NIXPKGS-2026-1715

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-42448

3.5 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 2 weeks ago
• @LeSuisse ignored
  8 packages

  • wormhole-rs
  • magic-wormhole-rs
  • python314Packages.magic-wormhole-mailbox-server
  • python313Packages.magic-wormhole-mailbox-server
  • python312Packages.magic-wormhole-mailbox-server
  • python314Packages.magic-wormhole-transit-relay
  • python313Packages.magic-wormhole-transit-relay
  • python312Packages.magic-wormhole-transit-relay
  3 months, 2 weeks ago
• @LeSuisse ignored maintainer @mjoerg 3 months, 2 weeks ago maintainer.ignore
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

wormhole receive, with --output pointing at an existing directory can be path-traversed

• https://github.com/magic-wormhole/magic-wormhole/security/advisories/GHSA-cf92-gfcw-6v53 x_refsource_CONFIRM

---

magic-wormhole

• ==< 0.24.0

NIXPKGS-2026-1714

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-48852

3.7 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 3 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

PuTTY 0.71 before 0.84 has an assertion failure in ECDSA …

• https://lists.tartarus.org/pipermail/putty-announce/2026/000042.html
• https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/ecdsa-remotely-trig…

---

PuTTY

• <0.84

NIXPKGS-2026-1713

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-9501

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 3 weeks ago
• @LeSuisse ignored
  3 references

  • https://www.gnu.org/
  • VDB-365483 | CTI Indicators (IOB, IOC, …
  • Submit #814250 | LibreDWG Project Libre…
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

GNU LibreDWG Dwgread Utility decode.c decompress_R2004_section assertion

• VDB-365483 | GNU LibreDWG Dwgread Utility decode.c decompress_R2004_section assertion technical-descriptionvdb-entry
• https://github.com/LibreDWG/libredwg/issues/1242 issue-tracking
• https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_asse… exploit
• https://github.com/LibreDWG/libredwg/commit/e501cb9926c1e9a07a0d1cc997f3e69e9be… patch

Ignored references (3)

• VDB-365483 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• Submit #814250 | LibreDWG Project LibreDWG <= 0.14, main branch up to commit 6d6a339 (released 2026-04-10) Reachable Assertion (CWE-617) third-party-advisory
• https://www.gnu.org/ product

---

LibreDWG

• ==0.12
• ==0.1
• ==0.13
• ==0.8
• ==0.7
• ==0.2
• ==0.6
• ==0.11
• ==0.10
• ==0.9
• ==0.5
• ==0.4
• ==0.14
• ==0.3

NIXPKGS-2026-1712

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-9500

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 3 weeks ago
• @LeSuisse ignored
  3 references

  • https://www.gnu.org/
  • Submit #814248 | LibreDWG Project Libre…
  • VDB-365482 | CTI Indicators (IOB, IOC, …
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

GNU LibreDWG Dwgread Utility decode.c read_2004_compressed_section heap-based overflow

• VDB-365482 | GNU LibreDWG Dwgread Utility decode.c read_2004_compressed_section heap-based overflow technical-descriptionvdb-entry
• https://github.com/LibreDWG/libredwg/issues/1241 issue-tracking
• https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap… exploit

Ignored references (3)

• VDB-365482 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
• Submit #814248 | LibreDWG Project LibreDWG <= 0.14, main branch up to commit 6d6a339 (released 2026-04-10) Heap-based Buffer Overflow (CWE-122) third-party-advisory
• https://www.gnu.org/ product

---

LibreDWG

• ==0.11
• ==0.1
• ==0.13
• ==0.3
• ==0.6
• ==0.12
• ==0.2
• ==0.5
• ==0.9
• ==0.8
• ==0.14
• ==0.4
• ==0.7
• ==0.10

NIXPKGS-2026-1711

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-48850

3.7 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 3 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

PuTTY 0.72 before 0.84 has a double free in RSA …

• https://lists.tartarus.org/pipermail/putty-announce/2026/000042.html
• https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/rsakex-double-free.…

---

PuTTY

• <0.84

NIXPKGS-2026-1710

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-9504

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 3 weeks ago
• @LeSuisse ignored
  3 references

  • Submit #814261 | LibreDWG Project Libre…
  • VDB-365486 | CTI Indicators (IOB, IOC, …
  • https://www.gnu.org/
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

GNU LibreDWG Dwggrep Utility dwggrep.c bit_convert_TU out-of-bounds

• VDB-365486 | GNU LibreDWG Dwggrep Utility dwggrep.c bit_convert_TU out-of-bounds technical-descriptionvdb-entry
• https://github.com/LibreDWG/libredwg/issues/1246 issue-tracking
• https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap… exploit
• https://github.com/LibreDWG/libredwg/commit/be996bf2178a40e98720f18c2414815d244… patch

