MGASA-2026-0574: Updated znc package fixes security vulnerabilities

Q: Who can trigger the module-unloading use-after-free issue?

An unprivileged user can trigger the use-after-free when modules are unloaded.

Q: What access is required to trigger the crypt-module null pointer dereference?

The null pointer dereference in the crypt module is triggered by an IRC server.

Q: What component update addresses the bundled client-side vulnerability?

The package updates its previously bundled vulnerable jQuery version to jQuery 3.5.1 for CVE-2020-11022.

Published Nov 5, 2026

Updated

Updated the old bundled vulnerable version of jQuery to 3.5.1. (CVE-2020-11022) Use-after-free when unloading modules, triggered by unprivileged users. (CVE-2026-82373) Null pointer dereference in crypt module, triggered by IRC server. (CVE-2026-82374)

Affected Software

1 affected componentFixes available

mageia/znc<1.10.3-1.mga10

1.10.3-1.mga10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade mageia/znc to a version that resolves this vulnerability.
Fixed in 1.10.3-1.mga10
Upgrade
Upgrade jQuery to a version that resolves this vulnerability.
Fixed in 3.5.1

Event History

Nov 5, 2026

Advisory Published

via OSV·05:11 AM

Data Sourced

via OSV·05:11 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Who can trigger the module-unloading use-after-free issue?

An unprivileged user can trigger the use-after-free when modules are unloaded.

What access is required to trigger the crypt-module null pointer dereference?

The null pointer dereference in the crypt module is triggered by an IRC server.

What component update addresses the bundled client-side vulnerability?

The package updates its previously bundled vulnerable jQuery version to jQuery 3.5.1 for CVE-2020-11022.

MGASA-2026-0574: Updated znc package fixes security vulnerabilities

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who can trigger the module-unloading use-after-free issue?

What access is required to trigger the crypt-module null pointer dereference?

What component update addresses the bundled client-side vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Who can trigger the module-unloading use-after-free issue?

What access is required to trigger the crypt-module null pointer dereference?

What component update addresses the bundled client-side vulnerability?