[DSA 6404-1] expat security update
ELA-1790-1 libraw security update (by )
ELA-1789-1 imagemagick security update (by )
[DLA 4707-1] gsasl security update
[DLA 4706-1] ruby-rack security update
[SECURITY] [DSA 6404-1] expat security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-6404-1 security@debian.org
https://www.debian.org/security/ Aron Xu
July 30, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : expat
CVE ID : CVE-2025-59375 CVE-2026-24515 CVE-2026-25210 CVE-2026-32776
CVE-2026-32777 CVE-2026-32778 CVE-2026-41080 CVE-2026-45186
CVE-2026-50219 CVE-2026-56131 CVE-2026-56132 CVE-2026-56403
CVE-2026-56404 CVE-2026-56405 CVE-2026-56406 CVE-2026-56407
CVE-2026-56408 CVE-2026-56409 CVE-2026-56410 CVE-2026-56411
CVE-2026-56412
Multiple security issues were discovered in expat, an XML parsing C library,
including integer overflows, out-of-bounds write, NULL pointer dereferences,
excessive resource consumption, and memory corruption through re-entrant
parser API calls, which may result in denial of service or potentially the
execution of arbitrary code.
For the stable distribution (trixie), this problem has been fixed in
version 2.8.2-1~deb13u1.
We recommend that you upgrade your expat packages.
For the detailed security status of expat please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/expat
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
ELA-1790-1 libraw security update (by )
Package : libraw
Version : 0.19.2-2+deb10u6 (buster)
Related CVEs :
CVE-2026-20884
CVE-2026-20889
CVE-2026-21413
CVE-2026-24660
CVE-2026-20884
An integer overflow vulnerability was discovered in the decoder
routine for deflate-compressed floating-point DNG RAW files, which
may lead to heap buffer overflow via specially crafted input file.
CVE-2026-20889
A heap-based buffer overflow vulnerability was discovered in the
thumbnail extraction routine for RAW image files from Sigma/Foveon
X3F digital cameras.
CVE-2026-21413
A heap-based buffer overflow vulnerability was discovered in the
lossless JPEG decoder used for processing compressed RAW data from
various camera formats.
CVE-2026-24660
A heap-based buffer overflow vulnerability was discovered in the
Huffman decompression routine for RAW image files from Sigma/Foveon
X3F digital cameras.
ELA-1790-1 libraw security update (by )
ELA-1789-1 imagemagick security update (by )
Package : imagemagick
Version : 8:6.9.10.23+dfsg-2.1+deb10u21 (buster)
Related CVEs :
CVE-2026-55594
CVE-2026-55628
CVE-2026-56377
CVE-2026-61464
CVE-2026-61465
CVE-2026-61857
CVE-2026-61858
CVE-2026-61859
CVE-2026-61860
CVE-2026-61862
CVE-2026-61863
CVE-2026-61864
CVE-2026-61865
CVE-2026-61866
CVE-2026-61868
CVE-2026-61869
CVE-2026-61870
CVE-2026-61872
Multiple security vulnerabilities were discovered in imagemagick, a
software suite used for editing and manipulating digital images, which
could lead to denial of service, information disclosure or potentially
arbitrary code execution if malformed images are processed.ELA-1789-1 imagemagick security update (by )
[SECURITY] [DLA 4707-1] gsasl security update
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4707-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Carlos Henrique Lima Melara
July 30, 2026 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : gsasl
Version : 1.10.0-4+deb11u3 2.2.0-1+deb12u2
CVE ID : CVE-2026-56968
It was discovered that missing input sanitising in the NTLM client of the
GNU SASL library could result in memory disclosure.
For Debian 11 bullseye, this problem has been fixed in version
1.10.0-4+deb11u3.
For Debian 12 bookworm, this problem has been fixed in version
2.2.0-1+deb12u2.
We recommend that you upgrade your gsasl packages.
For the detailed security status of gsasl please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/gsasl
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
[SECURITY] [DLA 4706-1] ruby-rack security update
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4706-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Abhijith PA
July 31, 2026 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : ruby-rack
Version : 2.1.4-3+deb11u6 2.2.22-0+deb12u2
CVE ID : CVE-2026-26961 CVE-2026-34230 CVE-2026-34763 CVE-2026-34785
CVE-2026-34786 CVE-2026-34826 CVE-2026-34829 CVE-2026-34830
CVE-2026-34831
Multiple vulnerabilities were found in ruby-rack, a modular Ruby
webserver interface
CVE-2026-26961
Rack::Multipart::Parser extracts the boundary parameter from
multipart/form-data using a greedy regular expression. When a
Content-Type header contains multiple boundary parameters, Rack
selects the last one rather than the first. In deployments where
an upstream proxy, WAF, or intermediary interprets the first
boundary parameter, this mismatch can allow an attacker to smuggle
multipart content past upstream inspection and have Rack parse a
different body structure than the intermediary validated.
