Update to 0.5.18, resolve CVE-2026-25506. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-ec8baadd48 2026-02-26 01:08:36.076651+00:00 -------------------------------------------------------------------------------- Name : munge Product : Fedora 43 Version : 0.5.18 Release : 1.fc43 URL : https://dun.github.io/munge/ Summary : Enables uid & gid authentication across a host cluster Description : MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating and validating credentials. It is designed to be highly scalable for use in an HPC cluster environment. It allows a process to authenticate the UID and GID of another local or remote process within a group of hosts having common users and groups. These hosts form a security realm that is defined by a shared cryptographic key. Clients within this security realm can create and validate credentials without the use of root privileges, reserved ports, or platform-specific methods. -------------------------------------------------------------------------------- Update Information: Update to 0.5.18, resolve CVE-2026-25506 -------------------------------------------------------------------------------- ChangeLog: * Fri Feb 13 2026 Michal Schmidt - 0.5.18-1 - Update to 0.5.18 * Fri Jan 16 2026 Fedora Release Engineering - 0.5.16-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2414773 - munge-0.5.18 is available https://bugzilla.redhat.com/show_bug.cgi?id=2414773 [ 2 ] Bug #2438833 - CVE-2026-25506 munge: MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2438833 -------------------------------------------------------------------------------- This update can beinstalled with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-ec8baadd48' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Important: munge security update. {"type": "TYPE_SECURITY", "shortCode": "RL", "name": "RLSA-2026:3033", "synopsis": "Important: munge security update", "severity": "SEVERITY_IMPORTANT", "topic": "An update is available for munge.\nThis update affects Rocky Linux 10.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list", "description": "MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating and validating credentials. It is designed to be highly scalable for use in an HPC cluster environment. It allows a process to authenticate the UID and GID of another local or remote process within a group of hosts having common users and groups. These hosts form a security realm that is defined by a shared cryptographic key. Clients within this security realm can create and validate credentials without the use of root privileges, reserved ports, or platform-specific methods.\n\nSecurity Fix(es):\n\n* MUNGE: MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery (CVE-2026-25506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "solution": null, "affectedProducts": ["Rocky Linux 10"], "fixes": [{"ticket": "2438715", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2438715", "description": ""}], "cves": [{"name": "CVE-2026-25506", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2026-25506", "cvss3ScoringVector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L", "cvss3BaseScore": "7.7", "cwe": "CWE-120"}], "references": [], "publishedAt": "2026-02-24T18:56:34.668877Z", "rpms": {"Rocky Linux 10": {"nvras": ["munge-libs-0:0.5.15-11.el10_1.aarch64.rpm", "munge-debuginfo-0:0.5.15-11.el10_1.aarch64.rpm", "munge-debuginfo-0:0.5.15-11.el10_1.s390x.rpm","munge-devel-0:0.5.15-11.el10_1.x86_64.rpm", "munge-debugsource-0:0.5.15-11.el10_1.aarch64.rpm", "munge-libs-0:0.5.15-11.el10_1.ppc64le.rpm", "munge-devel-0:0.5.15-11.el10_1.s390x.rpm", "munge-0:0.5.15-11.el10_1.s390x.rpm", "munge-debugsource-0:0.5.15-11.el10_1.x86_64.rpm", "munge-debugsource-0:0.5.15-11.el10_1.ppc64le.rpm", "munge-libs-0:0.5.15-11.el10_1.x86_64.rpm", "munge-0:0.5.15-11.el10_1.src.rpm", "munge-libs-0:0.5.15-11.el10_1.s390x.rpm", "munge-libs-debuginfo-0:0.5.15-11.el10_1.aarch64.rpm", "munge-debugsource-0:0.5.15-11.el10_1.s390x.rpm", "munge-0:0.5.15-11.el10_1.ppc64le.rpm", "munge-libs-debuginfo-0:0.5.15-11.el10_1.ppc64le.rpm", "munge-0:0.5.15-11.el10_1.x86_64.rpm", "munge-debuginfo-0:0.5.15-11.el10_1.ppc64le.rpm", "munge-libs-debuginfo-0:0.5.15-11.el10_1.x86_64.rpm", "munge-devel-0:0.5.15-11.el10_1.aarch64.rpm", "munge-libs-debuginfo-0:0.5.15-11.el10_1.s390x.rpm", "munge-0:0.5.15-11.el10_1.aarch64.rpm", "munge-debuginfo-0:0.5.15-11.el10_1.x86_64.rpm", "munge-devel-0:0.5.15-11.el10_1.ppc64le.rpm"]}}, "rebootSuggested": false, "buildReferences": []}. Munge