{
    "summary": {
        "snap": {
            "added": [],
            "removed": [],
            "diff": []
        },
        "deb": {
            "added": [],
            "removed": [],
            "diff": [
                "curl",
                "libcurl4",
                "libperl5.34",
                "libssl3",
                "openssl",
                "perl",
                "perl-base",
                "perl-modules-5.34",
                "xxd"
            ]
        }
    },
    "diff": {
        "deb": [
            {
                "name": "curl",
                "from_version": {
                    "source_package_name": "curl",
                    "source_package_version": "7.81.0-1ubuntu1.26",
                    "version": "7.81.0-1ubuntu1.26"
                },
                "to_version": {
                    "source_package_name": "curl",
                    "source_package_version": "7.81.0-1ubuntu1.27",
                    "version": "7.81.0-1ubuntu1.27"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-8932",
                        "url": "https://ubuntu.com/security/CVE-2026-8932",
                        "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.  libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-07-03 07:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-8932",
                                "url": "https://ubuntu.com/security/CVE-2026-8932",
                                "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.  libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-07-03 07:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Authentication Bypass in connection reuse.",
                            "    - debian/patches/CVE-2026-8932.patch: Fix incomplete mTLS config in",
                            "      lib/ldap.c, ../urldata.h, ../url.c, lib/vssh/libssh.c, ../libssh2.c,",
                            "      lib/vtls/gtls.c, ../mbedtls.c, ../openssl.c, ../schannel.c,",
                            "      ../sectransp.c, ../vtls.c, ../nss.c, and ../wolfssl.c.",
                            "    - CVE-2026-8932",
                            ""
                        ],
                        "package": "curl",
                        "version": "7.81.0-1ubuntu1.27",
                        "urgency": "medium",
                        "distributions": "jammy-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Kyle Kernick <kyle.kernick@canonical.com>",
                        "date": "Fri, 21 Aug 2026 12:40:03 -0600"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libcurl4",
                "from_version": {
                    "source_package_name": "curl",
                    "source_package_version": "7.81.0-1ubuntu1.26",
                    "version": "7.81.0-1ubuntu1.26"
                },
                "to_version": {
                    "source_package_name": "curl",
                    "source_package_version": "7.81.0-1ubuntu1.27",
                    "version": "7.81.0-1ubuntu1.27"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-8932",
                        "url": "https://ubuntu.com/security/CVE-2026-8932",
                        "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.  libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-07-03 07:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-8932",
                                "url": "https://ubuntu.com/security/CVE-2026-8932",
                                "cve_description": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.  libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-07-03 07:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Authentication Bypass in connection reuse.",
                            "    - debian/patches/CVE-2026-8932.patch: Fix incomplete mTLS config in",
                            "      lib/ldap.c, ../urldata.h, ../url.c, lib/vssh/libssh.c, ../libssh2.c,",
                            "      lib/vtls/gtls.c, ../mbedtls.c, ../openssl.c, ../schannel.c,",
                            "      ../sectransp.c, ../vtls.c, ../nss.c, and ../wolfssl.c.",
                            "    - CVE-2026-8932",
                            ""
                        ],
                        "package": "curl",
                        "version": "7.81.0-1ubuntu1.27",
                        "urgency": "medium",
                        "distributions": "jammy-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Kyle Kernick <kyle.kernick@canonical.com>",
                        "date": "Fri, 21 Aug 2026 12:40:03 -0600"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libperl5.34",
                "from_version": {
                    "source_package_name": "perl",
                    "source_package_version": "5.34.0-3ubuntu1.7",
                    "version": "5.34.0-3ubuntu1.7"
                },
                "to_version": {
                    "source_package_name": "perl",
                    "source_package_version": "5.34.0-3ubuntu1.8",
                    "version": "5.34.0-3ubuntu1.8"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-12087",
                        "url": "https://ubuntu.com/security/CVE-2026-12087",
                        "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read.  In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.  Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-15 22:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-13221",
                        "url": "https://ubuntu.com/security/CVE-2026-13221",
