Security Digest: November 8, 2026 - 33 Critical Vulnerabilities

Today’s alert is broad and urgent: 33 critical and high-severity vulnerabilities affect identity platforms, DNS infrastructure, image processing, blockchain nodes, and the Vikunja project management stack. The most dangerous issues enable full administrative takeover, authentication bypass, and remote denial of service with little or no user interaction.

· 19 min read

Executive Summary

Today’s alert is broad and urgent: 33 critical and high-severity vulnerabilities affect identity platforms, DNS infrastructure, image processing, blockchain nodes, and the Vikunja project management stack. The most dangerous issues enable full administrative takeover, authentication bypass, and remote denial of service with little or no user interaction.

Act now: prioritize internet-facing systems, identity and SSO services, and any service that processes untrusted files or requests. Patch immediately where available, remove exposure where you cannot patch today, and increase monitoring for login anomalies, crash loops, and unusual traffic spikes.

Critical Vulnerabilities

  • CVE-2026-123549: OpenAM self-registration attribute enforcement bypass
    • Impact: Anonymous attackers can register accounts with restricted attributes, join administrative groups, and take full control of OpenAM.
    • Affected Systems: OpenAM before 16.1.4
    • Immediate Action: Disable legacy self-service registration flows until patched; restrict access to registration and REST endpoints.
    • Mitigation: Upgrade to 16.1.4 or later and verify self-registration controls are enforced.
  • CVE-2026-123614: imgproxy ICO heap buffer overflow
    • Impact: Crafted ICO images can crash the service or potentially enable code execution.
    • Affected Systems: imgproxy 4.0.0 before 4.0.16
    • Immediate Action: Block or sanitize ICO uploads at the edge if possible.
    • Mitigation: Upgrade to 4.0.16 or later; treat all untrusted image input as hostile.
  • CVE-2026-123550: OpenAM SAML authentication bypass
    • Impact: Attackers can forge SAML assertions and impersonate any mapped user, including administrators.
    • Affected Systems: OpenAM before 16.1.4
    • Immediate Action: Review SAML SP settings and temporarily restrict affected bindings if feasible.
    • Mitigation: Upgrade to 16.1.4 or later; enforce signed assertions and re-check SSO trust configuration.
  • CVE-2026-123616: imgproxy ICO memory exhaustion
    • Impact: A tiny crafted ICO file can trigger massive allocations and crash worker processes.
    • Affected Systems: imgproxy 3.3.0 before 4.0.16
    • Immediate Action: Restrict ICO uploads and watch for repeated worker restarts.
    • Mitigation: Upgrade to 4.0.16 or later; enforce file-type and size limits.
  • CVE-2026-123565: devalue quadratic expansion in uneval
    • Impact: Small crafted payloads can exhaust CPU and memory during serialization.
    • Affected Systems: sveltejs/devalue before 5.9.3
    • Immediate Action: Identify any service serializing attacker-influenced data with devalue.
    • Mitigation: Upgrade to 5.9.3 or later; cap payload size and reject suspicious repeated strings.
  • CVE-2026-123554: Zebra mempool quadratic verification work
    • Impact: Peers can pin verification threads and slow or stall node processing.
    • Affected Systems: zebrad 6.4.0 before 7.0.0
    • Immediate Action: Limit exposure to untrusted peers and monitor sync latency.
    • Mitigation: Upgrade to 7.0.0 or later.
  • CVE-2026-123606: Hickory DNS referral amplification
    • Impact: Attackers can force excessive lookups and exhaust resolver resources.
    • Affected Systems: hickory-recursor 0.25.0-alpha.3 through 0.25.2; hickory-resolver 0.26.0-alpha.1 before 0.26.2
    • Immediate Action: Watch for referral-heavy traffic and unusual outbound DNS activity.
    • Mitigation: Upgrade to 0.26.2 or later.
  • CVE-2026-123543: OpenAM Java deserialization denial of service
    • Impact: Unauthenticated requests can exhaust resources and block login, policy, and session services.
    • Affected Systems: OpenAM before 16.1.4
    • Immediate Action: Rate-limit and isolate remote SDK, login, and admin endpoints.
    • Mitigation: Upgrade to 16.1.4 or later; block serialized Java data at the edge if possible.
  • CVE-2026-123560: Zebra checkpoint sync stall
    • Impact: A malicious peer can stall initial sync until restart.
    • Affected Systems: zebrad before 7.0.0
    • Immediate Action: Segment peers and monitor for sync freeze conditions.
    • Mitigation: Upgrade to 7.0.0 or later.
  • CVE-2026-123577: Hickory DNS DoH request-body exhaustion
    • Impact: Large HTTP/2 or HTTP/3 request bodies can consume memory and deny service.
    • Affected Systems: Hickory DNS 0.24.0 before 0.26.2
    • Immediate Action: Restrict public DoH exposure and enforce request-size limits at the proxy.
    • Mitigation: Upgrade to 0.26.2 or later.
  • CVE-2026-123531: Vikunja page=0 query amplification
    • Impact: Authenticated users can trigger unbounded queries and degrade availability.
    • Affected Systems: Vikunja 1.0.0 before 2.7.1
    • Immediate Action: Rate-limit list endpoints and watch for page=0 abuse.
    • Mitigation: Upgrade to 2.7.1 or later.
  • CVE-2026-123566: devalue sparse-array CPU denial of service
    • Impact: Crafted sparse arrays can block the event loop and exhaust CPU.
    • Affected Systems: sveltejs/devalue before 5.9.3
    • Immediate Action: Audit any server-side serialization of attacker-controlled arrays.
    • Mitigation: Upgrade to 5.9.3 or later.
  • CVE-2026-123575: Hickory DNS incomplete DoH body exhaustion
    • Impact: Slow or incomplete requests can hold memory and connections open.
    • Affected Systems: Hickory DNS before 0.26.2
    • Immediate Action: Apply aggressive connection and body timeouts now.
    • Mitigation: Upgrade to 0.26.2 or later.
  • CVE-2026-123558: Zebra checkpoint verification stall
    • Impact: A malicious peer can keep verification stuck until restart.
    • Affected Systems: zebrad before 7.0.0
    • Immediate Action: Monitor for stuck verifier states and peer misbehavior.
    • Mitigation: Upgrade to 7.0.0 or later.
  • CVE-2026-123562: devalue unhandled promise rejection crash
