Suricata, OpenStack, and language runtime fixes

Several high-severity fixes landed across network IDS, cloud middleware, and language runtimes, alongside smaller library advisories. Operators of Suricata, OpenStack, Python, and Go on Linux kernels should review the day's disclosures first.

Suricata 8.0.8 closes high-severity protocol flaws

Suricata releases before 8.0.8 contain multiple high-severity vulnerabilities in protocol and TCP handling that enable CPU or memory exhaustion and detection bypass. The 8.0.8 update addresses these issues. Network security teams running Suricata should upgrade promptly to restore reliable inspection and avoid resource exhaustion.

OpenStack keystonemiddleware access_rules bypass

OpenStack keystonemiddleware is affected by an access_rules bypass via the X-Service-Token header, tracked as OSSA-2026-050 and CVE-2026-115642. The flaw permits privilege escalation in affected versions. Cloud operators relying on keystone middleware for authorization should apply the available patches.

CPython socket.getaddrinfo null-byte acceptance

CPython's socket.getaddrinfo accepts embedded null bytes in host and port arguments, disclosed as CVE-2026-116566. The medium-severity issue can lead to unexpected name resolution behavior. Python application maintainers should update once fixed releases are available and audit code that passes untrusted host or port strings.

Go MPTCP default exposes kernel use-after-free

Go 1.24 enables multipath TCP by default, which can expose Go programs to the unpatched Linux kernel use-after-free CVE-2026-98432. Guidance was posted on protecting affected deployments. Operators running Go binaries on vulnerable kernels should disable MPTCP or apply kernel updates.

OpenStack Ironic conductor gzip-bomb DoS

OpenStack Ironic's conductor is vulnerable to denial of service via a gzip bomb in configdrive data, tracked as OSSA-2026-049 and CVE-2026-115638. Backported patches are available. Ironic deployments should install the fixes to prevent conductor resource exhaustion.

Spreadsheet::XLSX unsafe eval allows code execution

Spreadsheet::XLSX versions before 0.19 for Perl allow code execution through string eval of number format conditions in ExcelFmt, assigned CVE-2026-115943. Processing untrusted XLSX files can lead to remote code execution. Perl users of the module should upgrade to 0.19 or later.

Apache Fineract SQL injection in ORDER BY

Apache Fineract contains SQL injection via unsanitized ORDER BY parameters in the Center and datatables endpoints, tracked as CVE-2026-65874. Attackers able to influence those parameters can manipulate queries. Fineract administrators should apply the upstream fix.

GPAC MP4Box heap use-after-free in AC-4 handling

GPAC/MP4Box has a heap use-after-free in AC-4 descriptor cleanup, disclosed as CVE-2025-60482. Crafted media can trigger the flaw during processing. Users of MP4Box should update to a corrected build when available.