ZeroDay Findings
Sign inSign up

Every 24 hours

Tech News

Original briefings on what changed in security. Each story has a small illustration matched to what it covers, a short structure, and links to the catalog records and public identifiers it discusses.

  1. Oct 14, 2026

    Critical Vulnerabilities Found in YAML-LibYAML Affecting Ubuntu Users

    Recent vulnerabilities have been identified in YAML-LibYAML, a library used for parsing YAML files, which poses significant risks to users of Ubuntu 16.04 LTS and 18.04 LTS. Security researcher Dominique Dumont uncovered that the library mishandles certain reflection operations, which could allow an attacker to delete files if a user or system is deceived into opening a maliciously crafted file. This vulnerability is tracked under CVE-2017-20285.

    What changed

    In addition to this, another critical issue was found where YAML-LibYAML fails to parse specific documents correctly, enabling attackers to potentially execute arbitrary code on the affected systems. This vulnerability is listed as CVE-2019-25777 and highlights the importance of cautious file handling in environments using these Ubuntu versions.

    Who is affected

    Moreover, a regular expression within YAML-LibYAML is vulnerable to catastrophic backtracking, which can lead to denial of service conditions. This issue, identified as CVE-2026-63676, poses further risks, particularly for automated systems that might inadvertently process maliciously crafted YAML files.

    What it means

    The implications of these vulnerabilities are significant, as they could lead to unauthorized access, data loss, or service interruptions for users relying on these Ubuntu versions. Administrators and users are urged to apply necessary patches and updates to mitigate these risks. As cyber threats evolve, maintaining vigilance and ensuring systems are up to date is critical to safeguarding against exploitation.

  2. Oct 14, 2026

    New psqlODBC Release Addresses Critical Security Vulnerability

    The psqlODBC team has announced the release of version 18.00.0005, which addresses a significant security vulnerability identified as CVE-2026-109448, alongside fixing two additional bugs. This update is crucial for all users of the official ODBC driver for PostgreSQL, as the identified vulnerability could lead to heap memory corruption when applications attempt to bind more than 32,767 parameters in a single SQL statement. The CVSS 3.1 base score for this vulnerability is rated at 5.9, indicating a medium level of severity.

    What changed

    The vulnerability arises from the way psqlODBC stores the number of bound parameters in a signed 16-bit field. If an application binds more than the stipulated limit, the driver may overwrite memory, potentially causing crashes or corrupting the application's operation. This issue particularly affects applications that allow untrusted inputs to dictate the number of parameters, such as those dynamically generating SQL statements.

    Who is affected

    With the release of version 18.00.0005, the psqlODBC driver now rejects attempts to bind more than 32,767 parameters, effectively mitigating the risk of memory corruption associated with this vulnerability. Users are strongly advised to upgrade to the latest version to ensure their applications remain secure. For those unable to upgrade immediately, it is recommended to limit the number of parameters sourced from external inputs or to utilize alternative methods for passing long value lists.

    What it means

    The psqlODBC team has acknowledged Richard Kuesters for reporting this issue, highlighting the importance of community involvement in identifying and resolving security concerns. As cyber threats continue to evolve, maintaining updated software and adhering to best practices in application security is essential for protecting sensitive data and ensuring system integrity.