Ncurses, Undertow, Jackson-Databind Face Critical Flaws
Multiple critical vulnerabilities in GNU ncurses, Undertow, and Java's jackson-databind library allow for remote code execution and denial of service.
A cluster of critical vulnerabilities in GNU ncurses (CVE-2017-10685, CVE-2017-10684, CVE-2017-16879, CVE-2017-13728, CVE-2017-11113, CVE-2017-11112, CVE-2022-29458) presents a significant risk, with multiple flaws allowing for remote code execution and denial of service. These vulnerabilities stem from issues like format string bugs, buffer overflows, and improper handling of terminfo data. Given ncurses's widespread use in Unix-like systems for terminal control, exploitation could lead to widespread compromise. Patches and updates are available for some versions, but users should prioritize updating to secure versions.
Undertow, a popular HTTP server used in Java applications like WildFly and JBoss EAP, is affected by several high-severity vulnerabilities. CVE-2025-12543 allows for request hijacking due to improper Host header validation. CVE-2024-3884 and CVE-2025-9784 enable denial of service attacks through malformed requests and excessive server-side stream resets, respectively. These flaws could be exploited by unauthenticated attackers to disrupt services or potentially gain unauthorized access.
The Ash Project's authorization framework is susceptible to authentication bypass vulnerabilities (CVE-2025-48044, CVE-2025-48043). These flaws, located in policy and authorizer routines, could allow unauthorized users to gain access to sensitive resources or perform actions they should not be permitted to. While the CVSS scores are not provided, the nature of authentication bypass makes these vulnerabilities critical for any application relying on Ash for access control.
Several Linux kernel vulnerabilities have been disclosed, including issues related to IPv6 multicast handling (CVE-2025-38550), eventpoll reference counting (CVE-2025-38349), and MHI host event ring pointer alignment (CVE-2023-52494). While these may require specific conditions or local access to exploit, they highlight ongoing security concerns within the kernel. Additionally, a path traversal vulnerability in Dell Inventory Collector (CVE-2024-37129) allows for local privilege escalation.
A critical vulnerability in the jackson-databind library (CVE-2021-20190) allows for remote code execution by exploiting flaws in the serialization of Java objects. This library is widely used in Java applications, making the potential impact significant. Users should update to version 2.9.10.7 or later to mitigate this risk. Urllib3, a Python HTTP client, also has a high-severity vulnerability (CVE-2026-21441) related to its streaming API that could lead to information disclosure or denial of service.