Skip to content
OpenAdvisories
High RHSA-2026:3033 1 CVE

Red Hat Security Advisory: munge security update

Published Feb 23, 2026 · Updated Jun 30, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.1 munge 0:0.5.15-11.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 munge-debuginfo 0:0.5.15-11.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 munge-debugsource 0:0.5.15-11.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 munge-devel 0:0.5.15-11.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 munge-libs 0:0.5.15-11.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 munge-libs-debuginfo 0:0.5.15-11.el10_1

Vulnerabilities 1

  • High 7.7
    CVE-2026-25506

    MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery

    MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged (the MUNGE authentication daemon) to leak cryptographic key material from process memory.…

    dun munge munge munge Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2438715
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3033.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-25506
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-25506
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-25506
  • article
    https://github.com/dun/munge/commit/bf40cc27c4ce8451d4b062c9de0b67ec40894812
  • article
    https://github.com/dun/munge/releases/tag/munge-0.5.18
  • article
    https://github.com/dun/munge/security/advisories/GHSA-r9cr-jf4v-75gh