Skip to content
Heist/ feed
Unrated

DEBIAN-CVE-2026-44605

Type: advisorySource: OSV1 source record

A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable.

Announced Group revision 1
Original source ↗

DEBIAN-CVE-2026-44605

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-44605

rpm

Source reference: /affected/0/package/name

Affected versions
4.18.0+dfsg-1

Source reference: /affected/0/versions

4.18.0+dfsg-1+deb12u1

Source reference: /affected/0/versions

4.18.2+dfsg-1

Source reference: /affected/0/versions

4.18.2+dfsg-1.1~exp1

Source reference: /affected/0/versions

4.18.2+dfsg-2

Source reference: /affected/0/versions

4.18.2+dfsg-2.1

Source reference: /affected/0/versions

4.18.2+dfsg-2.1~exp1

Source reference: /affected/0/versions

4.19.1.1+dfsg-1

Source reference: /affected/0/versions

4.19.1.1+dfsg-1~exp

Source reference: /affected/0/versions

4.20.0+dfsg-1

Source reference: /affected/0/versions

4.20.0+dfsg-2

Source reference: /affected/0/versions

4.20.0+dfsg-3

Source reference: /affected/0/versions

4.20.0+dfsg-4

Source reference: /affected/0/versions

4.20.1+dfsg-1

Source reference: /affected/0/versions

4.20.1+dfsg-2

Source reference: /affected/0/versions

4.20.1+dfsg-3

Source reference: /affected/0/versions

6.0.0-1

Source reference: /affected/0/versions

6.0.0-2

Source reference: /affected/0/versions

6.0.1-1

Source reference: /affected/0/versions

6.1.0-1

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

rpm

Source reference: /affected/1/package/name

Affected versions
4.20.1+dfsg-3

Source reference: /affected/1/versions

6.0.0-1

Source reference: /affected/1/versions

6.0.0-2

Source reference: /affected/1/versions

6.0.1-1

Source reference: /affected/1/versions

6.1.0-1

Source reference: /affected/1/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

rpm

Source reference: /affected/2/package/name

Affected versions
4.20.1+dfsg-3

Source reference: /affected/2/versions

6.0.0-1

Source reference: /affected/2/versions

6.0.0-2

Source reference: /affected/2/versions

6.0.1-1

Source reference: /affected/2/versions

6.1.0-1

Source reference: /affected/2/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "rpm",
      "purl": "pkg:deb/debian/rpm?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "4.18.0+dfsg-1",
      "4.18.0+dfsg-1+deb12u1",
      "4.18.2+dfsg-1",
      "4.18.2+dfsg-1.1~exp1",
      "4.18.2+dfsg-2",
      "4.18.2+dfsg-2.1",
      "4.18.2+dfsg-2.1~exp1",
      "4.19.1.1+dfsg-1",
      "4.19.1.1+dfsg-1~exp",
      "4.20.0+dfsg-1",
      "4.20.0+dfsg-2",
      "4.20.0+dfsg-3",
      "4.20.0+dfsg-4",
      "4.20.1+dfsg-1",
      "4.20.1+dfsg-2",
      "4.20.1+dfsg-3",
      "6.0.0-1",
      "6.0.0-2",
      "6.0.1-1",
      "6.1.0-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44605.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "rpm",
      "purl": "pkg:deb/debian/rpm?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "4.20.1+dfsg-3",
      "6.0.0-1",
      "6.0.0-2",
      "6.0.1-1",
      "6.1.0-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44605.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "rpm",
      "purl": "pkg:deb/debian/rpm?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "4.20.1+dfsg-3",
      "6.0.0-1",
      "6.0.0-2",
      "6.0.1-1",
      "6.1.0-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44605.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#57031 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement

Revision history

  1. DEBIAN-CVE-2026-44605 · Revision 1Source updated