{
    "summary": {
        "snap": {
            "added": [],
            "removed": [],
            "diff": []
        },
        "deb": {
            "added": [],
            "removed": [],
            "diff": [
                "base-files",
                "libssl3t64",
                "openssl",
                "openssl-provider-legacy",
                "python-apt-common",
                "python3-apt",
                "python3-distupgrade",
                "ubuntu-release-upgrader-core"
            ]
        }
    },
    "diff": {
        "deb": [
            {
                "name": "base-files",
                "from_version": {
                    "source_package_name": "base-files",
                    "source_package_version": "14ubuntu6.1",
                    "version": "14ubuntu6.1"
                },
                "to_version": {
                    "source_package_name": "base-files",
                    "source_package_version": "14ubuntu6.2",
                    "version": "14ubuntu6.2"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2164885
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * /etc/issue{,.net}, /etc/{lsb,os}-release: bump version to 26.04.1",
                            "    (LP: #2164885)",
                            ""
                        ],
                        "package": "base-files",
                        "version": "14ubuntu6.2",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2164885
                        ],
                        "author": "Oliver Reiche <oliver.reiche@canonical.com>",
                        "date": "Mon, 24 Aug 2026 12:33:48 +0200"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libssl3t64",
                "from_version": {
                    "source_package_name": "openssl",
                    "source_package_version": "3.5.5-1ubuntu3.3",
                    "version": "3.5.5-1ubuntu3.3"
                },
                "to_version": {
                    "source_package_name": "openssl",
                    "source_package_version": "3.5.5-1ubuntu3.4",
                    "version": "3.5.5-1ubuntu3.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-14456",
                        "url": "https://ubuntu.com/security/CVE-2026-14456",
                        "cve_description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit.  Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service.  CWE: CWE-770: Allocation of Resources Without Limits or Throttling  Description: The function that handles inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC channel). If no existing connection is found and the packet type is INITIAL, the function treats the packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial channel objects may grow without bounds if the application is not able to call SSL_accept() frequently enough to serve these inbound connection requests.  The issue is present since OpenSSL 3.5 when the QUIC server implementation was added.  The fix introduces a limit for pending connections. The default limit is set to 256 pending connections (waiting to be accepted by the local application). Applications may change the default by calling SSL_set_value_uint(3ossl).  FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-13 15:19:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-14457",
                        "url": "https://ubuntu.com/security/CVE-2026-14457",
                        "cve_description": "RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate",
                        "cve_priority": "low",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-18798",
                        "url": "https://ubuntu.com/security/CVE-2026-18798",
                        "cve_description": "QUIC Server May Trigger Double Free When Processing INITIAL Packet",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-54874",
                        "url": "https://ubuntu.com/security/CVE-2026-54874",
                        "cve_description": "Excessive Memory Use Buffering DTLS Records for a Future Epoch",
                        "cve_priority": "low",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-63072",
                        "url": "https://ubuntu.com/security/CVE-2026-63072",
                        "cve_description": "Heap Buffer Overflow in CMS Key Unwrapping",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-63073",
                        "url": "https://ubuntu.com/security/CVE-2026-63073",
                        "cve_description": "Untrusted Sender DN Used as Format String in CMP Response Validation",
                        "cve_priority": "low",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-63074",
                        "url": "https://ubuntu.com/security/CVE-2026-63074",
                        "cve_description": "CMP Indefinite Cache Growth of ExtraCerts",
                        "cve_priority": "low",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-63075",
                        "url": "https://ubuntu.com/security/CVE-2026-63075",
                        "cve_description": "QUIC ACK-only Packet Retention Can Cause Memory Exhaustion",
                        "cve_priority": "low",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-63076",
                        "url": "https://ubuntu.com/security/CVE-2026-63076",
                        "cve_description": "Invalid Pointer Dereference in CMP Server via Crafted protectionAlg",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-25"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-14456",
                                "url": "https://ubuntu.com/security/CVE-2026-14456",
