# changelog

author: chengyechun<chengyechun1@huawei.com> - 32:9.18.21-3
changelog:
  - Type:CVE
  - CVE:CVE-2024-0760,CVE-2024-1737,CVE-2024-1975,CVE-2024-4076
  - SUG:NA
  - DESC:fix CVE-2024-0760,CVE-2024-1737,CVE-2024-1975,CVE-2024-4076


author: chengyechun<chengyechun1@huawei.com> - 32:9.18.21-4
changelog:
  - Type:CVE
  - CVE:CVE-2024-11187,CVE-2024-12705
  - SUG:NA
  - DESC:fix CVE-2024-111878 and CVE-2024-12705


author: tangce<tangce1@huawei.com> - 32:9.18.21-5
changelog:
  - Type:CVE
  - CVE:CVE-2025-8677,CVE-2025-40778,CVE-2025-40780
  - SUG:NA
  - DESC:fix CVE-2025-8677,CVE-2025-40778,CVE-2025-40780


author: tangce <tangce1@h-partners.com> - 32:9.18.21-8
changelog:
  - Type:CVE
  - CVE:CVE-2026-3039,CVE-2026-3592,CVE-2026-5946
  - SUG:NA
  - DESC:fix CVE-2026-3039,CVE-2026-3592,CVE-2026-5946


author: tangce <tangce1@h-partners.com> - 32:9.18.21-9
changelog:
  - Type:CVE
  - CVE:CVE-2026-10822,CVE-2026-11331,CVE-2026-12617,CVE-2026-13204
  - SUG:NA
  - DESC:fix CVE-2026-10822,CVE-2026-11331,CVE-2026-12617,CVE-2026-13204


author: tangce <tangce1@h-partners.com> - 32:9.18.21-11
changelog:
  - Type:CVE
  - CVE:CVE-2026-10723,CVE-2026-11721,CVE-2026-13321
  - SUG:NA
  - DESC:fix CVE-2026-10723,CVE-2026-11721,CVE-2026-13321


author: yueyuankun <yueyuankun@kylinos.cn> - 3.8.2-4
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:fix syntax error on SymbolKind.toString method
         fix interface syntax error


author: lingsheng <lingsheng1@h-partners.com> - 3.7.1-7
changelog:
  - Type:CVE
  - ID:CVE-2025-5914,CVE-2025-5915,CVE-2025-5916,CVE-2025-5917,CVE-2025-5918
  - SUG:NA
  - DESC:fix CVE-2025-5914 CVE-2025-5915 CVE-2025-5916 CVE-2025-5917 CVE-2025-5918


author: lijian <lijian2@kylinos.cn> - 1:1.36.1-21
changelog:
  - Type:cves
  - ID:CVE-2026-38754
  - SUG:NA
  - DESC:re-fix CVE-2026-38754, clear stale IFS state on expansion error


author: zhaoyonghao10 <zhaoyonghao10@h-partners.com> - 2.78.3-16
changelog:
  - apply 3 patches: backport-Fix-a-buffer-leak-when-finishing-connecting.patch, backport-Add-thread-pool-stress-test-to-task-c.patch, backport-Cleanup-trailing-spaces-task-c.patch


author: zhusicong <zhusicong@h-partners> - 2.78.3-17
changelog:
  - fix CVE-2026-58010, CVE-2026-58011, CVE-2026-58012, CVE-2026-58013, CVE-2026-58014, CVE-2026-58015, CVE-2026-58016


author: yaoxin <yao_xin001@hoperun.com> - 1.14.5-1
changelog:
  - Update to 1.14.5:
    * Added signed Windows msi binary and signed Apple dmg binary files.
    * Moved examples to the HDF5Examples folder in the source tree.
    * Added support for using zlib-ng package as the zlib library
    * Disable CMake UNITY_BUILD for hdf5
    * Removed "function/code stack" debugging configuration option
    * Added configure options for enabling/disabling non-standard programming language features
    * Added the CMake variable HDF5_ENABLE_ROS3_VFD to the HDF5 CMake config
      file hdf5-config.cmake. This allows it to easily detect if the library
      has been built with or without read-only S3 functionality.
    * Fixed many CVE:
      CVE-2024-29157,CVE-2024-29158,CVE-2024-29159,CVE-2024-29160,CVE-2024-29161,CVE-2024-29162
      CVE-2024-29163,CVE-2024-29164,CVE-2024-29165,CVE-2024-29166,CVE-2024-32605,CVE-2024-32606
      CVE-2024-32607,CVE-2024-32608,CVE-2024-32609,CVE-2024-32610,CVE-2024-32611,CVE-2024-32612
      CVE-2024-32613,CVE-2024-32614,CVE-2024-32615,CVE-2024-32616,CVE-2024-32617,CVE-2024-32618
      CVE-2024-32619,CVE-2024-32620,CVE-2024-32621,CVE-2024-32622,CVE-2024-32623,CVE-2024-32624
      CVE-2024-33873,CVE-2024-33874,CVE-2024-33875,CVE-2024-33876,CVE-2024-33877,CVE-2018-13871
      CVE-2018-13875,CVE-2018-14034


