Bug 35485 - perl-Gazelle new security issue CVE-2026-40562
Summary: perl-Gazelle new security issue CVE-2026-40562
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2026-05-07 10:40 CEST by Nicolas Salguero
Modified: 2026-05-13 09:03 CEST (History)
3 users (show)

See Also:
Source RPM: perl-Gazelle-0.490.0-10.mga10.src.rpm, perl-Gazelle-0.490.0-5.mga9.src.rpm
CVE: CVE-2026-40562
Status comment:
herman.viaene: test_passed_mga9_64+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Nicolas Salguero 2026-05-07 10:42:39 CEST

Source RPM: (none) => perl-Gazelle-0.490.0-10.mga10.src.rpm, perl-Gazelle-0.490.0-5.mga9.src.rpm
Whiteboard: (none) => MGA9TOO
CVE: (none) => CVE-2026-40562
Flags: (none) => affects_mga9+

Comment 1 Nicolas Salguero 2026-05-07 11:10:38 CEST 
For Cauldron, I asked for a freeze move.


Suggested advisory:
========================

The updated package fixes a security vulnerability:

Gazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Improper Header Precedence. (CVE-2026-40562)

References:
https://www.openwall.com/lists/oss-security/2026/05/06/7
https://datatracker.ietf.org/doc/html/rfc7230#section-3.3.3
========================

Updated package in core/updates_testing:
========================
perl-Gazelle-0.490.0-5.1.mga9

from SRPM:
perl-Gazelle-0.490.0-5.1.mga9.src.rpm

Flags: affects_mga9+ => (none)
See Also: (none) => https://bugs.mageia.org/show_bug.cgi?id=35448, https://bugs.mageia.org/show_bug.cgi?id=35464
Status: NEW => ASSIGNED
Assignee: bugsquad => qa-bugs
Version: Cauldron => 9
Whiteboard: MGA9TOO => (none)

katnatek 2026-05-10 03:36:45 CEST

Keywords: (none) => advisory

Comment 2 Herman Viaene 2026-05-11 14:50:59 CEST 
MGA9-64 server Plasma Wayland on Compaq H000SB.
No installation issues.
No wiki, no previous updates and
#  urpmq --whatrequires perl-Gazelle
perl-Gazelle
From description this is developer area, so OK on clean install.

Flags: (none) => test_passed_mga9_64+
Whiteboard: (none) => MGA9-64-OK
CC: (none) => herman.viaene

Comment 3 Thomas Andrews 2026-05-13 02:42:20 CEST 
Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Comment 4 Mageia Robot 2026-05-13 09:03:36 CEST 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2026-0130.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED
Note You need to log in before you can comment on or make changes to this bug.