Skip to content

CVE record · 2 sources

CVE-2026-74222

CVSS 8.2

U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget implementation.

Vendor: Canonical
Product: Ubuntu
CVSS: 8.2
Exposure class: Operating system

Coverage

2

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

25

Ubuntu notice Ubuntu 10d ago

U-Boot vulnerabilities

USN-8930-1 fixed some vulnerabilities in U-Boot. This update provides the corresponding fix for U-Boot on Ubuntu 26.10. Original advisory details: Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled…

CVE-2026-74220 CVE-2026-74221 CVE-2026-74222+1 more Canonical
10

CVE NVD 29 Sep 2026

U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget implementation.

U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERR_BUF…

CVSS 8.2 CVE-2026-74222