authentication service update for Rocky Linux 10 addressing important buffer overflow and credential forgery risks.. security patch, Rocky Linux update, malleability risk, credential forensics. . Severity: Important. LinuxSecurity.com Team
Important: munge security update. {"type": "TYPE_SECURITY", "shortCode": "RL", "name": "RLSA-2026:3033", "synopsis": "Important: munge security update", "severity": "SEVERITY_IMPORTANT", "topic": "An update is available for munge.\nThis update affects Rocky Linux 10.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list", "description": "MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating and validating credentials. It is designed to be highly scalable for use in an HPC cluster environment. It allows a process to authenticate the UID and GID of another local or remote process within a group of hosts having common users and groups. These hosts form a security realm that is defined by a shared cryptographic key. Clients within this security realm can create and validate credentials without the use of root privileges, reserved ports, or platform-specific methods.\n\nSecurity Fix(es):\n\n* MUNGE: MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery (CVE-2026-25506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "solution": null, "affectedProducts": ["Rocky Linux 10"], "fixes": [{"ticket": "2438715", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2438715", "description": ""}], "cves": [{"name": "CVE-2026-25506", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2026-25506", "cvss3ScoringVector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L", "cvss3BaseScore": "7.7", "cwe": "CWE-120"}], "references": [], "publishedAt": "2026-02-24T18:56:34.668877Z", "rpms": {"Rocky Linux 10": {"nvras": ["munge-libs-0:0.5.15-11.el10_1.aarch64.rpm", "munge-debuginfo-0:0.5.15-11.el10_1.aarch64.rpm", "munge-debuginfo-0:0.5.15-11.el10_1.s390x.rpm","munge-devel-0:0.5.15-11.el10_1.x86_64.rpm", "munge-debugsource-0:0.5.15-11.el10_1.aarch64.rpm", "munge-libs-0:0.5.15-11.el10_1.ppc64le.rpm", "munge-devel-0:0.5.15-11.el10_1.s390x.rpm", "munge-0:0.5.15-11.el10_1.s390x.rpm", "munge-debugsource-0:0.5.15-11.el10_1.x86_64.rpm", "munge-debugsource-0:0.5.15-11.el10_1.ppc64le.rpm", "munge-libs-0:0.5.15-11.el10_1.x86_64.rpm", "munge-0:0.5.15-11.el10_1.src.rpm", "munge-libs-0:0.5.15-11.el10_1.s390x.rpm", "munge-libs-debuginfo-0:0.5.15-11.el10_1.aarch64.rpm", "munge-debugsource-0:0.5.15-11.el10_1.s390x.rpm", "munge-0:0.5.15-11.el10_1.ppc64le.rpm", "munge-libs-debuginfo-0:0.5.15-11.el10_1.ppc64le.rpm", "munge-0:0.5.15-11.el10_1.x86_64.rpm", "munge-debuginfo-0:0.5.15-11.el10_1.ppc64le.rpm", "munge-libs-debuginfo-0:0.5.15-11.el10_1.x86_64.rpm", "munge-devel-0:0.5.15-11.el10_1.aarch64.rpm", "munge-libs-debuginfo-0:0.5.15-11.el10_1.s390x.rpm", "munge-0:0.5.15-11.el10_1.aarch64.rpm", "munge-debuginfo-0:0.5.15-11.el10_1.x86_64.rpm", "munge-devel-0:0.5.15-11.el10_1.ppc64le.rpm"]}}, "rebootSuggested": false, "buildReferences": []}. MUNGE security update for Rocky Linux addresses critical buffer overflow issue allowing credential forgery. Stay safe!. MUNGE update. . Severity: Important. LinuxSecurity.com Team
