oss-security mailing list (openwall.com)
oss-security · B · candidate
https://www.openwall.com/lists/oss-security/
Added 2026-11-06: S1 candidate; the primary channel for open-source project security announcements. On 2026-11-04 and 2026-11-05 it carried the OpenSSH 10.6p2 and *sshole thread, the Apache OFBiz 46-CVE announcement, the zlib 1.4 security fixes and Go and CPython posts, none of which a slice record surfaced first. No feed: `python3 tools/fetch_source.py extract https://www.openwall.com/lists/oss-security/YYYY/MM/DD/` lists each day's threads and `extract .../DD/<n>` reads a message; promote after three contributing runs.
Cited in 5 entries
Citation cadence
Citation days per ISO week (12 weeks of coverage span, total 5).
- CVE-2025-15467, Siemens Desigo CC: a vendored OpenSSL CMS parsing overflow gives pre-auth code execution, and the V7 family still has no fix (CVSS 9.8)2026-07-29
- HTTP/2 Bomb (CVE-2026-49975): a single-connection memory-exhaustion DoS against every major web server2026-06-04
- CVE-2026-4408 & CVE-2026-4480, Samba: unauthenticated RCE in SAMR RPC and print-command subsystems (CVSS 10.0)2026-05-29
- PinTheft: Linux kernel RDS zerocopy double-free (CVE-2026-43494) turned into a root exploit through io_uring fixed buffers, public PoC; V12 found RDS loaded by default only on Arch Linux among the distributions it tested2026-05-21
- CVE-2026-45185 "Dead.Letter": Exim use-after-free in BDAT/CHUNKING on GnuTLS builds, fixed in 4.99.32026-05-13