                        "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.  When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.  A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-13 17:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-57432",
                        "url": "https://ubuntu.com/security/CVE-2026-57432",
                        "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.  S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.  A template derived from untrusted input can read heap memory past the buffer and return it to the caller.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-13 17:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-57433",
                        "url": "https://ubuntu.com/security/CVE-2026-57433",
                        "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.  retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.  A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-13 17:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-12087",
                                "url": "https://ubuntu.com/security/CVE-2026-12087",
                                "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read.  In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.  Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-15 22:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-13221",
                                "url": "https://ubuntu.com/security/CVE-2026-13221",
                                "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.  When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.  A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-13 17:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-57432",
                                "url": "https://ubuntu.com/security/CVE-2026-57432",
                                "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.  S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.  A template derived from untrusted input can read heap memory past the buffer and return it to the caller.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-13 17:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-57433",
                                "url": "https://ubuntu.com/security/CVE-2026-57433",
                                "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.  retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.  A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-13 17:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Out-of-bounds heap read in Socket pack_ip_mreq_source",
                            "    - debian/patches/CVE-2026-12087.patch: Scope STRLEN len per argument in",
                            "      pack_ip_mreq_source in cpan/Socket/Socket.xs",
                            "    - CVE-2026-12087",
                            "  * SECURITY UPDATE: Trie 16-bit overflow causing incorrect regex matches",
                            "    - debian/patches/CVE-2026-13221.patch: Skip trie creation when branch delta",
                            "      would overflow 16 bits in regcomp.c, t/re/pat_advanced.t",
                            "    - CVE-2026-13221",
                            "  * SECURITY UPDATE: Integer overflow leading to heap OOB read in pack/unpack",
                            "    - debian/patches/CVE-2026-57432_1.patch: Reject pack/unpack template sizes",
                            "      that would overflow SSize_t in pp_pack.c",
                            "    - debian/patches/CVE-2026-57432_2.patch: Avoid bit-count overflows in B/H",
                            "      template size math in pp_pack.c",
                            "    - CVE-2026-57432",
                            "  * SECURITY UPDATE: Signed int overflow in Storable SX_HOOK deserialization",
                            "    - debian/patches/CVE-2026-57433.patch: Reject I32_MAX hook data item counts",
                            "      before av_extend in dist/Storable/Storable.xs",
                            "    - CVE-2026-57433",
                            ""
                        ],
                        "package": "perl",
                        "version": "5.34.0-3ubuntu1.8",
                        "urgency": "high",
                        "distributions": "jammy-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Shafayat Hossain Majumder <shafayat.majumder@canonical.com>",
                        "date": "Tue, 18 Aug 2026 17:25:25 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libssl3",
                "from_version": {
                    "source_package_name": "openssl",
                    "source_package_version": "3.0.2-0ubuntu1.26",
                    "version": "3.0.2-0ubuntu1.26"
                },
                "to_version": {
                    "source_package_name": "openssl",
                    "source_package_version": "3.0.2-0ubuntu1.29",
                    "version": "3.0.2-0ubuntu1.29"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-54874",
                        "url": "https://ubuntu.com/security/CVE-2026-54874",
                        "cve_description": "Excessive Memory Use Buffering DTLS Records for a Future Epoch",
                        "cve_priority": "low",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-63072",
                        "url": "https://ubuntu.com/security/CVE-2026-63072",
                        "cve_description": "Heap Buffer Overflow in CMS Key Unwrapping",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-63074",
                        "url": "https://ubuntu.com/security/CVE-2026-63074",
