MidnightBSD vulnerabilities
We track 3 vulnerabilities in MidnightBSD products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 17, 2026.
Latest MidnightBSD vulnerabilities
- 8.3 High severity
mport: Improper Limitation of a Pathname to a Restricted Directory
mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index data could place an unsa
- 8.3 High severity
mport: Insufficient Verification of Data Authenticity
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_bootstrap_index() function in libmport/fetch.c could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve
- 8.3 High severity
mport: Improper Validation of Integrity Check Value
mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal in mport_decompress_zstd(), and libmport/fetch.c did not consistently propagate those failures to index-fetch callers.