Ignored references (3)

• VDB-365486 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• Submit #814261 | LibreDWG Project LibreDWG <= 0.14, main branch up to commit 6d6a339 (2026-04-10) Out-of-bounds Read (CWE-125) third-party-advisory
• https://www.gnu.org/ product

---

LibreDWG

• ==0.12
• ==0.1
• ==0.13
• ==0.8
• ==0.7
• ==0.2
• ==0.11
• ==0.4
• ==0.10
• ==0.9
• ==0.5
• ==0.6
• ==0.14
• ==0.3

NIXPKGS-2026-1709

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-9503

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 3 weeks ago
• @LeSuisse ignored
  3 references

  • Submit #814260 | LibreDWG Project Libre…
  • https://www.gnu.org/
  • VDB-365485 | CTI Indicators (IOB, IOC, …
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

GNU LibreDWG DWG File decode.c dwg_next_entity null pointer dereference

• VDB-365485 | GNU LibreDWG DWG File decode.c dwg_next_entity null pointer dereference technical-descriptionvdb-entry
• https://github.com/LibreDWG/libredwg/issues/1245 issue-tracking
• https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap… exploit
• https://github.com/LibreDWG/libredwg/commit/8f03865f37f5d4ffd616fef802acc980be5… patch

Ignored references (3)

• VDB-365485 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
• Submit #814260 | LibreDWG Project LibreDWG <= 0.14, main branch up to commit 6d6a339 (2026-04-10) NULL Pointer Dereference (CWE-476) third-party-advisory
• https://www.gnu.org/ product

---

LibreDWG

• ==0.11
• ==0.1
• ==0.13
• ==0.3
• ==0.6
• ==0.12
• ==0.2
• ==0.5
• ==0.9
• ==0.8
• ==0.14
• ==0.4
• ==0.7
• ==0.10

NIXPKGS-2026-1708

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-9502

1.9 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 3 weeks ago
• @LeSuisse ignored
  3 references

  • https://www.gnu.org/
  • Submit #814259 | LibreDWG Project Libre…
  • VDB-365484 | CTI Indicators (IOB, IOC, …
  3 months, 2 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

GNU LibreDWG Dwgread Utility decode.c decompress_R2004_section heap-based overflow

• VDB-365484 | GNU LibreDWG Dwgread Utility decode.c decompress_R2004_section heap-based overflow technical-descriptionvdb-entry
• https://github.com/LibreDWG/libredwg/issues/1243 issue-tracking
• https://github.com/HackC0der/CVE-Repos/blob/main/libredwg/libredwg_6d6a339_heap… exploit
• https://github.com/LibreDWG/libredwg/commit/e501cb9926c1e9a07a0d1cc997f3e69e9be… patch

Ignored references (3)

• VDB-365484 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• Submit #814259 | LibreDWG Project LibreDWG <= 0.14, main branch up to commit 6d6a339 (released 2026-04-10) Heap-based Buffer Overflow (CWE-122) third-party-advisory
• https://www.gnu.org/ product

---

LibreDWG

• ==0.12
• ==0.1
• ==0.13
• ==0.8
• ==0.7
• ==0.2
• ==0.11
• ==0.4
• ==0.10
• ==0.9
• ==0.5
• ==0.6
• ==0.14
• ==0.3

NIXPKGS-2026-1707

GitHub issue published 3 months, 2 weeks ago

Permalink CVE-2026-48851

3.1 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 3 months, 2 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 3 weeks ago
• @LeSuisse accepted 3 months, 2 weeks ago
• @LeSuisse published on GitHub 3 months, 2 weeks ago

PuTTY 0.77 before 0.84 uses a copy of the PuTTY …

• https://lists.tartarus.org/pipermail/putty-announce/2026/000042.html
• https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/telnet-trust-sigil.…

---

PuTTY

• <0.84

NIXPKGS-2026-1706

GitHub issue published 3 months, 3 weeks ago

Permalink CVE-2026-9150

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months, 3 weeks ago by @LeSuisse Activity log

• Created suggestion 3 months, 3 weeks ago
• @LeSuisse accepted 3 months, 3 weeks ago
• @LeSuisse published on GitHub 3 months, 3 weeks ago

Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums

• https://access.redhat.com/security/cve/CVE-2026-9150 x_refsource_REDHATvdb-entry
• RHBZ#2460379 x_refsource_REDHATissue-tracking
• https://github.com/openSUSE/libsolv/pull/616

---

rhcos

libsolv

satellite-capsule:el8/libsolv

Fixed in 0.7.37.

https://github.com/openSUSE/libsolv/commit/0de68ee047a69a5aae5186f8939bd1d31113aa2a