{"vulnerability": "cve-2026-27171", "sightings": [{"uuid": "0b6d0b39-d385-4107-b2d7-103b25246dfc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27171", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mfmf7ngpun2s", "content": "", "creation_timestamp": "2026-02-24T14:35:08.104735Z"}, {"uuid": "ab2b8e77-60e7-4a5a-89da-34852930a81f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-27171", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}, {"uuid": "d39d3062-cc4e-40a0-8601-0ebd47da200d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27171", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0254", "content": "Oracle heeft 158 kwetsbaarheden verholpen in Oracle Database Server, APEX, Autonomous Health Framework, Essbase, Global Lifecycle Management, GoldenGate, NoSQL Database, Spatial Studio, SQL Developer en TimesTen In-Memory Database.\n\nVan deze kwetsbaarheden zijn 91 kwetsbaarheden afkomstig van third-party producten waarvoor eerder al updates zijn verschenen welke nu door Oracle zijn verwerkt, of betreffen kwetsbaarheden welke niet kunnen leiden tot exploitatie, omdat zij zich bevinden in delen van de producten die niet toegankelijk zijn. De zes ernstigste kwetsbaarheden hebben een CVSS score van 9 en hoger gekregen.\n\nDe kwetsbaarheid in Eclipse Jetty's HTTP/1.1 parser, gebruikt in Oracle REST Data Services versies 24.2.0 tot 26.1.0, betreft incorrecte parsing van chunked transfer encoding extensies met ongesloten gequoteerde strings, waardoor HTTP request smuggling mogelijk is. Dit kan leiden tot cache poisoning, bypass van toegangscontrole, session hijacking en ongeautoriseerde toegang tot endpoints. \n\nPerl versies vanaf 5.9.4 tot 5.43.9 bevatten een kwetsbare Compress::Raw::Zlib module door een verouderde zlib bibliotheek met meerdere beveiligingsproblemen, waaronder CVE-2026-3381 en CVE-2026-27171. Deze kwetsbaarheid is relevant voor Perl distributies die vaak worden ingezet in Red Hat Enterprise Linux en OpenShift Container Platform omgevingen.\n\nApache Kafka versies 4.1.0 en 4.1.1 bevatten een kwetsbaarheid in de JWT token validatie waarbij de standaard validator elke JWT token accepteert zonder correcte validatie, wat ongeautoriseerde toegang kan toestaan. Dit is opgelost door de validator expliciet in te stellen of te upgraden naar versie 4.1.2 of hoger. Oracle Communications Unified Assurance Message Bus componenten versies 6.1.1 tot 7.0.0, die Apache Kafka gebruiken, bevatten een kwetsbaarheid die ongeauthenticeerde netwerkaanvallers in staat stelt ongeautoriseerde toegang te verkrijgen en kritieke data te wijzigen.\n\nOracle Net Services versies 19.3 tot 19.31, 21.3 tot 21.22 en 23.4.0 tot 23.26.2 bevatten een kwetsbaarheid die ongeauthenticeerde netwerktoegang mogelijk maakt om gevoelige informatie te verkrijgen of een denial of service te veroorzaken.\n\nOracle TimesTen In-Memory Database versie 26.1.1.1.0 bevat een kwetsbaarheid in de Kubernetes Operator component die een aanvaller met lage privileges en netwerktoegang via HTTPS in staat stelt volledige controle over de database instance te verkrijgen.\n\nOracle Database Server RDBMS componenten versies 19.3 tot 19.31 en 23.4.0 tot 23.26.2 bevatten een kwetsbaarheid waarbij een aanvaller met lage privileges en Execute DBMS_CLOUD rechten en netwerktoegang volledige controle over de RDBMS kan verkrijgen.\n\nHet voert te ver om de overige 152 kwetsbaarheden in detail te beschrijven in deze advisory en het NCSC verwijst dan ook naar de bijgevoegde referentie.", "creation_timestamp": "2026-07-22T16:00:54.255845Z"}, {"uuid": "1ceea924-9112-43a2-9f4d-bbbf721fcdd5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-27171", "type": "seen", "source": "https://gist.github.com/citadelculture/f97a518fd9863464f47fb67323ba03ad", "content": "# CorbanuTerminal Ubuntu Bazel zlib 404: exact pin, cause, and minimal repair\n\nRead-only investigation for Tasknode `task_c2e9100585b46fdddf8f4d4a7a5c590a`, observed September 26, 2026. No Corbanu repository files were changed, no PR/commit was created for this investigation, and nothing was pushed. Downloaded Debian packages were hashed, not installed or executed. The recommendations below are maintainer actions, not claims of an applied fix or passing CI.