An update for munge is now available for openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP2,openEuler-24.03-LTS-SP3 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-1348 Final 1.0 1.0 2026-02-13 Initial 2026-02-13 2026-02-13 openEuler SA Tool V1.0 2026-02-13 munge security update An update for munge is now available for openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP2,openEuler-24.03-LTS-SP3 MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating and validating credentials. It is designed to be highly scalable for use in an HPC cluster environment. It allows a process to authenticate the UID and GID of another local or remote process within a group of hosts having common users and groups. These hosts form a security realm that is defined by a shared cryptographic key. Clients within this security realm can create and validate credentials without the use of root privileges, reserved ports, or platform-specific methods. Security Fix(es): MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged (the MUNGE authentication daemon) to leak cryptographic key material from process memory. With the leaked key material, the attacker could forge arbitrary MUNGE credentials to impersonate any user (including root) to services that rely on MUNGE for authentication. The vulnerability allows a buffer overflow by sending a crafted message with an oversized address length field, corrupting munged's internal state and enabling extraction of the MAC subkey used for credential verification. This vulnerability is fixed in 0.5.18.(CVE-2026-25506) An update for munge is now available for openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP2,openEuler-24.03-LTS-SP3. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High munge https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1348 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-25506 https://nvd.nist.gov/vuln/detail/CVE-2026-25506 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP2 openEuler-24.03-LTS-SP3 munge-0.5.14-2.oe2003sp4.aarch64.rpm munge-debuginfo-0.5.14-2.oe2003sp4.aarch64.rpm munge-debugsource-0.5.14-2.oe2003sp4.aarch64.rpm munge-devel-0.5.14-2.oe2003sp4.aarch64.rpm munge-libs-0.5.14-2.oe2003sp4.aarch64.rpm munge-0.5.14-2.oe2203sp4.aarch64.rpm munge-debuginfo-0.5.14-2.oe2203sp4.aarch64.rpm munge-debugsource-0.5.14-2.oe2203sp4.aarch64.rpm munge-devel-0.5.14-2.oe2203sp4.aarch64.rpm munge-libs-0.5.14-2.oe2203sp4.aarch64.rpm munge-0.5.15-2.oe2403.aarch64.rpm munge-debuginfo-0.5.15-2.oe2403.aarch64.rpm munge-debugsource-0.5.15-2.oe2403.aarch64.rpm munge-devel-0.5.15-2.oe2403.aarch64.rpm munge-libs-0.5.15-2.oe2403.aarch64.rpm munge-0.5.15-2.oe2403sp1.aarch64.rpm munge-debuginfo-0.5.15-2.oe2403sp1.aarch64.rpm munge-debugsource-0.5.15-2.oe2403sp1.aarch64.rpm munge-devel-0.5.15-2.oe2403sp1.aarch64.rpm munge-libs-0.5.15-2.oe2403sp1.aarch64.rpm munge-0.5.15-2.oe2403sp2.aarch64.rpm munge-debuginfo-0.5.15-2.oe2403sp2.aarch64.rpm munge-debugsource-0.5.15-2.oe2403sp2.aarch64.rpm munge-devel-0.5.15-2.oe2403sp2.aarch64.rpm munge-libs-0.5.15-2.oe2403sp2.aarch64.rpm munge-0.5.15-2.oe2403sp3.aarch64.rpm munge-debuginfo-0.5.15-2.oe2403sp3.aarch64.rpm munge-debugsource-0.5.15-2.oe2403sp3.aarch64.rpm munge-devel-0.5.15-2.oe2403sp3.aarch64.rpm munge-libs-0.5.15-2.oe2403sp3.aarch64.rpm munge-0.5.14-2.oe2003sp4.src.rpm munge-0.5.14-2.oe2203sp4.src.rpm munge-0.5.15-2.oe2403.src.rpm munge-0.5.15-2.oe2403sp1.src.rpm munge-0.5.15-2.oe2403sp2.src.rpm munge-0.5.15-2.oe2403sp3.src.rpm munge-0.5.14-2.oe2003sp4.x86_64.rpm munge-debuginfo-0.5.14-2.oe2003sp4.x86_64.rpm munge-debugsource-0.5.14-2.oe2003sp4.x86_64.rpm munge-devel-0.5.14-2.oe2003sp4.x86_64.rpm munge-libs-0.5.14-2.oe2003sp4.x86_64.rpm munge-0.5.14-2.oe2203sp4.x86_64.rpm munge-debuginfo-0.5.14-2.oe2203sp4.x86_64.rpm munge-debugsource-0.5.14-2.oe2203sp4.x86_64.rpm munge-devel-0.5.14-2.oe2203sp4.x86_64.rpm munge-libs-0.5.14-2.oe2203sp4.x86_64.rpm munge-0.5.15-2.oe2403.x86_64.rpm munge-debuginfo-0.5.15-2.oe2403.x86_64.rpm munge-debugsource-0.5.15-2.oe2403.x86_64.rpm munge-devel-0.5.15-2.oe2403.x86_64.rpm munge-libs-0.5.15-2.oe2403.x86_64.rpm munge-0.5.15-2.oe2403sp1.x86_64.rpm munge-debuginfo-0.5.15-2.oe2403sp1.x86_64.rpm munge-debugsource-0.5.15-2.oe2403sp1.x86_64.rpm munge-devel-0.5.15-2.oe2403sp1.x86_64.rpm munge-libs-0.5.15-2.oe2403sp1.x86_64.rpm munge-0.5.15-2.oe2403sp2.x86_64.rpm munge-debuginfo-0.5.15-2.oe2403sp2.x86_64.rpm munge-debugsource-0.5.15-2.oe2403sp2.x86_64.rpm munge-devel-0.5.15-2.oe2403sp2.x86_64.rpm munge-libs-0.5.15-2.oe2403sp2.x86_64.rpm munge-0.5.15-2.oe2403sp3.x86_64.rpm munge-debuginfo-0.5.15-2.oe2403sp3.x86_64.rpm munge-debugsource-0.5.15-2.oe2403sp3.x86_64.rpm munge-devel-0.5.15-2.oe2403sp3.x86_64.rpm munge-libs-0.5.15-2.oe2403sp3.x86_64.rpm MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged (the MUNGE authentication daemon) to leak cryptographic key material from process memory. With the leaked key material, the attacker could forge arbitrary MUNGE credentials to impersonate any user (including root) to services that rely on MUNGE for authentication. The vulnerability allows a buffer overflow by sending a crafted message with an oversized address length field, corrupting munged's internal state and enabling extraction of the MAC subkey used for credential verification. This vulnerability is fixed in 0.5.18. 2026-02-13 CVE-2026-25506 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP2 openEuler-24.03-LTS-SP3 High 7.7 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L munge security update 2026-02-13 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1348