It was discovered that libnfs did not properly enforce the maximum size bound during ZDR decoding, resulting in an out-of-bounds write. An attacker could possibly use this issue to cause libnfs to crash, resulting in a denial of service, or execute arbitrary code.
It was discovered that FreeRDP contained multiple security issues. An attacker could possibly use these issues to obtain sensitive information, cause FreeRDP to crash, resulting in a denial of service, or execute arbitrary code.
USN-8952-1 fixed vulnerabilities in Tornado. Unfortunately that update was incomplete due to an incomplete fix for CVE-2026-103263, which broke static file serving for applications that subclass Tornado's StaticFileHandler, such as Jupyter, and could introduce a regression. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly use these issues to cause a denial of service, expose sensitive information, or bypass access controls.
(CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992, CVE-2026-103262, CVE-2026-103263)
It was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly use these issues to cause a denial of service, expose sensitive information, or bypass access controls.
(CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992, CVE-2026-103262, CVE-2026-103263)
It was discovered that the ca-certificates JKS integration was not working properly, resulting in CA certificates removed from the system bundle not being removed from the JKS keystore. This update corrects the feature and resyncs the keystore with the system CA certificates list.
It was discovered that Twisted's IMAP server mishandled wildcard patterns in mailbox list commands. An authenticated remote attacker could possibly use this issue to cause Twisted to use excessive resources, leading to a denial of service.
Max Justicz discovered that APT incorrectly handled hard links when encountering redirects and retrying package downloads. A remote on-path attacker could possibly use this issue to trick APT into installing an unverified package and achieve remote code execution with root privileges.
It was discovered that libsoup incorrectly handled certain WebSocket frames. A remote attacker could possibly use this issue to cause an application to crash or expose sensitive information. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-12478)
It was discovered that libsoup incorrectly handled certain data URIs. A remote attacker could possibly use this issue to cause an application to crash or expose sensitive information. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-102555)
It was discovered that libsoup incorrectly handled certain WebSocket messages. A remote attacker could possibly use this issue to cause an application to crash. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-102556)
It was discovered that libsoup incorrectly handled fragmented WebSocket messages. A remote attacker could possibly use this issue to cause an application to crash. (CVE-2026-102557)
It was discovered that libsoup incorrectly handled certain WebSocket frames. A remote attacker could possibly use this issue to cause an application to crash. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-102558)
It was discovered that libsoup incorrectly handled large WebSocket messages. An attacker could possibly use this issue to cause an application to crash. (CVE-2026-102559)
It was discovered that libsoup incorrectly handled compressed WebSocket messages. An attacker could possibly use this issue to cause an application to crash. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-102560)
It was discovered that libsoup did not properly handle certain HTTP requests. A remote attacker could possibly use this issue to inject arbitrary HTTP requests. (CVE-2026-103399)
It was discovered that libsoup incorrectly handled proxy credentials. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-12547)
It was discovered that libsoup incorrectly handled multipart messages. A remote attacker could possibly use this issue to cause an application to crash or obtain sensitive information. (CVE-2026-12548)
It was discovered that libmspack did not properly initialize pointers when handling errors while reading KWAJ archive headers. An attacker could possibly use this issue to cause libmspack to crash, resulting in a denial of service, or execute arbitrary code.
