From: Arnout Vandecappelle via buildroot <buildroot@buildroot.org>
To: buildroot-lts-sponsors@buildroot.org,
buildroot-users@buildroot.org, buildroot@buildroot.org
Subject: [Buildroot] Buildroot 2026.05.1 released
Date: Wed, 15 Jul 2026 21:32:56 +0200 [thread overview]
Message-ID: <buildroot-2026.05.1-announce-1784143976@buildroot.org> (raw)
Hi,
Buildroot is a simple tool for creating complete embedded Linux systems
(https://buildroot.org).
Buildroot 2026.05.1 is released - Go download it at:
https://buildroot.org/downloads/buildroot-2026.05.1.tar.gz
or
https://buildroot.org/downloads/buildroot-2026.05.1.tar.xz
Or get it from Git:
https://gitlab.com/buildroot.org/buildroot.git (2026.05.1 tag)
Buildroot 2026.05.1 is a bugfix release, fixing a number of important /
security related issues discovered since the 2026.05 release.
Important / security related fixes:
apache: CVE-2026-29167, CVE-2026-29170, CVE-2026-34355, CVE-2026-34356,
CVE-2026-42535, CVE-2026-42536, CVE-2026-43951, CVE-2026-44119,
CVE-2026-44185, CVE-2026-44186, CVE-2026-44631, CVE-2026-48913,
CVE-2026-49975
asterisk: GHSA-3g56-cgrh-95p5, GHSA-3rhj-hhw7-m6fw,
GHSA-4pgv-j3mr-3rcp, GHSA-589g-qgf8-m6mx, GHSA-746q-794h-cc7f,
GHSA-8jhw-m2hg-vp3h, GHSA-8jw3-ccr9-xrmf, GHSA-g8q2-p36q-94f6,
GHSA-h5hv-jmgj-92q2, GHSA-j2mm-57pq-jh94, GHSA-mxgm-8c6f-5p8f,
GHSA-ph27-3m5q-mj5m, GHSA-q9fr-m7g8-6ph5, GHSA-qf8j-jp7h-c5hx,
GHSA-r6c2-hwc2-j4mp, GHSA-vfhr-r9x9-c687, GHSA-vrfp-mg3q-3959,
GHSA-wcvv-g26m-wx5c, GHSA-x348-j6c9-77f3, GHSA-xgj6-2gc5-5x9c
avahi: CVE-2026-34933
bind: (no CVE assigned), CVE-2026-3593
clamav: CVE-2026-20213, CVE-2026-20214, CVE-2026-20215, CVE-2026-20216,
CVE-2026-20217, CVE-2026-20243, CVE-2026-20244, CVE-2026-41676
cpp-httplib: CVE-2026-45352, CVE-2026-45372, CVE-2026-46527
cups-filters: CVE-2025-64503
expat: CVE-2026-50219, CVE-2026-56131, CVE-2026-56132, CVE-2026-56403,
CVE-2026-56404, CVE-2026-56405, CVE-2026-56406, CVE-2026-56407,
CVE-2026-56408, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411,
CVE-2026-56412
fetchmail: (no CVE assigned)
ghostscript: (no CVE assigned)
gnupg2: CVE-2026-34182
imagemagick: CVE-2026-48724, CVE-2026-48733, CVE-2026-48734,
CVE-2026-48994, CVE-2026-49218, CVE-2026-49219, CVE-2026-53460,
CVE-2026-53461, CVE-2026-53462, CVE-2026-53463, CVE-2026-53464,
CVE-2026-53465
jq: CVE-2026-32316, CVE-2026-33947, CVE-2026-33948, CVE-2026-39979,
CVE-2026-40164, CVE-2026-40612, CVE-2026-41256, CVE-2026-41257,
CVE-2026-43894, CVE-2026-43896, CVE-2026-44777, CVE-2026-49839,
CVE-2026-54679, GHSA-gf4g-95wj-4q4r, GHSA-hj52-j2c9-r8r4
libarchive: (no CVE assigned)
libcurl: CVE-2026-10536, CVE-2026-11352, CVE-2026-11564,
CVE-2026-11586, CVE-2026-11856, CVE-2026-12064, CVE-2026-8286,
CVE-2026-8458, CVE-2026-8924, CVE-2026-8925, CVE-2026-8926,
CVE-2026-8927, CVE-2026-8932, CVE-2026-9079, CVE-2026-9080,
CVE-2026-9545, CVE-2026-9546, CVE-2026-9547
libevent: (no CVE assigned)
libgsasl: CVE-2026-48829
libopenssl: CVE-2026-34180, CVE-2026-34181, CVE-2026-34182,
CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767,
CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445,
CVE-2026-45446, CVE-2026-45447, CVE-2026-7383, CVE-2026-9076
libssh2: CVE-2026-55199, CVE-2026-55200
mariadb: CVE-2026-48163, CVE-2026-48165, CVE-2026-49261
mongoose: (no CVE assigned yet)
nginx: CVE-2026-42055, CVE-2026-48142
openjpeg: CVE-2026-6192
openvpn: CVE-2026-11771, CVE-2026-12932, CVE-2026-12996,
CVE-2026-13117, CVE-2026-13122, CVE-2026-13379, CVE-2026-13698
php: CVE-2026-14355
python-django: CVE-2026-35192, CVE-2026-35193, CVE-2026-48587,
CVE-2026-5766, CVE-2026-6873, CVE-2026-6907, CVE-2026-7666,
CVE-2026-8404
python3: CVE-2026-11940, CVE-2026-9669
redis: CVE-2026-23479, CVE-2026-23631, CVE-2026-25243
ruby: CVE-2026-46727
rust: CVE-2025-15661, CVE-2026-55199, CVE-2026-55200
squid: CVE-2026-47729, CVE-2026-50012
sudo: CVE-2026-35535
tiff: CVE-2026-36849
tmux: CVE-2026-11623
tor: TROVE-2026-025, TROVE-2026-026.
