#1149971 apcupsd: CVE-2026-103432 CVE-2026-103436

Package:
src:apcupsd
Source:
src:apcupsd
Submitter:
Salvatore Bonaccorso
Date:
2026-10-04 20:03:03 UTC
Severity:
normal
Tags:
#1149971#5
Date:
2026-10-04 20:00:41 UTC
From:
To:
Hi,

The following vulnerabilities were published for apcupsd.

CVE-2026-103432[0]:
| apcupsd through 3.14.14 has an sscanf stack-based buffer overflow in
| getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi,
| multimon.cgi, and upsfstats.cgi), a related issue to CVE-2026-15544.


CVE-2026-103436[1]:
| apcupsd through 3.14.14 discloses uninitialized stack memory in
| getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi,
| multimon.cgi, and upsfstats.cgi. On the single-field path, when the
| matched STATUS line has fewer than three whitespace-separated
| tokens, sscanf("%*s %*s %s", answer) performs no assignment but the
| function returns success, and thus the caller prints the
| uninitialized destination buffer into the HTTP response.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-103432
https://www.cve.org/CVERecord?id=CVE-2026-103432
[1] https://security-tracker.debian.org/tracker/CVE-2026-103436
https://www.cve.org/CVERecord?id=CVE-2026-103436

Regards,
Salvatore