author: Funda Wang <fundawang@yeah.net> - 1.14.5-2
changelog:
  - add patches from azure linux for fixing CVE-2025-2153, CVE-2025-2310,
    CVE-2025-2914, CVE-2025-2926, CVE-2025-6816, CVE-2025-2925,
    CVE-2025-2924, CVE-2025-44905, CVE-2025-6269, CVE-2025-6750,
    CVE-2025-6857, CVE-2025-7067, CVE-2025-7068, CVE-2025-6858,
    CVE-2025-2923, CVE-2025-2913, CVE-2025-6516, CVE-2025-6818,
    CVE-2025-6817, CVE-2025-6856, CVE-2025-7069


author: yangyingqing <yangyingqing@h-partners.com> -1:11.0.31.11-0
changelog:
  - update to 11.0.31+11(GA)
  - modify G1-interate-region-by-bitmap-rather-than-obj-size-in.patch
  - delete fix-libpng-API-allow-reading-up-to-1012-bytes-beyond-the-png-sRGB-bbase-array-bug.patch
  - delete fix-libpng-CVE-2026-22695.patch
  - delete 8373476-tz-Update-Timezone-Data-to-2025c.patch
  - delete fix-libpng-CVE-2026-25646.patch
  - add Use-stlr-for-putOrdered.patch


author: yangyingqing <yangyingqing@h-partners.com> -1:11.0.32.9-0
changelog:
  - update to 11.0.32+9(GA)
  - delete fix-zlib-CVE-2026-27171.patch
  - modify G1-iterate-region-by-bitmap-rather-than-obj-size-in.patch
  - modify delete_expired_certificates.patch
  - modify Add-KAE-implementation.patch


author: yaoxin <1024769339@qq.com> - 1.28-3
changelog:
  - Fix CVE-2026-15811, CVE-2026-15812 and CVE-2026-15813
  - Add patches to make the tests of previous fixes run on 1.28


author: yuanchao <1050706328@qq.com> - 2.1.12-13
changelog:
  - Fix function undeclared,incompatible pointer and parameter lack in 'add-testcases-for-event.c-apis.patch',support clang build


author: andy <liuyang01@kylinos.cn> - 2.1.12-14
changelog:
  - Fix leak in evbuffer_add_file() on empty files
  - evthread: fix NULL dereference in evthread_setup_global_lock_()
  - Fix potential null dereference in http-server


author: shixuantong <shixuantong1@h-partners.com> - 2.1.12-15
changelog:
  - fix: arc4_getword integer overflow, detected by -fsanitize=undefined
  - Fix divide-by-zero in ev_token_bucket_get_tick_
  - fixed missing check for null after strdup in evutil_inet_pton_scope
  - Fix integer-overflow in ev_token_bucket_cfg_new
  - Fix integer overflow in HTTP version
  - Fix potential Null pointer dereference in bufferevent_openssl.c
  - Fix potential Null pointer dereference in dns-example.c
  - Fix potential Null pointer dereference in event-read-fifo.c
  - Fix unlikely (for libevent) UB in HT_GROW()


author: Funda Wang <fundawang@yeah.net> - 2.1.12-16
changelog:
  - Don't use deprecated functions when building against OpenSSL 3.0
  - fix linkage of shared libraries


author: fly_fzc <2385803914@qq.com> - 2.1.12-17
changelog:
  - fix CVE-2026-63387 CVE-2026-63388 CVE-2026-63384 CVE-2026-63381
        CVE-2026-63385 CVE-2026-63382 CVE-2026-63379 CVE-2026-63383


author: yaoxin <1024769339@qq.com> - 3.1.52-1
changelog:
  - Update to 3.1.52 for fix CVEs: CVE-2026-67322, CVE-2026-67323,
    CVE-2026-67324, CVE-2026-67325 and CVE-2026-67326


