CVE catalog

CVE-2026-15811

A vulnerability was found in kronosnet's (version…

A vulnerability was found in kronosnet's (version <=1.34) cryptographic configuration management. The framework does not correctly zero-out or wipe sensitive memory segments after executing changes to its cryptographic configuration. This omission leaves raw encryption keys resident in memory after the associated structures are freed. A local attacker capable of leveraging memory disclosure techniques could exploit this flaw to retrieve the active encryption key, allowing them to decrypt cluster network communications or inject malicious packets to cause severe high-availability cluster instability.

Severity: Medium · CVSS 5.8CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
Published: Jul 15, 2026, 10:28:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.08% · Oct 27, 2026

Projects and upstream resources

[kronosnet][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiansid	kronosnet	`1.35-1`	FixedDistribution-reported fixed boundary	[CVE-2026-15811]
Debianforky	kronosnet	`1.35-1`	FixedDistribution-reported fixed boundary	[CVE-2026-15811]

Showing 2 fix observations. All 12 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	kronosnet	Not reported	AffectedDistribution reports no fix	[CVE-2026-15811]
Debianbookworm	kronosnet	`1.25-1`	Affected	[CVE-2026-15811]
Debianforky	kronosnet	`1.35-1`	FixedDistribution-reported fixed boundary	[CVE-2026-15811]
Debiansid	kronosnet	`1.35-1`	FixedDistribution-reported fixed boundary	[CVE-2026-15811]
Debiantrixie	kronosnet	Not reported	AffectedDistribution reports no fix	[CVE-2026-15811]
Debiantrixie	kronosnet	`1.31-1`	Affected	[CVE-2026-15811]
Opensuseleap 16.0	kronosnet	`1.30-160000.4.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2026:21851-1]Sep 17, 2026, 6:23:13 PM UTC
Opensusetumbleweed	kronosnet	`1.33-2.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2026:11364-1]Jul 25, 2026, 6:24:56 PM UTC
Suselinux enterprise high availability extension 16.0	kronosnet	`1.30-160000.4.1`	UnknownSource applicability is not established	[SUSE-SU-2026:23782-1]Sep 27, 2026, 6:23:11 PM UTC
Suselinux enterprise server for sap applications 16.0	kronosnet	`1.30-160000.4.1`	UnknownSource applicability is not established	[SUSE-SU-2026:23792-1]Sep 27, 2026, 6:23:12 PM UTC
Suselinux micro 6.2	kernel-livepatch-SLE16-RT_Update_15	`3-160000.1.1`	UnknownSource applicability is not established	[SUSE-SU-2026:23792-1]Sep 27, 2026, 6:23:12 PM UTC
Suselinux micro extras 6.2	rpm	`4.20.1-160000.3.1`	UnknownSource applicability is not established	[SUSE-SU-2026:23782-1]Sep 27, 2026, 6:23:11 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "kronosnet",
      "status": "fixed",
      "release": "sid",
      "version": "1.35-1"
    },
    {
      "name": "kronosnet",
      "status": "fixed",
      "release": "forky",
      "version": "1.35-1"
    },
    {
      "name": "kronosnet",
      "status": "vulnerable",
      "release": "trixie",
      "version": "1.31-1"
    },
    {
      "name": "kronosnet",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "1.25-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1142847,
      "name": "kronosnet",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1.35-1"
    },
    {
      "bug": 1142847,
      "name": "kronosnet",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1.35-1"
    },
    {
      "bug": 1142847,
      "name": "kronosnet",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1142847,
      "name": "kronosnet",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "kernel-livepatch-SLE16-RT_Update_15",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3-160000.1.1"
            }
          ]
        }
      ],
      "release": "linux micro 6.2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2026:23792-1",
      "fixed_version": "3-160000.1.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2026:23792-1",
      "provider_updated_at": "2026-09-27T18:23:12.574694860Z",
      "applicability_unknown": true
    },
    {
      "name": "kronosnet",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.30-160000.4.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server for sap applications 16.0",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2026:23792-1",
      "fixed_version": "1.30-160000.4.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2026:23792-1",
      "provider_updated_at": "2026-09-27T18:23:12.574694860Z",
      "applicability_unknown": true
    },
    {
      "name": "rpm",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.20.1-160000.3.1"
            }
          ]
        }
      ],
      "release": "linux micro extras 6.2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2026:23782-1",
      "fixed_version": "4.20.1-160000.3.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2026:23782-1",
      "provider_updated_at": "2026-09-27T18:23:11.775004981Z",
      "applicability_unknown": true
    },
    {
      "name": "kronosnet",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.30-160000.4.1"
            }
          ]
        }
      ],
      "release": "linux enterprise high availability extension 16.0",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2026:23782-1",
      "fixed_version": "1.30-160000.4.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2026:23782-1",
      "provider_updated_at": "2026-09-27T18:23:11.775004981Z",
      "applicability_unknown": true
    },
    {
      "name": "kronosnet",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.30-160000.4.1"
            }
          ]
        }
      ],
      "release": "leap 16.0",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2026:21851-1",
      "fixed_version": "1.30-160000.4.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2026:21851-1",
      "provider_updated_at": "2026-09-17T18:23:13.848576762Z",
      "applicability_unknown": true
    },
    {
      "name": "kronosnet",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.33-2.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2026:11364-1",
      "fixed_version": "1.33-2.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2026:11364-1",
      "provider_updated_at": "2026-07-25T18:24:56.633918606Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1142847]