\n\n## Result\n\n`rules_rs` 0.0.102 hard-codes a Noble zlib package that Ubuntu superseded on August 31 and removed from its rolling archive on September 1. The package filename was valid; its original rolling-archive URL is now unavailable. The exact pin is in the **transitive `rules_rs` source**, not Corbanu's root Bazel lockfile.\n\nThe smallest byte-preserving recovery changes one URL to the verified official Ubuntu snapshot and keeps the existing hash. The recommended current-package repair changes the URL to `2.2` and the SHA-256 together; that version includes Ubuntu's August security update. Neither repair has been applied or run through Bazel in this read-only task.\n\n## 1. Pinned CI evidence and a correction to the brief\n\nCurrent Corbanu main is [`c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b`](https://github.com/CorbanuCore/CorbanuTerminal/commit/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b). PR126 head is [`74c908230d854a33ecf0a227bfa60547e1f02179`](https://github.com/CorbanuCore/CorbanuTerminal/pull/126).\n\nThe brief calls run `36008538634` a main run. GitHub identifies it as the **PR126 `pull_request` run**, on `74c908\u2026`, created September 24. The exact main `push` run is [`35788214243`](https://github.com/CorbanuCore/CorbanuTerminal/actions/runs/35788214243), on `c9f358\u2026`, created September 22. Both have the same failure. This distinction does not change the root cause.\n\nLiteral line freshly retrieved from the PR run's [Ubuntu verify-release job 107662920525](https://github.com/CorbanuCore/CorbanuTerminal/actions/runs/36008538634/job/107662920525):\n\n```text\n2026-09-24T13:52:14.2905056Z WARNING: Download from https://archive.ubuntu.com/ubuntu/pool/main/z/zlib/zlib1g_1.3.dfsg-3.1ubuntu2.1_amd64.deb failed: class java.io.FileNotFoundException GET returned 404 Not Found\n```\n\nThe following traceback locates `rules_rs+/rs/private/rustc_repository.bzl:69` (`rctx.download_and_extract`), called by `_add_linux_zlib` at line 88 while fetching `rules_rs++toolchains+rustc_linux_x86_64_1_95_0`. The build aborts during repository analysis, before intended compilation/tests.\n\nThe same error appears on exact main in the [clippy](https://github.com/CorbanuCore/CorbanuTerminal/actions/runs/35788214243/job/106959375758), [GNU tests](https://github.com/CorbanuCore/CorbanuTerminal/actions/runs/35788214243/job/106959376397), [musl tests](https://github.com/CorbanuCore/CorbanuTerminal/actions/runs/35788214243/job/106959376021), [verify-release](https://github.com/CorbanuCore/CorbanuTerminal/actions/runs/35788214243/job/106959376059), and [SDK](https://github.com/CorbanuCore/CorbanuTerminal/actions/runs/35788214243/job/106959376091) logs. This is shared build infrastructure, not an OpenTelemetry bump or PR126 logic regression.\n\n## 2. Exact source of the pin\n\nCorbanu main [`MODULE.bazel:93\u2013101`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/MODULE.bazel#L93) selects `rules_rs` **0.0.102** in both `bazel_dep` and `single_version_override`. That override already applies `rules_rs_build_script_deps_annotation.patch`. [`MODULE.bazel:189\u2013196`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/MODULE.bazel#L189) selects its Rust **1.95.0** toolchain extension.\n\nThe [Bazel Central Registry source mapping](https://bcr.bazel.build/modules/rules_rs/0.0.102/source.json) points to the official `rules_rs-v0.0.102.tar.gz` release. Its source integrity is `sha256-suVfd5SpujPSYlZtCGasyDOSEFcH+FZgtCKsJn2V2RE=`. The matching upstream tag resolves to **`e3ca3bafd5d1617d9188c7f743c26cd2c4cb01ec`**.