[Git][security-tracker-team/security-tracker][master] Add Debian bug references for various issues

Salvatore Bonaccorso (@carnil) carnil at debian.org
Thu Oct 29 20:45:36 GMT 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
7e0236cc by Salvatore Bonaccorso at 2026-10-29T21:44:37+01:00
Add Debian bug references for various issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1070,43 +1070,43 @@ CVE-2026-118660 (Happy DOM is a JavaScript implementation of a web browser witho
 CVE-2026-118659 (Happy DOM is a JavaScript implementation of a web browser without its  ...)
 	TODO: check
 CVE-2026-118658 (Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme  ...)
-	- golang-github-labstack-echo <unfixed>
+	- golang-github-labstack-echo <unfixed> (bug #1152486)
 	NOTE: https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj
 	NOTE: Fixed by: https://github.com/labstack/echo/commit/ca4f38a474302aabee93c66bdd0052359882e181 (v4.15.2)
 	NOTE: Fixed by: https://github.com/labstack/echo/commit/d1d8ad3f99dd9b80542cd0c357d56a8916c515df (v5.1.1)
 CVE-2026-118657 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme  ...)
-	- golang-github-labstack-echo <unfixed>
+	- golang-github-labstack-echo <unfixed> (bug #1152486)
 	NOTE: https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p
 	NOTE: Fixed by: https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 (v4.16.0)
 	NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
 CVE-2026-118656 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI che ...)
-	- golang-github-labstack-echo <unfixed>
+	- golang-github-labstack-echo <unfixed> (bug #1152486)
 	NOTE: https://github.com/labstack/echo/security/advisories/GHSA-v753-g4cw-jm48
 	NOTE: Fixed by: https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 (v4.16.0)
 	NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
 CVE-2026-118655 (Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Stat ...)
-	- golang-github-labstack-echo <unfixed>
+	- golang-github-labstack-echo <unfixed> (bug #1152486)
 	NOTE: https://github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96
 	NOTE: https://github.com/labstack/echo/issues/2599
 	NOTE: https://github.com/labstack/echo/pull/3006
 	NOTE: Fixed by; https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725 (v4.15.3)
 	NOTE: Fixed by: https://github.com/labstack/echo/commit/a9ede66a5a7196411131beb1ee801e75bbaf7ac6 (v5.2.0)
 CVE-2026-118654 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static f ...)
-	- golang-github-labstack-echo <unfixed>
+	- golang-github-labstack-echo <unfixed> (bug #1152486)
 	NOTE: https://github.com/labstack/echo/security/advisories/GHSA-3pmx-cf9f-34xr
 	NOTE: Fixed by: https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 (v4.16.0)
 	NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
 CVE-2026-118653 (Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP fal ...)
-	- golang-github-labstack-echo <unfixed>
+	- golang-github-labstack-echo <unfixed> (bug #1152486)
 	NOTE: https://github.com/labstack/echo/security/advisories/GHSA-246p-cpwv-v3jq
 	NOTE: Fixed by: https://github.com/labstack/echo/commit/22e4b71109ef072ef011a489066ec662ca9565b2 (v5.1.0)
 CVE-2026-118652 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP a ...)
-	- golang-github-labstack-echo <unfixed>
+	- golang-github-labstack-echo <unfixed> (bug #1152486)
 	NOTE: https://github.com/labstack/echo/security/advisories/GHSA-h9g5-28mm-hx3g
 	NOTE: Fixed by: https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 (v4.16.0)
 	NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
 CVE-2026-118651 (Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ...)
-	- golang-github-labstack-echo <unfixed>
+	- golang-github-labstack-echo <unfixed> (bug #1152486)
 	NOTE: https://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36
 	NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
 CVE-2026-118650 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally moun ...)
@@ -1136,7 +1136,7 @@ CVE-2026-118537 (A vulnerability was found in a2ui up to 0.10.4. This vulnerabil
 CVE-2026-118426 (In affected versions of Octopus Server with the LDAP authentication pr ...)
 	NOT-FOR-US: Octopus Deploy
 CVE-2026-118266 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOv ...)
-	- golang-github-labstack-echo <unfixed>
+	- golang-github-labstack-echo <unfixed> (bug #1152486)
 	NOTE: https://github.com/labstack/echo/security/advisories/GHSA-r7w9-592q-9vg4
 	NOTE: Fixed by: https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 (v4.16.0)
 	NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
@@ -1545,7 +1545,7 @@ CVE-2026-118265 (Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's E
 	NOTE: https://github.com/labstack/echo/security/advisories/GHSA-h53f-rm2w-w7rg
 	NOTE: Fixed by: https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaae (v5.4.1)
 CVE-2026-118264 (Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's  ...)
-	- golang-github-labstack-echo <unfixed>
+	- golang-github-labstack-echo <unfixed> (bug #1152486)
 	NOTE: https://github.com/labstack/echo/security/advisories/GHSA-cxf3-9h37-7rr8
 	NOTE: Fixed by: https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f (v4.16.1)
 	NOTE: Fixed by: https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec (v5.4.1)
