MontaVista CVE List and Response
MontaVista continually monitors the security community and customers for threats. We follow the community on CVE scoring (NVD) and set fix priority accordingly for affected products. Please view the following CVEs that have been remediated or are in process by clicking the CVE Year to the left or use the CVE Filters below.
For inquiries regarding Security Vulnerabilities, please see our Vulnerability Response Policy or email our PSIRT team security@mvista.com. Email messages and attachments can be encrypted using PGP and a MontaVista PSIRT PGP key, which is available for download here.
| CVE | Score | Severity | Package | Description | Published |
|---|---|---|---|---|---|
| CVE-2026-35334 |
7.5 (i)
| HIGH | strongswan | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. | 2026-08-04 |
| CVE-2026-64564 |
7.8 (i)
| HIGH | kernel | In the Linux kernel, the following vulnerability has been resolved:sctp: don't free the ASCONF's own transport in DEL-IP processingsctp_process_asconf() caches the transport the ASCONF chunk is processedagainst in asconf->transport (== chunk->transport, set once in sctp_rcv()).For an ASCONF located through its Address Parameter by__sctp_rcv_asconf_lookup(), that cached transport corresponds to theAddress Parameter, which need not be the packet's source address.sctp_process_asconf_param() rejects a DEL-IP for the packet source address(ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport.A single ASCONF can therefore carry, in order: [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0]where L differs from the source. The DEL-IP for L passes the D8 check andcalls sctp_assoc_rm_peer() on the transport that asconf->transport stillpoints at, freeing it (RCU-deferred). The following wildcard DEL-IP thenreuses the now-dangling asconf->transport in sctp_assoc_set_primary() andsctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freedtransport (->ipaddr, ->state) and plants the dangling pointer intoasoc->peer.primary_path / active_path, and del_nonprimary_peers(), keepingonly the pointer that is no longer on the list, removes every realtransport, leaving the association with a transport_count of 0 andprimary_path/active_path pointing at freed memory.Reject a DEL-IP that targets the transport the ASCONF is being processedagainst, mirroring the existing source-address guard, so the wildcardbranch can never reuse a freed transport. | 2026-08-04 |
| CVE-2026-6540 |
7.5 (i)
| HIGH | calico | Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes authorizes the request under the permitted prefix while the downstream workload or a fronting proxy normalizes the path and serves the restricted endpoint. An attacker with network access and no special RBAC can potentially reach HTTP endpoints the policy was intended to restrict. | 2026-07-30 |
| CVE-2026-41187 |
6.5 (i)
| MEDIUM | calico | Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary. | 2026-07-30 |
| CVE-2026-41186 |
6.5 (i)
| MEDIUM | calico | When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks (including function arguments), and command-line arguments. Depending on the process's in-memory state, the heap may contain sensitive material. The debug listener is opt-in but is unsafe when enabled because it offers no authentication and no safe localhost-only binding option. | 2026-07-30 |
| CVE-2026-7260 |
5.5 (i)
| MEDIUM | php | Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9. | 2026-07-30 |
| CVE-2026-17544 |
9.1 (i)
| CRITICAL | php | Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9. | 2026-07-30 |
| CVE-2026-17543 |
9.8 (i)
| CRITICAL | php | Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9. | 2026-07-30 |
| CVE-2026-16524 |
7.8 (i)
| HIGH | performance_co-pilot | A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric.This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh. | 2026-07-30 |
| CVE-2021-26142 |
8.1 (i)
| HIGH | kernel | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. | 2026-07-27 |