Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 22:12:24 +0000 CVE-2026-49846 — libks has path traversal in kws HTTP parser via URI segment overflow https://cve.radiocsirt.org/vuln/cve-2026-49846 <p><strong>Affected:</strong> signalwire libks</p> <p>libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()` in libks&#39;s HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with embedded &#34;..&#34; sequences intact, enabling path traversal in any consumer that later joins the URI with a filesystem path. Version 2.0.11 patches the issue.</p> <p><strong>Affected:</strong> signalwire libks</p> <p>libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()` in libks&#39;s HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with embedded &#34;..&#34; sequences intact, enabling path traversal in any consumer that later joins the URI with a filesystem path. Version 2.0.11 patches the issue.</p> https://cve.radiocsirt.org/vuln/cve-2026-49846