author: wangkai <13474090681@163.com> - 3.13.5-1
changelog:
  - Update to 3.13.5
    * Fix CVE-2026-22815, CVE-2026-34513, CVE-2026-34514, CVE-2026-34516,
      CVE-2026-34517, CVE-2026-34518, CVE-2026-34519, CVE-2026-34520, CVE-2026-34525


author: yaoxin <1024769339@qq.com> - 3.14.1-1
changelog:
  - Update to 3.14.1 for fix CVEs: CVE-2026-54273,CVE-2026-54274,CVE-2026-54275
    CVE-2026-54276,CVE-2026-54277,CVE-2026-54278,CVE-2026-54279,CVE-2026-54280


author: Qin Fandong <qinfandong@kylinos.cn> - 3.11.6-39
changelog:
  - Type:CVE
  - CVE:CVE-2026-7210
  - SUG:NA
  - DESC:fix CVE-2026-7210: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible


author: Qin Fandong <qinfandong@kylinos.cn> - 3.11.6-40
changelog:
  - Type:CVE
  - CVE:CVE-2026-6879
  - SUG:NA
  - DESC:fix CVE-2026-6879: avoid quadratic behavior in xml.etree.ElementPath index predicates


author: gaihuiying <eaglegai@163.com> - 1.17.1-15
changelog:
  - Type:CVE
  - CVE:CVE-2025-11411
  - SUG:NA
  - DESC:Additional fix for CVE-2025-11411 to include YXDOMAIN and non-referral nodata answers in the mitigation


author: gaihuiying <eaglegai@163.com> - 1.17.1-16
changelog:
  - Type:cves
  - CVE:CVE-2026-33278,CVE-2026-42944,CVE-2026-41292,CVE-2026-42959,CVE-2026-42960
  - SUG:NA
  - DESC:fix CVE-2026-33278,CVE-2026-42944,CVE-2026-41292,CVE-2026-42959,CVE-2026-42960


author: gaihuiying <eaglegai@163.com> - 1.17.1-17
changelog:
  - Type:cves
  - CVE:CVE-2026-32792,CVE-2026-42923,CVE-2026-40622,CVE-2026-42534,CVE-2026-44390,CVE-2026-44608
  - SUG:NA
  - DESC:fix CVE-2026-32792,CVE-2026-42923,CVE-2026-40622,CVE-2026-42534,CVE-2026-44390,CVE-2026-44608


author: gaihuiying <eaglegai@163.com> - 1.17.1-19
changelog:
  - Type:CVE
  - CVE:CVE-2026-46582,CVE-2026-40691,CVE-2026-42955,CVE-2026-44621,CVE-2026-44687,CVE-2026-44690,CVE-2026-50046,CVE-2026-50243,CVE-2026-50248,CVE-2026-50251,CVE-2026-55708,CVE-2026-55717,CVE-2026-55990,CVE-2026-56416
  - SUG:NA
  - DESC:fix CVE-2026-46582,CVE-2026-40691,CVE-2026-42955,CVE-2026-44621,CVE-2026-44687,CVE-2026-44690,CVE-2026-50046,CVE-2026-50243,CVE-2026-50248,CVE-2026-50251,CVE-2026-55708,CVE-2026-55717,CVE-2026-55990,CVE-2026-56416


author: huangyan <huangyan@cdjrlc.com> - 11:8.2.0-50
changelog:
  - Add qemu-user package for arm, aarch64, riscv32, riscv64 targets
  - Add user-static, user-binfmt package for statically-linked QEMU user emulator


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-51
changelog:
  - trace: Add trace to measure hot migrate downtime
  - backends: Add support of one guest numa node alloc memory from multi host nodes


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-53
changelog:
  - net: pad packets to minimum length in qemu_receive_packet() (CVE-2025-12464)
  - io: release active GSource in TLS channel finalizer
  - io: move websock resource release to close method
  - io: fix use after free in websocket handshake code(CVE-2025-11234)
  - hw/i386/kvm: fix PIRQ bounds check in xen_physdev_map_pirq()(CVE-2026-0665)