                        "cve_description": "CMP Indefinite Cache Growth of ExtraCerts",
                        "cve_priority": "low",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-63076",
                        "url": "https://ubuntu.com/security/CVE-2026-63076",
                        "cve_description": "Invalid Pointer Dereference in CMP Server via Crafted protectionAlg",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-75803",
                        "url": "https://ubuntu.com/security/CVE-2026-75803",
                        "cve_description": "AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()",
                        "cve_priority": "low",
                        "cve_public_date": "2026-08-25"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2130576
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-54874",
                                "url": "https://ubuntu.com/security/CVE-2026-54874",
                                "cve_description": "Excessive Memory Use Buffering DTLS Records for a Future Epoch",
                                "cve_priority": "low",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-63072",
                                "url": "https://ubuntu.com/security/CVE-2026-63072",
                                "cve_description": "Heap Buffer Overflow in CMS Key Unwrapping",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-63074",
                                "url": "https://ubuntu.com/security/CVE-2026-63074",
                                "cve_description": "CMP Indefinite Cache Growth of ExtraCerts",
                                "cve_priority": "low",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-63076",
                                "url": "https://ubuntu.com/security/CVE-2026-63076",
                                "cve_description": "Invalid Pointer Dereference in CMP Server via Crafted protectionAlg",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-75803",
                                "url": "https://ubuntu.com/security/CVE-2026-75803",
                                "cve_description": "AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()",
                                "cve_priority": "low",
                                "cve_public_date": "2026-08-25"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Excessive Memory Use Buffering DTLS Records for a Future",
                            "    Epoch",
                            "    - debian/patches/CVE-2026-54874-1.patch: Avoid full read buffer allocation",
                            "      when buffering DTLS records in ssl/record/rec_layer_d1.c,",
                            "      ssl/record/record.h, ssl/record/ssl3_record.c.",
                            "    - debian/patches/CVE-2026-54874-2.patch: ssl/record: lower the DTLS",
                            "      unprocessed_rcds queue limit in ssl/record/rec_layer_d1.c,",
                            "      ssl/record/record_local.h, ssl/record/ssl3_record.c.",
                            "    - CVE-2026-54874",
                            "  * SECURITY UPDATE: Heap Buffer Overflow in CMS Key Unwrapping",
                            "    - debian/patches/CVE-2026-63072-1.patch: Add test for CVE-2026-63072 in",
                            "      test/cmsapitest.c, test/recipes/80-test_cmsapi.t.",
                            "    - debian/patches/CVE-2026-63072-2.patch: Fix heap buffer overflow (8-byte",
                            "      OOB write) in AES-WRAP-PAD unwrap in crypto/cms/cms_kari.c.",
                            "    - CVE-2026-63072",
                            "  * SECURITY UPDATE: CMP Indefinite Cache Growth of ExtraCerts",
                            "    - debian/patches/CVE-2026-63074-1.patch: Add a test for restricting growth",
                            "      in cmp cert cache in test/build.info, test/cmp_extracerts_dos_test.c,",
                            "      test/recipes/65-test_cmp_msg.t.",
                            "    - debian/patches/CVE-2026-63074-2.patch: Fix unbounded cert cache growth in",
                            "      cmp in crypto/cmp/cmp_vfy.c.",
                            "    - CVE-2026-63074",
                            "  * SECURITY UPDATE: Invalid Pointer Dereference in CMP Server via Crafted",
                            "    protectionAlg",
                            "    - debian/patches/CVE-2026-63076-1.patch: Add test for CVE-2026-63076 in",
                            "      test/cmp_protect_test.c.",
                            "    - debian/patches/CVE-2026-63076-2.patch: Fix Remote NULL deref in",
                            "      ossl_cmp_calc_protection() via crafted protectionAlg in",
                            "      crypto/cmp/cmp_protect.c.",
                            "    - CVE-2026-63076",
                            "  * SECURITY UPDATE: AEAD Forgeries with Empty Ciphertext When Using",
                            "    EVP_Cipher()",
                            "    - debian/patches/CVE-2026-75803-1.patch: Check the tag on EVP_Cipher()",
                            "      finalize: Poly1305 and OCB AEADs in",
                            "      providers/implementations/ciphers/cipher_aes_ocb.c,",
                            "      providers/implementations/ciphers/cipher_chacha20_poly1305.c.",
                            "    - debian/patches/CVE-2026-75803-2.patch: Add tests for empty AEAD",
                            "      EVP_Cipher() finalization in test/evp_extra_test.c.",
                            "    - CVE-2026-75803",
                            ""