It was discovered that HAProxy incorrectly handled truncated HTTP/2 PING frames. A remote attacker could possibly use this issue to cause HAProxy to consume excessive CPU resources, leading to a denial of service. (CVE-2026-110353)
It was discovered that HAProxy incorrectly handled certain HTTP/1.1 chunked requests. A remote attacker could possibly use this issue to cause HAProxy to consume excessive CPU resources, leading to a denial of service. (CVE-2026-110354)
It was discovered that PCRE2 did not correctly manage memory when processing certain patterns. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-86145)
Albert Zhang discovered that PCRE2 did not correctly process certain input. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-89156)
It was discovered that PCRE2 did not correctly handle large patterns. On 32-bit platforms, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-89157)
It was discovered that PCRE2 did not correctly handle certain patterns. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-89158)
Ilia Alshanetsky discovered that PCRE2 did not correctly handle certain input. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-89160)
It was discovered that PCRE2 did not correctly manage memory when handling certain patterns. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-89161)
It was discovered that PCRE2 could expose uninitialized data in certain circumstances. A local attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-89162)
Michael Allen discovered that PCRE2 did not correctly manage memory when using just-in-time compilation. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-103111)
It was discovered that Bind incorrectly handled certain DNS messages with repeated singleton records such as SOA, CNAME, or DNAME records. A remote attacker could possibly use this issue to cause Bind to use excessive memory, leading to a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-75029)
It was discovered that Bind incorrectly handled cached DNSSEC proofs. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-19662)
It was discovered that Bind incorrectly handled certain invalid DNSSEC records. A remote attacker could possibly use this issue to cause Bind to use excessive CPU resources, leading to a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-19668)
It was discovered that Bind incorrectly handled malformed answers on resolvers configured to use DNS64. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-19666)
It was discovered that Bind incorrectly handled TKEY queries when no global options block was present. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-76163)
It was discovered that Bind incorrectly verified TSIG signatures during zone transfers. A remote attacker could possibly use this issue to inject unauthorized zone contents into a secondary server. This issue only affected Ubuntu 26.10. (CVE-2026-19033)
It was discovered that Bind incorrectly handled certain NSEC wildcard proofs. A remote attacker could possibly use this issue to forge NXDOMAIN responses and hide the existence of wildcard records. This issue only affected Ubuntu 26.10. (CVE-2026-19941)
It was discovered that Bind incorrectly handled DNS-over-HTTPS requests with invalid SIG(0) records. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-77692)
It was discovered that Bind incorrectly handled malformed zones containing NS or DNAME nodes above the zone origin. An attacker could possibly use this issue to cause Bind to serve out-of-zone records as authoritative, leading to cache poisoning. This issue only affected Ubuntu 26.10. (CVE-2026-78301)
It was discovered that Bind incorrectly handled SVCB/HTTPS AliasMode records referencing large numbers of ServiceMode records. A remote attacker could possibly use this issue to cause Bind to exhaust resources, leading to a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-81563)
It was discovered that Bind incorrectly validated NSEC3 records from unrelated sibling zones. A remote attacker could possibly use this issue to perform a DNSSEC downgrade attack and have forged unsigned answers accepted. This issue only affected Ubuntu 26.10. (CVE-2026-77119)
It was discovered that Bind incorrectly handled wildcard answers with mixed NSEC and NSEC3 proofs. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-80274)
It was discovered that Bind incorrectly handled oversized negative cache records. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-19667)
It was discovered that Bind incorrectly handled cached trees of SVCB/HTTPS AliasMode records. A remote attacker could possibly use this issue to cause Bind to use excessive CPU resources, leading to a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-81736)
It was discovered that Bind incorrectly limited the processing of compression pointers in inbound DNS messages. A remote attacker could possibly use this issue to cause Bind to use excessive CPU and memory resources, leading to a denial of service. (CVE-2026-19630)
It was discovered that Bind incorrectly serialized access to shared GSS-TSIG security contexts. A remote attacker could possibly use this issue to corrupt memory and execute arbitrary code. (CVE-2026-94300)
It was discovered that Bind incorrectly handled redirect zones when used together with strict QNAME minimization. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-96888)
It was discovered that Bind incorrectly handled certain RPZ configurations when processing queries with and without recursion. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. (CVE-2026-97313)
USN-8927-1 fixed vulnerabilities in curl. This update provides the corresponding fixes for Ubuntu 26.10.