CVE-2026-34230
Rack::Utils.select_best_encoding processes Accept-Encoding values
with quadratic time complexity when the header contains many
wildcard (*) entries. Because this method is used by
Rack::Deflater to choose a response encoding, an unauthenticated
attacker can send a single request with a crafted Accept-Encoding
header and cause disproportionate CPU consumption on the
compression middleware path. This results in a denial of service
condition for applications using Rack::Deflater.
CVE-2026-34763
Rack::Directory interpolates the configured root path directly
into a regular expression when deriving the displayed directory
path. If root contains regex metacharacters such as +, *, or .,
the prefix stripping can fail and the generated directory listing
may expose the full filesystem path in the HTML output.
CVE-2026-34785
Rack::Static determines whether a request should be served as a
static file using a simple string prefix check. When configured
with URL prefixes such as "/css", it matches any request path that
begins with that string, including unrelated paths such as
"/css-config.env" or "/css-backup.sql". As a result, files under
the static root whose names merely share the configured prefix may
be served unintentionally, leading to information disclosure.
CVE-2026-34786
Rack::Static#applicable_rules evaluates several header_rules types
against the raw URL-encoded PATH_INFO, while the underlying
file-serving path is decoded before the file is served. As a
result, a request for a URL-encoded variant of a static path can
serve the same file without the headers that header_rules were
intended to apply. In deployments that rely on Rack::Static to
attach security-relevant response headers to static content, this
can allow an attacker to bypass those headers by requesting an
encoded form of the path.
CVE-2026-34826
Rack::Utils.get_byte_ranges parses the HTTP Range header without
limiting the number of individual byte ranges. Although the
existing fix for CVE-2024-26141 rejects ranges whose total byte
coverage exceeds the file size, it does not restrict the count of
ranges. An attacker can supply many small overlapping ranges such
as 0-0,0-0,0-0,... to trigger disproportionate CPU, memory, I/O,
and bandwidth consumption per request. This results in a denial of
service condition in Rack file-serving paths that process
multipart byte range responses.
CVE-2026-34829
Rack::Multipart::Parser only wraps the request body in a BoundedIO
when CONTENT_LENGTH is present. When a multipart/form-data request
is sent without a Content-Length header, such as with HTTP chunked
transfer encoding, multipart parsing continues until end-of-stream
with no total size limit. For file parts, the uploaded body is
written directly to a temporary file on disk rather than being
constrained by the buffered in-memory upload limit. An
unauthenticated attacker can therefore stream an arbitrarily large
multipart file upload and consume unbounded disk space. This
results in a denial of service condition for Rack applications
that accept multipart form data.
CVE-2026-34830
Rack::Sendfile#map_accel_path interpolates the value of the
X-Accel-Mapping request header directly into a regular expression
when rewriting file paths for X-Accel-Redirect. Because the header
value is not escaped, an attacker who can supply X-Accel-Mapping
to the backend can inject regex metacharacters and control the
generated X-Accel-Redirect response header. In deployments using
Rack::Sendfile with x-accel-redirect, this can allow an attacker
to cause nginx to serve unintended files from configured internal
locations.
CVE-2026-34831
Rack::Files#fail sets the Content-Length response header using
String#size instead of String#bytesize. When the response body
contains multibyte UTF-8 characters, the declared Content-Length
is smaller than the number of bytes actually sent on the
wire. Because Rack::Files reflects the requested path in 404
responses, an attacker can trigger this mismatch by requesting a
non-existent path containing percent-encoded UTF-8
characters. This results in incorrect HTTP response framing and
may cause response desynchronization in deployments that rely on
the incorrect Content-Length value.
For Debian 11 bullseye, these problems have been fixed in version
2.1.4-3+deb11u6.
For Debian 12 bookworm, these problems have been fixed in version
2.2.22-0+deb12u2.
We recommend that you upgrade your ruby-rack packages.
For the detailed security status of ruby-rack please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ruby-rack
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
