OpenZFS escapes, SSO bypasses, and HQC tweaks

Security traffic centered on OpenZFS Linux privilege issues, several authentication and library flaws, and a parameter adjustment proposal for the HQC post-quantum scheme. Perl OAuth modules and a Huffman decoder used by antivirus tools also received CVE attention.

OpenZFS Linux zpool manipulation and userns escapes

Full disclosure on oss-security described OpenZFS Linux vulnerabilities that allow open zpool manipulation and escapes through unprivileged user namespaces. The issues affect the Linux port and let unprivileged processes interfere with zpools or break out of constrained environments. Operators of multi-tenant or containerized ZFS hosts should treat the report as actionable and review mitigations.

Lemonldap::NG OAuth2 authentication bypass

CVE-2026-19349 was assigned to Lemonldap::NG::Portal in ranges from 2.0.0 before 2.16.9, 2.17.0 before 2.21.5, and 2.22.0 before 2.23.3. An OAuth2 state parameter stored as an SSO session in the GitHub and LinkedIn backends can be abused for authentication bypass. Sites running those backends need the corresponding patched releases.

HQC parameter adjustment proposal

The HQC team posted a small parameter update on the NIST pqc-forum, citing recent DFR and attack papers. Bernstein and Mattsson raised questions about timing, long-term stability, and consistency with NIST FIPS 207. Implementers tracking post-quantum standardization should note the discussion before locking in parameters.

libmspack heap buffer overflow

An oss-security report flagged a heap buffer overflow in libmspack make_decode_table() during Huffman decode table construction. The library is consumed by ClamAV and cabextract; a CVE was requested and technical details were withheld. Maintainers of those packages should watch for the follow-up advisory.

Net::OAuth::Client protocol downgrade

CVE-2026-72887 covers Net::OAuth::Client versions before 0.32 for Perl. A service provider can silently downgrade OAuth 1.0a to OAuth 1.0 inside get_request_token. Perl code that relies on this client should move to 0.32 or newer.

Net::OAuth unbounded cache exhaustion

CVE-2026-72888 affects Net::OAuth versions before 0.32 for Perl. Failed module loads are cached without bound in smart_require, enabling memory exhaustion. Deployments should upgrade to eliminate the denial-of-service path.