    • Impact: A rejected async value can terminate a Node.js process.
    • Affected Systems: sveltejs/devalue 5.8.0 before 5.9.3
    • Immediate Action: Identify services using stringifyAsync on untrusted async data.
    • Mitigation: Upgrade to 5.9.3 or later; add process-level crash recovery.
  • CVE-2026-123576: Hickory DNS DoQ memory exhaustion
    • Impact: Incomplete DNS-over-QUIC bodies can exhaust memory.
    • Affected Systems: Hickory DNS 0.24.0 through 0.26.1
    • Immediate Action: Limit concurrent QUIC sessions and watch memory growth.
    • Mitigation: Upgrade to 0.26.2 or later.
  • CVE-2026-123569: devalue sparse-array serialization DoS
    • Impact: Excessive CPU and memory use during serialization.
    • Affected Systems: devalue before 5.6.3
    • Immediate Action: Search for server-side serialization of sparse arrays.
    • Mitigation: Upgrade to 5.6.3 or later.
  • CVE-2026-123604: Hickory DNS resolver retry loop
    • Impact: A malicious authoritative server can keep the resolver spinning and waste resources.
    • Affected Systems: hickory-resolver 0.26.0-beta.1 before 0.26.2
    • Immediate Action: Monitor for persistent retry loops and high resolver CPU.
    • Mitigation: Upgrade to 0.26.2 or later.
  • CVE-2026-123601: Hickory DNSSEC negative-response forgery
    • Impact: Attackers can forge DNSSEC-validated negative responses and deny legitimate names.
    • Affected Systems: hickory-proto 0.25.0 through 0.26.0-alpha.1; hickory-net 0.26.0-beta.1 before 0.26.2
    • Immediate Action: Treat suspicious NXDOMAIN patterns as a potential integrity issue.
    • Mitigation: Upgrade to 0.26.2 or later.
  • CVE-2026-123584: Hickory DNS client malformed-response crash
    • Impact: Spoofed malformed responses can abort client queries and deny service.
    • Affected Systems: hickory-net 0.26.0 before 0.26.2
    • Immediate Action: Monitor for UDP query failures from untrusted networks.
    • Mitigation: Upgrade to 0.26.2 or later; restrict exposure to spoofable networks.
  • CVE-2026-123513: Vikunja auth token exposure via API URL switch
    • Impact: Stored bearer and refresh tokens can be sent to an attacker-controlled server.
    • Affected Systems: Vikunja before 2.7.1
    • Immediate Action: Instruct users not to change frontend API URLs until patched.
    • Mitigation: Upgrade to 2.7.1 or later; rotate exposed tokens.
  • CVE-2026-123528: Vikunja revoked-token session persistence
    • Impact: Revoked or disabled accounts may still authenticate and mint sessions.
    • Affected Systems: Vikunja before 2.7.1
    • Immediate Action: Revoke active sessions and audit stale tokens now.
    • Mitigation: Upgrade to 2.7.1 or later.
  • CVE-2026-123542: OpenAM device flow PKCE bypass
    • Impact: Stolen approved device codes can be redeemed for tokens.
    • Affected Systems: OpenAM before 16.1.4
    • Immediate Action: Review device-flow logs for code leakage and suspicious approvals.
    • Mitigation: Upgrade to 16.1.4 or later and enforce PKCE validation.
  • CVE-2026-123497: Vikunja veans protocol downgrade
    • Impact: On-path attackers can force plain HTTP and steal credentials and tokens.
    • Affected Systems: Vikunja veans before 2.7.1
    • Immediate Action: Block downgrade paths and verify HTTPS-only discovery.
    • Mitigation: Upgrade to 2.7.1 or later.
  • CVE-2026-123525: Vikunja importer memory exhaustion
    • Impact: Large remote attachments or oversized API responses can crash the shared API process.
    • Affected Systems: Vikunja before 2.7.1
    • Immediate Action: Disable or tightly limit migration imports from untrusted sources.
    • Mitigation: Upgrade to 2.7.1 or later.
  • CVE-2026-123545: OpenAM OAuth device-flow CSRF
    • Impact: Attackers can trick users into approving device codes and obtain tokens.
    • Affected Systems: OpenAM 14.5.1 before 16.1.4
    • Immediate Action: Disable skipped-consent device approvals where possible.
    • Mitigation: Upgrade to 16.1.4 or later; enforce anti-CSRF protections.
  • CVE-2026-123501: Vikunja image-decoding memory exhaustion
    • Impact: Parallel image uploads can trigger OOM kills.
    • Affected Systems: Vikunja before 2.7.1
    • Immediate Action: Restrict avatar/background uploads and apply file-size caps.
    • Mitigation: Upgrade to 2.7.1 or later.
  • CVE-2026-123519: Vikunja import OOM via large WeKan files
    • Impact: Authenticated users can exhaust memory and crash the instance.
    • Affected Systems: Vikunja before 2.7.1
    • Immediate Action: Pause untrusted imports and monitor memory spikes.
    • Mitigation: Upgrade to 2.7.1 or later.
  • CVE-2026-123516: Vikunja ZIP importer resource exhaustion
    • Impact: Excessive ZIP entries can consume CPU and memory.
    • Affected Systems: Vikunja before 2.7.1
    • Immediate Action: Block unusually large export ZIPs until patched.
    • Mitigation: Upgrade to 2.7.1 or later.
  • CVE-2026-123532: gitoxide gix-fs NTLM credential disclosure
    • Impact: Crafted repositories can leak Windows NTLM credentials during checkout.
    • Affected Systems: gix-fs in gitoxide before 0.24.1
    • Immediate Action: Warn Windows users not to checkout untrusted repos with symlinks enabled.
    • Mitigation: Upgrade to 0.24.1 or later.
  • CVE-2026-123523: Vikunja avatar-size cache exhaustion
    • Impact: Many avatar sizes can consume roughly a gigabyte per account and trigger OOM.
    • Affected Systems: Vikunja before 2.7.1
    • Immediate Action: Reduce avatar size variants and clear abusive caches.
    • Mitigation: Upgrade to 2.7.1 or later.
  • CVE-2026-123520: Vikunja project ownership escalation
    • Impact: Team owners can gain admin or ownership over read-only shared projects.
    • Affected Systems: Vikunja 0.18.0 before 2.7.1
    • Immediate Action: Review project ownership changes and bot-based deletions.
    • Mitigation: Upgrade to 2.7.1 or later; audit impacted projects.
  • CVE-2026-123522: Vikunja task-read authorization bypass
    • Impact: Authenticated users can read arbitrary task contents and forge notifications.
    • Affected Systems: Vikunja before 2.7.1
    • Immediate Action: Treat any suspicious Kanban move activity as a possible data exposure event.
    • Mitigation: Upgrade to 2.7.1 or later.

