{"schema_version":"1","data":[{"id":19316,"advisory_id":"534f7178-c4a7-4a8e-a8de-6c3cbff207f5","revision":1,"source_id":"oss-security","source_url":"https://seclists.org/oss-sec/2026/q4/363","source_published_at":"2026-10-23T22:16:18+00:00","published_at":"2026-10-25T02:33:22.57352+00:00","extraction_method":"llm","technologies":["http-headers-actionpack","oss-security"],"cve_ids":["CVE-2026-113877"],"event_types":["patch"],"payload":{"kind":"patch","title":"CVE-2026-113877: HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions","summary":"Unescaped Accept-Language ranges can trigger excessive regular-expression backtracking and CPU exhaustion. Upgrade to version 0.10 or later.","evidence":"A remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it.","products":[{"name":{"value":"HTTP-Headers-ActionPack","evidence":"Distribution: HTTP-Headers-ActionPack"},"prerequisites":[{"value":"passes an untrusted Accept-Language header to it","evidence":"in any application that passes an untrusted Accept-Language header to it."}],"fixed_versions":[{"value":"0.10 or later","evidence":"Upgrade to HTTP-Headers-ActionPack 0.10 or later."}],"affected_versions":[{"value":"before 0.10","evidence":"Versions: before 0.10"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-113877","evidence":"CVE ID: CVE-2026-113877"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":19314,"advisory_id":"9c427ccc-d6f1-4a1b-9097-c6e6d543e120","revision":1,"source_id":"oss-security","source_url":"https://seclists.org/oss-sec/2026/q4/359","source_published_at":"2026-10-23T16:41:37+00:00","published_at":"2026-10-25T02:31:22.125833+00:00","extraction_method":"llm","technologies":["oss-security","php"],"cve_ids":["CVE-2026-115560"],"event_types":["mitigation"],"payload":{"kind":"mitigation","title":"PHP Informational advisory: Session upload progress (CVE-2026-115560)","summary":"PHP advises disabling session upload progress until the next regular bugfix release to mitigate an unlikely RCE vector. The issue requires a specific runtime session serialization-handler change and session upload progress to remain enabled.","evidence":"We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector.","products":[{"name":{"value":"PHP","evidence":"PHP Informational advisory: Session upload progress"},"prerequisites":[{"value":"session.serialize_handler to php_binary or php_serialize","evidence":"An application must set session.serialize_handler to php_binary or php_serialize in its configuration"},{"value":"switch it to php at runtime with ini_set() before calling session_start()","evidence":"then switch it to php at runtime with ini_set() before calling session_start()"},{"value":"Session upload progress must also still be enabled","evidence":"Session upload progress must also still be enabled"}],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-115560","evidence":"CVE-2026-115560"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":19313,"advisory_id":"9e6dbf92-2246-4c2d-a01a-4d0d5186fafb","revision":1,"source_id":"oss-security","source_url":"https://seclists.org/oss-sec/2026/q4/362","source_published_at":"2026-10-23T22:14:20+00:00","published_at":"2026-10-25T02:30:22.665613+00:00","extraction_method":"llm","technologies":["nginx-open-source","nginx-plus","oss-security"],"cve_ids":["CVE-2026-15176","CVE-2026-93479","CVE-2026-95101","CVE-2026-97205","CVE-2026-97629"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"nginx vulnerabilities including potential remote code execution","summary":"The message describes multiple vulnerabilities in NGINX Open Source and NGINX Plus, including buffer overflows that may allow code execution when ASLR is disabled or bypassed. It says the issues appear to affect open source nginx versions prior to 1.31.7 or 1.30.6.","evidence":"The following appear to impact open source nginx prior to 1.31.7 or 1.30.6. At least two of them include a possibility of RCE.","products":[{"name":{"value":"NGINX Open Source","evidence":"NGINX Plus and NGINX Open Source"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"prior to 1.31.7 or 1.30.6","evidence":"The following appear to impact open source nginx prior to 1.31.7 or 1.30.6."}]},{"name":{"value":"NGINX Plus","evidence":"NGINX Plus and NGINX Open Source"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-93479","evidence":"CVE-2026-93479"},{"value":"CVE-2026-15176","evidence":"CVE-2026-15176"},{"value":"CVE-2026-97205","evidence":"CVE-2026-97205"},{"value":"CVE-2026-97629","evidence":"CVE-2026-97629"},{"value":"CVE-2026-95101","evidence":"CVE-2026-95101"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":19312,"advisory_id":"444f4acf-6186-418c-b4ba-05e3e0d49050","revision":1,"source_id":"oss-security","source_url":"https://seclists.org/oss-sec/2026/q4/372","source_published_at":"2026-10-24T16:15:20+00:00","published_at":"2026-10-25T02:25:21.216012+00:00","extraction_method":"llm","technologies":["oss-security","python"],"cve_ids":["CVE-2026-115557"],"event_types":["other"],"payload":{"kind":"other","title":"Distrust compromised intermediate certificates in Python ssl module","summary":"Python's ssl module now automatically rejects certificates on a denylist of known compromised certificates, regardless of SSLContext policy configuration.","evidence":"Python has added a denylist for known compromised certificates to the \"ssl\" module to ensure user safety even without certificate revocation configured. Known compromised certificates on this denylist will automatically be rejected regardless of the SSLContext policy configuration.","products":[{"name":{"value":"Python","evidence":"Python has added a denylist for known compromised certificates