[QSA-1111262]
Security Update Bundle
Qlustar Security Advisory 1111262
November 11th, 2026
Summary:
A Qlustar security update bundle is a cumulative update of packages that are taken from upstream Debian/Ubuntu without modification. Only packages that are used in a typical HPC/Storage cluster installation are mentioned in Qlustar Security Advisories. Other non-HPC related updates also enter the Qlustar repository, but their functionality is not separately verified by the Qlustar team. To track these updates subscribe to the general security mailing lists of Debian/Ubuntu and/or AlmaLinux.
Package(s) : see upstream description of individual package
Qlustar releases : 13, 14
Affected versions: All versions prior to this update
Vulnerability : see upstream description of individual package
Problem type : see upstream description of individual package
Qlustar-specific : no
CVE Id(s) : see upstream description of individual package
This update includes several security related package updates from Debian/Ubuntu and AlmaLinux. The following list provides references to the upstream security report of the corresponding packages. You can view the original upstream advisory by clicking on the corresponding title.
Relevant to Qlustar 13 and/or 14 – Ubuntu
If an advisory applies only to Qlustar 13 or 14, it is noted in its description.
Perl vulnerability
It was discovered that Pod::Text in Perl did not properly handle POD documents with deeply nested =over directives. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to cause CPU and memory exhaustion, resulting in a denial of service. (CVE-2026-82560)
Apache HTTP Server vulnerabilities
Zhang San, Ankit Prateek, Zhen Kong, SeungHyun Cho, Ryoma Nishioka, Keita Sode and Hyojae Lee discovered that Apache HTTP Server did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-46729)
It was discovered that Apache HTTP Server did not correctly handle certain session cookies. A remote attacker could possibly use this issue to leak sensitive information. (CVE-2026-47360)
Zhen Kong discovered that Apache HTTP Server did not correctly handle certain forms of authentication. An unauthenticated remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-48005)
Bartlomiej Dmitruk and Masumi Tanaka discovered that Apache HTTP Server did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-56153)
Lucian Nitescu discovered that Apache HTTP Server did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-56449)
libheif vulnerability
Alex Thomas discovered that libheif incorrectly handled certain HEIF images. An attacker could possibly use this issue to execute arbitrary code if a user or automated system were tricked into opening a specially crafted file. (CVE-2026-120208)
pyasn1 vulnerabilities
It was discovered that pyasn1 incorrectly handled tracking component types when decoding containers without a schema. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. (CVE-2026-119194)
It was discovered that pyasn1 processed fragmented constructed BIT STRING values in quadratic time. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. (CVE-2026-119196)
It was discovered that pyasn1 processed binary-encoded REAL values with large mantissas in quadratic time. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. (CVE-2026-119197)
APT vulnerability
Max Justicz discovered that APT incorrectly handled hard links when encountering redirects and retrying package downloads. A remote on-path attacker could possibly use this issue to trick APT into installing an unverified package and achieve remote code execution with root privileges. (CVE-2026-109518)
libsoup vulnerabilities
It was discovered that libsoup incorrectly handled certain WebSocket frames. A remote attacker could possibly use this issue to cause an application to crash or expose sensitive information. (CVE-2026-12478)
It was discovered that libsoup incorrectly handled certain data URIs. A remote attacker could possibly use this issue to cause an application to crash or expose sensitive information. (CVE-2026-102555)
It was discovered that libsoup incorrectly handled certain WebSocket messages. A remote attacker could possibly use this issue to cause an application to crash. (CVE-2026-102556)
It was discovered that libsoup incorrectly handled fragmented WebSocket messages. A remote attacker could possibly use this issue to cause an application to crash. (CVE-2026-102557)
It was discovered that libsoup incorrectly handled certain WebSocket frames. A remote attacker could possibly use this issue to cause an application to crash. (CVE-2026-102558)
It was discovered that libsoup incorrectly handled large WebSocket messages. An attacker could possibly use this issue to cause an application to crash. (CVE-2026-102559)
It was discovered that libsoup incorrectly handled compressed WebSocket messages. An attacker could possibly use this issue to cause an application to crash. (CVE-2026-102560)
It was discovered that libsoup did not properly handle certain HTTP requests. A remote attacker could possibly use this issue to inject arbitrary HTTP requests. (CVE-2026-103399)
It was discovered that libsoup incorrectly handled proxy credentials. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-12547)
It was discovered that libsoup incorrectly handled multipart messages. A remote attacker could possibly use this issue to cause an application to crash or obtain sensitive information. (CVE-2026-12548)
GVfs vulnerabilities
It was discovered that GVfs did not properly validate data returned by an SFTP server. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-84267)
It was discovered that GVfs did not properly validate the size of replies from an AFP server. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-84269)
It was discovered that GVfs did not properly validate the size of data returned by an MTP device. An attacker with a malicious MTP device could possibly use this issue to cause a denial of service. (CVE-2026-84270)
AlmaLinux 8.10 security updates
Please check the AlmaLinux Errata site for details about AlmaLinux 8 updates that entered this release (everything from October 30th until November 10th).
Update instructions:
The problem can be corrected by updating your system to the following or more recent package versions:
For Qlustar 14
qlustar-module-core-noble-amd64-14.1 14.1.18-b592f1669
qlustar-module-core-centos8-amd64-14.1 14.1.18-b592f1669
For Qlustar 13
qlustar-module-core-jammy-amd64-13.4 13.4.17-b593f1668
Special Update instructions:
In addition to the steps described in the general Qlustar Update Instructions these updates require the following:
- Spack migration
With the release of the HPC Core Stack 02/26, spack was also updated to version 1.1.1. If you
haven’t yet migrated your spack database to version 8, login on a cluster node as a user with
Spack admin rights (usually user softadm or anybody in the group softadm) and execute
# spack reindexNote that after this, older Spack versions will no longer be able to read the database. However, a backup is created in case a revert is needed.
- Please note that we no longer provide 13.x AlmaLinux 8 modules for Qlustar 13. If you want to use AlmaLinux 8 under Qlustar 13, please switch to the 14.x image modules and create a corresponding chroot for it.