GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

RHSA-2026:18480

Vulnerability from csaf_opensuse - Published: 2026-05-19 00:00 - Updated: 2026-09-14 16:08
Summary
security update for linux-sgx
Severity
Important
Notes
Title of the patch: security update for linux-sgx
Description of the patch: This security update provides a functional equivalent of RHSA-2026:18480. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:18480.
Patchnames: RHSA-2026:18480
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2025-13465
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Liberty Linux 10:sgx-common-2.26-7.el10.x86_64 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:sgx-libs-2.26-7.el10.x86_64 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:sgx-mpa-2.26-7.el10.x86_64 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:sgx-pccs-2.26-7.el10.x86_64 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:sgx-pccs-admin-2.26-7.el10.x86_64 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:sgx-pckid-tool-2.26-7.el10.x86_64 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:tdx-qgs-2.26-7.el10.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2025-15284
Affected products
Recommended 7 products, the same list as for CVE-2025-13465
Threats
Impact moderate
CVE-2026-23745
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
Recommended 7 products, the same list as for CVE-2025-13465
Threats
Impact important
CVE-2026-23950
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
Recommended 7 products, the same list as for CVE-2025-13465
Threats
Impact important
CVE-2026-24842
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
Recommended 7 products, the same list as for CVE-2025-13465
Threats
Impact important
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for linux-sgx",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2026:18480.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2026:18480.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2026:18480",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_18480.json"
      },
      {
        "category": "self",
        "summary": "URL for RHSA-2026:18480",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-June/006377.html"
      },
      {
        "category": "self",
        "summary": "E-Mail link for RHSA-2026:18480",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-June/006377.html"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-13465 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-13465/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-15284 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-15284/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-23745 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-23745/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-23950 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-23950/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-24842 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-24842/"
      }
    ],
    "title": "security update for linux-sgx",
    "tracking": {
      "current_release_date": "2026-09-14T16:08:56Z",
      "generator": {
        "date": "2026-05-19T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2026:18480",
      "initial_release_date": "2026-05-19T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-05-19T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-14T16:08:56Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "sgx-common-2.26-7.el10.x86_64",
                "product": {
                  "name": "sgx-common-2.26-7.el10.x86_64",
                  "product_id": "sgx-common-2.26-7.el10.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "sgx-libs-2.26-7.el10.x86_64",
                "product": {
                  "name": "sgx-libs-2.26-7.el10.x86_64",
                  "product_id": "sgx-libs-2.26-7.el10.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "sgx-mpa-2.26-7.el10.x86_64",
                "product": {
                  "name": "sgx-mpa-2.26-7.el10.x86_64",
                  "product_id": "sgx-mpa-2.26-7.el10.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "sgx-pccs-2.26-7.el10.x86_64",
                "product": {
                  "name": "sgx-pccs-2.26-7.el10.x86_64",
                  "product_id": "sgx-pccs-2.26-7.el10.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "sgx-pccs-admin-2.26-7.el10.x86_64",
                "product": {
                  "name": "sgx-pccs-admin-2.26-7.el10.x86_64",
                  "product_id": "sgx-pccs-admin-2.26-7.el10.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "sgx-pckid-tool-2.26-7.el10.x86_64",
                "product": {
                  "name": "sgx-pckid-tool-2.26-7.el10.x86_64",
                  "product_id": "sgx-pckid-tool-2.26-7.el10.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "tdx-qgs-2.26-7.el10.x86_64",
                "product": {
                  "name": "tdx-qgs-2.26-7.el10.x86_64",
                  "product_id": "tdx-qgs-2.26-7.el10.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 10",
                "product": {
                  "name": "SUSE Liberty Linux 10",
                  "product_id": "SUSE Liberty Linux 10",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:10"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sgx-common-2.26-7.el10.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:sgx-common-2.26-7.el10.x86_64"
        },
        "product_reference": "sgx-common-2.26-7.el10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sgx-libs-2.26-7.el10.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:sgx-libs-2.26-7.el10.x86_64"
        },
        "product_reference": "sgx-libs-2.26-7.el10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sgx-mpa-2.26-7.el10.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:sgx-mpa-2.26-7.el10.x86_64"
        },
        "product_reference": "sgx-mpa-2.26-7.el10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sgx-pccs-2.26-7.el10.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:sgx-pccs-2.26-7.el10.x86_64"
        },
        "product_reference": "sgx-pccs-2.26-7.el10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sgx-pccs-admin-2.26-7.el10.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:sgx-pccs-admin-2.26-7.el10.x86_64"
