Security feed

25 October 2026

patchoss-security25 Oct 2026

CVE-2026-113877: HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions

Unescaped Accept-Language ranges can trigger excessive regular-expression backtracking and CPU exhaustion. Upgrade to version 0.10 or later.

HTTP-Headers-ActionPack · Fixed in 0.10 or later CVE-2026-113877

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

A remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it.

HTTP-Headers-ActionPack

Distribution: HTTP-Headers-ActionPack

Affected versions: before 0.10
Versions: before 0.10
Fixed versions: 0.10 or later
Upgrade to HTTP-Headers-ActionPack 0.10 or later.
Prerequisites: passes an untrusted Accept-Language header to it
in any application that passes an untrusted Accept-Language header to it.

Related CVEs: CVE-2026-113877
CVE ID: CVE-2026-113877

Publisher severity

No explicit severity was extracted.

Event: #19316 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 02:33:22 GMT
Publisher date: Fri, 23 Oct 2026 22:16:18 GMT

Read the original announcement

mitigationoss-security25 Oct 2026

PHP Informational advisory: Session upload progress (CVE-2026-115560)

PHP advises disabling session upload progress until the next regular bugfix release to mitigate an unlikely RCE vector. The issue requires a specific runtime session serialization-handler change and session upload progress to remain enabled.

PHP CVE-2026-115560

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector.

PHP

PHP Informational advisory: Session upload progress

Affected versions: Not stated in this extraction
Fixed versions: Not stated in this extraction
Prerequisites: session.serialize_handler to php_binary or php_serialize
An application must set session.serialize_handler to php_binary or php_serialize in its configuration
switch it to php at runtime with ini_set() before calling session_start()
then switch it to php at runtime with ini_set() before calling session_start()
Session upload progress must also still be enabled
Session upload progress must also still be enabled

Related CVEs: CVE-2026-115560
CVE-2026-115560

Publisher severity

No explicit severity was extracted.

Event: #19314 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 02:31:22 GMT
Publisher date: Fri, 23 Oct 2026 16:41:37 GMT

Read the original announcement

advisoryoss-security25 Oct 2026

nginx vulnerabilities including potential remote code execution

The message describes multiple vulnerabilities in NGINX Open Source and NGINX Plus, including buffer overflows that may allow code execution when ASLR is disabled or bypassed. It says the issues appear to affect open source nginx versions prior to 1.31.7 or 1.30.6.

NGINX Open Source NGINX Plus CVE-2026-93479 CVE-2026-15176 CVE-2026-97205 CVE-2026-97629 CVE-2026-95101

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

The following appear to impact open source nginx prior to 1.31.7 or 1.30.6. At least two of them include a possibility of RCE.

NGINX Open Source

NGINX Plus and NGINX Open Source

Affected versions: prior to 1.31.7 or 1.30.6
The following appear to impact open source nginx prior to 1.31.7 or 1.30.6.
Fixed versions: Not stated in this extraction
Prerequisites: Not stated in this extraction

NGINX Plus

NGINX Plus and NGINX Open Source

Affected versions: Not stated in this extraction
Fixed versions: Not stated in this extraction
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2026-93479
CVE-2026-93479
CVE-2026-15176
CVE-2026-15176
CVE-2026-97205
CVE-2026-97205
CVE-2026-97629
CVE-2026-97629
CVE-2026-95101
CVE-2026-95101

Publisher severity

No explicit severity was extracted.

Event: #19313 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 02:30:22 GMT
Publisher date: Fri, 23 Oct 2026 22:14:20 GMT

Read the original announcement

otheross-security25 Oct 2026

Distrust compromised intermediate certificates in Python ssl module

Python's ssl module now automatically rejects certificates on a denylist of known compromised certificates, regardless of SSLContext policy configuration.

Python CVE-2026-115557

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates on this denylist will automatically be rejected regardless of the SSLContext policy configuration.

Python

Python has added a denylist for known compromised certificates to the "ssl" module

Affected versions: Not stated in this extraction
Fixed versions: Not stated in this extraction
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2026-115557
https://www.cve.org/CVERecord?id=CVE-2026-115557

Publisher severity

No explicit severity was extracted.