                        ],
                        "package": "openssl",
                        "version": "3.0.2-0ubuntu1.29",
                        "urgency": "medium",
                        "distributions": "jammy-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Tue, 18 Aug 2026 08:18:41 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Enable ec_nistp_64_gcc_128 optimization on multiple 64-bit",
                            "    architectures (LP: #2130576).",
                            "    Thanks to Szilárd Pfeiffer <coroner@pfeifferszilard.hu> for the",
                            "    bug report and patch.",
                            ""
                        ],
                        "package": "openssl",
                        "version": "3.0.2-0ubuntu1.27",
                        "urgency": "medium",
                        "distributions": "jammy",
                        "launchpad_bugs_fixed": [
                            2130576
                        ],
                        "author": "Ravi Kant Sharma <ravi.kant.sharma@canonical.com>",
                        "date": "Wed, 12 Aug 2026 15:10:04 +0200"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "openssl",
                "from_version": {
                    "source_package_name": "openssl",
                    "source_package_version": "3.0.2-0ubuntu1.26",
                    "version": "3.0.2-0ubuntu1.26"
                },
                "to_version": {
                    "source_package_name": "openssl",
                    "source_package_version": "3.0.2-0ubuntu1.29",
                    "version": "3.0.2-0ubuntu1.29"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-54874",
                        "url": "https://ubuntu.com/security/CVE-2026-54874",
                        "cve_description": "Excessive Memory Use Buffering DTLS Records for a Future Epoch",
                        "cve_priority": "low",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-63072",
                        "url": "https://ubuntu.com/security/CVE-2026-63072",
                        "cve_description": "Heap Buffer Overflow in CMS Key Unwrapping",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-63074",
                        "url": "https://ubuntu.com/security/CVE-2026-63074",
                        "cve_description": "CMP Indefinite Cache Growth of ExtraCerts",
                        "cve_priority": "low",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-63076",
                        "url": "https://ubuntu.com/security/CVE-2026-63076",
                        "cve_description": "Invalid Pointer Dereference in CMP Server via Crafted protectionAlg",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-75803",
                        "url": "https://ubuntu.com/security/CVE-2026-75803",
                        "cve_description": "AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()",
                        "cve_priority": "low",
                        "cve_public_date": "2026-08-25"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2130576
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-54874",
                                "url": "https://ubuntu.com/security/CVE-2026-54874",
                                "cve_description": "Excessive Memory Use Buffering DTLS Records for a Future Epoch",
                                "cve_priority": "low",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-63072",
                                "url": "https://ubuntu.com/security/CVE-2026-63072",
                                "cve_description": "Heap Buffer Overflow in CMS Key Unwrapping",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-63074",
                                "url": "https://ubuntu.com/security/CVE-2026-63074",
                                "cve_description": "CMP Indefinite Cache Growth of ExtraCerts",
                                "cve_priority": "low",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-63076",
                                "url": "https://ubuntu.com/security/CVE-2026-63076",
                                "cve_description": "Invalid Pointer Dereference in CMP Server via Crafted protectionAlg",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-75803",
                                "url": "https://ubuntu.com/security/CVE-2026-75803",
                                "cve_description": "AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()",
                                "cve_priority": "low",
                                "cve_public_date": "2026-08-25"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Excessive Memory Use Buffering DTLS Records for a Future",
                            "    Epoch",
                            "    - debian/patches/CVE-2026-54874-1.patch: Avoid full read buffer allocation",
                            "      when buffering DTLS records in ssl/record/rec_layer_d1.c,",
                            "      ssl/record/record.h, ssl/record/ssl3_record.c.",
                            "    - debian/patches/CVE-2026-54874-2.patch: ssl/record: lower the DTLS",
                            "      unprocessed_rcds queue limit in ssl/record/rec_layer_d1.c,",
                            "      ssl/record/record_local.h, ssl/record/ssl3_record.c.",
                            "    - CVE-2026-54874",
                            "  * SECURITY UPDATE: Heap Buffer Overflow in CMS Key Unwrapping",
                            "    - debian/patches/CVE-2026-63072-1.patch: Add test for CVE-2026-63072 in",
                            "      test/cmsapitest.c, test/recipes/80-test_cmsapi.t.",
