resolved
Stack Overflow DoS in ST_GeomFromGeoJSON Allows Any Authenticated User to Crash the Entire Server
Bug reported by Byte Override was disclosed at September 3, 2026, 10:13 pm | Stack Overflow
A vulnerability was discovered in the MariaDB database server's ST_GeomFromGeoJSON function. Any authenticated user with basic SELECT privileges could crash the entire server by passing a deeply nested GeoJSON GeometryCollection. The crash was caused by unbounded recursion in the GeoJSON parser, which consumed the server's stack until it overflowed, leading to a SIGSEGV crash that killed all active connections and required a full server restart. The vulnerability existed since the introduction of ST_GeomFromGeoJSON in MariaDB 10.2.4 and affected all versions through the current development trunk.
resolved
CVE-2026-19931: Negotiate ambient user conn reuse
Bug reported by Martin Dukek was disclosed at September 3, 2026, 6:09 am | Authentication Bypass by Primary Weakness
resolved
CVE-2026-80231: native CA store conn reuse
Bug reported by Anteater was disclosed at September 3, 2026, 6:08 am |
resolved
CVE-2026-13608: OpenLDAP SASL authentication bypass
Bug reported by Eunsoo Kim was disclosed at September 3, 2026, 12:35 am | Authentication Bypass by Primary Weakness
A vulnerability was discovered in the OpenLDAP SASL authentication mechanism in libcurl. The vulnerability could allow a malicious LDAP server to bypass SASL authentication, potentially allowing the injection of arbitrary LDAP results. The vulnerable code has been present since the OpenLDAP SASL support was introduced and was unchanged in the current release.