                                "cve_description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit.  Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service.  CWE: CWE-770: Allocation of Resources Without Limits or Throttling  Description: The function that handles inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC channel). If no existing connection is found and the packet type is INITIAL, the function treats the packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial channel objects may grow without bounds if the application is not able to call SSL_accept() frequently enough to serve these inbound connection requests.  The issue is present since OpenSSL 3.5 when the QUIC server implementation was added.  The fix introduces a limit for pending connections. The default limit is set to 256 pending connections (waiting to be accepted by the local application). Applications may change the default by calling SSL_set_value_uint(3ossl).  FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-13 15:19:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-14457",
                                "url": "https://ubuntu.com/security/CVE-2026-14457",
                                "cve_description": "RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate",
                                "cve_priority": "low",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-18798",
                                "url": "https://ubuntu.com/security/CVE-2026-18798",
                                "cve_description": "QUIC Server May Trigger Double Free When Processing INITIAL Packet",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-54874",
                                "url": "https://ubuntu.com/security/CVE-2026-54874",
                                "cve_description": "Excessive Memory Use Buffering DTLS Records for a Future Epoch",
                                "cve_priority": "low",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-63072",
                                "url": "https://ubuntu.com/security/CVE-2026-63072",
                                "cve_description": "Heap Buffer Overflow in CMS Key Unwrapping",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-63073",
                                "url": "https://ubuntu.com/security/CVE-2026-63073",
                                "cve_description": "Untrusted Sender DN Used as Format String in CMP Response Validation",
                                "cve_priority": "low",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-63074",
                                "url": "https://ubuntu.com/security/CVE-2026-63074",
                                "cve_description": "CMP Indefinite Cache Growth of ExtraCerts",
                                "cve_priority": "low",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-63075",
                                "url": "https://ubuntu.com/security/CVE-2026-63075",
                                "cve_description": "QUIC ACK-only Packet Retention Can Cause Memory Exhaustion",
                                "cve_priority": "low",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-63076",
                                "url": "https://ubuntu.com/security/CVE-2026-63076",
                                "cve_description": "Invalid Pointer Dereference in CMP Server via Crafted protectionAlg",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-25"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Unbounded Memory Growth in QUIC Server Incoming Channel",
                            "    Queue",
                            "    - debian/patches/CVE-2026-14456.patch: QUIC server: limit number of pending",
                            "      QUIC channels/connections in doc/man3/SSL_get_value_uint.pod,",
                            "      include/internal/quic_port.h, include/openssl/ssl.h.in,",
                            "      ssl/quic/quic_impl.c, ssl/quic/quic_port.c, ssl/quic/quic_port_local.h,",
                            "      util/other.syms.",
                            "    - CVE-2026-14456",
                            "  * SECURITY UPDATE: RPK Server Signature Algorithm Selection Can Dereference",
                            "    a Missing Certificate",
                            "    - debian/patches/CVE-2026-14457.patch: Handle signature_algorithms_cert",
                            "      extension in key-only context in ssl/t1_lib.c, test/rpktest.c.",
                            "    - CVE-2026-14457",
                            "  * SECURITY UPDATE: QUIC Server May Trigger Double Free When Processing",
                            "    INITIAL Packet",
                            "    - debian/patches/CVE-2026-18798-pre1.patch: quic: remove unused scid from",
                            "      port_default_packet_handler in include/internal/quic_channel.h,",
                            "      ssl/quic/quic_channel.c, ssl/quic/quic_port.c.",
                            "    - debian/patches/CVE-2026-18798.patch: Avoid double free of qrx in",
                            "      port_default_packet_handler() in include/internal/quic_record_rx.h,",
                            "      ssl/quic/quic_port.c, ssl/quic/quic_record_rx.c.",
                            "    - CVE-2026-18798",
                            "  * SECURITY UPDATE: Excessive Memory Use Buffering DTLS Records for a Future",
                            "    Epoch",
                            "    - debian/patches/CVE-2026-54874-1.patch: Avoid full read buffer allocation",
                            "      when buffering DTLS next-epoch records in ssl/record/methods/dtls_meth.c.",
                            "    - debian/patches/CVE-2026-54874-2.patch: ssl/record/methods/dtls_meth.c:",
                            "      lower the unprocessed_rcds queue limit in ssl/record/methods/dtls_meth.c.",
                            "    - debian/patches/CVE-2026-54874-3.patch: ssl/record: remove dead DTLS",