                            "    - debian/patches/CVE-2026-63072-2.patch: Fix heap buffer overflow (8-byte",
                            "      OOB write) in AES-WRAP-PAD unwrap in crypto/cms/cms_kari.c.",
                            "    - CVE-2026-63072",
                            "  * SECURITY UPDATE: CMP Indefinite Cache Growth of ExtraCerts",
                            "    - debian/patches/CVE-2026-63074-1.patch: Add a test for restricting growth",
                            "      in cmp cert cache in test/build.info, test/cmp_extracerts_dos_test.c,",
                            "      test/recipes/65-test_cmp_msg.t.",
                            "    - debian/patches/CVE-2026-63074-2.patch: Fix unbounded cert cache growth in",
                            "      cmp in crypto/cmp/cmp_vfy.c.",
                            "    - CVE-2026-63074",
                            "  * SECURITY UPDATE: Invalid Pointer Dereference in CMP Server via Crafted",
                            "    protectionAlg",
                            "    - debian/patches/CVE-2026-63076-1.patch: Add test for CVE-2026-63076 in",
                            "      test/cmp_protect_test.c.",
                            "    - debian/patches/CVE-2026-63076-2.patch: Fix Remote NULL deref in",
                            "      ossl_cmp_calc_protection() via crafted protectionAlg in",
                            "      crypto/cmp/cmp_protect.c.",
                            "    - CVE-2026-63076",
                            "  * SECURITY UPDATE: AEAD Forgeries with Empty Ciphertext When Using",
                            "    EVP_Cipher()",
                            "    - debian/patches/CVE-2026-75803-1.patch: Check the tag on EVP_Cipher()",
                            "      finalize: Poly1305 and OCB AEADs in",
                            "      providers/implementations/ciphers/cipher_aes_ocb.c,",
                            "      providers/implementations/ciphers/cipher_chacha20_poly1305.c.",
                            "    - debian/patches/CVE-2026-75803-2.patch: Add tests for empty AEAD",
                            "      EVP_Cipher() finalization in test/evp_extra_test.c.",
                            "    - CVE-2026-75803",
                            ""
                        ],
                        "package": "openssl",
                        "version": "3.0.2-0ubuntu1.29",
                        "urgency": "medium",
                        "distributions": "jammy-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Tue, 18 Aug 2026 08:18:41 -0400"
                    },
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Enable ec_nistp_64_gcc_128 optimization on multiple 64-bit",
                            "    architectures (LP: #2130576).",
                            "    Thanks to Szilárd Pfeiffer <coroner@pfeifferszilard.hu> for the",
                            "    bug report and patch.",
                            ""
                        ],
                        "package": "openssl",
                        "version": "3.0.2-0ubuntu1.27",
                        "urgency": "medium",
                        "distributions": "jammy",
                        "launchpad_bugs_fixed": [
                            2130576
                        ],
                        "author": "Ravi Kant Sharma <ravi.kant.sharma@canonical.com>",
                        "date": "Wed, 12 Aug 2026 15:10:04 +0200"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "perl",
                "from_version": {
                    "source_package_name": "perl",
                    "source_package_version": "5.34.0-3ubuntu1.7",
                    "version": "5.34.0-3ubuntu1.7"
                },
                "to_version": {
                    "source_package_name": "perl",
                    "source_package_version": "5.34.0-3ubuntu1.8",
                    "version": "5.34.0-3ubuntu1.8"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-12087",
                        "url": "https://ubuntu.com/security/CVE-2026-12087",
                        "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read.  In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.  Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-15 22:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-13221",
                        "url": "https://ubuntu.com/security/CVE-2026-13221",
                        "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.  When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.  A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-13 17:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-57432",
                        "url": "https://ubuntu.com/security/CVE-2026-57432",
                        "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.  S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.  A template derived from untrusted input can read heap memory past the buffer and return it to the caller.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-13 17:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-57433",
                        "url": "https://ubuntu.com/security/CVE-2026-57433",
                        "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.  retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.  A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-13 17:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-12087",
                                "url": "https://ubuntu.com/security/CVE-2026-12087",
