Edit ndaal-sa-2026-223

Document Metadata

Tracking ID *

Title *

Category *

Status *

Document Version *

TLP 2.0 *

Verschlusssache

NATO

Initial Release Date *

Current Release Date *

Summary *

Publisher

Name *

Namespace *

Category *

Contact details

Affected Product

Vendor *

Product Name *

Product ID *

Product Status *

Vulnerability

Required for Security Advisories, optional for Informational / VEX.

CVE ID

Vulnerability Title

Vulnerability Description

This advisory announces the 1.6.36 cut, now published to crates.io and GitLab (tag v1.6.36). The scored findings it collects are Low-severity, availability/correctness-class issues: the encrypted-search annotation lookup running on the async executor thread instead of the blocking pool (163); a quoted multi-line CSV field truncating or dropping mapping rows in a --mappings-dir pack (165); a failed --restore-dump SQL replay leaving a stale destination file that blocked the operator's next retry (167); a rename failure partway through publishing a fetched YARA rule set leaving already-published new files un-rolled-back (168); and a dump failure after the VACUUM INTO snapshot leaving an orphaned .db file that could block a same-stamp retry (169). Three further fixes carry zero security impact: a defense-in-depth mirror of the CSV fix in the embedded frameworks.csv parser with no live external-input path today (166), a stale pre-1.5-era --help default-path string (170), and an ignored RFC 9110 Accept-Language q=0 exclusion that could still serve a client-forbidden language (171). One report (164 — that split_csv_line trims quoted CSV fields) was investigated and confirmed intentional, already-fuzzed behaviour — no code changed. The announcement itself introduces no vulnerability and requires no score beyond 0.0 / NONE. The running viewer's default-secure posture (127.0.0.1 bind, TLS 1.3 only, no authentication, single-operator local tool) is unchanged.

CWE ID

CWE Name

CVSS v3.1

Base Score (0.0 – 10.0)

Severity

CVSS v3.1 Vector

CVSS v4.0

Base Score (0.0 – 10.0)

Severity

CVSS v4.0 Vector

Cancel