\n\nThe literal amd64 pin is [`rs/private/rustc_repository.bzl:60\u201364`](https://github.com/hermeticbuild/rules_rs/blob/e3ca3bafd5d1617d9188c7f743c26cd2c4cb01ec/rs/private/rustc_repository.bzl#L60):\n\n```starlark\n    \"x86_64\": struct(\n        libdir = \"usr/lib/x86_64-linux-gnu\",\n        sha256 = \"7074b6a2f6367a10d280c00a1cb02e74277709180bab4f2491a2f355ab2d6c20\",\n        url = \"https://archive.ubuntu.com/ubuntu/pool/main/z/zlib/zlib1g_1.3.dfsg-3.1ubuntu2.1_amd64.deb\",\n    ),\n```\n\nThus **line 62 is the package checksum and line 63 is the package URL**. Lines 69\u201373 pass that checksum to the download. Lines 83\u201388 select by execution architecture; lines 106\u2013107 explain that the upstream Linux Rust compiler's LLVM library requires `libz.so.1`.\n\nA tracked-tree search at exact Corbanu main finds no literal `zlib1g_1.3.dfsg-3.1ubuntu2.1` pin. The broad `archive.ubuntu.com` search finds unrelated QA Linux-header/archive-list probes, not this toolchain dependency. Root `MODULE.bazel.lock` records registry/Rust metadata; it does not contain the zlib literal to edit. Do not fabricate a Corbanu file:line match or patch a generated cache path by hand.\n\n## 3. Why it disappeared; current verified package\n\nThe [exact Noble amd64 publication](https://api.launchpad.net/1.0/ubuntu/+archive/primary/+binarypub/213776678) records old version `1:1.3.dfsg-3.1ubuntu2.1`, status `Superseded`, superseded at **2026-08-31 14:08:01 UTC**, and removed at **2026-09-01 18:10:11 UTC**. This is direct publication metadata; no mirror-maintenance process was observed.\n\n[Noble Updates Packages.xz](https://archive.ubuntu.com/ubuntu/dists/noble-updates/main/binary-amd64/Packages.xz), [Noble Security Packages.xz](https://security.ubuntu.com/ubuntu/dists/noble-security/main/binary-amd64/Packages.xz), and the [Ubuntu package page](https://packages.ubuntu.com/noble/amd64/zlib1g/download) agree on:\n\n```text\nVersion: 1:1.3.dfsg-3.1ubuntu2.2\nArchitecture: amd64\nFilename: pool/main/z/zlib/zlib1g_1.3.dfsg-3.1ubuntu2.2_amd64.deb\nSize: 62988\nSHA256: 84b9cf5752b29c9f92c27cd4c4ba9bbcc70b5ccf9b1b515421a28ae23212e273\nDepends: libc6 (>= 2.14)\n```\n\nThe version epoch `1:` is intentionally absent from Debian's filename. [USN-8706-1](https://ubuntu.com/security/notices/USN-8706-1), published August 31, identifies `2.2` as the Noble fix for CVE-2026-27171. The [archive directory](https://archive.ubuntu.com/ubuntu/pool/main/z/zlib/) lists the replacement.\n\nReal HTTPS GET observations on September 26:\n\n| Resource | Result | Independently hashed bytes |\n|---|---|---|\n| Original `archive.ubuntu.com` `2.1` URL |404|No package|\n| Same path on `security.ubuntu.com` |404|No package; host swap alone fails|\n| Same path on `old-releases.ubuntu.com` |404|No verified relocation there|\n| [Archive `2.2` amd64](https://archive.ubuntu.com/ubuntu/pool/main/z/zlib/zlib1g_1.3.dfsg-3.1ubuntu2.2_amd64.deb) |200|62,988 bytes; SHA-256 `84b9cf5752b29c9f92c27cd4c4ba9bbcc70b5ccf9b1b515421a28ae23212e273`|\n| [Official snapshot `2.1`, August 30](https://snapshot.ubuntu.com/ubuntu/20260830T000000Z/pool/main/z/zlib/zlib1g_1.3.dfsg-3.1ubuntu2.1_amd64.deb) |200|62,850 bytes; SHA-256 `7074b6a2f6367a10d280c00a1cb02e74277709180bab4f2491a2f355ab2d6c20`|\n\nThe [snapshot's Packages index](https://snapshot.ubuntu.com/ubuntu/20260830T000000Z/dists/noble-updates/main/binary-amd64/Packages.xz) independently matches the old package's version, size and hash. Downloaded old/new bytes match the respective authoritative index hashes exactly. Ubuntu documents its [official snapshot service](https://snapshot.ubuntu.com/) for past archive states. This establishes removal from the rolling pool and recovery from a timestamped archive, not a transient HTTP outage.