                                "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read.  In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.  Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-15 22:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-13221",
                                "url": "https://ubuntu.com/security/CVE-2026-13221",
                                "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.  When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.  A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-13 17:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-57432",
                                "url": "https://ubuntu.com/security/CVE-2026-57432",
                                "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.  S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.  A template derived from untrusted input can read heap memory past the buffer and return it to the caller.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-13 17:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-57433",
                                "url": "https://ubuntu.com/security/CVE-2026-57433",
                                "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.  retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.  A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-13 17:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Out-of-bounds heap read in Socket pack_ip_mreq_source",
                            "    - debian/patches/CVE-2026-12087.patch: Scope STRLEN len per argument in",
                            "      pack_ip_mreq_source in cpan/Socket/Socket.xs",
                            "    - CVE-2026-12087",
                            "  * SECURITY UPDATE: Trie 16-bit overflow causing incorrect regex matches",
                            "    - debian/patches/CVE-2026-13221.patch: Skip trie creation when branch delta",
                            "      would overflow 16 bits in regcomp.c, t/re/pat_advanced.t",
                            "    - CVE-2026-13221",
                            "  * SECURITY UPDATE: Integer overflow leading to heap OOB read in pack/unpack",
                            "    - debian/patches/CVE-2026-57432_1.patch: Reject pack/unpack template sizes",
                            "      that would overflow SSize_t in pp_pack.c",
                            "    - debian/patches/CVE-2026-57432_2.patch: Avoid bit-count overflows in B/H",
                            "      template size math in pp_pack.c",
                            "    - CVE-2026-57432",
                            "  * SECURITY UPDATE: Signed int overflow in Storable SX_HOOK deserialization",
                            "    - debian/patches/CVE-2026-57433.patch: Reject I32_MAX hook data item counts",
                            "      before av_extend in dist/Storable/Storable.xs",
                            "    - CVE-2026-57433",
                            ""
                        ],
                        "package": "perl",
                        "version": "5.34.0-3ubuntu1.8",
                        "urgency": "high",
                        "distributions": "jammy-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Shafayat Hossain Majumder <shafayat.majumder@canonical.com>",
                        "date": "Tue, 18 Aug 2026 17:25:25 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "perl-base",
                "from_version": {
                    "source_package_name": "perl",
                    "source_package_version": "5.34.0-3ubuntu1.7",
                    "version": "5.34.0-3ubuntu1.7"
                },
                "to_version": {
                    "source_package_name": "perl",
                    "source_package_version": "5.34.0-3ubuntu1.8",
                    "version": "5.34.0-3ubuntu1.8"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-12087",
                        "url": "https://ubuntu.com/security/CVE-2026-12087",
                        "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read.  In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.  Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-15 22:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-13221",
                        "url": "https://ubuntu.com/security/CVE-2026-13221",
                        "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.  When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.  A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-13 17:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-57432",
                        "url": "https://ubuntu.com/security/CVE-2026-57432",
                        "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.  S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.  A template derived from untrusted input can read heap memory past the buffer and return it to the caller.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-13 17:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-57433",
                        "url": "https://ubuntu.com/security/CVE-2026-57433",
                        "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.  retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.  A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-13 17:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-12087",
                                "url": "https://ubuntu.com/security/CVE-2026-12087",
                                "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read.  In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.  Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-15 22:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-13221",