        },
        "product_reference": "sgx-pccs-admin-2.26-7.el10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sgx-pckid-tool-2.26-7.el10.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:sgx-pckid-tool-2.26-7.el10.x86_64"
        },
        "product_reference": "sgx-pckid-tool-2.26-7.el10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tdx-qgs-2.26-7.el10.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:tdx-qgs-2.26-7.el10.x86_64"
        },
        "product_reference": "tdx-qgs-2.26-7.el10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-13465",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-13465"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset  and _.omit  functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.\n\nThe issue permits deletion of properties but does not allow overwriting their original behavior.\n\nThis issue is patched on 4.17.23",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:sgx-common-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:sgx-libs-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:sgx-mpa-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:sgx-pccs-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:sgx-pccs-admin-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:sgx-pckid-tool-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:tdx-qgs-2.26-7.el10.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-13465",
          "url": "https://www.suse.com/security/cve/CVE-2025-13465"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257321 for CVE-2025-13465",
          "url": "https://bugzilla.suse.com/1257321"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:sgx-common-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-libs-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-mpa-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pccs-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pccs-admin-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pckid-tool-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:tdx-qgs-2.26-7.el10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:sgx-common-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-libs-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-mpa-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pccs-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pccs-admin-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pckid-tool-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:tdx-qgs-2.26-7.el10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-19T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-13465"
    },
    {
      "cve": "CVE-2025-15284",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-15284"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: \u003c 6.14.1.\n\n\nSummary\n\nThe arrayLimit  option in qs did not enforce limits for bracket notation (a[]=1\u0026a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit  should apply uniformly across all array notations.\n\nNote:  The default parameterLimit  of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit  regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.\n\nDetails\n\nThe arrayLimit  option only checked limits for indexed notation (a[0]=1\u0026a[1]=2) but did not enforce it for bracket notation (a[]=1\u0026a[]=2).\n\nVulnerable code  (lib/parse.js:159-162):\n\nif (root === \u0027[]\u0027 \u0026\u0026 options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\n\n\n\n\n\nWorking code  (lib/parse.js:175):\n\nelse if (index \u003c= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\n\n\n\n\n\nThe bracket notation handler at line 159 uses utils.combine([], leaf)  without validating against options.arrayLimit, while indexed notation at line 175 checks index \u003c= options.arrayLimit  before creating arrays.\n\n\n\nPoC\n\nconst qs = require(\u0027qs\u0027);\nconst result = qs.parse(\u0027a[]=1\u0026a[]=2\u0026a[]=3\u0026a[]=4\u0026a[]=5\u0026a[]=6\u0027, { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\n\n\n\n\n\nNote on parameterLimit interaction:  The original advisory\u0027s \"DoS demonstration\" claimed a length of 10,000, but parameterLimit  (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\n\nImpact\n\nConsistency bug in arrayLimit  enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit  already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit  is explicitly set to a very high value.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:sgx-common-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:sgx-libs-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:sgx-mpa-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:sgx-pccs-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:sgx-pccs-admin-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:sgx-pckid-tool-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:tdx-qgs-2.26-7.el10.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-15284",
          "url": "https://www.suse.com/security/cve/CVE-2025-15284"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:sgx-common-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-libs-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-mpa-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pccs-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pccs-admin-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pckid-tool-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:tdx-qgs-2.26-7.el10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-19T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-15284"
    },
    {
      "cve": "CVE-2026-23745",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-23745"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "node-tar is a Tar for Node.js. The node-tar library (\u003c= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:sgx-common-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:sgx-libs-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:sgx-mpa-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:sgx-pccs-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:sgx-pccs-admin-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:sgx-pckid-tool-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:tdx-qgs-2.26-7.el10.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-23745",