Original advisory details:
It was discovered that curl, when built with GnuTLS support, had an out-of-bounds read in the WebSocket send path. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-107928)
Maksim discovered that curl did not correctly include the interface binding in connection reuse decisions when CURLOPTINTERFACE was used. An attacker could possibly use this issue to cause connections to go out from an unintended source address. (CVE-2026-107929)
Stanislav Fort discovered that curl did not properly clear AWS SigV4 authentication state when CURLOPTAWSSIGV4 was set to NULL. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-86409)
Stanislav Fort discovered that the curl command line tool did not set SSH host verification options when following redirects to SFTP or SCP URLs. An attacker could possibly use this issue to perform machine-in-the-middle attacks. (CVE-2026-86410)
Stanislav Fort discovered that curl did not properly handle cookie jar entries that could not be reloaded. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-86412)
Stanislav Fort discovered that an HTTP proxy could trick libcurl into sending credentials to the proxy itself by responding to a CONNECT request with an unexpected authentication challenge. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-86414)
Stanislav Fort discovered that curl did not correctly handle HSTS entries when an includeSubDomains parent entry was imported before a longer-lived child entry. An attacker could possibly use this issue to cause curl to use unencrypted HTTP connections. (CVE-2026-87862)
Stanislav Fort discovered that curl did not properly handle HSTS max-age values that exceeded calendar time structure bounds. An attacker could possibly use this issue to cause a denial of service or data loss. (CVE-2026-87863)
Stanislav Fort discovered that curl did not properly handle IMAP APPEND commands when CURLOPTCRLF was enabled, allowing overflow bytes to be interpreted as pipelined commands. An authenticated attacker could possibly use this issue to inject arbitrary IMAP commands. (CVE-2026-87864)
Bobbeh Rhino discovered that libcurl, when used with libssh2 and a hashed knownhosts file, could misreport a host key mismatch as a missing key. An attacker could possibly use this issue to perform machine-in-the-middle attacks. (CVE-2026-87865)
Joshua Rogers discovered that curl did not properly handle long cookie entries written to a Netscape cookie jar. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-92386)
Joshua Rogers discovered that a malicious FTP, IMAP, POP3, or SMTP server could cause libcurl to block indefinitely by omitting the final control-response line. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-92387)
Joshua Rogers discovered that libcurl had a use-after-free vulnerability in the FTP wildcard matching code. An attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-92388)
Joshua Rogers discovered that libcurl's TFTP state machine did not properly validate transfer directions, allowing a malicious server to force the client into transmit mode. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-92389)
Joshua Rogers discovered that curl did not properly enforce its file overwrite protection when using --remote-header-name in certain circumstances. An attacker could possibly use this issue to overwrite local files. (CVE-2026-92390)
Joshua Rogers discovered that curl had a stack overflow vulnerability when processing deeply nested MIME structures. An attacker could possibly use this issue to cause curl to crash, resulting in a denial of service. (CVE-2026-92391)
Joshua Rogers discovered that libcurl could expose credentials in the URL returned by CURLINFOEFFECTIVEURL when credentials were retrieved from a .netrc file. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-94266)
Joshua Rogers discovered that libcurl had a use-after-free vulnerability during HTTP/2 uploads when handling RSTSTREAM responses from the server. An attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-92392)
It was discovered that the .NET Blazor WebAssembly debug proxy did not properly escape certain values. An attacker could possibly use this issue to execute arbitrary code. The fix for this CVE was originally released via USN-8942-1, but it was found to be incomplete. This issue only affected dotnet10 and dotnet11. (CVE-2026-102870)
It was discovered that the Brotli decompression library used by .NET incorrectly handled certain compressed streams. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-111497)
Alen Cheung discovered that .NET did not properly handle file ownership in certain circumstances. An attacker could possibly use this issue to elevate local privileges. (CVE-2026-114148)
Multiple security issues were discovered in .NET and this update includes new upstream .NET versions to fix these issues.
.NET 8 has been updated to 8.0.32 in Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. .NET 10 has been updated to 10.0.13 in Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. .NET 11 has been updated to 11.0.0~rc2 in Ubuntu 26.10.
In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.