                                "url": "https://ubuntu.com/security/CVE-2026-13221",
                                "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.  When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.  A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-13 17:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-57432",
                                "url": "https://ubuntu.com/security/CVE-2026-57432",
                                "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.  S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.  A template derived from untrusted input can read heap memory past the buffer and return it to the caller.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-13 17:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-57433",
                                "url": "https://ubuntu.com/security/CVE-2026-57433",
                                "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.  retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.  A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-13 17:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Out-of-bounds heap read in Socket pack_ip_mreq_source",
                            "    - debian/patches/CVE-2026-12087.patch: Scope STRLEN len per argument in",
                            "      pack_ip_mreq_source in cpan/Socket/Socket.xs",
                            "    - CVE-2026-12087",
                            "  * SECURITY UPDATE: Trie 16-bit overflow causing incorrect regex matches",
                            "    - debian/patches/CVE-2026-13221.patch: Skip trie creation when branch delta",
                            "      would overflow 16 bits in regcomp.c, t/re/pat_advanced.t",
                            "    - CVE-2026-13221",
                            "  * SECURITY UPDATE: Integer overflow leading to heap OOB read in pack/unpack",
                            "    - debian/patches/CVE-2026-57432_1.patch: Reject pack/unpack template sizes",
                            "      that would overflow SSize_t in pp_pack.c",
                            "    - debian/patches/CVE-2026-57432_2.patch: Avoid bit-count overflows in B/H",
                            "      template size math in pp_pack.c",
                            "    - CVE-2026-57432",
                            "  * SECURITY UPDATE: Signed int overflow in Storable SX_HOOK deserialization",
                            "    - debian/patches/CVE-2026-57433.patch: Reject I32_MAX hook data item counts",
                            "      before av_extend in dist/Storable/Storable.xs",
                            "    - CVE-2026-57433",
                            ""
                        ],
                        "package": "perl",
                        "version": "5.34.0-3ubuntu1.8",
                        "urgency": "high",
                        "distributions": "jammy-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Shafayat Hossain Majumder <shafayat.majumder@canonical.com>",
                        "date": "Tue, 18 Aug 2026 17:25:25 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "perl-modules-5.34",
                "from_version": {
                    "source_package_name": "perl",
                    "source_package_version": "5.34.0-3ubuntu1.7",
                    "version": "5.34.0-3ubuntu1.7"
                },
                "to_version": {
                    "source_package_name": "perl",
                    "source_package_version": "5.34.0-3ubuntu1.8",
                    "version": "5.34.0-3ubuntu1.8"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-12087",
                        "url": "https://ubuntu.com/security/CVE-2026-12087",
                        "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read.  In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.  Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-15 22:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-13221",
                        "url": "https://ubuntu.com/security/CVE-2026-13221",
                        "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.  When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.  A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-13 17:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-57432",
                        "url": "https://ubuntu.com/security/CVE-2026-57432",
                        "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.  S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.  A template derived from untrusted input can read heap memory past the buffer and return it to the caller.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-13 17:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-57433",
                        "url": "https://ubuntu.com/security/CVE-2026-57433",
                        "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.  retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.  A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-13 17:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-12087",
                                "url": "https://ubuntu.com/security/CVE-2026-12087",
                                "cve_description": "Socket versions before 2.041 for Perl have an out-of-bounds heap read.  In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.  Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-15 22:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-13221",