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-54
changelog:
  - MAINTAINERS: add me as maintainer to virtio-snd
  - virtio-snd: remove TODO comments
  - virtio-snd: handle 5.14.6.2 for PCM_INFO properly(CVE-2026-3196)
  - virtio-snd: fix max_size bounds check in input cb(CVE-2026-3195)
  - virtio-snd: tighten read amount in in_cb(CVE-2026-3195)


author: Pengrui Zhang <zhangpengrui@huawei.com> - 11:8.2.0-55
changelog:
  - target/arm: add kunpeng 920 V1 support
  - target/arm: add kunpeng 950 V1 support
  - target/arm: add kunpeng 920 V2 support
  - hw/virtio/virtio-crypto: verify asym request size(CVE-2025-14876)
  - cryptodev-builtin: Limit the maximum size(CVE-2025-14876)
  - block/vmdk: fix OOB read in vmdk_read_extent()(CVE-2026-2243)
  - lsi53c895a: keep a reference to the device while SCRIPTS execute(CVE-2024-6519)


author: Junqi Ma <majunqi1@huawei.com> - 11:8.2.0-56
changelog:
  - virtio-gpu: fix overflow check when allocating 2d image (CVE-2026-3886)
  - ui/vnc: fix OOB read updating VNC update frequency stats(CVE-2026-48003)
  - virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check (CVE-2026-48914)


author: Fei Xu <xufei30@huawei.com> - 11:8.2.0-57
changelog:
  - hw/net/rocker_of_dpa: Check group ID pointers are not NULL(CVE-2022-36648)
  - hw/net/rocker_of_dpa: Avoid unaligned accesses in _of_dpa_flow_match()
  - virtio-scsi: pass the same cdb_size to virtio_scsi_pop_req and virtio_scsi_handle_cmd_req_prepare(CVE-2026-5763)


author: Fei Xu <xufei30@huawei.com> - 11:8.2.0-58
changelog:
  - tcg: move free_tcg_plugin_context to the correct macro range
  - hw/arm/virt: Fix build error on ARM
  - virtio-blk: fix zone report buffer out-of-memory (CVE-2026-5761)
  - iotests/copy-before-write: lower throttle rate to fix cbw-timeout flakiness


author: Fei Xu <xufei30@huawei.com> - 11:8.2.0-59
changelog:
  - hw/usb/hcd-xhci-sysbus: Fix OOB heap access in xhci_sysbus_intr_raise() (CVE-2026-16043)
  - hw/9pfs: add xattr FID limit to prevent memory exhaustion (CVE-2026-8348)
  - ui/vnc: validate SetPixelFormat field ranges (CVE-2026-15578)
  - usbredir: fix use-after-free on buffered bulk packet overflow (CVE-2026-15705)
  - usbredir: fix infinite loop and SIGFPE with zero max_packet_size (CVE-2026-63319)
  - hw/9pfs: add response_buffer_size transport callback
  - 9pfs/virtio: implement response_buffer_size callback
  - 9pfs/xen: implement response_buffer_size callback
  - hw/9pfs: cap Treaddir allocation (CVE-2026-9238)
  - ui/vnc: fix OOB write in VNC stats array (CVE-2026-48002)
  - ui/vnc: fix OOB write in lossy rect worker code (CVE-2026-48002)
  - ui/vnc: fix OOB write in vnc_refresh_lossy_rect (CVE-2026-48002)
  - ui/vnc: fix out-of-bounds write in lossy refresh dirty marking (CVE-2026-61475)
  - ui/vnc: remove redundant rows computation
  - hw/9pfs: fix O_TRUNC bypass on read-only export (CVE-2026-63318)


author: yaoxin <1024769339@qq.com> - 1:9.0.117-1
changelog:
  - Update to 9.0.117 for fix CVEs: CVE-2026-24880, CVE-2026-25854,
    CVE-2026-29129, CVE-2026-29145, CVE-2026-29146, CVE-2026-32990,
    CVE-2026-34483, CVE-2026-34486, CVE-2026-34487, CVE-2026-34500


author: yaoxin <1024769339@qq.com> - 1:9.0.118-1
changelog:
  - Update to 9.0.118 for fix CVEs: CVE-2026-41284, CVE-2026-41293,
    CVE-2026-42498, CVE-2026-43512, CVE-2026-43513, CVE-2026-43514,
    CVE-2026-43515
  - Fix tomcat-jsvc stop failed


author: yaoxin <1024769339@qq.com> - 1:9.0.119-1
changelog:
  - Update to 9.0.119 for fix CVEs: CVE-2026-50229, CVE-2026-53404,
    CVE-2026-53434, CVE-2026-55276, CVE-2026-55955, CVE-2026-55956,
    CVE-2026-55957