It was discovered that Brotli incorrectly handled certain compressed streams. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
It was discovered that PHP did not properly validate the size of MySQL server packets in the mysqlnd driver. A malicious server could possibly use this issue to cause PHP to crash, resulting in a denial of service. This issue was only addressed in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2025-1218)
It was discovered that PHP incorrectly handled response buffer sizes in the SOAP HTTP client. A malicious server could possibly use this issue to cause PHP to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2025-14181)
It was discovered that PHP incorrectly handled certain TAR archive headers in the Phar extension. An attacker could possibly use this issue to inject arbitrary files into a crafted archive. (CVE-2026-6103)
It was discovered that PHP did not limit recursion depth when parsing certain SOAP requests. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2026-91765)
It was discovered that PHP incorrectly handled authentication headers when following HTTP redirects. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-91766)
It was discovered that PHP incorrectly handled wildcard names in TLS server certificates. A malicious server could possibly use this issue to cause PHP to crash, resulting in a denial of service. This issue did not affect Ubuntu 14.04 LTS. (CVE-2026-91767)
It was discovered that PHP incorrectly validated IPv6 client addresses in the FastCGI client access check. A remote attacker could possibly use this issue to bypass access restrictions. This issue did not affect Ubuntu 14.04 LTS. (CVE-2026-91768)
It was discovered that PHP incorrectly performed TLS peer name verification. A remote attacker could possibly use this issue to impersonate a trusted server. (CVE-2026-91769)
It was discovered that PHP incorrectly handled certain stream filter options. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-92842)
It was discovered that PHP incorrectly handled empty Location headers when following HTTP redirects. A malicious server could possibly use this issue to redirect the client to an unintended location. This issue did not affect Ubuntu 14.04 LTS. (CVE-2026-93682)
Ali Mashally discovered that authd did not properly validate user identities when matching accounts from identity providers. An attacker could possibly use this issue to gain access to another user's local account and files, resulting in unauthorized access to sensitive information.
It was discovered that nginx incorrectly handled certain configurations using the alias directive together with rewrite rules. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-15176) It was discovered that nginx incorrectly handled map directives using regex matching under certain circumstances. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-93479) It was discovered that nginx incorrectly handled HTTP/3 requests when proxyrequestbuffering was enabled. This issue only affected Ubuntu 26.04 LTS and Ubuntu 26.10. A remote attacker could possibly use this issue to inject data into proxied requests. (CVE-2026-95101) It was discovered that nginx incorrectly handled asynchronous file I/O in certain configurations with Server Side Includes pages. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-97205) It was discovered that nginx incorrectly handled SSL session ticket keys when configured with a shared session cache but without explicit ticket key rotation. This issue only affected Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. A remote attacker could possibly use this issue to forge client SSL sessions and bypass client certificate verification. (CVE-2026-97629)
It was discovered that OpenVPN incorrectly handled certificate subject fields. A remote authenticated user could possibly use this issue to impersonate other users.
Ali Firas discovered that zlib incorrectly handled certain non-blocking write operations. An attacker could possibly use this issue to trigger a heap buffer overflow, resulting in a denial of service or arbitrary code execution.
It was discovered that PHP incorrectly handled out-of-memory conditions while processing requests. A remote attacker could use this issue to execute arbitrary code. (CVE-2026-109618) It was discovered that PHP incorrectly managed internal request state across worker reuse. A remote attacker could use this issue to execute arbitrary code. (CVE-2026-109619)
This update removes the "emSign ECC Root CA - G3" and "Comodo AAA Services root" CA certificate due to intermediate CA certificates being compromised.
USN-8890-1 fixed vulnerabilities in libsoup. This update provides the corresponding updates for libsoup3 on Ubuntu 26.10. Original advisory details: It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-4271) It was discovered that libsoup incorrectly handled certain HTTPS proxy connections. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-5119) It was discovered that libsoup incorrectly parsed certain chunked HTTP requests. A remote attacker could possibly use this issue to bypass security controls. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-6324) It was discovered that libsoup incorrectly handled proxy authentication credentials. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-66339) It was discovered that libsoup incorrectly handled certain HTTP Range headers. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-77014, CVE-2026-77680) It was discovered that libsoup incorrectly handled certain HTTP/2 connections. A remote attacker could possibly use this issue to obtain sensitive information or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-85197) It was discovered that libsoup incorrectly handled certain HTTP/2 transfers. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-85534)
It was discovered that cifs-utils incorrectly handled credentials files used by privileged mount.cifs invocations. A local attacker could possibly use this issue to inject arbitrary mount options into a privileged mount, resulting in a privilege escalation.