resolved
A disabled account's API key still works on BMO's Mojolicious /rest/ routes, including for security-group bugs filed after the disable
Bug reported by Tim Haines was disclosed at October 26, 2026, 10:49 am | Improper Authentication - Generic
A Bugzilla instance had inconsistent authentication validation across its API implementations. The newer REST routes failed to verify account status when processing API keys, while the legacy REST API and web interface correctly rejected disabled accounts. This allowed disabled accounts' API keys to remain functional on the newer routes, including for security-sensitive bug operations. The vulnerability was remediated by implementing proper account status validation in the REST API authentication process.
resolved
CVE-2026-115529: Schannel TLS auto client session resumption
Bug reported by Johnny Kao was disclosed at October 26, 2026, 7:54 am | Improper Authentication - Generic
resolved
CVE-2026-111954: upload reader failed redirect UAF
Bug reported by 1rhino2 was disclosed at October 26, 2026, 7:54 am | Use After Free
resolved
CVE-2026-111953: GnuTLS SecTrust OCSP staple bypass
Bug reported by Sujit Jaunjal was disclosed at October 26, 2026, 7:54 am | Improper Certificate Validation
resolved
CVE-2026-111950: TLS session cache diff scheme reuse
Bug reported by was disclosed at October 26, 2026, 7:54 am | Incorrect Comparison
resolved
CVE-2026-111484: OpenSSL with SecTrust accepts bad OCSP staples
Bug reported by Sujit Jaunjal was disclosed at October 26, 2026, 7:53 am | Improper Certificate Validation
resolved
CVE-2026-111482: libssh2 knownhosts prefix match
Bug reported by Samuel Henrique was disclosed at October 26, 2026, 7:53 am | Partial String Comparison
resolved
CVE-2026-111481: server-set cookie still aborts cookie jar
Bug reported by Samuel Henrique was disclosed at October 26, 2026, 7:53 am | Improper Input Validation
resolved
CVE-2026-111480: pause UAF from within callback
Bug reported by Daniel Wade was disclosed at October 26, 2026, 7:53 am | Use After Free
resolved
CVE-2026-111952: OpenSSL provider use-after-free again
Bug reported by moltenbit was disclosed at October 26, 2026, 7:52 am | Use After Free
resolved
CVE-2026-111878: OpenSSL provider UAF on TLS shutdown
Bug reported by Van was disclosed at October 26, 2026, 7:25 am | Use After Free
A use-after-free vulnerability was identified in the OpenSSL provider implementation when using the multi interface. The vulnerability occurred when a private library context was freed while an SSL context that borrowed it remained queued for shutdown. This happened because the library context was stored only on the easy handle and was freed during cleanup before deferred shutdown operations completed. When shutdown processing continued on the connection queue, freed memory was accessed through SSL read and shutdown operations, potentially corrupting memory in the process.
resolved
CVE-2026-111951: curl -OJ truncate without filename
Bug reported by Mattéo was disclosed at October 26, 2026, 7:22 am | External Control of File Name or Path
In curl versions 8.23.0, 8.22.0, and master branch, a vulnerability was identified in the tool's handling of Content-Disposition headers with the -OJ flag. When a response contained multiple Content-Disposition headers where the first lacked a filename parameter, the tool would create and truncate an existing file to zero bytes before refusing to overwrite it, contradicting documented behavior. This occurred because the code fell through to file creation with the URL-derived name before the second header containing the actual filename was processed. The file was left empty while curl reported exit code 23 indicating refusal to overwrite. Similar issues were observed with redirect handling and the -i flag for writing response headers.
resolved
CVE-2026-115528: wolfSSL TLS connect without cert
Bug reported by Mattéo was disclosed at October 26, 2026, 7:21 am | Improper Certificate Validation
A vulnerability was discovered in curl when built with wolfSSL that allowed TLS connections to complete without certificate verification. When using default certificate verification settings, curl accepted anonymous Diffie-Hellman cipher suites that transmitted no server certificate. This caused user credentials and request data to be sent to unauthenticated servers. The issue was caused by insufficient certificate validation checks in the wolfSSL backend code. Connections using OpenSSL or GnuTLS were not affected by this vulnerability.
resolved
CVE-2026-111483: GnuTLS accepts non-successful OCSP staples
Bug reported by Mattéo was disclosed at October 26, 2026, 7:21 am | Improper Check for Certificate Revocation
A vulnerability was identified in curl version 8.22.0 and 8.23.0 when built with GnuTLS. The --cert-status option failed to properly validate stapled OCSP responses. Instead of checking the response status and certificate status within the response, the code only verified that some stapled OCSP response was received. This allowed a revoked certificate to be accepted if accompanied by a bogus or non-successful OCSP response. The issue was introduced when OCSP signature verification code was removed, and the previous validation checks for response and certificate status were eliminated. The vulnerability was not present in version 8.21.0 and earlier, where the bogus staple was correctly rejected.
resolved
Arbitrary `/tmp` read in discourse via `convert_heif!` decoder-confusion (regression of 4bf3bf6786)
Bug reported by Tuan Nguyen was disclosed at October 26, 2026, 3:43 am | Information Disclosure
A decoder confusion vulnerability was discovered in image conversion functionality that allowed arbitrary file reads from temporary directories. When HEIF/HEIC files were processed, the conversion function failed to enforce a specific decoder prefix, allowing ImageMagick to dispatch based on file magic bytes instead of extension. Files with PostScript headers were routed through Ghostscript, which executed arbitrary PostScript code under a restricted sandbox. The PostScript was able to read temporary files, enumerate directory contents, and render the results into JPEG images that were stored as normal uploads and served publicly without authentication. This enabled authenticated users to exfiltrate temporary files from other users and system processes, including in-flight upload buffers, email attachments, and conversion intermediates. The vulnerability was introduced when HEIF support was added and represented a regression of previous security fixes that had enforced decoder specification.
![[Image: e72398fe92beda2aa80d0329e8b9f4febece7568.gif]](https://64.media.tumblr.com/834502d05f9b014cbc37366fe428a5a7/13cb9841c0799d7a-ff/s500x560/e72398fe92beda2aa80d0329e8b9f4febece7568.gif)