Previously Alerted

What to Do Now

  1. Patch identity and internet-facing services first: OpenAM, Hickory DNS, imgproxy, Vikunja, Zebra, and gitoxide dependencies.
  2. Disable or restrict risky features today: self-registration, device-flow shortcuts, untrusted imports, public DoH/DoQ, and image uploads where possible.
  3. Rotate credentials and revoke sessions: especially for OpenAM and Vikunja if any exposure is suspected.
  4. Apply edge controls: request-size limits, rate limits, WAF rules, and timeouts for all exposed services.
  5. Prepare rollback and restart plans: several flaws can cause crash loops or stalled sync states.

Verification steps:

  • Confirm deployed versions are at or above the fixed releases listed above.
  • Check logs for abnormal authentication, repeated failed requests, oversized bodies, and sudden worker restarts.
  • Review SSO, OAuth, and device-flow settings for unsigned, skipped, or weakly validated paths.

Monitoring recommendations:

  • Alert on spikes in memory use, CPU saturation, and process restarts.
  • Watch for unusual DNS referral traffic, DoH/DoQ connection counts, and resolver retry loops.
  • Track account creation, group membership changes, token issuance, and unexpected project ownership changes.

Related Resources

  • Internal blog posts: add your incident response guidance, patch-triage playbook, and identity hardening notes here.
  • Official vendor advisories: OpenAM, imgproxy, Svelte/devalue, Hickory DNS, Zebra, Vikunja, and gitoxide release advisories.

Keep reading