                            "      processed_rcds record queue in ssl/record/methods/dtls_meth.c,",
                            "      ssl/record/methods/recmethod_local.h.",
                            "    - CVE-2026-54874",
                            "  * SECURITY UPDATE: Heap Buffer Overflow in CMS Key Unwrapping",
                            "    - debian/patches/CVE-2026-63072-1.patch: Add test for CVE-2026-63072 in",
                            "      test/cmsapitest.c, test/recipes/80-test_cmsapi.t.",
                            "    - debian/patches/CVE-2026-63072-2.patch: Fix heap buffer overflow (8-byte",
                            "      OOB write) in AES-WRAP-PAD unwrap in crypto/cms/cms_kari.c.",
                            "    - CVE-2026-63072",
                            "  * SECURITY UPDATE: Untrusted Sender DN Used as Format String in CMP Response",
                            "    Validation",
                            "    - debian/patches/CVE-2026-63073-1.patch: CMP unexpected sender DN used as",
                            "      format string in ERR_raise_data() in crypto/cmp/cmp_vfy.c.",
                            "    - debian/patches/CVE-2026-63073-2.patch: Add test for CVE-2026-63073 in",
                            "      test/cmp_vfy_test.c.",
                            "    - CVE-2026-63073",
                            "  * SECURITY UPDATE: CMP Indefinite Cache Growth of ExtraCerts",
                            "    - debian/patches/CVE-2026-63074-1.patch: Add a test for restricting growth",
                            "      in cmp cert cache in test/build.info, test/cmp_extracerts_dos_test.c,",
                            "      test/recipes/65-test_cmp_msg.t.",
                            "    - debian/patches/CVE-2026-63074-2.patch: Fix unbounded cert cache growth in",
                            "      cmp in crypto/cmp/cmp_vfy.c.",
                            "    - CVE-2026-63074",
                            "  * SECURITY UPDATE: QUIC ACK-only Packet Retention Can Cause Memory Exhaustion",
                            "    - debian/patches/CVE-2026-63075.patch: Don't store ACK-only frames in TX",
                            "      history for QUIC. in include/internal/quic_ackm.h, ssl/quic/quic_ackm.c,",
                            "      ssl/quic/quic_txp.c.",
                            "    - CVE-2026-63075",
                            "  * SECURITY UPDATE: Invalid Pointer Dereference in CMP Server via Crafted",
                            "    protectionAlg",
                            "    - debian/patches/CVE-2026-63076-1.patch: Add test for CVE-2026-63076 in",
                            "      test/cmp_protect_test.c.",
                            "    - debian/patches/CVE-2026-63076-2.patch: Fix Remote NULL deref in",
                            "      ossl_cmp_calc_protection() via crafted protectionAlg in",
                            "      crypto/cmp/cmp_protect.c.",
                            "    - CVE-2026-63076",
                            ""
                        ],
                        "package": "openssl",
                        "version": "3.5.5-1ubuntu3.4",
                        "urgency": "medium",
                        "distributions": "resolute-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Tue, 18 Aug 2026 07:56:34 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "openssl",
                "from_version": {
                    "source_package_name": "openssl",
                    "source_package_version": "3.5.5-1ubuntu3.3",
                    "version": "3.5.5-1ubuntu3.3"
                },
                "to_version": {
                    "source_package_name": "openssl",
                    "source_package_version": "3.5.5-1ubuntu3.4",
                    "version": "3.5.5-1ubuntu3.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-14456",
                        "url": "https://ubuntu.com/security/CVE-2026-14456",
                        "cve_description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit.  Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service.  CWE: CWE-770: Allocation of Resources Without Limits or Throttling  Description: The function that handles inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC channel). If no existing connection is found and the packet type is INITIAL, the function treats the packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial channel objects may grow without bounds if the application is not able to call SSL_accept() frequently enough to serve these inbound connection requests.  The issue is present since OpenSSL 3.5 when the QUIC server implementation was added.  The fix introduces a limit for pending connections. The default limit is set to 256 pending connections (waiting to be accepted by the local application). Applications may change the default by calling SSL_set_value_uint(3ossl).  FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-13 15:19:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-14457",
                        "url": "https://ubuntu.com/security/CVE-2026-14457",
                        "cve_description": "RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate",
                        "cve_priority": "low",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-18798",
                        "url": "https://ubuntu.com/security/CVE-2026-18798",
                        "cve_description": "QUIC Server May Trigger Double Free When Processing INITIAL Packet",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-54874",
                        "url": "https://ubuntu.com/security/CVE-2026-54874",
                        "cve_description": "Excessive Memory Use Buffering DTLS Records for a Future Epoch",
                        "cve_priority": "low",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-63072",