Publisher notes

[trixie] kronosnet: Minor issue [bookworm] kronosnet: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[libknet1]Unknown
Source package: [kronosnet]
Details (2)
- 1.25-1 · amd64 · bookworm
  Affected
  nvd · kronosnet · debian · bookworm; nvd · kronosnet · debian · 12
- 1.25-1 · arm64 · bookworm
  Affected
  nvd · kronosnet · debian · bookworm; nvd · kronosnet · debian · 12
[libknet-dev]Unknown
Source package: [kronosnet]
Details (2)
- 1.25-1 · amd64 · bookworm
  Affected
  nvd · kronosnet · debian · bookworm; nvd · kronosnet · debian · 12
- 1.25-1 · arm64 · bookworm
  Affected
  nvd · kronosnet · debian · bookworm; nvd · kronosnet · debian · 12
[libknet-doc]Unknown
Source package: [kronosnet]
Details (2)
- 1.25-1 · all · bookworm
  Affected
  nvd · kronosnet · debian · bookworm; nvd · kronosnet · debian · 12
- 1.25-1 · all · bookworm
  Affected
  nvd · kronosnet · debian · bookworm; nvd · kronosnet · debian · 12
[libnozzle1]Unknown
Source package: [kronosnet]
Details (2)
- 1.25-1 · amd64 · bookworm
  Affected
  nvd · kronosnet · debian · bookworm; nvd · kronosnet · debian · 12
- 1.25-1 · arm64 · bookworm
  Affected
  nvd · kronosnet · debian · bookworm; nvd · kronosnet · debian · 12
[libnozzle-dev]Unknown
Source package: [kronosnet]
Details (2)
- 1.25-1 · amd64 · bookworm
  Affected
  nvd · kronosnet · debian · bookworm; nvd · kronosnet · debian · 12
- 1.25-1 · arm64 · bookworm
  Affected
  nvd · kronosnet · debian · bookworm; nvd · kronosnet · debian · 12

[Debian 13 (Trixie)]

[libknet1t64]Unknown
Source package: [kronosnet]
Details (2)
- 1.31-1 · amd64 · trixie
  Affected
  nvd · kronosnet · debian · 13
- 1.31-1 · arm64 · trixie
  Affected
  nvd · kronosnet · debian · 13
[libknet-dev]Unknown
Source package: [kronosnet]
Details (2)
- 1.31-1 · amd64 · trixie
  Affected
  nvd · kronosnet · debian · 13
- 1.31-1 · arm64 · trixie
  Affected
  nvd · kronosnet · debian · 13
[libknet-doc]Unknown
Source package: [kronosnet]
Details (2)
- 1.31-1 · all · trixie
  Affected
  nvd · kronosnet · debian · 13
- 1.31-1 · all · trixie
  Affected
  nvd · kronosnet · debian · 13
[libnozzle1t64]Unknown
Source package: [kronosnet]
Details (2)
- 1.31-1 · amd64 · trixie
  Affected
  nvd · kronosnet · debian · 13
- 1.31-1 · arm64 · trixie
  Affected
  nvd · kronosnet · debian · 13
[libnozzle-dev]Unknown
Source package: [kronosnet]
Details (2)
- 1.31-1 · amd64 · trixie
  Affected
  nvd · kronosnet · debian · 13
- 1.31-1 · arm64 · trixie
  Affected
  nvd · kronosnet · debian · 13

[openSUSE Tumbleweed]

[libknet1]Unknown
Source package: [kronosnet]
Details (1)
- 1.33-2.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.33-2.1
  Version impact unknown
  nvd · kronosnet · opensuse · tumbleweed
[libknet1-compress-bzip2-plugin]Unknown
Source package: [kronosnet]
Details (1)
- 1.33-2.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.33-2.1
  Version impact unknown
  nvd · kronosnet · opensuse · tumbleweed
[libknet1-compress-lz4-plugin]Unknown
Source package: [kronosnet]
Details (1)
- 1.33-2.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.33-2.1
  Version impact unknown
  nvd · kronosnet · opensuse · tumbleweed
[libknet1-compress-lzma-plugin]Unknown
Source package: [kronosnet]
Details (1)
- 1.33-2.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.33-2.1
  Version impact unknown
  nvd · kronosnet · opensuse · tumbleweed
[libknet1-compress-lzo2-plugin]Unknown
Source package: [kronosnet]
Details (1)
- 1.33-2.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.33-2.1
  Version impact unknown
  nvd · kronosnet · opensuse · tumbleweed
[libknet1-compress-plugins-all]Unknown
Source package: [kronosnet]
Details (1)
- 1.33-2.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.33-2.1
  Version impact unknown
  nvd · kronosnet · opensuse · tumbleweed
[libknet1-compress-zlib-plugin]Unknown
Source package: [kronosnet]
Details (1)
- 1.33-2.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.33-2.1
  Version impact unknown
  nvd · kronosnet · opensuse · tumbleweed
[libknet1-compress-zstd-plugin]Unknown
Source package: [kronosnet]
Details (1)
- 1.33-2.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.33-2.1
  Version impact unknown
  nvd · kronosnet · opensuse · tumbleweed
[libknet1-crypto-nss-plugin]Unknown
Source package: [kronosnet]
Details (1)
- 1.33-2.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.33-2.1
  Version impact unknown
  nvd · kronosnet · opensuse · tumbleweed
[libknet1-crypto-openssl-plugin]Unknown
Source package: [kronosnet]
Details (1)
- 1.33-2.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.33-2.1
  Version impact unknown
  nvd · kronosnet · opensuse · tumbleweed

Next results

Observed: Oct 23, 2026, 9:44:02 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]