Bugs addressed in recent updates
| Origin | Bug number | Title | Packages |
|---|---|---|---|
| CVE | CVE-2026-56866 | When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing afte | golang-1.22 golang-1.22 golang-1.22 golang-1.22 |
| CVE | CVE-2026-94440 | Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is le | golang-1.22 golang-1.22 golang-1.22 golang-1.22 |
| CVE | CVE-2026-78660 | Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 fram | golang-1.22 golang-1.22 golang-1.22 golang-1.22 |
| CVE | CVE-2026-56865 | A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist | golang-1.22 golang-1.22 golang-1.22 golang-1.22 |
| CVE | CVE-2026-33818 | Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. | golang-1.22 golang-1.22 golang-1.22 golang-1.22 |
| CVE | CVE-2026-56859 | Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. | golang-1.22 golang-1.22 golang-1.22 golang-1.22 |
| CVE | CVE-2026-56862 | Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a re | golang-1.22 golang-1.22 golang-1.22 golang-1.22 |
| Launchpad | 2156532 | SRU: New upstream version 7.2.4 | hipblas |
| Launchpad | 2155398 | SRU: New upstream version 7.2.4 | hipfft |
| Launchpad | 2156046 | SRU: New upstream version 7.2.4 | hipsolver |
| Launchpad | 2170996 | containerd fatal on restart | containerd-app containerd-app containerd-app containerd-app |
| CVE | CVE-2026-67409 | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Co | rabbitmq-server rabbitmq-server rabbitmq-server rabbitmq-server rabbitmq-server rabbitmq-server |
| CVE | CVE-2026-67404 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, When no CA bundle is available, ssl_option | rabbitmq-server rabbitmq-server |
| CVE | CVE-2026-67239 | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificat | rabbitmq-server rabbitmq-server rabbitmq-server rabbitmq-server rabbitmq-server rabbitmq-server |
| CVE | CVE-2026-67238 | RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ET | rabbitmq-server rabbitmq-server rabbitmq-server rabbitmq-server rabbitmq-server rabbitmq-server |
| CVE | CVE-2026-67237 | RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization heade | rabbitmq-server rabbitmq-server rabbitmq-server rabbitmq-server |
| CVE | CVE-2026-67236 | RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is_authorized/2 to set an auth cookie | rabbitmq-server rabbitmq-server rabbitmq-server rabbitmq-server rabbitmq-server rabbitmq-server |
| CVE | CVE-2026-67235 | RabbitMQ is a messaging and streaming broker. Prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15, The content-header BodySize (a uint64) was | rabbitmq-server rabbitmq-server rabbitmq-server rabbitmq-server rabbitmq-server rabbitmq-server |
| CVE | CVE-2026-67232 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 s | rabbitmq-server rabbitmq-server rabbitmq-server rabbitmq-server rabbitmq-server rabbitmq-server |
| CVE | CVE-2026-67231 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify_f | rabbitmq-server rabbitmq-server rabbitmq-server rabbitmq-server rabbitmq-server rabbitmq-server |
About
-
Send Feedback to @ubuntu_updates
