The IT Show

Security · rsync rsync

rsync Use-After-Free Flaw (CVE-2026-41035) Affects Versions 3.0.1 Through 3.4.1 When Extended Attributes Are Enabled

CVE-2026-41035 describes a receiver-side use-after-free in rsync 3.0.1 through 3.4.1, where receive_xattr passes an untrusted length value to a qsort call. Exploitation requires the victim to run rsync with -X (--xattrs); many common Linux configurations are vulnerable, and non-Linux platforms are more widely affected.

Security · Go Go crypto/x509

Go crypto/x509 Fails to Apply Excluded DNS Name Constraints to Mixed-Case Wildcard SANs

CVE-2026-33810 describes a certificate validation flaw in which excluded DNS name constraints in a certificate chain are not correctly applied to wildcard DNS SANs that use different letter casing than the constraint, allowing a constrained name to be accepted. The issue affects validation of otherwise trusted chains issued by a root CA in VerifyOptions.Roots or the system certificate pool.

Security · MLflow MLflow

MLflow Command Injection Flaw (CVE-2025-15379) Fixed in Version 3.8.2

MLflow's model serving container initialization contains a command injection vulnerability (CVE-2025-15379) in the `_install_model_dependencies_to_env()` function, where dependency entries from a model artifact's `python_env.yaml` are interpolated into a shell command without sanitization when deploying with `env_manager=LOCAL`, allowing a malicious model artifact to execute arbitrary commands on the deploying system. The issue affects version 3.8.0 and is fixed in 3.8.2; separately, an update to CVE-2025-14813 covers a broken/risky cryptographic algorithm issue in Bouncy Castle BC-JAVA (bcprov) G3413CTRBlockCipher affecting 1.59 before 1.80.2, 1.81 before 1.81.1, and 1.82 before 1.84.

Security · Remix React Router

React Router Patches Client-Side Script Execution Flaw in Loader/Action Redirects (CVE-2026-22029)

CVE-2026-22029 affects @remix-run/router before 1.23.2 and react-router 7.0.0 through 7.11.0, where SPA redirects returned from loaders or actions in Framework, Data, or unstable RSC modes can produce unsafe URLs that trigger unintended JavaScript execution in the browser. Exploitation requires redirect paths built from untrusted content or an open redirect; Declarative Mode is unaffected, and fixes are available in @remix-run/router 1.23.2 and react-router 7.12.0.

Security · Red Hat Undertow

Multiple Undertow Flaws Disclosed, Including Chunked-Response Denial of Service (CVE-2024-5971)

CVE-2024-5971 describes a vulnerability in Undertow where a chunked response hangs after the body is flushed because Undertow does not send the expected 0\r\n chunk terminator, leaving clients waiting and causing uncontrolled resource consumption and denial of service in Java 17 TLSv1.3 scenarios. Related Undertow advisories include CVE-2024-3884 (OutOfMemory condition when parsing large application/x-www-form-urlencoded data), CVE-2025-9784 ("MadeYouReset" server-side stream resets that bypass abuse counters), and CVE-2025-12543 (improper Host header validation in the Undertow HTTP server core used by WildFly, JBoss EAP, and other Java applications).

Security · GNU Emacs

Command Injection Flaw in Emacs Enables Remote Shell Command Execution

CVE-2025-1244 is a command injection vulnerability in the Emacs text editor that could allow a remote, unauthenticated attacker to execute arbitrary shell commands by tricking a user into visiting a specially crafted website or an HTTP URL with a redirect. Separately published advisories include authenticated root-level OS command injection issues in Lantronix EDS5000 2.1.0.0R3 and EDS3000PS 3.1.0.0R2 (CVE-2025-67034 through CVE-2025-67038 and CVE-2025-67041), an authentication bypass in EDS3000PS (CVE-2025-67039), and prototype pollution in Lodash 4.0.0 through 4.17.22, patched in 4.17.23 (CVE-2025-13465).

Cloud Security · Amazon AWS Amplify CLI

AWS Amplify CLI Flaw (CVE-2024-28056) Could Expose IAM Roles to Unauthorized Assumption

Amazon AWS Amplify CLI versions before 12.10.1 incorrectly configure the role trust policy of IAM roles tied to Amplify projects: when the Authentication component is removed, a Condition property is dropped while "Effect":"Allow" remains, leaving sts:AssumeRoleWithWebIdentity available without conditions. Projects built between August 2019 and January 2024 from which an authorized AWS user removed the Authentication component could have allowed threat actors to assume the role and gain unauthorized access to AWS resources.

Security · VMware Reactor Netty

Reactor Netty HttpClient Can Leak Credentials on Cross-Domain Redirects (CVE-2020-5404)

CVE-2020-5404 affects Reactor Netty's HttpClient in versions 0.9.x before 0.9.5 and 0.8.x before 0.8.16, where credentials may be leaked during a redirect to a different domain, but only when the client is explicitly configured to follow redirects. The issue is part of a broader set of Reactor Netty advisories that also includes the HttpServer flaws CVE-2020-5403, CVE-2022-31684, CVE-2023-34062 (directory traversal) and CVE-2023-34054 (denial of service).

Security · VMware Spring Web Services

New Spring Web Services Flaws Disclosed Alongside Legacy XXE Advisory

Spring Web Services is affected by CVE-2026-40998, where Jaxp13XPathTemplate evaluates XPath on StreamSource and SAXSource inputs using the JDK's default DocumentBuilderFactory rather than Spring's hardened parser, exposing applications to XML External Entity (XXE) attacks, and CVE-2026-40994, where Wss4jSecurityInterceptor disables WSS4J WS-I Basic Security Profile enforcement during inbound validation, allowing non-compliant messages to be accepted; affected versions are 5.0.0–5.0.1, 4.1.0–4.1.3, 4.0.0–4.0.18 and 3.1.0–3.1.8. These follow the earlier CVE-2019-3773 advisory, in which Spring Web Services 2.4.3, 3.0.4 and older unsupported versions were susceptible to XXE when processing XML from untrusted sources.

Security · MOOS-IvP MOOS-IvP

MOOS-IvP through 24.8.1 Affected by Command Injection and Out-of-Bounds Read Flaws

MOOS-IvP versions through 24.8.1 contain a command injection vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir(), which fails to sanitize shell metacharacters in log file pathnames or the --dir parameter, allowing arbitrary command execution with the privileges of the operator running alogsplit. A separate out-of-bounds read affects the isQuoted(), isBraced(), and isChevroned() functions, which strip whitespace but index using the original string length, letting attackers send NODE_REPORT messages with leading or trailing whitespace to read adjacent memory.