SECURITY ANNOUNCEMENT

CVE-2026-99021

23 October 2026

entries, so that it shares the array's lifetime and callers still have nothing extra to free. That also retires the fixed 64 byte stack buffer the names were assembled in, which is_supply_name() never bounded the

Introduced

6.227b9ecc7a9ba1d0014779bfe5a6dbf630899c6e7

Fixed releases

6.18.5782ac8c4939bdbd064b4f54a580fbe4baf0d60e41

7.2.11a3384ec2516a7cc567bd7c09029282494469b247

7.3e2151c29cec73f6cc70abf1c7cbc7b9b202489f5

View source announcement ↗