Emacs TRAMP RCE and assorted CVEs

Security traffic on oss-security centered on a local command-execution flaw in Emacs TRAMP, with additional CVEs for Perl modules, Kata Containers, and a withdrawn BusyBox report. Patches or advisories accompanied the higher-impact items.

Emacs TRAMP zero-click local command execution

Emacs TRAMP was reported to allow local command execution via crafted filenames embedded in remote paths. The issue can be triggered without further user interaction on systems that process such paths. A patch and backports were posted to address the flaw.

Heap out-of-bounds write in DBD::Pg

CVE-2026-78183 covers a heap out-of-bounds write in DBD::Pg version 3.21.0 for Perl. The bug is reached when quote() invokes quote_float on special floating-point values. Users of the PostgreSQL driver should treat 3.21.0 as affected pending an update.

Kata Containers runtime config loading flaw

CVE-2026-50540 affects configuration loading in both the Rust and Go Kata Containers runtimes. The issue was posted to oss-security after the CVE had already been made public. Operators running Kata for container isolation should review the advisory and apply available fixes.

HTTP request smuggling in Reverse::Proxy

CVE-2026-75922 was assigned to Reverse::Proxy versions before 0.04 for Perl. The module writes a percent-decoded PATH_INFO unencoded into the upstream request line, enabling HTTP request smuggling. Deployments using the module should move to a fixed release.

Predictable session keys in Apache::AppSamurai

CVE-2026-19565 affects Apache::AppSamurai::Util versions through 1.01 for Perl. CreateSessionAuthKey builds session authentication keys from the clock and process id, making them predictable. Applications that rely on these keys for session security should assume they are weak until a corrected version is available.

BusyBox dpkg applet injection report withdrawn

An OS command injection issue was reported against the BusyBox dpkg applet. The report was withdrawn from coordinated disclosure after no privilege boundary was identified. No further action is indicated by the disclosed material.