RHSA-2026:21275

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech.

A flaw was found in GLib (Gnome Lib).

Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used.

Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer.

A flaw was found in p11-kit.

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (pres…

Vim is an open source, command line text editor.

In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line.

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.

OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech.

Mitgation of CVE-2026-4519 was incomplete.

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers.

A flaw was found in libcap.

A flaw was found in glib.

OpenSSH before 10.3 can use unintended ECDSA algorithms.

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete.

User-controlled header names and values containing newlines can allow injecting HTTP headers.

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages.

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.

The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files.

systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data.

OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.