HIGH 7.5 NVD

CVE-2026-49846

libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()` in libks's HTTP request parser fails to reject URIs whose

libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()` in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with embedded ".." sequences intact, enabling path traversal in any consumer that later joins the URI with a filesystem path. Version 2.0.11 patches the issue.

References

https://github.com/signalwire/libks/security/advisories/GHSA-684h-wjm9-2p6j

Published: 2026-09-11 · Source: NVD · Feed updated: 2026-09-11

This high severity vulnerability with a CVSS score of 7.5 was published on 2026-09-11 via NVD.

vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.