CVE-2026-54580 Details
Description
mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal in mport_decompress_zstd(), and libmport/fetch.c did not consistently propagate those failures to index-fetch callers. A malicious or faulty mirror could supply compressed package index data that caused ZSTD_decompressStream() or an output write to fail while leaving partial index output available for later use, resulting in package-index integrity loss or denial of service. This issue is fixed in version 2.7.8.
A vulnerability in the MidnightBSD Package Manager (Mport) versions prior to 2.7.8 allows for improper handling of Zstandard (zstd) compressed package index data. The issue arises because the package manager did not consistently treat errors from truncated or corrupt zstd streams as critical. This lack of proper validation meant that partial index data could be left intact and used later, potentially leading to a loss of integrity in the package index or causing a denial-of-service condition. The vulnerability could be exploited if a malicious or faulty mirror supplied compromised compressed index data.
Users can upgrade to Mport version 2.7.8 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MidnightBSD/mport/commit/b3e11ba078351402082a881209ee6fda5d332e3d | [email protected] | Source CodeVendor |
| https://github.com/MidnightBSD/mport/pull/135 | [email protected] | Issue TrackingVendor |
| https://github.com/MidnightBSD/mport/releases/tag/2.7.8 | [email protected] | Release NotesVendor |
| https://github.com/MidnightBSD/mport/security/advisories/GHSA-ffqj-j42r-747w | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-354 | Improper Validation of Integrity Check Value | [email protected] |
| CWE-755 | Improper Handling of Exceptional Conditions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MidnightBSD mport | < 2.7.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |