critique
CVE-2026-40468
gawk: gawk: Memory corruption via integer overflow
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Red Hat4.4CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Julia2.1CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:L
Le label propre à Trivy est CRITICAL. Critique selon NVD, Photon OS. Plus basse selon Amazon (élevée), Red Hat (moyenne), AlmaLinux (moyenne), Oracle (moyenne), Rocky Linux (moyenne), Ubuntu (moyenne), Azure Linux (faible), Julia (faible).
Description
Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 5.0 | gawk, gawk-all-langpacks, gawk-bin et 3 autres | 5.3.2-5.ph5 |
| alma 10 | gawk, gawk-all-langpacks | 5.3.0-6.el10_2.1 |
| alma 8 | gawk | 4.2.1-5.el8_10 |
| alma 9 | gawk, gawk-all-langpacks | 5.1.0-6.el9_8.1 |
| amazon linux 2023 | gawk, gawk-all-langpacks, gawk-debuginfo et 3 autres | 5.1.0-3.amzn2023.0.4 |
| Azure Linux 3.0 | gawk | 0:5.2.2-2.azl3 |
| debian 11 | gawk | pas de correctif indiqué |
| debian 12 | gawk | pas de correctif indiqué |
| debian 13 | gawk | pas de correctif indiqué |
| debian 14 | gawk | pas de correctif indiqué |
| echo | gawk | 1:5.2.1-2+e1 |
| julia::Julia Ecosystem Security Advisories | gawk_jll | 5.4.1+0 |
Afficher les 88 entrées de 46 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 5.0 | gawk | 5.3.2-5.ph5 |
| Photon OS 5.0 | gawk-all-langpacks | 5.3.2-5.ph5 |
| Photon OS 5.0 | gawk-bin | 5.3.2-5.ph5 |
| Photon OS 5.0 | gawk-devel | 5.3.2-5.ph5 |
| Photon OS 5.0 | gawk-doc | 5.3.2-5.ph5 |
| Photon OS 5.0 | gawk-extras | 5.3.2-5.ph5 |
| alma 10 | gawk | 5.3.0-6.el10_2.1 |
| alma 10 | gawk-all-langpacks | 5.3.0-6.el10_2.1 |
| alma 8 | gawk | 4.2.1-5.el8_10 |
| alma 9 | gawk | 5.1.0-6.el9_8.1 |
| alma 9 | gawk-all-langpacks | 5.1.0-6.el9_8.1 |
| amazon linux 2023 | gawk | 5.1.0-3.amzn2023.0.4 |
| amazon linux 2023 | gawk-all-langpacks | 5.1.0-3.amzn2023.0.4 |
| amazon linux 2023 | gawk-debuginfo | 5.1.0-3.amzn2023.0.4 |
| amazon linux 2023 | gawk-debugsource | 5.1.0-3.amzn2023.0.4 |
| amazon linux 2023 | gawk-devel | 5.1.0-3.amzn2023.0.4 |
| amazon linux 2023 | gawk-doc | 5.1.0-3.amzn2023.0.4 |
| Azure Linux 3.0 | gawk | 0:5.2.2-2.azl3 |
| debian 11 | gawk | pas de correctif indiqué |
| debian 12 | gawk | pas de correctif indiqué |
| debian 13 | gawk | pas de correctif indiqué |
| debian 14 | gawk | pas de correctif indiqué |
| echo | gawk | 1:5.2.1-2+e1 |
| julia::Julia Ecosystem Security Advisories | gawk_jll | 5.4.1+0 |
| Oracle Linux 8 | gawk | 4.2.1-5.el8_10 |
| Oracle Linux 9 | gawk | 5.1.0-6.el9_8.1 |
| Oracle Linux 9 | gawk-all-langpacks | 5.1.0-6.el9_8.1 |
| rapidfort alma 10 | gawk | 0:5.3.0-6.el10_2.1 |
| rapidfort alma 10 | gawk-all-langpacks | 5.3.0-6.el10_2.1 |
| rapidfort alma 9 | gawk | 0:5.1.0-6.el9_8.1 |
| rapidfort alma 9 | gawk-all-langpacks | 5.1.0-6.el9_8.1 |
| rapidfort alpine 3.20 | gawk | pas de correctif indiqué |
| rapidfort alpine 3.21 | gawk | pas de correctif indiqué |
| rapidfort alpine 3.22 | gawk | pas de correctif indiqué |
| rapidfort alpine 3.23 | gawk | pas de correctif indiqué |
| rapidfort alpine 3.24 | gawk | pas de correctif indiqué |
| rapidfort amazon linux 2023 | gawk | 0:5.1.0-3.amzn2023.0.4 |
| rapidfort amazon linux 2023 | gawk-all-langpacks | 5.1.0-3.amzn2023.0.4 |
| rapidfort amazon linux 2023 | gawk-devel | 5.1.0-3.amzn2023.0.4 |
| rapidfort amazon linux 2023 | gawk-doc | 5.1.0-3.amzn2023.0.4 |
| rapidfort amazon linux 2023 | rf-gawk | 0:5.1.0-3.amzn2023.0.4 |
| rapidfort amazon linux 2023 | rf-gawk-all-langpacks | 5.1.0-3.amzn2023.0.4 |
| rapidfort amazon linux 2023 | rf-gawk-devel | 5.1.0-3.amzn2023.0.4 |
| rapidfort amazon linux 2023 | rf-gawk-doc | 5.1.0-3.amzn2023.0.4 |
| rapidfort debian 12 | gawk | pas de correctif indiqué |
| rapidfort debian 13 | gawk | pas de correctif indiqué |
| rapidfort fedora 41 | gawk | 0:5.3.0-5.fc41 |
| rapidfort fedora 41 | rf-gawk | 0:5.3.0-5.fc41 |
| rapidfort fedora 43 | gawk | 0:5.3.2-3.fc43 |
| rapidfort fedora 43 | gawk-all-langpacks | 5.3.2-3.fc43 |
| rapidfort fedora 43 | gawk-devel | 5.3.2-3.fc43 |
| rapidfort fedora 43 | gawk-doc | 5.3.2-3.fc43 |
| rapidfort fedora 43 | rf-gawk | 0:5.3.2-3.fc43 |
| rapidfort fedora 43 | rf-gawk-all-langpacks | 5.3.2-3.fc43 |
| rapidfort fedora 43 | rf-gawk-devel | 5.3.2-3.fc43 |
| rapidfort fedora 43 | rf-gawk-doc | 5.3.2-3.fc43 |
| rapidfort Oracle Linux | rf-gawk | 0:5.4.1-10.rf, 5.4.1-10.rf |
| rapidfort Oracle Linux | rf-gawk-all-langpacks | 5.4.1-10.rf |
| rapidfort Oracle Linux | rf-gawk-devel | 5.4.1-10.rf |
| rapidfort Oracle Linux | rf-gawk-doc | 5.4.1-10.rf |
| rapidfort Oracle Linux 10 | gawk | 0:5.3.0-6.el10_2.1 |
| rapidfort Oracle Linux 10 | gawk-all-langpacks | 0:5.3.0-6.el10_2.1 |
| rapidfort Oracle Linux 9 | gawk | 0:5.1.0-6.el9_8.1 |
| rapidfort Oracle Linux 9 | gawk-all-langpacks | 0:5.1.0-6.el9_8.1 |
| rapidfort Red Hat 10 | gawk | 0:5.3.0-6.el10_2.1 |
| rapidfort Red Hat 10 | rf-gawk | 0:5.3.0-6.el10_2.1 |
| rapidfort rocky | rf-gawk | 0:5.4.1-10.rf |
| rapidfort rocky | rf-gawk-all-langpacks | 0:5.4.1-10.rf |
| rapidfort rocky 9 | gawk | 0:5.1.0-6.el9_8.1 |
| rapidfort rocky 9 | gawk-all-langpacks | 0:5.1.0-6.el9_8.1 |
| rapidfort ubuntu 20.04 | gawk | 1:5.1.0-1ubuntu0.2, 1:5.2.1-2ubuntu0.1, 1:5.3.2-1ubuntu1.1 |
| rapidfort ubuntu 22.04 | gawk | 1:5.1.0-1ubuntu0.2, 1:5.2.1-2ubuntu0.1, 1:5.3.2-1ubuntu1.1 |
| rapidfort ubuntu 24.04 | gawk | 1:5.1.0-1ubuntu0.2, 1:5.2.1-2ubuntu0.1, 1:5.3.2-1ubuntu1.1 |
| Red Hat | gawk | pas de correctif indiqué |
| Red Hat | openshift/ose-rhel-coreos-8 | pas de correctif indiqué |
| Red Hat | openshift/ose-rhel-coreos-9 | pas de correctif indiqué |
| rocky 10 | gawk | 5.3.0-6.el10_2.1 |
| rocky 8 | gawk | 4.2.1-5.el8_10 |
| rocky 9 | gawk | 5.1.0-6.el9_8.1 |
| seal Red Hat 7 | gawk | 4.0.2-4.el7_3.1+sp999 |
| seal Red Hat 7 | seal-gawk | 4.0.2-4.el7_3.1+sp999 |
| seal Red Hat 9 | gawk | 5.1.0-6.el9+sp999 |
| seal Red Hat 9 | seal-gawk | 5.1.0-6.el9+sp999 |
| ubuntu 18.04-ESM | gawk | 1:4.1.4+dfsg-1ubuntu0.1~esm2 |
| ubuntu 20.04-ESM | gawk | 1:5.0.1+dfsg-1ubuntu0.1+esm1 |
| ubuntu 22.04 | gawk | 1:5.1.0-1ubuntu0.2 |
| ubuntu 24.04 | gawk | 1:5.2.1-2ubuntu0.1 |
| ubuntu 26.04 | gawk | 1:5.3.2-1ubuntu1.1 |
Références
- https://access.redhat.com/errata/RHSA-2026:73512
- https://access.redhat.com/security/cve/CVE-2026-40468
- https://bugzilla.redhat.com/2499655
- https://bugzilla.redhat.com/2499657
- https://bugzilla.redhat.com/2499658
- https://bugzilla.redhat.com/show_bug.cgi?id=2499655
- https://bugzilla.redhat.com/show_bug.cgi?id=2499657
- https://bugzilla.redhat.com/show_bug.cgi?id=2499658
Les 21 références
- https://cert.pl/en/posts/2026/07/CVE-2026-40467
- https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=062f2f2581b991362c046f7f2e238ffa34e6f8c7
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40467
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40468
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40553
- https://errata.almalinux.org/9/ALSA-2026-73512.html
- https://errata.rockylinux.org/RLSA-2026:73512
- https://linux.oracle.com/cve/CVE-2026-40468.html
- https://linux.oracle.com/errata/ELSA-2026-73512.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-40468
- https://ubuntu.com/security/notices/USN-8588-1
- https://www.cve.org/CVERecord?id=CVE-2026-40468