Linuxsecurity Fedora NextCloud Update Addresses JSON Tampering and DoS Vulnerabilities
Article Content
- •Two critical vulnerabilities in NextCloud require immediate updates to version 33.0.4.
- •CVE-2026-42044 allows JSON response tampering via Axios, posing security risks.
- •CVE-2026-44167 enables denial of service through untrusted ASN.1 file loading.
On June 5, 2026, Fedora released updates for NextCloud addressing two critical vulnerabilities: CVE-2026-42044 and CVE-2026-44167. CVE-2026-42044 involves JSON response tampering via prototype pollution in Axios, while CVE-2026-44167 allows denial of service through untrusted ASN.1 file loading in phpseclib. Both vulnerabilities affect NextCloud versions prior to 33.0.4. Users are advised to upgrade to version 33.0.4 to mitigate these risks. The vulnerabilities were published on April 24 and May 12, 2026, respectively. The updates can be installed using the 'dnf' package manager. Immediate action is recommended to prevent potential exploitation.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Fedora and CVE-2026-42044 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Rising Incomplete Security Patches Expose Vulnerabilities to Attackers Research from Terra Security reveals that security patches are increasingly becoming incomplete, acting as guides for attackers to exploit vulnerabilities. The rate of broken fixes has surged eightfold in 2026, with patches for known exploited bugs being reported as broken four times more often than others. Specific…