery to 3.5.1.\n(CVE-2020-11022)\nUse-after-free when unloading modules, triggered by unprivileged users.\n(CVE-2026-82373)\nNull pointer dereference in crypt module, triggered by IRC server.\n(CVE-2026-82374)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-09-14T00:00:00Z","modified":"2026-11-05T05:15:03Z","fixes":[{"ecosystem":"Debian:13","package":"znc","fixed_in":["1.9.1-2+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"znc","fixed_in":["1.10.3-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"znc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.1-1","1.10.2-1","1.10.3-1","1.8.2-3.1","1.8.2-3.1+deb12u1","1.8.2-4","1.9.0-1","1.9.0-2","1.9.1-1","1.9.1-2"]},{"source":"osv","ecosystem":"Debian:13","package":"znc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-2+deb13u1"}]}],"versions":["1.9.1-2"]},{"source":"osv","ecosystem":"Debian:14","package":"znc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-1"}]}],"versions":["1.10.1-1","1.10.2-1","1.9.1-2"]},{"source":"osv","ecosystem":"Mageia:10","package":"znc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-1.mga10"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"znc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0-5","1.0-5build1","1.2-1","1.2-2","1.2-3","1.2-3build1","1.2-3ubuntu0.1","1.2-3ubuntu0.1+esm1","1.2-3ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"znc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.1-1","1.6.1-1build1","1.6.1-2","1.6.2-1","1.6.2-2","1.6.2-2build1","1.6.3-1","1.6.3-1ubuntu0.1","1.6.3-1ubuntu0.2","1.6.3-1ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"znc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.5-2build2","1.6.5-2build3","1.6.5-2build4","1.6.5-2build5","1.6.6-1","1.6.6-1ubuntu0.1","1.6.6-1ubuntu0.2","1.6.6-1ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"znc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.4-7","1.7.4-7build1","1.7.5-1","1.7.5-2","1.7.5-2build1","1.7.5-2build2","1.7.5-2build3","1.7.5-3","1.7.5-3build1","1.7.5-4","1.7.5-4ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"znc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.2-2build1","1.8.2-2build2","1.8.2-2build3","1.8.2-2build5","1.8.2-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"znc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.2-3.1","1.8.2-4","1.8.2-4build1","1.8.2-4build3","1.9.0-2build2","1.9.0-2build3","1.9.0-2ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"znc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.1-1build3","1.10.2-1","1.10.2-1ubuntu1","1.10.2-1ubuntu2","1.10.2-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"znc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.1-2build5","1.10.1-1","1.10.1-1build1","1.10.1-1build2","1.10.1-1build3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"znc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-1.1"}]}],"bundled":3}],"references":[{"url":"https://security-tracker.debian.org/tracker/CVE-2026-82373","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0574.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36333","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/43LPDUREWN6TG2MXJYUQPY2QK3CRKWAD/","tags":["web"]},{"url":"https://wiki.znc.in/ChangeLog/1.10.3","tags":["web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3I6VFAWFKIZEOR37U3K7TA7GJVMFAULQ/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-82373","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-82373","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-82373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-82374","tags":["web"]}],"sources":{"osv":[{"id":"DEBIAN-CVE-2026-82373","status":"published","published":"2026-09-16T07:47:23.115762712Z","modified":"2026-09-23T23:00:10.359701507Z","updated_at":"2026-11-02T15:46:04.577397Z"},{"id":"MGASA-2026-0574","title":"Updated znc package fixes security vulnerabilities","description":"Updated the old bundled vulnerable version of jQuery to 3.5.1.\n(CVE-2020-11022)\nUse-after-free when unloading modules, triggered by unprivileged users.\n(CVE-2026-82373)\nNull pointer dereference in crypt module, triggered by IRC server.\n(CVE-2026-82374)\n","status":"published","published":"2026-11-05T05:11:54Z","modified":"2026-11-05T05:15:03.206668978Z","updated_at":"2026-11-05T07:10:31.343344Z"},{"id":"openSUSE-SU-2026:11782-1","title":"znc-1.10.3-1.1 on GA media","description":"These are all security issues fixed in the znc-1.10.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-14T00:00:00Z","modified":"2026-09-15T10:15:04.091260244Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"UBUNTU-CVE-2026-82373","description":"[Unknown description]","status":"published","published":"2026-09-17T00:00:00Z","modified":"2026-10-17T13:01:11.854120693Z","updated_at":"2026-11-02T16:57:22.213888Z"}]}}