Ubuntu security wave: five USNs for Python, KissFFT, libEBML, Beets and Apache, plus the 24.04.5 LTS point release
On 2026-09-10 Ubuntu published five security notices fixing Python (CVE-2026-3644 plus a pyexpat DoS), KissFFT (CVE-2025-34297, CVE-2026-41445), a libEBML buffer overflow, a Beets web injection flaw, and an Apache HTTP Server startup regression; on 2026-09-11…
Ubuntu issued a batch of security notices on 2026-09-10. USN-8744-1 fixes two Python flaws affecting Ubuntu 14.04, 16.04, 18.04, 20.04, 22.04 and 24.04 LTS: CVE-2026-3644, where the http.cookies module mishandles control characters and could allow arbitrary content injection, and an unbounded-recursion issue in the Expat XML parser reached via pyexpat that can crash Python and cause denial of service; no exploitation in the wild is reported. USN-8745-1 fixes two KissFFT flaws, CVE-2025-34297 (mishandling of large Fourier transform sizes on 32-bit architectures) and CVE-2026-41445 (multidimensional transform sizes), either of which could crash KissFFT and cause denial of service or arbitrary code execution. USN-8746-1 fixes a libEBML buffer overflow caused by incorrect handling of certain read and write operations, resulting in denial of service. USN-8747-1 fixes a Beets flaw in which untrusted media metadata was incorrectly escaped in the web interface, allowing attackers to inject arbitrary HTML or execute JavaScript in a user's browser. USN-8571-2 repairs a regression from USN-8571-1 in Apache HTTP Server: the earlier fix was incomplete due to a missing library symbol, causing Apache to fail to start when HTTP/2 proxying was enabled; the underlying advisory addressed CVE-2026-33007, a memory-handling flaw in mod_authn_socache allowing remote denial of service, and an HTTP response splitting vulnerability fixed across multiple modules, credited to Pavel Kohout, Arkadi Vainbrand, Haruki Oyama, Merih Mengisteab and Dawit Jeong. Separately, Canonical released Ubuntu 24.04.5 LTS, the fifth point release of the 'Noble Numbat' series, bundling accumulated security corrections and high-severity bug fixes into fresh install media for desktop, server and nine flavors including Kubuntu, Xubuntu, Ubuntu MATE, Ubuntu Studio and Edubuntu. The HWE stack moves to Linux 7.0 with Mesa 26.2 pulled from Ubuntu 26.04 LTS while the GA kernel remains on the 6.8 series, and Livepatch covers the 7.0 HWE kernel on x86-64. Existing 22.04 LTS users receive the fixes through the free automatic upgrade path, and existing 24.04 systems get them through regular updates. The release notes name no CVEs or bug IDs, and support clocks still run from the original 24.04 launch: five years for Desktop/Server/Cloud/Core and three for flavors per one report, with standard support through May 2029 and ESM available to 2034 per another.
- USN-8744-1 (2026-09-10) fixes CVE-2026-3644, a Python http.cookies control-character mishandling allowing arbitrary content injection, plus a pyexpat/Expat unbounded-recursion denial of service; it affects Ubuntu 14.04, 16.04, 18.04,…
- USN-8745-1 fixes two KissFFT flaws, CVE-2025-34297 (large Fourier transform sizes mishandled on 32-bit architectures) and CVE-2026-41445 (multidimensional Fourier transform sizes), each able to cause denial of service or arbitrary code…
- USN-8746-1 fixes a libEBML buffer overflow from incorrect handling of certain read and write operations, which could cause denial of service.
- USN-8747-1 fixes a Beets web interface flaw: improper escaping of untrusted media metadata could allow arbitrary HTML injection or JavaScript execution in a user's browser.
- USN-8571-2 fixes an Apache HTTP Server regression from USN-8571-1, caused by a missing library symbol, which prevented Apache from starting when HTTP/2 proxying was enabled; underlying issues include CVE-2026-33007 (mod_authn_socache…
- Ubuntu 24.04.5 LTS (reported 2026-09-11) is the fifth point release of the Noble Numbat series, bundling accumulated security and high-severity bug fixes into fresh install media for desktop, server and nine flavors including Kubuntu,…
- The 24.04.5 HWE stack upgrades to Linux 7.0 with Mesa 26.2 from Ubuntu 26.04 LTS; the GA kernel remains on the 6.8 series, and Livepatch covers the 7.0 HWE kernel on x86-64.
- Support for 24.04.5 runs from the original 24.04 launch date: five years for Desktop/Server/Cloud/Core and three for flavors per one report, with standard support through May 2029 and ESM available to 2034 per another; the release notes…
Coverage timelineoldest first · each row is one article
- · 7d agoUSN-8744-1: Python vulnerabilities
Ubuntu Security Notices· 22
Ubuntu issued USN-8744-1 fixing CVE-2026-3644, a Python http.cookies content-injection flaw, plus a pyexpat recursion DoS across six Ubuntu LTS releases.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-34297 | KissFFT versions prior to the fix commit 1b083165 contain an integer overflow in kiss_fft_alloc() in kiss_fft.c on platforms where size_t is 32-bit. KissFFT versions prior to the fix commit 1b083165 contain an integer overflow in kiss_fft_alloc() in kiss_fft.c on platforms where size_t is 32-bit. The nfft parameter is not validated before being used in a size calculation (sizeof(kiss_fft_cpx) * (nfft - 1)), which can wrap to a small value when nfft is large. As a result, malloc() allocates an undersized buffer and the subsequent twiddle-factor initialization loop writes nfft elements, causing a heap buffer overflow. This vulnerability only affects 32-bit architectures. NVD description · AI analysis pending | 8.6 | <1% | — | — | ||
| CVE-2026-33007 | A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration. Users are recommended to upgrade to version 2.4.67, which fixes this issue. NVD description · AI analysis pending | 5.3 | <1% |
| — | ||
| CVE-2026-3644 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output(). NVD description · AI analysis pending | 6.0 | <1% |
| — | ||
| CVE-2026-41445 | KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function in kiss_fftndr.c where the allocation size calculat KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function in kiss_fftndr.c where the allocation size calculation dimOther*(dimReal+2)*sizeof(kiss_fft_scalar) overflows signed 32-bit integer arithmetic before being widened to size_t, causing malloc() to allocate an undersized buffer. Attackers can trigger heap buffer overflow by providing crafted dimensions that cause the multiplication to exceed INT_MAX, allowing writes beyond the allocated buffer region when kiss_fftndr() processes the data. NVD description · AI analysis pending | 8.7 | <1% | — | — |