CVE-2026-90455 in Malcolm
Résumé
par MITRE • 12/09/2026
A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing the earlier, vulnerable version into a log-processing component. The only code path in that component using the library issues a request to a single fixed, trusted vendor URL at initialization and does not process attacker-controlled input through the library, limiting practical exploitability of the reintroduced version in this context.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.