                        "url": "https://ubuntu.com/security/CVE-2026-63072",
                        "cve_description": "Heap Buffer Overflow in CMS Key Unwrapping",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-63073",
                        "url": "https://ubuntu.com/security/CVE-2026-63073",
                        "cve_description": "Untrusted Sender DN Used as Format String in CMP Response Validation",
                        "cve_priority": "low",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-63074",
                        "url": "https://ubuntu.com/security/CVE-2026-63074",
                        "cve_description": "CMP Indefinite Cache Growth of ExtraCerts",
                        "cve_priority": "low",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-63075",
                        "url": "https://ubuntu.com/security/CVE-2026-63075",
                        "cve_description": "QUIC ACK-only Packet Retention Can Cause Memory Exhaustion",
                        "cve_priority": "low",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-63076",
                        "url": "https://ubuntu.com/security/CVE-2026-63076",
                        "cve_description": "Invalid Pointer Dereference in CMP Server via Crafted protectionAlg",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-25"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-14456",
                                "url": "https://ubuntu.com/security/CVE-2026-14456",
                                "cve_description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit.  Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service.  CWE: CWE-770: Allocation of Resources Without Limits or Throttling  Description: The function that handles inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC channel). If no existing connection is found and the packet type is INITIAL, the function treats the packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial channel objects may grow without bounds if the application is not able to call SSL_accept() frequently enough to serve these inbound connection requests.  The issue is present since OpenSSL 3.5 when the QUIC server implementation was added.  The fix introduces a limit for pending connections. The default limit is set to 256 pending connections (waiting to be accepted by the local application). Applications may change the default by calling SSL_set_value_uint(3ossl).  FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-13 15:19:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-14457",
                                "url": "https://ubuntu.com/security/CVE-2026-14457",
                                "cve_description": "RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate",
                                "cve_priority": "low",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-18798",
                                "url": "https://ubuntu.com/security/CVE-2026-18798",
                                "cve_description": "QUIC Server May Trigger Double Free When Processing INITIAL Packet",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-54874",
                                "url": "https://ubuntu.com/security/CVE-2026-54874",
                                "cve_description": "Excessive Memory Use Buffering DTLS Records for a Future Epoch",
                                "cve_priority": "low",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-63072",
                                "url": "https://ubuntu.com/security/CVE-2026-63072",
                                "cve_description": "Heap Buffer Overflow in CMS Key Unwrapping",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-63073",
                                "url": "https://ubuntu.com/security/CVE-2026-63073",
                                "cve_description": "Untrusted Sender DN Used as Format String in CMP Response Validation",
                                "cve_priority": "low",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-63074",
                                "url": "https://ubuntu.com/security/CVE-2026-63074",
                                "cve_description": "CMP Indefinite Cache Growth of ExtraCerts",
                                "cve_priority": "low",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-63075",
                                "url": "https://ubuntu.com/security/CVE-2026-63075",
                                "cve_description": "QUIC ACK-only Packet Retention Can Cause Memory Exhaustion",
                                "cve_priority": "low",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-63076",
                                "url": "https://ubuntu.com/security/CVE-2026-63076",
                                "cve_description": "Invalid Pointer Dereference in CMP Server via Crafted protectionAlg",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-25"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Unbounded Memory Growth in QUIC Server Incoming Channel",
                            "    Queue",
                            "    - debian/patches/CVE-2026-14456.patch: QUIC server: limit number of pending",
                            "      QUIC channels/connections in doc/man3/SSL_get_value_uint.pod,",
                            "      include/internal/quic_port.h, include/openssl/ssl.h.in,",
                            "      ssl/quic/quic_impl.c, ssl/quic/quic_port.c, ssl/quic/quic_port_local.h,",
                            "      util/other.syms.",
                            "    - CVE-2026-14456",
                            "  * SECURITY UPDATE: RPK Server Signature Algorithm Selection Can Dereference",
                            "    a Missing Certificate",
                            "    - debian/patches/CVE-2026-14457.patch: Handle signature_algorithms_cert",
