Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

openSUSE-SU-2026:21367-1 | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceopenSUSE-SU-2026:21367-1

openSUSE-SU-2026:21367-1

HIGH7.5

Security update for lux

Published Jul 17, 2026

Modified 2 months ago

Fix available

Details

Description of the patch:

This update for lux fixes the following issues:

Changes in lux:

CVE-2026-25680, CVE-2026-42502, CVE-2026-27136, CVE-2026-25681, CVE-2026-42506: Issues when parsing HTML files (bsc#1267110)
CVE-2024-45338: Denial of service due to non-linear parsing of case-insensitive content (bsc#1235304)
CVE-2025-22872: Incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241766)
CVE-2025-47911: Various algorithms with quadratic complexity when parsing HTML documents (bsc#1251460)
CVE-2025-58190: Excessive memory consumption (bsc#1251627) Bump x/net to 0.57.0
Update to 0.24.1:
- ci: bump go version to 1.22 #1350

Affected Packages

lux

openSUSE Leap 16.0

Fixed in:

0.24.1-bp160.1.1

References

https://bugzilla.suse.com/1235304

https://bugzilla.suse.com/1241766

https://bugzilla.suse.com/1251460

https://bugzilla.suse.com/1251627

https://bugzilla.suse.com/1267110

https://www.suse.com/security/cve/CVE-2024-45338/

https://www.suse.com/security/cve/CVE-2025-22872/

https://www.suse.com/security/cve/CVE-2025-47911/

https://www.suse.com/security/cve/CVE-2025-58190/

https://www.suse.com/security/cve/CVE-2026-25680/

https://www.suse.com/security/cve/CVE-2026-25681/

https://www.suse.com/security/cve/CVE-2026-27136/

https://www.suse.com/security/cve/CVE-2026-42502/

https://www.suse.com/security/cve/CVE-2026-42506/

https://www.suse.com/support/security/rating/

CVSS Analysis

CVSS v3.1

7.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

HighA:H

7.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Upstream

CVE-2024-45338 CVE-2025-22872 CVE-2025-47911 CVE-2025-58190 CVE-2026-25680 CVE-2026-25681 CVE-2026-27136 CVE-2026-42502 CVE-2026-42506

Ecosystems

openSUSE Leap 16.0

Timeline

PublishedJul 17, 2026

ModifiedJul 17, 2026