to the \"ssl\" module"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-115557","evidence":"https://www.cve.org/CVERecord?id=CVE-2026-115557"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":19311,"advisory_id":"225bfa82-0dae-489e-a890-952f5633acdb","revision":1,"source_id":"oss-security","source_url":"https://seclists.org/oss-sec/2026/q4/364","source_published_at":"2026-10-23T22:18:16+00:00","published_at":"2026-10-25T02:22:21.622457+00:00","extraction_method":"llm","technologies":["godot","oss-security"],"cve_ids":["CVE-2026-110734"],"event_types":["patch"],"payload":{"kind":"patch","title":"Godot 4.x: heap out-of-bounds write in Radiance HDR image loader","summary":"A fix for an out-of-bounds write when loading corrupt HDR images was merged upstream. The patch validates image dimensions and bounds RLE runs and dumps against the remaining scanline width.","evidence":"the fix for this issue has been merged upstream. PR #124697, \"Fix out-of-bounds write when loading corrupt HDR images\", merged to master on 2026-10-20","products":[{"name":{"value":"Godot","evidence":"Godot 4.x: heap out-of-bounds write in Radiance HDR image loader"},"prerequisites":[],"fixed_versions":[{"value":"master","evidence":"merged to master on 2026-10-20"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-110734","evidence":"The PR body cites CVE-2026-110734"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":19310,"advisory_id":"a038abfe-8611-4556-90a4-46d4522d47fc","revision":1,"source_id":"oss-security","source_url":"https://seclists.org/oss-sec/2026/q4/367","source_published_at":"2026-10-23T22:29:11+00:00","published_at":"2026-10-25T02:19:22.728522+00:00","extraction_method":"llm","technologies":["io-compress-brotli","oss-security"],"cve_ids":["CVE-2026-111497","CVE-2026-115936"],"event_types":["patch"],"payload":{"kind":"patch","title":"CVE-2026-115936: IO::Compress::Brotli out-of-bounds write in decoder","summary":"IO::Compress::Brotli bundles a vulnerable Brotli decoder that can be reached when decompressing untrusted data. Upgrade to version 0.023 or later; upgrading the system Brotli library does not remediate the issue.","evidence":"Upgrade to IO-Compress-Brotli 0.023 or later.","products":[{"name":{"value":"IO::Compress::Brotli","evidence":"IO::Compress::Brotli versions from 0.004001 before 0.023"},"prerequisites":[{"value":"Any caller that decompresses untrusted data with unbro or the decompress method","evidence":"Any caller that decompresses untrusted data with unbro or the decompress method reaches the bundled decoder."}],"fixed_versions":[{"value":"0.023","evidence":"Upgrade to IO-Compress-Brotli 0.023 or later."}],"affected_versions":[{"value":"from 0.004001 before 0.023","evidence":"Versions: from 0.004001 before 0.023"}]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-115936","evidence":"CVE ID: CVE-2026-115936"},{"value":"CVE-2026-111497","evidence":"described in CVE-2026-111497"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":19309,"advisory_id":"b40893d0-7014-4be0-ad4c-991d38d7a9f9","revision":1,"source_id":"oss-security","source_url":"https://seclists.org/oss-sec/2026/q4/368","source_published_at":"2026-10-24T09:22:02+00:00","published_at":"2026-10-25T02:14:23.258424+00:00","extraction_method":"llm","technologies":["jxrlib","mircomir-jxrlib","oss-security"],"cve_ids":[],"event_types":["patch"],"payload":{"kind":"patch","title":"jxrlib memory bugs in damaged JPEG XR files","summary":"Multiple memory-safety bugs can be triggered by damaged JPEG XR files. The maintained mircomir/jxrlib fork fixes them in version 1.4.4; older versions remain in several distributions and products.","evidence":"All of them are fixed in public in the maintained fork github.com/mircomir/jxrlib (1.4.4, released 2026-10-09)","products":[{"name":{"value":"mircomir/jxrlib","evidence":"the maintained fork github.com/mircomir/jxrlib"},"prerequisites":[],"fixed_versions":[{"value":"1.4.4","evidence":"github.com/mircomir/jxrlib (1.4.4, released 2026-10-09)"}],"affected_versions":[]},{"name":{"value":"jxrlib","evidence":"jxrlib, Microsoft's JPEG XR library"},"prerequisites":[{"value":"a damaged JPEG XR file","evidence":"a damaged JPEG XR file of a few hundred bytes triggers"}],"fixed_versions":[],"affected_versions":[{"value":"1.2~git20170615.f752187-5.3","evidence":"Debian's 1.2~git20170615.f752187-5.3"}]}],"severity":"unknown","related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":19308,"advisory_id":"5ebf49ca-97d4-4f95-b8ec-757ec93f6c5e","revision":1,"source_id":"oss-security","source_url":"https://seclists.org/oss-sec/2026/q4/373","source_published_at":"2026-10-24T16:36:32+00:00","published_at":"2026-10-25T02:07:34.106233+00:00","extraction_method":"llm","technologies":["google-brotli","oss-security"],"cve_ids":["CVE-2026-111497"],"event_types":["patch"],"payload":{"kind":"patch","title":"Brotli release v1.2.1","summary":"Google Brotli published a library release addressing a vulnerability that also affects consumers of the library.","evidence":"https://github.com/google/brotli/releases/tag/v1.2.1 has been published for the library itself.","products":[{"name":{"value":"Google brotli","evidence":"underlying problem is not restricted to Node.js alone, but rather in Google brotli"},"prerequisites":[],"fixed_versions":[{"value":"v1.2.1","evidence":"https://github.com/google/brotli/releases/tag/v1.2.1 has been published for the library itself."}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2026-111497","evidence":"Node.js Brotli decoder out-of-bounds write permits remote code execution (CVE-2026-111497)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":19316,"next_before":19308}