Tor, Xen, and Apache security advisories

Security releases and advisories arrived for Tor, Xen, libpcap, and several Apache projects. The bulk of the issues involve high-severity flaws that enable code execution, authentication bypass, or denial of service.

Tor 0.4.9.12 security release

The Tor Project issued version 0.4.9.12 as a security release containing multiple high-severity fixes. The changes address OOM use-after-free bugs along with protocol updates. Relay and client operators should apply the release to close those exposure paths.

Xen XSA-513 Tapdisk out-of-bounds accesses

Xen published Security Advisory 513 v3 covering two out-of-bounds access flaws in Tapdisk, tracked as CVE-2026-79605 and CVE-2026-79606. The bugs can allow code execution in dom0. Systems that rely on Tapdisk require the supplied patches.

Apache Impala SAML authentication bypass

CVE-2026-56207 was disclosed for Apache Impala, describing a SAML authentication bypass achieved with a forged bearer token. An attacker can impersonate users through the flawed check. Deployments that enable SAML authentication need the corresponding fix.

Xen XSA-510 HVM emulation return codes

Xen released Security Advisory 510 v3 for CVE-2026-79602, an x86 issue involving improper handling of HVM emulation return codes. With PCI IO BAR passthrough the flaw can produce a host denial of service. Affected hypervisors should receive the advisory updates.

Apache Airflow FAB Azure AD OAuth bypass

CVE-2026-75156 affects the Apache Airflow FAB provider when using Azure AD OAuth. The id_token issuer and audience are not validated, permitting a cross-tenant authentication bypass even after an earlier fix. Operators of the FAB provider must upgrade to restore proper token checks.

Apache Nutch unauthenticated RCE

CVE-2026-41870 describes unauthenticated remote code execution in Apache Nutch Server versions 1.11 through 1.22 via JEXL injection in the REST API. Version 1.23 removes the server component entirely. Installations still running the vulnerable server range should move to the fixed release or disable the service.

Xen XSA-512 oxenstored watch accumulation

Xen published Security Advisory 512 v3 for CVE-2026-79604, an unbounded accumulation of watches in the Ocaml oxenstored implementation present since Xen 4.6. The condition can be used for denial of service. Hosts running that store need the advisory mitigation.

libpcap 1.10.7 vulnerability fixes

libpcap 1.10.7 was released to address seven CVEs. The announcement also warns against enabling the experimental remote capture feature. Applications and packet-capture tools that embed libpcap should move to the new version.