CVE-2026-54580 in mport
Summary
by MITRE • 09/17/2026
mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal in mport_decompress_zstd(), and libmport/fetch.c did not consistently propagate those failures to index-fetch callers. A malicious or faulty mirror could supply compressed package index data that caused ZSTD_decompressStream() or an output write to fail while leaving partial index output available for later use, resulting in package-index integrity loss or denial of service. This issue is fixed in version 2.7.8.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The MidnightBSD Package Manager, known as mport, serves as the primary tool for software installation and system maintenance on the Midnight BSD operating system. A significant security vulnerability was identified within the core library components responsible for handling compressed data streams, specifically affecting versions prior to 2.7.8. The flaw resides in two key source files: libmport/util.c and libmport/fetch.c. In these modules, the implementation of the Zstandard compression algorithm integration lacked rigorous error handling protocols when processing package index data. Specifically, the function mport_decompress_zstd failed to treat truncated, corrupt, or otherwise failed zstd streams as fatal errors that would halt execution immediately. Instead, the system allowed partial decompression results to persist in memory even after a failure occurred during the stream processing phase.
This technical deficiency creates a critical integrity issue within the package management workflow. When mport retrieves package index data from remote mirrors, it relies on the assumption that the received compressed payload is complete and valid. Due to the insufficient validation logic, if a mirror supplies malformed or maliciously crafted zstd-compressed data, the decompression process may fail partway through but still return whatever partial output was successfully generated before the error condition triggered. This behavior violates the principle of atomicity in data processing, where an operation should either succeed completely with valid data or fail entirely without leaving residual artifacts that could be misinterpreted as legitimate content. The fetch module further exacerbated this issue by not consistently propagating these decompression failures back to the higher-level index-fetch callers who orchestrate the retrieval and validation process.
The operational impact of this vulnerability is severe, primarily affecting system integrity and availability. An attacker controlling a malicious mirror or performing a man-in-the-middle attack could supply corrupted package index data that triggers this partial output condition. By doing so, they can cause mport to install packages based on incomplete or inconsistent metadata, leading to package-index integrity loss. This undermines the trust model of the package manager, potentially allowing for the installation of compromised software or causing dependency resolution failures. Furthermore, in scenarios where repeated attempts are made with faulty data, this flaw can lead to denial of service conditions by exhausting system resources through continuous partial decompression cycles without proper termination signals. The vulnerability aligns with CWE-20 Improper Input Validation and CWE-754 Improper Check for Unusual or Exceptional Conditions, as the software fails to adequately validate input integrity and handle exceptional error states appropriately.
From a threat intelligence perspective, this flaw can be leveraged in attacks categorized under MITRE ATT&CK techniques related to Supply Chain Compromise or Data Manipulation. An adversary could exploit this weakness to inject malicious package metadata into the local system cache, thereby influencing future software installations without direct access to the target machine's command line interface. The lack of strict failure propagation means that downstream components may proceed with operations using stale or corrupted index data, effectively bypassing integrity checks designed to protect against tampered repositories.
To mitigate this risk, administrators and developers must upgrade mport to version 2.7.8 or later, where the decompression logic has been hardened to ensure that any failure in zstd stream processing results in a fatal error with no partial output being used. Additionally, system maintainers should verify the integrity of their package mirrors using cryptographic signatures whenever possible, ensuring that even if such vulnerabilities exist, the authenticity of the data can be independently verified. Implementing strict input validation at all layers of the fetch and decompression pipeline is essential to prevent similar issues in future updates or related software components. Regular auditing of third-party dependencies for proper error handling practices remains a critical component of maintaining secure system configurations.