                            "      extension in key-only context in ssl/t1_lib.c, test/rpktest.c.",
                            "    - CVE-2026-14457",
                            "  * SECURITY UPDATE: QUIC Server May Trigger Double Free When Processing",
                            "    INITIAL Packet",
                            "    - debian/patches/CVE-2026-18798-pre1.patch: quic: remove unused scid from",
                            "      port_default_packet_handler in include/internal/quic_channel.h,",
                            "      ssl/quic/quic_channel.c, ssl/quic/quic_port.c.",
                            "    - debian/patches/CVE-2026-18798.patch: Avoid double free of qrx in",
                            "      port_default_packet_handler() in include/internal/quic_record_rx.h,",
                            "      ssl/quic/quic_port.c, ssl/quic/quic_record_rx.c.",
                            "    - CVE-2026-18798",
                            "  * SECURITY UPDATE: Excessive Memory Use Buffering DTLS Records for a Future",
                            "    Epoch",
                            "    - debian/patches/CVE-2026-54874-1.patch: Avoid full read buffer allocation",
                            "      when buffering DTLS next-epoch records in ssl/record/methods/dtls_meth.c.",
                            "    - debian/patches/CVE-2026-54874-2.patch: ssl/record/methods/dtls_meth.c:",
                            "      lower the unprocessed_rcds queue limit in ssl/record/methods/dtls_meth.c.",
                            "    - debian/patches/CVE-2026-54874-3.patch: ssl/record: remove dead DTLS",
                            "      processed_rcds record queue in ssl/record/methods/dtls_meth.c,",
                            "      ssl/record/methods/recmethod_local.h.",
                            "    - CVE-2026-54874",
                            "  * SECURITY UPDATE: Heap Buffer Overflow in CMS Key Unwrapping",
                            "    - debian/patches/CVE-2026-63072-1.patch: Add test for CVE-2026-63072 in",
                            "      test/cmsapitest.c, test/recipes/80-test_cmsapi.t.",
                            "    - debian/patches/CVE-2026-63072-2.patch: Fix heap buffer overflow (8-byte",
                            "      OOB write) in AES-WRAP-PAD unwrap in crypto/cms/cms_kari.c.",
                            "    - CVE-2026-63072",
                            "  * SECURITY UPDATE: Untrusted Sender DN Used as Format String in CMP Response",
                            "    Validation",
                            "    - debian/patches/CVE-2026-63073-1.patch: CMP unexpected sender DN used as",
                            "      format string in ERR_raise_data() in crypto/cmp/cmp_vfy.c.",
                            "    - debian/patches/CVE-2026-63073-2.patch: Add test for CVE-2026-63073 in",
                            "      test/cmp_vfy_test.c.",
                            "    - CVE-2026-63073",
                            "  * SECURITY UPDATE: CMP Indefinite Cache Growth of ExtraCerts",
                            "    - debian/patches/CVE-2026-63074-1.patch: Add a test for restricting growth",
                            "      in cmp cert cache in test/build.info, test/cmp_extracerts_dos_test.c,",
                            "      test/recipes/65-test_cmp_msg.t.",
                            "    - debian/patches/CVE-2026-63074-2.patch: Fix unbounded cert cache growth in",
                            "      cmp in crypto/cmp/cmp_vfy.c.",
                            "    - CVE-2026-63074",
                            "  * SECURITY UPDATE: QUIC ACK-only Packet Retention Can Cause Memory Exhaustion",
                            "    - debian/patches/CVE-2026-63075.patch: Don't store ACK-only frames in TX",
                            "      history for QUIC. in include/internal/quic_ackm.h, ssl/quic/quic_ackm.c,",
                            "      ssl/quic/quic_txp.c.",
                            "    - CVE-2026-63075",
                            "  * SECURITY UPDATE: Invalid Pointer Dereference in CMP Server via Crafted",
                            "    protectionAlg",
                            "    - debian/patches/CVE-2026-63076-1.patch: Add test for CVE-2026-63076 in",
                            "      test/cmp_protect_test.c.",
                            "    - debian/patches/CVE-2026-63076-2.patch: Fix Remote NULL deref in",
                            "      ossl_cmp_calc_protection() via crafted protectionAlg in",
                            "      crypto/cmp/cmp_protect.c.",
                            "    - CVE-2026-63076",
                            ""
                        ],
                        "package": "openssl",
                        "version": "3.5.5-1ubuntu3.4",
                        "urgency": "medium",
                        "distributions": "resolute-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Tue, 18 Aug 2026 07:56:34 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "openssl-provider-legacy",
                "from_version": {
                    "source_package_name": "openssl",
                    "source_package_version": "3.5.5-1ubuntu3.3",
                    "version": "3.5.5-1ubuntu3.3"
                },
                "to_version": {
                    "source_package_name": "openssl",
                    "source_package_version": "3.5.5-1ubuntu3.4",
                    "version": "3.5.5-1ubuntu3.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-14456",
                        "url": "https://ubuntu.com/security/CVE-2026-14456",
