CVE catalog

CVE-2026-109117

oath-toolkit: CVE-2026-109117

Severity: Medium
Published: Oct 16, 2026, 12:00:00 AM UTC
Source: [NVD] · [CVE record]

unknown

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	oath-toolkit	sid	`2.6.15-1`	fixed
Debian	oath-toolkit	forky	`2.6.15-1`	fixed
Debian	oath-toolkit	trixie	`2.6.12-1`	vulnerable
Debian	oath-toolkit	bookworm	`2.6.7-3.1+deb12u1`	vulnerable
Debian	oath-toolkit	bookworm-security	`2.6.7-3.1+deb12u1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	oath-toolkit	source	sid	`2.6.15-1`	not yet assigned	Not reported	Not reported
Debian	oath-toolkit	source	forky	`2.6.15-1`	not yet assigned	Not reported	Not reported
Debian	oath-toolkit	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	oath-toolkit	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported

Notes

[trixie] oath-toolkit: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[liboath0]Affected
Source package: [oath-toolkit]
Details (4)
- 2.6.7-3.1+deb12u1 · amd64 · bookworm
  Affected
  dsa · oath-toolkit · debian · bookworm
- 2.6.7-3.1+deb12u1 · arm64 · bookworm
  Affected
  dsa · oath-toolkit · debian · bookworm
- 2.6.7-3.1+deb12u1 · amd64 · bookworm-security
  Affected
  dsa · oath-toolkit · debian · bookworm
- 2.6.7-3.1+deb12u1 · arm64 · bookworm-security
  Affected
  dsa · oath-toolkit · debian · bookworm
[liboath-dev]Affected
Source package: [oath-toolkit]
Details (4)
- 2.6.7-3.1+deb12u1 · amd64 · bookworm
  Affected
  dsa · oath-toolkit · debian · bookworm
- 2.6.7-3.1+deb12u1 · arm64 · bookworm
  Affected
  dsa · oath-toolkit · debian · bookworm
- 2.6.7-3.1+deb12u1 · amd64 · bookworm-security
  Affected
  dsa · oath-toolkit · debian · bookworm
- 2.6.7-3.1+deb12u1 · arm64 · bookworm-security
  Affected
  dsa · oath-toolkit · debian · bookworm
[libpam-oath]Affected
Source package: [oath-toolkit]
Details (4)
- 2.6.7-3.1+deb12u1 · amd64 · bookworm
  Affected
  dsa · oath-toolkit · debian · bookworm
- 2.6.7-3.1+deb12u1 · arm64 · bookworm
  Affected
  dsa · oath-toolkit · debian · bookworm
- 2.6.7-3.1+deb12u1 · amd64 · bookworm-security
  Affected
  dsa · oath-toolkit · debian · bookworm
- 2.6.7-3.1+deb12u1 · arm64 · bookworm-security
  Affected
  dsa · oath-toolkit · debian · bookworm
[libpskc0]Affected
Source package: [oath-toolkit]
Details (4)
- 2.6.7-3.1+deb12u1 · amd64 · bookworm
  Affected
  dsa · oath-toolkit · debian · bookworm
- 2.6.7-3.1+deb12u1 · arm64 · bookworm
  Affected
  dsa · oath-toolkit · debian · bookworm
- 2.6.7-3.1+deb12u1 · amd64 · bookworm-security
  Affected
  dsa · oath-toolkit · debian · bookworm
- 2.6.7-3.1+deb12u1 · arm64 · bookworm-security
  Affected
  dsa · oath-toolkit · debian · bookworm
[libpskc-dev]Affected
Source package: [oath-toolkit]
Details (4)
- 2.6.7-3.1+deb12u1 · amd64 · bookworm
  Affected
  dsa · oath-toolkit · debian · bookworm
- 2.6.7-3.1+deb12u1 · arm64 · bookworm
  Affected
  dsa · oath-toolkit · debian · bookworm
- 2.6.7-3.1+deb12u1 · amd64 · bookworm-security
  Affected
  dsa · oath-toolkit · debian · bookworm
- 2.6.7-3.1+deb12u1 · arm64 · bookworm-security
  Affected
  dsa · oath-toolkit · debian · bookworm
[oathtool]Affected
Source package: [oath-toolkit]
Details (4)
- 2.6.7-3.1+deb12u1 · amd64 · bookworm
  Affected
  dsa · oath-toolkit · debian · bookworm
- 2.6.7-3.1+deb12u1 · arm64 · bookworm
  Affected
  dsa · oath-toolkit · debian · bookworm
- 2.6.7-3.1+deb12u1 · amd64 · bookworm-security
  Affected
  dsa · oath-toolkit · debian · bookworm
- 2.6.7-3.1+deb12u1 · arm64 · bookworm-security
  Affected
  dsa · oath-toolkit · debian · bookworm
[pskctool]Affected
Source package: [oath-toolkit]
Details (4)
- 2.6.7-3.1+deb12u1 · amd64 · bookworm
  Affected
  dsa · oath-toolkit · debian · bookworm
- 2.6.7-3.1+deb12u1 · arm64 · bookworm
  Affected
  dsa · oath-toolkit · debian · bookworm
- 2.6.7-3.1+deb12u1 · amd64 · bookworm-security
  Affected
  dsa · oath-toolkit · debian · bookworm
- 2.6.7-3.1+deb12u1 · arm64 · bookworm-security
  Affected
  dsa · oath-toolkit · debian · bookworm

Observed: Oct 23, 2026, 7:37:31 PM UTC

References

[Debian Security Tracker] · [SUSE security advisories and VEX]