CVE-2026-90455: Security vulnerability
A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing the earlier, vulnerable version into a log-processing component. The only code path in that component using the library issues a request to a single fixed, trusted vendor URL at initialization and does not process attacker-controlled input through the library, limiting practical exploitability of the reintroduced version in this context.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Malcolmto a version that resolves this vulnerability.Fixed in September 2026 or later
Event History
Frequently Asked Questions
Is this realistically exploitable in the affected component?
Practical exploitability is limited because the library is used only to request a single fixed, trusted vendor URL during initialization. The component does not pass attacker-controlled input through the HTTP client library on that code path.
What attacker control would be needed to make this issue more concerning?
The available information indicates that exploitation would become more plausible only if an attacker could influence the library's request handling or the fixed trusted destination. No attacker-controlled input is processed through the library in the described component path.