                        "cve_description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit.  Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service.  CWE: CWE-770: Allocation of Resources Without Limits or Throttling  Description: The function that handles inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC channel). If no existing connection is found and the packet type is INITIAL, the function treats the packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial channel objects may grow without bounds if the application is not able to call SSL_accept() frequently enough to serve these inbound connection requests.  The issue is present since OpenSSL 3.5 when the QUIC server implementation was added.  The fix introduces a limit for pending connections. The default limit is set to 256 pending connections (waiting to be accepted by the local application). Applications may change the default by calling SSL_set_value_uint(3ossl).  FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-13 15:19:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-14457",
                        "url": "https://ubuntu.com/security/CVE-2026-14457",
                        "cve_description": "RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate",
                        "cve_priority": "low",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-18798",
                        "url": "https://ubuntu.com/security/CVE-2026-18798",
                        "cve_description": "QUIC Server May Trigger Double Free When Processing INITIAL Packet",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-54874",
                        "url": "https://ubuntu.com/security/CVE-2026-54874",
                        "cve_description": "Excessive Memory Use Buffering DTLS Records for a Future Epoch",
                        "cve_priority": "low",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-63072",
                        "url": "https://ubuntu.com/security/CVE-2026-63072",
                        "cve_description": "Heap Buffer Overflow in CMS Key Unwrapping",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-63073",
                        "url": "https://ubuntu.com/security/CVE-2026-63073",
                        "cve_description": "Untrusted Sender DN Used as Format String in CMP Response Validation",
                        "cve_priority": "low",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-63074",
                        "url": "https://ubuntu.com/security/CVE-2026-63074",
                        "cve_description": "CMP Indefinite Cache Growth of ExtraCerts",
                        "cve_priority": "low",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-63075",
                        "url": "https://ubuntu.com/security/CVE-2026-63075",
                        "cve_description": "QUIC ACK-only Packet Retention Can Cause Memory Exhaustion",
                        "cve_priority": "low",
                        "cve_public_date": "2026-08-25"
                    },
                    {
                        "cve": "CVE-2026-63076",
                        "url": "https://ubuntu.com/security/CVE-2026-63076",
                        "cve_description": "Invalid Pointer Dereference in CMP Server via Crafted protectionAlg",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-25"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-14456",
                                "url": "https://ubuntu.com/security/CVE-2026-14456",
                                "cve_description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit.  Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service.  CWE: CWE-770: Allocation of Resources Without Limits or Throttling  Description: The function that handles inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC channel). If no existing connection is found and the packet type is INITIAL, the function treats the packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial channel objects may grow without bounds if the application is not able to call SSL_accept() frequently enough to serve these inbound connection requests.  The issue is present since OpenSSL 3.5 when the QUIC server implementation was added.  The fix introduces a limit for pending connections. The default limit is set to 256 pending connections (waiting to be accepted by the local application). Applications may change the default by calling SSL_set_value_uint(3ossl).  FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-13 15:19:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-14457",
                                "url": "https://ubuntu.com/security/CVE-2026-14457",
                                "cve_description": "RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate",
                                "cve_priority": "low",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-18798",
                                "url": "https://ubuntu.com/security/CVE-2026-18798",
                                "cve_description": "QUIC Server May Trigger Double Free When Processing INITIAL Packet",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-54874",
                                "url": "https://ubuntu.com/security/CVE-2026-54874",
                                "cve_description": "Excessive Memory Use Buffering DTLS Records for a Future Epoch",
                                "cve_priority": "low",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-63072",
                                "url": "https://ubuntu.com/security/CVE-2026-63072",
                                "cve_description": "Heap Buffer Overflow in CMS Key Unwrapping",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-63073",
                                "url": "https://ubuntu.com/security/CVE-2026-63073",
                                "cve_description": "Untrusted Sender DN Used as Format String in CMP Response Validation",
                                "cve_priority": "low",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-63074",
                                "url": "https://ubuntu.com/security/CVE-2026-63074",