Important: munge security update. {"type": "TYPE_SECURITY", "shortCode": "RL", "name": "RLSA-2026:3034", "synopsis": "Important: munge security update", "severity": "SEVERITY_IMPORTANT", "topic": "An update is available for munge.\nThis update affects Rocky Linux 9.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list", "description": "MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating and validating credentials. It is designed to be highly scalable for use in an HPC cluster environment. It allows a process to authenticate the UID and GID of another local or remote process within a group of hosts having common users and groups. These hosts form a security realm that is defined by a shared cryptographic key. Clients within this security realm can create and validate credentials without the use of root privileges, reserved ports, or platform-specific methods.\n\nSecurity Fix(es):\n\n* MUNGE: MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery (CVE-2026-25506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "solution": null, "affectedProducts": ["Rocky Linux 9"], "fixes": [{"ticket": "2438715", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2438715", "description": ""}], "cves": [{"name": "CVE-2026-25506", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2026-25506", "cvss3ScoringVector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L", "cvss3BaseScore": "7.7", "cwe": "CWE-120"}], "references": [], "publishedAt": "2026-02-24T18:54:11.875441Z", "rpms": {"Rocky Linux 9": {"nvras": ["munge-0:0.5.13-14.el9_7.aarch64.rpm", "munge-0:0.5.13-14.el9_7.ppc64le.rpm", "munge-0:0.5.13-14.el9_7.s390x.rpm", "munge-0:0.5.13-14.el9_7.src.rpm","munge-0:0.5.13-14.el9_7.x86_64.rpm", "munge-debuginfo-0:0.5.13-14.el9_7.aarch64.rpm", "munge-debuginfo-0:0.5.13-14.el9_7.i686.rpm", "munge-debuginfo-0:0.5.13-14.el9_7.ppc64le.rpm", "munge-debuginfo-0:0.5.13-14.el9_7.s390x.rpm", "munge-debuginfo-0:0.5.13-14.el9_7.x86_64.rpm", "munge-debugsource-0:0.5.13-14.el9_7.aarch64.rpm", "munge-debugsource-0:0.5.13-14.el9_7.i686.rpm", "munge-debugsource-0:0.5.13-14.el9_7.ppc64le.rpm", "munge-debugsource-0:0.5.13-14.el9_7.s390x.rpm", "munge-debugsource-0:0.5.13-14.el9_7.x86_64.rpm", "munge-devel-0:0.5.13-14.el9_7.aarch64.rpm", "munge-devel-0:0.5.13-14.el9_7.i686.rpm", "munge-devel-0:0.5.13-14.el9_7.ppc64le.rpm", "munge-devel-0:0.5.13-14.el9_7.s390x.rpm", "munge-devel-0:0.5.13-14.el9_7.x86_64.rpm", "munge-libs-0:0.5.13-14.el9_7.aarch64.rpm", "munge-libs-0:0.5.13-14.el9_7.i686.rpm", "munge-libs-0:0.5.13-14.el9_7.ppc64le.rpm", "munge-libs-0:0.5.13-14.el9_7.s390x.rpm", "munge-libs-0:0.5.13-14.el9_7.x86_64.rpm", "munge-libs-debuginfo-0:0.5.13-14.el9_7.aarch64.rpm", "munge-libs-debuginfo-0:0.5.13-14.el9_7.i686.rpm", "munge-libs-debuginfo-0:0.5.13-14.el9_7.ppc64le.rpm", "munge-libs-debuginfo-0:0.5.13-14.el9_7.s390x.rpm", "munge-libs-debuginfo-0:0.5.13-14.el9_7.x86_64.rpm"]}}, "rebootSuggested": false, "buildReferences": []}. Important Munge security update for Rocky Linux 9 addresses key leakage, ensuring secure authentication. Read for details.. Munge Security Update, Rocky Linux Important Patch, Credential Forgery Fix, Buffer Overflow Resolution. . Severity: Important. LinuxSecurity.com Team
Important: munge security update. {"type": "TYPE_SECURITY", "shortCode": "RL", "name": "RLSA-2026:3032", "synopsis": "Important: munge security update", "severity": "SEVERITY_IMPORTANT", "topic": "An update is available for munge.\nThis update affects Rocky Linux 8.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list", "description": "MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating and validating credentials. It is designed to be highly scalable for use in an HPC cluster environment. It allows a process to authenticate the UID and GID of another local or remote process within a group of hosts having common users and groups. These hosts form a security realm that is defined by a shared cryptographic key. Clients within this security realm can create and validate credentials without the use of root privileges, reserved ports, or platform-specific methods.