\n\n## 4. Exact minimal maintainer changes\n\n### Recommended current-package repair\n\nPatch the `x86_64` entry in `rules_rs` 0.0.102's `rs/private/rustc_repository.bzl`, keeping `libdir` unchanged:\n\n```diff\n-        sha256 = \"7074b6a2f6367a10d280c00a1cb02e74277709180bab4f2491a2f355ab2d6c20\",\n-        url = \"https://archive.ubuntu.com/ubuntu/pool/main/z/zlib/zlib1g_1.3.dfsg-3.1ubuntu2.1_amd64.deb\",\n+        sha256 = \"84b9cf5752b29c9f92c27cd4c4ba9bbcc70b5ccf9b1b515421a28ae23212e273\",\n+        url = \"https://archive.ubuntu.com/ubuntu/pool/main/z/zlib/zlib1g_1.3.dfsg-3.1ubuntu2.2_amd64.deb\",\n```\n\nCorbanu's existing root override provides a narrow application point: add a maintainer-created `patches/rules_rs_zlib_noble_amd64.patch`, export it alongside existing files in [`patches/BUILD.bazel`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/patches/BUILD.bazel), and append `\"//patches:rules_rs_zlib_noble_amd64.patch\"` to the existing `single_version_override.patches` list at `MODULE.bazel:97\u201399`, retaining its existing patch and `patch_strip = 1`. Use a diff with `a/rs/private/rustc_repository.bzl` and `b/rs/private/rustc_repository.bzl` paths. This proposed patch filename is new, not an existing source location. This avoids a speculative whole-toolchain upgrade.\n\nThis task proves the new package's availability/integrity and declared libc dependency, not execution compatibility. Validate extraction of `usr/lib/x86_64-linux-gnu/libz.so.1` and the Linux compiler/build on Ubuntu before merging. The separate aarch64 entry at upstream lines 55\u201358 is outside this amd64 failure; do not reuse an amd64 checksum for it.\n\n### Smallest byte-preserving recovery\n\nIf the maintainer intentionally needs the identical frozen toolchain bytes, change only line 63 to:\n\n```text\nhttps://snapshot.ubuntu.com/ubuntu/20260830T000000Z/pool/main/z/zlib/zlib1g_1.3.dfsg-3.1ubuntu2.1_amd64.deb\n```\n\nKeep the original `7074b6a2\u2026d6c20` SHA-256 in full as shown above; it matches the fetched snapshot bytes. Apply via the same root override patch mechanism. This restores the missing download but retains a pre-security-update package. It is not the recommended security refresh, and no perpetual snapshot retention guarantee is made.\n\n### Lock and integrity regeneration\n\nUse the project's pinned Bazel **9.0.0** from [`.bazelversion`](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/.bazelversion), after adding the intended override patch:\n\n```sh\nbazel mod deps --lockfile_mode=update\ngit diff -- MODULE.bazel MODULE.bazel.lock patches/BUILD.bazel patches/rules_rs_zlib_noble_amd64.patch\n```\n\n[Bazel's documented command](https://bazel.build/external/lockfile#best-practices) re-evaluates dependencies/extensions and updates the lockfile as needed. Review and commit generated lock changes if any; do not invent a zlib lock entry or manually alter registry integrity. A local source patch does not change the BCR release archive's hash. The exact `.deb` checksum remains in the repository rule; changing package bytes requires changing that checksum, not disabling it. If Bazel emits no lockfile delta, preserve the unchanged file rather than claiming regeneration must produce a particular hash.\n\nThen fetch/analyze/build the affected Linux toolchain and rerun the same Ubuntu GNU/musl, clippy and verify-release jobs from [the pinned Bazel workflow](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/.github/workflows/bazel.yml), plus the SDK job from [the pinned SDK workflow](https://github.com/CorbanuCore/CorbanuTerminal/blob/c9f358c0a7ece3338d751ad2c3ecf1e091de2b8b/.github/workflows/sdk.yml). Use a clean test output base/cache boundary to demonstrate the download rather than relying solely on preexisting compiler artifacts. Other baseline CI failures can remain after this 404 is corrected.\n\n## Evidence limits\n\nThis report establishes current source pins, literal hosted failures, Ubuntu publication history, live/snapshot availability, and matching package hashes. It does not claim an applied patch, regenerated lockfile, fixed deployment, full CI pass, installed package, or verified package execution. Ubuntu index GPG signatures were not independently verified; all sources and package/index fetches used official HTTPS endpoints, with independent byte-hash matching. No credentials or private Tasknode packets are included. The earlier CI triage identified the symptom; this distinct assigned investigation traces the transitive pin and proves exact repair metadata.\n", "creation_timestamp": "2026-09-26T09:14:21.000000Z"}]}