Vim, Emacs, APISIX, and related security disclosures

Security traffic centered on editor flaws in Vim and Emacs, multiple Apache APISIX CVEs fixed in 3.18.0, an unfixed quadratic DoS in graphql-go, a gzip out-of-bounds issue, and a heated exchange on missing reporter credits in public vulnerability records. Patches are available for most of the software issues while one library remains unfixed and attribution practices drew scrutiny.

Out-of-bounds access in Vim libvterm resize handling

Vim before 9.2.1013 contains an out-of-bounds access in bundled libvterm resize handling, according to a vim-security advisory posted to oss-security. The flaw can lead to memory corruption during terminal resize operations. Users of affected Vim builds should move to 9.2.1013 or later.

Emacs TRAMP zero-click local command execution

Emacs TRAMP allows local command execution through unsanitized filenames in a zero-click scenario. A CVE has been assigned and patches have been backported by downstream distributors. Operators who rely on TRAMP should ensure updated packages are installed.

Quadratic CPU DoS in graphql-go GetLocation

graphql-go versions through 0.8.1 contain an unauthenticated quadratic CPU-exhaustion denial of service caused by per-error full-document rescans inside GetLocation. No fix has been released. Any service exposing this GraphQL stack is open to resource exhaustion.

Apache APISIX ldap-auth cross-subtree impersonation

CVE-2026-75020 covers LDAP injection in the Apache APISIX ldap-auth plugin that permits cross-subtree identity impersonation. The problem is corrected in APISIX 3.18.0. Deployments using the plugin should upgrade to close the impersonation path.

gzip 1.14 out-of-bounds memory buffer access

CVE-2026-41992 describes a medium-severity out-of-bounds memory buffer access in gzip 1.14 that appears when LZH data follows earlier LZW use. A patch exists and disclosure handling was noted on the list. Systems shipping gzip 1.14 need the update.

Apache APISIX serverless cross-user response poisoning

CVE-2026-74848 reports cross-user response poisoning via HTTP response smuggling on serverless routes in Apache APISIX 2.12 through 3.17. The issue is fixed in 3.18.0. Sites running serverless plugins on those releases should move forward.

Unauthenticated CPU DoS on Apache APISIX GraphQL routes

CVE-2026-75005 discloses an unauthenticated CPU-exhaustion denial of service affecting GraphQL routes in Apache APISIX 3.17.0. The flaw is resolved in 3.18.0. Installations that expose GraphQL through APISIX require the upgrade.

Reporter attribution missing from GitHub and NVD records

Measurement shared on oss-security shows that GitHub machine-readable vulnerability records and the NVD omit credits even when the data is present in CVE v5 or OSV sources. Greg KH and the original reporter discussed CNA discretion and NVD schema limits. The gap reduces public visibility of researchers who report flaws.