                                "cve_description": "CMP Indefinite Cache Growth of ExtraCerts",
                                "cve_priority": "low",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-63075",
                                "url": "https://ubuntu.com/security/CVE-2026-63075",
                                "cve_description": "QUIC ACK-only Packet Retention Can Cause Memory Exhaustion",
                                "cve_priority": "low",
                                "cve_public_date": "2026-08-25"
                            },
                            {
                                "cve": "CVE-2026-63076",
                                "url": "https://ubuntu.com/security/CVE-2026-63076",
                                "cve_description": "Invalid Pointer Dereference in CMP Server via Crafted protectionAlg",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-25"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: Unbounded Memory Growth in QUIC Server Incoming Channel",
                            "    Queue",
                            "    - debian/patches/CVE-2026-14456.patch: QUIC server: limit number of pending",
                            "      QUIC channels/connections in doc/man3/SSL_get_value_uint.pod,",
                            "      include/internal/quic_port.h, include/openssl/ssl.h.in,",
                            "      ssl/quic/quic_impl.c, ssl/quic/quic_port.c, ssl/quic/quic_port_local.h,",
                            "      util/other.syms.",
                            "    - CVE-2026-14456",
                            "  * SECURITY UPDATE: RPK Server Signature Algorithm Selection Can Dereference",
                            "    a Missing Certificate",
                            "    - debian/patches/CVE-2026-14457.patch: Handle signature_algorithms_cert",
                            "      extension in key-only context in ssl/t1_lib.c, test/rpktest.c.",
                            "    - CVE-2026-14457",
                            "  * SECURITY UPDATE: QUIC Server May Trigger Double Free When Processing",
                            "    INITIAL Packet",
                            "    - debian/patches/CVE-2026-18798-pre1.patch: quic: remove unused scid from",
                            "      port_default_packet_handler in include/internal/quic_channel.h,",
                            "      ssl/quic/quic_channel.c, ssl/quic/quic_port.c.",
                            "    - debian/patches/CVE-2026-18798.patch: Avoid double free of qrx in",
                            "      port_default_packet_handler() in include/internal/quic_record_rx.h,",
                            "      ssl/quic/quic_port.c, ssl/quic/quic_record_rx.c.",
                            "    - CVE-2026-18798",
                            "  * SECURITY UPDATE: Excessive Memory Use Buffering DTLS Records for a Future",
                            "    Epoch",
                            "    - debian/patches/CVE-2026-54874-1.patch: Avoid full read buffer allocation",
                            "      when buffering DTLS next-epoch records in ssl/record/methods/dtls_meth.c.",
                            "    - debian/patches/CVE-2026-54874-2.patch: ssl/record/methods/dtls_meth.c:",
                            "      lower the unprocessed_rcds queue limit in ssl/record/methods/dtls_meth.c.",
                            "    - debian/patches/CVE-2026-54874-3.patch: ssl/record: remove dead DTLS",
                            "      processed_rcds record queue in ssl/record/methods/dtls_meth.c,",
                            "      ssl/record/methods/recmethod_local.h.",
                            "    - CVE-2026-54874",
                            "  * SECURITY UPDATE: Heap Buffer Overflow in CMS Key Unwrapping",
                            "    - debian/patches/CVE-2026-63072-1.patch: Add test for CVE-2026-63072 in",
                            "      test/cmsapitest.c, test/recipes/80-test_cmsapi.t.",
                            "    - debian/patches/CVE-2026-63072-2.patch: Fix heap buffer overflow (8-byte",
                            "      OOB write) in AES-WRAP-PAD unwrap in crypto/cms/cms_kari.c.",
                            "    - CVE-2026-63072",
                            "  * SECURITY UPDATE: Untrusted Sender DN Used as Format String in CMP Response",
                            "    Validation",
                            "    - debian/patches/CVE-2026-63073-1.patch: CMP unexpected sender DN used as",
                            "      format string in ERR_raise_data() in crypto/cmp/cmp_vfy.c.",
                            "    - debian/patches/CVE-2026-63073-2.patch: Add test for CVE-2026-63073 in",
                            "      test/cmp_vfy_test.c.",
                            "    - CVE-2026-63073",
                            "  * SECURITY UPDATE: CMP Indefinite Cache Growth of ExtraCerts",
                            "    - debian/patches/CVE-2026-63074-1.patch: Add a test for restricting growth",
                            "      in cmp cert cache in test/build.info, test/cmp_extracerts_dos_test.c,",
                            "      test/recipes/65-test_cmp_msg.t.",
                            "    - debian/patches/CVE-2026-63074-2.patch: Fix unbounded cert cache growth in",
                            "      cmp in crypto/cmp/cmp_vfy.c.",
                            "    - CVE-2026-63074",
                            "  * SECURITY UPDATE: QUIC ACK-only Packet Retention Can Cause Memory Exhaustion",
                            "    - debian/patches/CVE-2026-63075.patch: Don't store ACK-only frames in TX",
                            "      history for QUIC. in include/internal/quic_ackm.h, ssl/quic/quic_ackm.c,",
                            "      ssl/quic/quic_txp.c.",
