You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@commons.apache.org by Gary Gregory <ga...@gmail.com> on 2026/08/07 15:04:59 UTC

CVE-2026-64607 announced?

Hi All,

I can't find an email on anounce@ or our dev@ mailing list for
https://nvd.nist.gov/vuln/detail/CVE-2026-64607

Am I missing something?

TY,
Gary

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org

Re: CVE-2026-64607 announced?

Posted by "Piotr P. Karwasz" <pi...@mailing.copernik.eu>.
Hi sebb,

On 10.08.2026 09:39, sebb wrote:
> On Mon, 10 Aug 2026 at 07:48, Piotr P. Karwasz
> <pi...@mailing.copernik.eu> wrote:
>> All the CVEs disclosed by the ASF *must* have a `vendor-advisory` link,
>> which most often than not is a link to the PonyMail archive:
>>
>> https://www.cve.org/CVERecord?id=CVE-2026-64607
> 
> Which suggests that such queries should be directed to the
> Httpcomponents project...


Yes, I saw that Gary posted the question to the wrong list. I just
wanted to point out that the answer to the question doesn't depend on
the PMC: all PMCs must include a `vendor-advisory`, otherwise the CVE
can not be switched to a PUBLIC state.

Piotr

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org

Re: CVE-2026-64607 announced?

Posted by sebb <se...@gmail.com>.
On Mon, 10 Aug 2026 at 07:48, Piotr P. Karwasz
<pi...@mailing.copernik.eu> wrote:
>
> Hi Gary,
>
> On 7.08.2026 17:04, Gary Gregory wrote:
> > I can't find an email on anounce@ or our dev@ mailing list for
> > https://nvd.nist.gov/vuln/detail/CVE-2026-64607
>
>
> All the CVEs disclosed by the ASF *must* have a `vendor-advisory` link,
> which most often than not is a link to the PonyMail archive:
>
> https://www.cve.org/CVERecord?id=CVE-2026-64607

Which suggests that such queries should be directed to the
Httpcomponents project...

> Piotr
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> For additional commands, e-mail: dev-help@commons.apache.org
>

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org

Re: CVE-2026-64607 announced?

Posted by Gary Gregory <ga...@gmail.com>.
On Mon, Aug 10, 2026 at 2:48 AM Piotr P. Karwasz
<pi...@mailing.copernik.eu> wrote:
>
> Hi Gary,
>
> On 7.08.2026 17:04, Gary Gregory wrote:
> > I can't find an email on anounce@ or our dev@ mailing list for
> > https://nvd.nist.gov/vuln/detail/CVE-2026-64607
>
>
> All the CVEs disclosed by the ASF *must* have a `vendor-advisory` link,
> which most often than not is a link to the PonyMail archive:
>
> https://www.cve.org/CVERecord?id=CVE-2026-64607

Yes, I know I posted to the wrong ML here ;p

Gary

>
> Piotr
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> For additional commands, e-mail: dev-help@commons.apache.org
>

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org

Re: CVE-2026-64607 announced?

Posted by "Piotr P. Karwasz" <pi...@mailing.copernik.eu>.
Hi Gary,

On 7.08.2026 17:04, Gary Gregory wrote:
> I can't find an email on anounce@ or our dev@ mailing list for
> https://nvd.nist.gov/vuln/detail/CVE-2026-64607


All the CVEs disclosed by the ASF *must* have a `vendor-advisory` link,
which most often than not is a link to the PonyMail archive:

https://www.cve.org/CVERecord?id=CVE-2026-64607

Piotr

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org

Re: CVE-2026-64607 announced?

Posted by Gary Gregory <ga...@gmail.com>.
On Fri, Aug 7, 2026, 11:21 Gilles Sadowski <gi...@gmail.com> wrote:

> Le ven. 7 août 2026 à 17:05, Gary Gregory <ga...@gmail.com> a
> écrit :
> >
> > Hi All,
> >
> > I can't find an email on anounce@ or our dev@ mailing list for
> > https://nvd.nist.gov/vuln/detail/CVE-2026-64607
> >
> > Am I missing something?
>
> Wrong ML?
>

Oops sorry about that!

Gary


> Regards,
> Gilles
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> For additional commands, e-mail: dev-help@commons.apache.org
>
>

Re: CVE-2026-64607 announced?

Posted by Gilles Sadowski <gi...@gmail.com>.
Le ven. 7 août 2026 à 17:05, Gary Gregory <ga...@gmail.com> a écrit :
>
> Hi All,
>
> I can't find an email on anounce@ or our dev@ mailing list for
> https://nvd.nist.gov/vuln/detail/CVE-2026-64607
>
> Am I missing something?

Wrong ML?

Regards,
Gilles

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org