          "url": "https://www.suse.com/security/cve/CVE-2026-23745"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257002 for CVE-2026-23745",
          "url": "https://bugzilla.suse.com/1257002"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:sgx-common-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-libs-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-mpa-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pccs-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pccs-admin-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pckid-tool-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:tdx-qgs-2.26-7.el10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:sgx-common-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-libs-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-mpa-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pccs-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pccs-admin-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pckid-tool-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:tdx-qgs-2.26-7.el10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-19T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-23745"
    },
    {
      "cve": "CVE-2026-23950",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-23950"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., `` and `ss`), allowing them to be processed in parallel. This bypasses the library\u0027s internal concurrency safeguards and permits Symlink Poisoning attacks via race conditions. The library uses a `PathReservations` system to ensure that metadata checks and file operations for the same path are serialized. This prevents race conditions where one entry might clobber another concurrently. This is a Race Condition which enables Arbitrary File Overwrite. This vulnerability affects users and systems using node-tar on macOS (APFS/HFS+). Because of using `NFD` Unicode normalization (in which `` and `ss` are different), conflicting paths do not have their order properly preserved under filesystems that ignore Unicode normalization (e.g., APFS (in which `` causes an inode collision with `ss`)). This enables an attacker to circumvent internal parallelization locks (`PathReservations`) using conflicting filenames within a malicious tar archive. The patch in version 7.5.4 updates `path-reservations.js` to use a normalization form that matches the target filesystem\u0027s behavior (e.g., `NFKD`), followed by first `toLocaleLowerCase(\u0027en\u0027)` and then `toLocaleUpperCase(\u0027en\u0027)`. As a workaround, users who cannot upgrade promptly, and who are programmatically using `node-tar` to extract arbitrary tarball data should filter out all `SymbolicLink` entries (as npm does) to defend against arbitrary file writes via this file system entry name collision issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:sgx-common-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:sgx-libs-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:sgx-mpa-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:sgx-pccs-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:sgx-pccs-admin-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:sgx-pckid-tool-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:tdx-qgs-2.26-7.el10.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-23950",
          "url": "https://www.suse.com/security/cve/CVE-2026-23950"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:sgx-common-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-libs-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-mpa-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pccs-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pccs-admin-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pckid-tool-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:tdx-qgs-2.26-7.el10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:sgx-common-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-libs-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-mpa-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pccs-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pccs-admin-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pckid-tool-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:tdx-qgs-2.26-7.el10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-19T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-23950"
    },
    {
      "cve": "CVE-2026-24842",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-24842"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:sgx-common-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:sgx-libs-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:sgx-mpa-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:sgx-pccs-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:sgx-pccs-admin-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:sgx-pckid-tool-2.26-7.el10.x86_64",
          "SUSE Liberty Linux 10:tdx-qgs-2.26-7.el10.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-24842",
          "url": "https://www.suse.com/security/cve/CVE-2026-24842"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257415 for CVE-2026-24842",
          "url": "https://bugzilla.suse.com/1257415"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:sgx-common-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-libs-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-mpa-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pccs-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pccs-admin-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pckid-tool-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:tdx-qgs-2.26-7.el10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:sgx-common-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-libs-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-mpa-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pccs-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pccs-admin-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:sgx-pckid-tool-2.26-7.el10.x86_64",
            "SUSE Liberty Linux 10:tdx-qgs-2.26-7.el10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-19T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-24842"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.