                                "url": "https://ubuntu.com/security/CVE-2026-13221",
                                "cve_description": "Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.  When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.  A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-13 17:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-57432",
                                "url": "https://ubuntu.com/security/CVE-2026-57432",
                                "cve_description": "Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.  S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.  A template derived from untrusted input can read heap memory past the buffer and return it to the caller.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-13 17:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-57433",
                                "url": "https://ubuntu.com/security/CVE-2026-57433",
                                "cve_description": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.  retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.  A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-13 17:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Out-of-bounds heap read in Socket pack_ip_mreq_source",
                            "    - debian/patches/CVE-2026-12087.patch: Scope STRLEN len per argument in",
                            "      pack_ip_mreq_source in cpan/Socket/Socket.xs",
                            "    - CVE-2026-12087",
                            "  * SECURITY UPDATE: Trie 16-bit overflow causing incorrect regex matches",
                            "    - debian/patches/CVE-2026-13221.patch: Skip trie creation when branch delta",
                            "      would overflow 16 bits in regcomp.c, t/re/pat_advanced.t",
                            "    - CVE-2026-13221",
                            "  * SECURITY UPDATE: Integer overflow leading to heap OOB read in pack/unpack",
                            "    - debian/patches/CVE-2026-57432_1.patch: Reject pack/unpack template sizes",
                            "      that would overflow SSize_t in pp_pack.c",
                            "    - debian/patches/CVE-2026-57432_2.patch: Avoid bit-count overflows in B/H",
                            "      template size math in pp_pack.c",
                            "    - CVE-2026-57432",
                            "  * SECURITY UPDATE: Signed int overflow in Storable SX_HOOK deserialization",
                            "    - debian/patches/CVE-2026-57433.patch: Reject I32_MAX hook data item counts",
                            "      before av_extend in dist/Storable/Storable.xs",
                            "    - CVE-2026-57433",
                            ""
                        ],
                        "package": "perl",
                        "version": "5.34.0-3ubuntu1.8",
                        "urgency": "high",
                        "distributions": "jammy-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Shafayat Hossain Majumder <shafayat.majumder@canonical.com>",
                        "date": "Tue, 18 Aug 2026 17:25:25 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "xxd",
                "from_version": {
                    "source_package_name": "vim",
                    "source_package_version": "2:8.2.3995-1ubuntu2.35",
                    "version": "2:8.2.3995-1ubuntu2.35"
                },
                "to_version": {
                    "source_package_name": "vim",
                    "source_package_version": "2:8.2.3995-1ubuntu2.36",
                    "version": "2:8.2.3995-1ubuntu2.36"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-73073",
                        "url": "https://ubuntu.com/security/CVE-2026-73073",
                        "cve_description": "(Vim is an open source, command line text editor. Prior to 9.2.0845, St ...)",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-19"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-73073",
                                "url": "https://ubuntu.com/security/CVE-2026-73073",
                                "cve_description": "(Vim is an open source, command line text editor. Prior to 9.2.0845, St ...)",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-19"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Arbitrary command execution during C omni-completion.",
                            "    - debian/patches/CVE-2026-73073.patch: Match tags typeref literally in",
                            "      runtime/autoload/ccomplete.vim.",
                            "    - CVE-2026-73073",
                            ""
                        ],
                        "package": "vim",
                        "version": "2:8.2.3995-1ubuntu2.36",
                        "urgency": "medium",
                        "distributions": "jammy-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Kyle Kernick <kyle.kernick@canonical.com>",
                        "date": "Mon, 24 Aug 2026 16:13:24 -0600"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            }
        ],
        "snap": []
    },
    "added": {
        "deb": [],
        "snap": []
    },
    "removed": {
        "deb": [],
        "snap": []
    },
    "notes": "Changelog diff for Ubuntu 22.04 jammy image from daily image serial 20260822 to 20260825",
    "from_series": "jammy",
    "to_series": "jammy",
    "from_serial": "20260822",
    "to_serial": "20260825",
    "from_manifest_filename": "daily_manifest.previous",
    "to_manifest_filename": "manifest.current"
}