Hi, Both entries say the Red Hat bugs had no details, and neither names a fix. Upstream's git history has them. This is from reading commits and Debian's sources; nothing was built or run, and I did not run the upstream tests.
CVE-2026-86344 (389-ds-base, #1149732) The fix names the CVE: "Issue 7919 - CVE-2026-86344 - Fix worker pool exhaustion via partial LDAP messages (DoS)", commit 1b26a640 on main, changing ldap/servers/slapd/connection.c plus a new test. There is a follow-up under the same issue, cb5e5776, "Issue 7919 - Coordinate PDU writer handoff and buffered reads". The first commit's description matches the CVE, and the follow-up says it stops repeated reader reacquisition from delaying result flushing, so it looks like it should be taken too. Branch commits (fix, then follow-up): 3.3: 71b781fd, 28b6d8af 3.1: cfa3971e, 9ae45bc6 2.2: 1e612cde, 3bb70b59 2.0: d38391cc, b73ee925 These are not in any 3.3.x tag yet: 71b781fd is not in 389-ds-base-3.3.1. None of 3.3.1-3 (sid), 3.1.2+dfsg1-1+deb13u1 (trixie), 2.3.1+dfsg1-1+deb12u1 (bookworm) or 1.4.4.11-2 (bullseye) contains the fix's code, and none has a debian/patches entry for it. The connection.c part of 1b26a640 applies in a dry run to all four with line offsets and no fuzz. I did not dry-run the follow-up or the branch commits against Debian's versions. CVE-2026-89091 (ansible-core) The fix is ed42c495 on devel, "ansible-galaxy collection install - fix validating paths before extraction (#87660)". It adds the containment check for directory members and stops using os.path.abspath() on link targets. I matched it to the CVE from the description and the code; the commit does not name the CVE. Backports are in v2.22.0 (5f4105bc), v2.21.6 (74dbbd01), v2.20.11 (0eb9be1c) and v2.19.15 (929d4cbf). There is no such commit on stable-2.18 or stable-2.14. - ansible-core 2.22.0-1 2.22.0-1 has the new check; 2.22.0~beta2-1 (forky) does not. 2.19.11-0+deb13u1 (trixie) and 2.14.18-0+deb12u2 (bookworm) still have the os.path.abspath(os.path.join(b_link_dir, b_path)) line and no new check, so they look affected. Regards, Sumit Verma
