Story · 1 source · 3 articlesfirst Oct 14, 03:31 UTCupdated Oct 14, 13:00 UTC (2d ago)

Ubuntu patches YAML-LibYAML, urllib3, and Bind flaws

mediumAdvisoryimportance 48CVE-2026-97687 CVE-2026-97688 CVE-2026-97689 CVE-2025-8677 CVE-2025-40778 CVE-2017-20285 CVE-2019-25777

What's new: First coverage.

Merged summary · grok-4.7-build · rewritten as coverage arrives

Ubuntu’s 14 October notices patch YAML-LibYAML, urllib3, and Bind flaws spanning file deletion, code execution, traffic tampering, and denial of service.

Ubuntu issued three separate security notices on 2026-10-14 rather than one shared vulnerability. USN-8925-1 patches YAML-LibYAML on Ubuntu 16.04 LTS and 18.04 LTS: CVE-2017-20285, discovered by Dominique Dumont, involves unsafe reflection that could delete files if a crafted file is opened, and CVE-2019-25777 is a parsing flaw that could allow arbitrary code execution under the same conditions; the notice also starts to describe a regular-expression issue but does not name another CVE. USN-8926-1 covers three urllib3 flaws and does not report active exploitation: CVE-2026-97687 is incorrect certificate validation that could let an attacker observe or modify forwarded traffic on Ubuntu 26.04 LTS only, CVE-2026-97688 is improper decoding of certain deflate responses that could cause denial of service on the same release, and CVE-2026-97689 is a memory-handling denial of service. USN-8929-1 covers Bind on older LTS releases and does not state in-the-wild exploitation: CVE-2025-8677, found by Zuyao Xu and Xiang Li, can let a remote attacker exhaust resources with malformed DNSKEY records on Ubuntu 14.04, 16.04, and 18.04 LTS, while CVE-2025-40778, found by Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan, may allow cache poisoning and affects only Ubuntu 18.04 LTS; a third insecure-delegation issue is mentioned without its CVE. The sources do not disagree; they describe different packages, CVEs, and affected releases.

On 2026-10-14 Ubuntu published USN-8925-1, USN-8926-1, and USN-8929-1 covering YAML-LibYAML, urllib3, and Bind.
USN-8925-1 names CVE-2017-20285 (unsafe reflection that could delete files; discovered by Dominique Dumont) and CVE-2019-25777 (parsing flaw that could allow arbitrary code execution); both affect only Ubuntu 16.04 LTS and 18.04 LTS. A…
USN-8926-1 names CVE-2026-97687 (incorrect certificate validation that could let an attacker observe or modify forwarded traffic; Ubuntu 26.04 LTS only), CVE-2026-97688 (improper decoding of certain deflate responses causing denial of…
USN-8929-1 names CVE-2025-8677 (malformed DNSKEY records can exhaust resources; found by Zuyao Xu and Xiang Li; Ubuntu 14.04, 16.04, and 18.04 LTS) and CVE-2025-40778 (cache poisoning via certain answer records; found by Yuxiao Wu, Yunyi…
The three notices do not contradict one another; each covers a different package and set of releases.

VendorsCanonical ISC Ubuntu

Productsurllib3 Bind Ubuntu YAML-LibYAML

OrganizationsUbuntu Canonical

Coverage timelineoldest first · each row is one article

Oct 14, 03:31 UTC · 3d ago
Ubuntu Security Notices· 28
USN-8925-1: YAML-LibYAML vulnerabilities
Ubuntu patched YAML-LibYAML flaws that could delete files or run code on 16.04 and 18.04 LTS.
Oct 14, 06:23 UTC · 2d ago
Ubuntu Security Notices· 48
USN-8926-1: urllib3 vulnerabilities
Ubuntu fixes three urllib3 flaws, including certificate validation bypass and denial-of-service bugs.
Oct 14, 13:00 UTC · 2d ago
Ubuntu Security Notices· 34
USN-8929-1: Bind vulnerabilities
Ubuntu patched Bind flaws that could cause denial of service or DNS cache poisoning.

Vulnerabilities in this storyAll →

CVE-2017-202859.1—
Unsafe deserialization in Perl YAML before 1.30
published 11d ago· Ingy döt Net YAML+1 related
CVE-2025-407788.6<1%
Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache
published Oct 22, 2025

CVE	Vulnerability	CVSS	EPSS	Affected	Exposure	Published
CVE-2017-20285 +1 related CVE CVE-2019-25777	Unsafe deserialization in Perl YAML before 1.30 Perl YAML before 1.30 unsafely deserializes a document that uses a perl/hash:Class tag to bless a hash into a class named by the document. The document supplies the object's fields, and when the object later goes out of scope Perl calls that class's DESTROY method. What DESTROY does depends on classes already loaded in the process; with core File::Temp::Dir, the document can delete a directory tree it names. Any application that loads untrusted YAML with an affected YAML.pm is exposed to this object-injection behavior. No public proof-of-concept is known, the issue is not in CISA KEV, and in-the-wild exploitation has not been reported. Do: Upgrade the Perl YAML distribution to 1.30 or later. Until then, do not load untrusted YAML with the affected module, and treat documents that contain perl/hash tags as hostile. After upgrading, confirm applications no longer deserialize external YAML into live Perl objects.	9.1 group max	—	Ingy döt Net YAML before 1.30	—	11d ago
CVE-2025-40778	Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. NVD description · AI analysis pending	8.6	<1%	—	—	Oct 22, 2025
CVE-2025-8677	Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. NVD description · AI analysis pending	7.5	11%	—	—	Oct 22, 2025
CVE-2026-97689 +2 related CVEs CVE-2026-97687 CVE-2026-97688	Unbounded Memory Allocation in Python urllib3 Chunked-Response Parsing urllib3, the widely used Python HTTP client library, fails to bound how much data it buffers while parsing a chunked HTTP response: in versions from 1.10.3 up to (but not including) 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods read the chunk-size line until a newline or EOF with no length limit. A malicious or compromised HTTP server triggers the flaw by replying with 'Transfer-Encoding: chunked' followed by an extremely long run of bytes containing no newline, causing the client to allocate unbounded memory and eventually exhaust the process. Any application built on an affected urllib3 that makes requests to servers it does not fully control, including apps that fetch user-supplied or third-party URLs, is at risk of denial of service; the CVSS 4.0 score is 8.9 (high), reflecting a network attack vector with high availability impact but requiring the attacker to operate a hostile server. The flaw is fixed in urllib3 2.8.0. As of this writing there is no known public PoC, and it does not appear in the CISA KEV catalog. Do: Upgrade to urllib3 2.8.0 or later, and update any lockfiles, base images, or vendored copies that pin an older version. Because urllib3 is almost always pulled in as a transitive dependency, run pip-audit or 'pip show urllib3' to confirm the resolved version across your projects. Highest-risk applications are those that fetch user-supplied or otherwise untrusted URLs; as interim mitigations, cap response sizes, enforce process memory limits, and restrict outbound HTTP to trusted hosts.	8.9 group max	—	urllib3 project (Python) urllib3 >= 1.10.3, < 2.8.0