Open Source Vulnerabilities

airflow-2

airflow-2

airflow-2

airflow-2

terraform-fips-1.14

grpc-1.78, grpc-1.78

grpc-1.78, grpc-1.78

py3.10-vllm-cuda-12.4

py3.10-vllm-cuda-12.4

py3.10-vllm-cuda-12.4

terraform-1.14

grpc-1.80, grpc-1.80

grpc-1.80, grpc-1.80

lmcache-cuda-12.8

lmcache-cuda-12.8

lmcache-cuda-12.8

linux-qemu-melange

linux-qemu-melange

linux-qemu-melange

opentofu-fips-1.11

hono-service-command-router

hono-service-command-router

hono-service-command-router

terraform-1.9

elastic-agent-9.3

grpc-1.73, grpc-1.73

grpc-1.73, grpc-1.73

grpc-1.75, grpc-1.75

grpc-1.75, grpc-1.75

vault-fips-2.0

vault-fips-1.21

grpc-1.69, grpc-1.69

grpc-1.69, grpc-1.69

libxml2

grpc-1.80, grpc-1.80

grpc-1.80, grpc-1.80

libxml2

libxml2

Integer overflow in xmlURIEscapeStr (uri.c). Upstream fix (8edbbdb0) adds `if (len == 0) return(NULL);` after xmlStrlen to catch overflow where xmlStrlen returns 0 for a non-empty input. Debian trixie's 2.9.14-based package already has the equivalent guard `if (!(len > 0)) return(NULL);` at the same site, so the bot's CVE-2026-86139 backport (#21567) is a no-op cosmetic rewrite and is not carried. Verified against the deb13u3 source tree.

libxml2

libxml2

libxml2

libxml2

libxml2

grpc-1.76, grpc-1.76

grpc-1.76, grpc-1.76

terraform-1.13

grpc-1.68, grpc-1.68

grpc-1.68, grpc-1.68

grpc-1.66, grpc-1.66

grpc-1.66, grpc-1.66