Event: #19312 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 02:25:21 GMT
Publisher date: Sat, 24 Oct 2026 16:15:20 GMT

Read the original announcement

patchoss-security25 Oct 2026

Godot 4.x: heap out-of-bounds write in Radiance HDR image loader

A fix for an out-of-bounds write when loading corrupt HDR images was merged upstream. The patch validates image dimensions and bounds RLE runs and dumps against the remaining scanline width.

Godot · Fixed in master CVE-2026-110734

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

the fix for this issue has been merged upstream. PR #124697, "Fix out-of-bounds write when loading corrupt HDR images", merged to master on 2026-10-20

Godot

Godot 4.x: heap out-of-bounds write in Radiance HDR image loader

Affected versions: Not stated in this extraction
Fixed versions: master
merged to master on 2026-10-20
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2026-110734
The PR body cites CVE-2026-110734

Publisher severity

No explicit severity was extracted.

Event: #19311 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 02:22:21 GMT
Publisher date: Fri, 23 Oct 2026 22:18:16 GMT

Read the original announcement

patchoss-security25 Oct 2026

CVE-2026-115936: IO::Compress::Brotli out-of-bounds write in decoder

IO::Compress::Brotli bundles a vulnerable Brotli decoder that can be reached when decompressing untrusted data. Upgrade to version 0.023 or later; upgrading the system Brotli library does not remediate the issue.

IO::Compress::Brotli · Fixed in 0.023 CVE-2026-115936 CVE-2026-111497

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Upgrade to IO-Compress-Brotli 0.023 or later.

IO::Compress::Brotli

IO::Compress::Brotli versions from 0.004001 before 0.023

Affected versions: from 0.004001 before 0.023
Versions: from 0.004001 before 0.023
Fixed versions: 0.023
Upgrade to IO-Compress-Brotli 0.023 or later.
Prerequisites: Any caller that decompresses untrusted data with unbro or the decompress method
Any caller that decompresses untrusted data with unbro or the decompress method reaches the bundled decoder.

Related CVEs: CVE-2026-115936
CVE ID: CVE-2026-115936
CVE-2026-111497
described in CVE-2026-111497

Publisher severity

No explicit severity was extracted.

Event: #19310 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 02:19:22 GMT
Publisher date: Fri, 23 Oct 2026 22:29:11 GMT

Read the original announcement

patchoss-security25 Oct 2026

jxrlib memory bugs in damaged JPEG XR files

Multiple memory-safety bugs can be triggered by damaged JPEG XR files. The maintained mircomir/jxrlib fork fixes them in version 1.4.4; older versions remain in several distributions and products.

mircomir/jxrlib · Fixed in 1.4.4 jxrlib

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

All of them are fixed in public in the maintained fork github.com/mircomir/jxrlib (1.4.4, released 2026-10-09)

mircomir/jxrlib

the maintained fork github.com/mircomir/jxrlib

Affected versions: Not stated in this extraction
Fixed versions: 1.4.4
github.com/mircomir/jxrlib (1.4.4, released 2026-10-09)
Prerequisites: Not stated in this extraction

jxrlib

jxrlib, Microsoft's JPEG XR library

Affected versions: 1.2~git20170615.f752187-5.3
Debian's 1.2~git20170615.f752187-5.3
Fixed versions: Not stated in this extraction
Prerequisites: a damaged JPEG XR file
a damaged JPEG XR file of a few hundred bytes triggers

Publisher severity

No explicit severity was extracted.

Event: #19309 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 02:14:23 GMT
Publisher date: Sat, 24 Oct 2026 09:22:02 GMT

Read the original announcement

patchoss-security25 Oct 2026

Brotli release v1.2.1

Google Brotli published a library release addressing a vulnerability that also affects consumers of the library.

Google brotli · Fixed in v1.2.1 CVE-2026-111497

Machine-extracted · Revision 1Original source

Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

https://github.com/google/brotli/releases/tag/v1.2.1 has been published for the library itself.

Google brotli

underlying problem is not restricted to Node.js alone, but rather in Google brotli

Affected versions: Not stated in this extraction
Fixed versions: v1.2.1
https://github.com/google/brotli/releases/tag/v1.2.1 has been published for the library itself.
Prerequisites: Not stated in this extraction

Related CVEs: CVE-2026-111497
Node.js Brotli decoder out-of-bounds write permits remote code execution (CVE-2026-111497)

Publisher severity

No explicit severity was extracted.

Event: #19308 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 02:07:34 GMT
Publisher date: Sat, 24 Oct 2026 16:36:32 GMT

Read the original announcement