util-linux: CVE-2026-27456, CVE-2026-53612, CVE-2026-53613,
CVE-2026-53614
webkitgtk: CVE-2026-28847, CVE-2026-28883, CVE-2026-28901,
CVE-2026-28902, CVE-2026-28903, CVE-2026-28904, CVE-2026-28905,
CVE-2026-28907, CVE-2026-28942, CVE-2026-28946, CVE-2026-28947,
CVE-2026-28953, CVE-2026-28955, CVE-2026-28958, CVE-2026-43658,
CVE-2026-43660
wolfssl: CVE-2026-10097, CVE-2026-10098, CVE-2026-10512,
CVE-2026-10592, CVE-2026-11310, CVE-2026-11703, CVE-2026-11999,
CVE-2026-12340, CVE-2026-55958, CVE-2026-55960, CVE-2026-55961,
CVE-2026-55962, CVE-2026-55964, CVE-2026-55967, CVE-2026-6091,
CVE-2026-6092, CVE-2026-6094, CVE-2026-6291, CVE-2026-6325,
CVE-2026-6329, CVE-2026-6330, CVE-2026-6331, CVE-2026-6412,
CVE-2026-6450, CVE-2026-6678, CVE-2026-6681, CVE-2026-6731,
CVE-2026-7511, CVE-2026-7531, CVE-2026-7532, CVE-2026-8720
Toolchain:
- gcc: bump 15.x series to 15.3.0
- gcc:: bump 14.x series to 14.4.0
Infrastructure updates/fixes:
- support/testing: various internal refactorings
- support/testing Improve TestPythonPy3NetworkmanagerGoi
- support/testing: improve iptables package test
- generate-cyclonedx: fixup scp-style git sites
- support/testing: Fix test_gnupg2
Updated / fixed packages: apache, asterisk, avahi, bind, bind, clamav,
cpp-httplib, cups-filters, expat, fetchmail, gcc, gcc:, ghostscript,
gnupg2, hwdata, imagemagick, iptables, jq, jq, kodi-screensaver-rsxs,
libarchive, libcurl, libepoxy, libevent, libglib2,
libglib2-bootstrap, libgsasl, libopenssl, libssh2, libssh2, linux,
mariadb, mdnsd, mongoose, mosquitto, mpd, nginx, ntp, openjpeg,
openrc, openvpn, passt, php, python-django, python3, python3, redis,
rsync, ruby, rust, shadow, shim, squid, strongswan, sudo, tiff, tmux,
tor, util-linux, util-linux, util-linux, webkitgtk, wolfssl
For more details, see the CHANGES file:
https://gitlab.com/buildroot.org/buildroot/-/blob/2026.05.1/CHANGES
Users of the affected packages are strongly encouraged to upgrade.
Many thanks to all the people contributing to this release:
git shortlog -s -n 2026.05..
34 Peter Korsgaard
28 Bernd Kuhls
13 Thomas Perale
8 Fiona Klute
6 Romain Naour
5 Giulio Benetti
3 Waldemar Brodkorb
2 Arnout Vandecappelle
2 Titouan Christophe
2 Yann E. MORIN
1 Dowan Gullient via buildroot
1 Joseph Kogut
1 Thomas Devoogdt
1 Vincent Stehlé
Regards,
Arnout
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
reply other threads:[~2026-07-15 19:33 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=buildroot-2026.05.1-announce-1784143976@buildroot.org \
--to=buildroot@buildroot.org \
--cc=arnout@rnout.be \
--cc=buildroot-lts-sponsors@buildroot.org \
--cc=buildroot-users@buildroot.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox