Debian 13.5 point release lands with security fixes, bug patches

CVE-2026-23918 is a double-free memory-corruption flaw (CWE-415) in the HTTP/2 protocol handling of Apache HTTP Server, which per the advisory can lead to possible remote code execution. It is triggered remotely over an HTTP/2 connection to an affected server; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) indicates network-reachable, low-privilege access with no user interaction required. A successful attacker can corrupt the heap of the httpd process, with potential for remote code execution and high impact on confidentiality, integrity, and availability. Only Apache HTTP Server 2.4.66 is listed as affected, and the fix is shipped in 2.4.67; distributions such as Debian (whose 13.5 point release landed with security fixes) are already distributing patched packages. No public proof-of-concept or confirmed in-the-wild exploitation is known and it is not yet in CISA KEV, but EPSS assigns a ~50% probability of exploitation within 30 days (99th percentile), so defenders should treat it as likely to be exploited soon.

Do: Upgrade to Apache HTTP Server 2.4.67, and verify the effective patched package version on your systems since distributions may ship the fix backported under their own package versions. If you cannot upgrade promptly, disable the HTTP/2 protocol (h2, mod_http2) on internet-facing virtual hosts or restrict client access to them. Maintain heightened monitoring, as the ~50% EPSS probability of exploitation within 30 days suggests active exploitation may begin even without a public PoC yet.

systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).

In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.

In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.

The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.

A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.