[Debian-mobcom-maintainers] Bug#1148471: osmo-iuh: CVE-2026-75894

[Moritz Mühlenhoff]

Source: osmo-iuh
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for osmo-iuh.

CVE-2026-75894[0]:
| In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found
| in the ranap_handle_co_dt() function via a arbitrarily sized NAS-PDU
| that leads to process crash and remote denial of service.

https://cgit.osmocom.org/osmo-iuh/commit/?id=f06967126f486bcb185ccf3d1a8f9bc02c4da1f6 (1.8.1)


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-75894
    https://www.cve.org/CVERecord?id=CVE-2026-75894

Please adjust the affected versions in the BTS as needed.