CVE-2026-65138: Medium severity debian/slurm-wlm vulnerability
Published Nov 3, 2026
·Updated
Fix heap over-read when unpacking a malformed forward data RPC in slurmd. Fix a slurmd crash when handling a malformed forward data RPC with a missing socket address
Other sources
NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filtrate authentication keys.
— MITRE
Affected Software
4 affected componentsFixes available
debian/slurm-wlm*
debian/slurm-wlm<24.11.5-4+deb13u1
24.11.5-4+deb13u1
debian/slurm-wlm<26.05.4-1
26.05.4-1
debian/slurm-wlm<=22.05.8-4+deb12u3, <=24.11.5-4
24.11.5-4+deb13u126.05.5-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/slurm-wlmto a version that resolves this vulnerability.Fixed in 24.11.5-4+deb13u1 - Upgrade
Upgrade
debian/slurm-wlmto a version that resolves this vulnerability.Fixed in 26.05.4-1 - Upgrade
Upgrade
debian/slurm-wlmto a version that resolves this vulnerability.Fixed in 24.11.5-4+deb13u1Fixed in 26.05.5-1
Event History
Nov 3, 2026
CVE Published
via MITRE·03:34 PM
Data Sourced
via MITRE·03:34 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeakness
Data Sourced
via OSV·04:17 PM
DescriptionSeverityAffected Software