SECURITY ANNOUNCEMENT

CVE-2026-99019

23 October 2026

Drop the reference as soon as the name has been printed, and remove the now unused dt[] array. That also removes the array leaked when ch_probe() fails The same leak was reported with an RFC patch in 2022, which was not merged.

Introduced

2.6.13daa6eda65a53e5addf86c6bc829129ff51b08bda

Fixed releases

6.12.114cef2cedb6f7a394b278775b3d6ffb9b20ecd61db

6.18.58a34a230ccea1b8b667ae59dca11295a2c8f81738

6.6.160ec6ecab1b7577ae555ee6b81480814d123dd9ec0

7.2.111d35a17f1c2ed4154731895694a1a3557f0da766

7.327c0f718d3b3c99e6d315308e95d987d0382a8a8

View source announcement ↗