CVE-2026-96283
Fixed in a distro release EPSS <1%CVSS 3.3
By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.
Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | flatpak | 1.14.10-1~deb12u2 |
| Debian 13 | flatpak | 1.16.4-1 |
| Debian 14 | flatpak | 1.16.4-1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | flatpak | 1.4.2-3.15.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | flatpak | 1.4.2-3.15.1 |
| Ubuntu Pro 18.04 LTS | flatpak | no fix |
| Ubuntu Pro 20.04 LTS | flatpak | no fix |
| Ubuntu Pro 22.04 LTS | flatpak | no fix |
| Ubuntu Pro 24.04 LTS | flatpak | no fix |