                            "    - CVE-2026-63075",
                            "  * SECURITY UPDATE: Invalid Pointer Dereference in CMP Server via Crafted",
                            "    protectionAlg",
                            "    - debian/patches/CVE-2026-63076-1.patch: Add test for CVE-2026-63076 in",
                            "      test/cmp_protect_test.c.",
                            "    - debian/patches/CVE-2026-63076-2.patch: Fix Remote NULL deref in",
                            "      ossl_cmp_calc_protection() via crafted protectionAlg in",
                            "      crypto/cmp/cmp_protect.c.",
                            "    - CVE-2026-63076",
                            ""
                        ],
                        "package": "openssl",
                        "version": "3.5.5-1ubuntu3.4",
                        "urgency": "medium",
                        "distributions": "resolute-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Tue, 18 Aug 2026 07:56:34 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "python-apt-common",
                "from_version": {
                    "source_package_name": "python-apt",
                    "source_package_version": "3.1.0ubuntu1",
                    "version": "3.1.0ubuntu1"
                },
                "to_version": {
                    "source_package_name": "python-apt",
                    "source_package_version": "3.1.0ubuntu1.1",
                    "version": "3.1.0ubuntu1.1"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2164900
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Refresh mirror list (LP: #2164900)",
                            ""
                        ],
                        "package": "python-apt",
                        "version": "3.1.0ubuntu1.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2164900
                        ],
                        "author": "Paride Legovini <paride@ubuntu.com>",
                        "date": "Mon, 24 Aug 2026 14:44:07 +0200"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "python3-apt",
                "from_version": {
                    "source_package_name": "python-apt",
                    "source_package_version": "3.1.0ubuntu1",
                    "version": "3.1.0ubuntu1"
                },
                "to_version": {
                    "source_package_name": "python-apt",
                    "source_package_version": "3.1.0ubuntu1.1",
                    "version": "3.1.0ubuntu1.1"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2164900
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Refresh mirror list (LP: #2164900)",
                            ""
                        ],
                        "package": "python-apt",
                        "version": "3.1.0ubuntu1.1",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2164900
                        ],
                        "author": "Paride Legovini <paride@ubuntu.com>",
                        "date": "Mon, 24 Aug 2026 14:44:07 +0200"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "python3-distupgrade",
                "from_version": {
                    "source_package_name": "ubuntu-release-upgrader",
                    "source_package_version": "1:26.04.22",
                    "version": "1:26.04.22"
                },
                "to_version": {
                    "source_package_name": "ubuntu-release-upgrader",
                    "source_package_version": "1:26.04.23",
                    "version": "1:26.04.23"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2164900
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Refresh mirror list (LP: #2164900)",
                            ""
                        ],
                        "package": "ubuntu-release-upgrader",
                        "version": "1:26.04.23",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2164900
                        ],
                        "author": "Paride Legovini <paride@ubuntu.com>",
                        "date": "Mon, 24 Aug 2026 16:06:51 +0200"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "ubuntu-release-upgrader-core",
                "from_version": {
                    "source_package_name": "ubuntu-release-upgrader",
                    "source_package_version": "1:26.04.22",
                    "version": "1:26.04.22"
                },
                "to_version": {
                    "source_package_name": "ubuntu-release-upgrader",
                    "source_package_version": "1:26.04.23",
                    "version": "1:26.04.23"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2164900
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Refresh mirror list (LP: #2164900)",
                            ""
                        ],
                        "package": "ubuntu-release-upgrader",
                        "version": "1:26.04.23",
                        "urgency": "medium",
                        "distributions": "resolute",
                        "launchpad_bugs_fixed": [
                            2164900
                        ],
                        "author": "Paride Legovini <paride@ubuntu.com>",
                        "date": "Mon, 24 Aug 2026 16:06:51 +0200"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            }
        ],
        "snap": []
    },
    "added": {
        "deb": [],
        "snap": []
    },
    "removed": {
        "deb": [],
        "snap": []
    },
    "notes": "Changelog diff for Ubuntu 26.04 resolute image from release image serial 20260821 to 20260827",
    "from_series": "resolute",
    "to_series": "resolute",
    "from_serial": "20260821",
    "to_serial": "20260827",
    "from_manifest_filename": "release_manifest.previous",
    "to_manifest_filename": "manifest.current"
}