\n\nSecurity Fix(es):\n\n* MUNGE: MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery (CVE-2026-25506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "solution": null, "affectedProducts": ["Rocky Linux 8"], "fixes": [{"ticket": "2438715", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2438715", "description": ""}], "cves": [{"name": "CVE-2026-25506", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2026-25506", "cvss3ScoringVector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L", "cvss3BaseScore": "7.7", "cwe": "CWE-120"}], "references": [], "publishedAt": "2026-02-24T18:52:02.882818Z", "rpms": {"Rocky Linux 8": {"nvras": ["munge-0:0.5.13-3.el8_10.aarch64.rpm", "munge-0:0.5.13-3.el8_10.src.rpm", "munge-0:0.5.13-3.el8_10.x86_64.rpm", "munge-debuginfo-0:0.5.13-3.el8_10.aarch64.rpm","munge-debuginfo-0:0.5.13-3.el8_10.i686.rpm", "munge-debuginfo-0:0.5.13-3.el8_10.x86_64.rpm", "munge-debugsource-0:0.5.13-3.el8_10.aarch64.rpm", "munge-debugsource-0:0.5.13-3.el8_10.i686.rpm", "munge-debugsource-0:0.5.13-3.el8_10.x86_64.rpm", "munge-devel-0:0.5.13-3.el8_10.aarch64.rpm", "munge-devel-0:0.5.13-3.el8_10.i686.rpm", "munge-devel-0:0.5.13-3.el8_10.x86_64.rpm", "munge-libs-0:0.5.13-3.el8_10.aarch64.rpm", "munge-libs-0:0.5.13-3.el8_10.i686.rpm", "munge-libs-0:0.5.13-3.el8_10.x86_64.rpm", "munge-libs-debuginfo-0:0.5.13-3.el8_10.aarch64.rpm", "munge-libs-debuginfo-0:0.5.13-3.el8_10.i686.rpm", "munge-libs-debuginfo-0:0.5.13-3.el8_10.x86_64.rpm"]}}, "rebootSuggested": false, "buildReferences": []}. Munge security update for Rocky Linux 8 addresses an important buffer overflow risk affecting credential integrity.. Munge Update Rocky Linux Important Buffer Overflow Credential Forgery. . Severity: Important. LinuxSecurity.com Team
Important: munge security update. {"type": "TYPE_SECURITY", "shortCode": "RL", "name": "RLSA-2026:3032", "synopsis": "Important: munge security update", "severity": "SEVERITY_IMPORTANT", "topic": "An update is available for munge.\nThis update affects Rocky Linux 8.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list", "description": "MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating and validating credentials. It is designed to be highly scalable for use in an HPC cluster environment. It allows a process to authenticate the UID and GID of another local or remote process within a group of hosts having common users and groups. These hosts form a security realm that is defined by a shared cryptographic key. Clients within this security realm can create and validate credentials without the use of root privileges, reserved ports, or platform-specific methods.\n\nSecurity Fix(es):\n\n* MUNGE: MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery (CVE-2026-25506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "solution": null, "affectedProducts": ["Rocky Linux 8"], "fixes": [{"ticket": "2438715", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2438715", "description": ""}], "cves": [{"name": "CVE-2026-25506", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2026-25506", "cvss3ScoringVector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L", "cvss3BaseScore": "7.7", "cwe": "CWE-120"}], "references": [], "publishedAt": "2026-02-24T18:52:02.882818Z", "rpms": {"Rocky Linux 8": {"nvras": ["munge-0:0.5.13-3.el8_10.aarch64.rpm", "munge-0:0.5.13-3.el8_10.src.rpm", "munge-0:0.5.13-3.el8_10.x86_64.rpm", "munge-debuginfo-0:0.5.13-3.el8_10.aarch64.rpm","munge-debuginfo-0:0.5.13-3.el8_10.i686.rpm", "munge-debuginfo-0:0.5.13-3.el8_10.x86_64.rpm", "munge-debugsource-0:0.5.13-3.el8_10.aarch64.rpm", "munge-debugsource-0:0.5.13-3.el8_10.i686.rpm", "munge-debugsource-0:0.5.13-3.el8_10.x86_64.rpm", "munge-devel-0:0.5.13-3.el8_10.aarch64.rpm", "munge-devel-0:0.5.13-3.el8_10.i686.rpm", "munge-devel-0:0.5.13-3.el8_10.x86_64.rpm", "munge-libs-0:0.5.13-3.el8_10.aarch64.rpm", "munge-libs-0:0.5.13-3.el8_10.i686.rpm", "munge-libs-0:0.5.13-3.el8_10.x86_64.rpm", "munge-libs-debuginfo-0:0.5.13-3.el8_10.aarch64.rpm", "munge-libs-debuginfo-0:0.5.13-3.el8_10.i686.rpm", "munge-libs-debuginfo-0:0.5.13-3.el8_10.x86_64.rpm"]}}, "rebootSuggested": false, "buildReferences": []}. Munge security update addresses a buffer overflow issue in Rocky Linux 8, impacting credential validation and authentication.. Rocky Linux, Munge, Security Update, Important, Buffer Overflow. . Severity: Important. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.