@@ -1555,16 +1555,16 @@ CVE-2026-118263 (Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's B
 	NOTE: https://github.com/labstack/echo/pull/3105
 	NOTE: Fixed by: https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec (v5.4.1)
 CVE-2026-118262 (Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ...)
-	- golang-github-labstack-echo <unfixed>
+	- golang-github-labstack-echo <unfixed> (bug #1152486)
 	NOTE: https://github.com/labstack/echo/security/advisories/GHSA-9969-6676-49h5
 	NOTE: Fixed by: https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f (v4.16.1)
 	NOTE: Fixed by: https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec (v5.4.1)
 CVE-2026-118261 (Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in  ...)
-	- golang-github-labstack-echo <unfixed>
+	- golang-github-labstack-echo <unfixed> (bug #1152486)
 	NOTE: https://github.com/labstack/echo/security/advisories/GHSA-h7wr-284f-5qvc
 	NOTE: Fixed by: https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f (v4.16.1)
 CVE-2026-118260 (Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in  ...)
-	- golang-github-labstack-echo <unfixed>
+	- golang-github-labstack-echo <unfixed> (bug #1152486)
 	NOTE: https://github.com/labstack/echo/security/advisories/GHSA-f48p-c9v4-h7xv
 	NOTE: Fixed by: https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f (v4.16.1)
 CVE-2026-118259 (opentelemetry-java is the Java implementation of the OpenTelemetry API ...)
@@ -2187,41 +2187,41 @@ CVE-2026-100105 (A user with permission to edit contact points but not their pro
 CVE-2025-30414 (Local privilege escalation due to improper authentication. The followi ...)
 	NOT-FOR-US: Acronis
 CVE-2026-117501 (HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion vi ...)
-	- libhttp-body-perl <unfixed>
+	- libhttp-body-perl <unfixed> (bug #1152485)
 	NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711939/
 	NOTE: Fixed by: https://github.com/libwww-perl/HTTP-Body/commit/7c6dc1ecd49e30ac405a3959c606ba389718f556
 CVE-2026-117500 (HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via r ...)
-	- libhttp-body-perl <unfixed>
+	- libhttp-body-perl <unfixed> (bug #1152485)
 	NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711935/
 	NOTE: Fixed by: https://github.com/libwww-perl/HTTP-Body/commit/9ab46daaede02fb13ea55a7e3ede34c8b918d8ca
 	NOTE: Fixed by: https://github.com/libwww-perl/HTTP-Body/commit/3abc958d78bd84bf4abb87bad79b9432eab7e694
 CVE-2026-116531 (HTTP::Body versions before 1.23_01 for Perl lose track of chunk bounda ...)
-	- libhttp-body-perl <unfixed>
+	- libhttp-body-perl <unfixed> (bug #1152485)
 	NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711932/
 	NOTE: Fixed by: https://github.com/libwww-perl/HTTP-Body/commit/5869dde9fe6d13f189a435b6583fd63fcc18677a (v1.24)
 CVE-2026-116285 (HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via q ...)
-	- libhttp-body-perl <unfixed>
+	- libhttp-body-perl <unfixed> (bug #1152485)
 	NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711941/
 	NOTE: Fixed by: https://github.com/libwww-perl/HTTP-Body/commit/954a5343d2a095b59d357f28759c5388d1169574 (v1.24)
 CVE-2026-116135 (HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent es ...)
-	- libhttp-body-perl <unfixed>
+	- libhttp-body-perl <unfixed> (bug #1152485)
 	NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711937/
 	NOTE: Fixed by: https://github.com/libwww-perl/HTTP-Body/commit/336f1a23b4115a5cbeb546f36df5af62c90bdc0d (v1.24)
 CVE-2026-116134 (HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion vi ...)
-	- libhttp-body-perl <unfixed>
+	- libhttp-body-perl <unfixed> (bug #1152485)
 	NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711947/
 	NOTE: Fixed by: https://github.com/libwww-perl/HTTP-Body/commit/c5d13911aabfad4a7ae4b6ee98ac2315400e5ed5 (v1.24)
 CVE-2026-116133 (HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via q ...)
-	- libhttp-body-perl <unfixed>
+	- libhttp-body-perl <unfixed> (bug #1152485)
 	NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711943/
 	NOTE: Fixed by: https://github.com/libwww-perl/HTTP-Body/commit/bf77eb959bbe1641b77f69eefe98d58ce4c4ec79 (v1.24)
 CVE-2026-116132 (HTTP::Body versions before 1.23_01 for Perl leave the temporary file o ...)
-	- libhttp-body-perl <unfixed>
+	- libhttp-body-perl <unfixed> (bug #1152485)
 	NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711945/
 	NOTE: https://rt.cpan.org/Public/Bug/Display.html?id=84004
 	NOTE: Fixed by: https://github.com/libwww-perl/HTTP-Body/commit/29e933b22ff918ccf5412d3513c885208511cfa3 (v1.24)
 CVE-2026-116131 (HTTP::Body versions before 1.23_01 for Perl allow memory and temporary ...)
-	- libhttp-body-perl <unfixed>
+	- libhttp-body-perl <unfixed> (bug #1152485)
 	NOTE: https://lists.security.metacpan.org/cve-announce/msg/44711949/
 	NOTE: Fixed by: https://github.com/libwww-perl/HTTP-Body/commit/47beca524a3062eacfd646664576f005fb4be19b (v1.24)
 CVE-2026-XXXX [Memory corruption when an application cancels its lookups after a connection failure]



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7e0236cc3f69ce191fa5b7a8401df7631bc27eeb

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7e0236cc3f69ce191fa5b7a8401df7631bc27eeb
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261029/e38f8bc8/attachment.htm>

More information about the debian-security-tracker-commits mailing list