Bugs addressed in recent updates
| Origin | Bug number | Title | Packages |
|---|---|---|---|
| CVE | CVE-2026-48860 | Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-ov | erlang erlang erlang erlang |
| CVE | CVE-2026-48858 | Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and SSRF via an unvalidated PASV r | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-48856 | Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded Sensitive Data. The httpc client forwards | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-48855 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows File Discovery. The SSH_FXP_REA | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-42791 | Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired respo | erlang erlang erlang erlang |
| CVE | CVE-2026-42790 | Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via s | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-42789 | Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be ac | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-32147 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authentic | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-32144 | Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via | erlang erlang erlang erlang |
| CVE | CVE-2026-28810 | Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning. The buil | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-28808 | Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when se | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-23943 | Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via R | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-23942 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal. | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2026-21620 | Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tft | erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang erlang |
| CVE | CVE-2025-58190 | The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (Do | golang-golang-x-net golang-golang-x-net |
| CVE | CVE-2025-47911 | The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service | golang-golang-x-net golang-golang-x-net |
| CVE | CVE-2025-22872 | The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using T | golang-golang-x-net golang-golang-x-net |
| CVE | CVE-2023-3978 | Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS at | golang-golang-x-net golang-golang-x-net |
| Launchpad | 2078356 | [SRU] python3 preinst failure to run pre-rtupdate hooks | python3-defaults python3-defaults python3-defaults python3-defaults |
| CVE | CVE-2026-46675 | Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression | libpng1.6 libpng1.6 libpng1.6 libpng1.6 libpng1.6 libpng1.6 |
About
-
Send Feedback to @ubuntu_updates
