Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Loki package accepts oversized RSA and DSA keys

published 23 days ago
Summary

The Loki software does not check the size of RSA or DSA public‑key values, allowing unusually large keys to be processed. This could be used to cause the program to run out of memory or crash, potentially disrupting services. Update to a patched version of Loki or apply the vendor’s recommended fix as soon as possible.

What to do
  • Update cleanstart loki to version 3.7.1-r1.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart loki < 3.7.1-r1
Fix: upgrade to 3.7.1-r1
Original advisory text
RSA and DSA public key parsers did not enforce size limits on key parameters
Security vulnerability affects the loki package. The RSA and DSA public key parsers did not enforce size limits on key parameters.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Timeline
Published26 Sep 2026
Updated26 Sep 2026
First seen26 Sep 2026
Sources
CLEANSTART-2026-UP76614 · OSV
Track software like this
Free during beta