OPENSUSE-SU-2026:21448-1

Advisory lineage Upstream: 13 Downstream: 0
Published: 27 Jul 2026, 15:55
Last modified:29 Jul 2026, 18:24

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

27 Jul 2026, 15:55
Published
Vulnerability first disclosed
29 Jul 2026, 18:24
Last Modified
Vulnerability information updated

Description

Security update for agama-web-ui This update for agama-web-ui fixes the following issues: - CVE-2025-7783: form-data: unsafe `Math.random()` function is used to select a boundary value for multipart form-encoded data (bsc#1246822). - CVE-2026-12143: form-data: CRLF injection via unescaped multipart field names and filenames (bsc#1272310). - CVE-2026-13149: brace-expansion: `expand()` function exhibits exponential-time complexity when processing non-expanding `{}` brace groups (bsc#1269927). - CVE-2026-13311: shell-quote: quadratic complexity in `parse()` function when processing specially crafted strings (bsc#1269359). - CVE-2026-13676: fast-uri: host-based policy bypass due to failure to canonicalize Unicode/IDN hostnames for HTTP-family URLs (bsc#1269595). - CVE-2026-27601: underscore: DoS via stack overflow due to missing depth limits in `_.flatten` and `_.isEqual` functions (bsc#1259169). - CVE-2026-40181: react-router: open redirect to an external domain due to path values starting with `//` being reinterpreted as protocol-relative URLs (bsc#1272311). - CVE-2026-49356: @babel/core: arbitrary file read via `sourceMappingURL` comment (bsc#1272317). - CVE-2026-53550: js-yaml: quadratic complexity in merge-key processing when processing a crafted YAML document (bsc#1268851). - CVE-2026-53632: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows (bsc#1272319). - CVE-2026-54466: websocket-driver: message corruption via abuse of protocol length headers (bsc#1272312). - CVE-2026-54490: websocket-driver: resource limit bypass via message compression (bsc#1272313). - CVE-2026-55602: http-proxy-middleware: Host-header-driven backend routing bypass via `router` host+path substring matching (bsc#1272318).

Affected Systems

  • opensuse•agama-web-ui&distro=openSUSE Leap 16.0

    < 17+673.b97ba64d6-160000.12.1

References (27)