Open Source Vulnerabilities

grpc-1.75, grpc-1.75

grpc-1.75, grpc-1.75

vault-fips-2.0

vault-fips-1.21

grpc-1.69, grpc-1.69

grpc-1.69, grpc-1.69

libxml2

grpc-1.80, grpc-1.80

grpc-1.80, grpc-1.80

libxml2

libxml2

Integer overflow in xmlURIEscapeStr (uri.c). Upstream fix (8edbbdb0) adds `if (len == 0) return(NULL);` after xmlStrlen to catch overflow where xmlStrlen returns 0 for a non-empty input. Debian trixie's 2.9.14-based package already has the equivalent guard `if (!(len > 0)) return(NULL);` at the same site, so the bot's CVE-2026-86139 backport (#21567) is a no-op cosmetic rewrite and is not carried. Verified against the deb13u3 source tree.

libxml2

libxml2

libxml2

libxml2

libxml2

grpc-1.76, grpc-1.76

grpc-1.76, grpc-1.76

terraform-1.13

grpc-1.68, grpc-1.68

grpc-1.68, grpc-1.68

grpc-1.66, grpc-1.66

grpc-1.66, grpc-1.66

elasticsearch-9.2

helmfile

hono

hono

hono

grpc-1.71, grpc-1.71

grpc-1.71, grpc-1.71

grpc-1.67, grpc-1.67

grpc-1.67, grpc-1.67

opentofu-1.12, opentofu-1.12

terraform-mcp-server, terraform-mcp-server

hono-adapter-mqtt

hono-adapter-mqtt

hono-adapter-mqtt

grpc-1.69, grpc-1.69

grpc-1.69, grpc-1.69

airflow-core-2

airflow-core-2

airflow-core-2

airflow-core-2

airflow-core-2

vault-2.1

vault-fips-2.1

grpc-1.74, grpc-1.74

grpc-1.74, grpc-1.74

opentofu-fips-1.10

hono-cli