{"id":"CVE-2026-54581","summary":"mport bootstrap index fetch can continue after hash verification failure","details":"mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_bootstrap_index() function in libmport/fetch.c could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or compromised mirror able to alter bootstrap index content or its transport path could therefore cause mport to proceed with an unverified or tampered bootstrap package index. This issue is fixed in version 2.7.8.","aliases":["GHSA-895r-rv8j-7g23"],"modified":"2026-09-19T08:14:22.045063Z","published":"2026-09-17T16:45:37.688Z","database_specific":{"cwe_ids":["CWE-345","CWE-347"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54581.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/MidnightBSD/mport/releases/tag/2.7.8"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54581.json"},{"type":"ADVISORY","url":"https://github.com/MidnightBSD/mport/security/advisories/GHSA-895r-rv8j-7g23"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54581"},{"type":"FIX","url":"https://github.com/MidnightBSD/mport/commit/64ebf3f60dc3df72a3b47fbb20a7f8072c0a0f5e"},{"type":"FIX","url":"https://github.com/MidnightBSD/mport/commit/b3e11ba078351402082a881209ee6fda5d332e3d"},{"type":"FIX","url":"https://github.com/MidnightBSD/mport/pull/134"},{"type":"FIX","url":"https://github.com/MidnightBSD/mport/pull/135"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/midnightbsd/mport","events":[{"introduced":"0"},{"fixed":"64ebf3f60dc3df72a3b47fbb20a7f8072c0a0f5e"},{"fixed":"b3e11ba078351402082a881209ee6fda5d332e3d"},{"fixed":"899c8fe2d3ceb25d899e70dbd0c7744b7d7a0946"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.7.8"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["2.7.6","2.7.5","2.7.4","2.7.3","2.7.2","2.7.1","2.7.0","2.6.8","2.6.7","2.6.5","2.6.4","2.6.3","2.6.2","2.6.1","2.6.0","2.5.1","2.5.0","2.4.8","2.4.7","2.4.6","2.4.5","2.4.4","2.4.3","2.4.1","2.4.0","2.3.0","2.2.9.1","2.2.9","2.2.8","2.2.7","2.2.6","2.2.5","2.2.4","2.2.3","2.2.2","2.2.1","2.2.0","2.1.9","2.1.8","2.1.7","2.1.6","2.1.5","2.1.4","2.1.3","2.1.2","2.1.1","2.1.0","2.0.9","2.0.8","2.0.7","2.0.6","2.0.5","2.0.2","2.0.1","2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54581.json","vanir_signatures_modified":"2026-09-19T08:14:22Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/64ebf3f60dc3df72a3b47fbb20a7f8072c0a0f5e","target":{"file":"libmport/fetch.c"},"deprecated":false,"digest":{"line_hashes":["276186686669721583823167012656388562511","219541036503213529366480024954147284260","219867170193786606266529216094979479232","314754098100687977375712053740569260673"],"threshold":0.9},"id":"CVE-2026-54581-0120aa29","signature_type":"Line"},{"source":"https://github.com/midnightbsd/mport/commit/b3e11ba078351402082a881209ee6fda5d332e3d","target":{"file":"libmport/util.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["273663711616624712904137650099031571974","294425045695914500674190171101965667096","87852885090537957491565621854760744324","182138002652916283422132749411705081273","133891235758763390135025935315507429585","338853542523308733483014684765343142728","207199073745177706665489780604859751366","122092128584208768294794609550683178198","337858432402960559802823748189594911313","221843752473596697732056465781662527261","142297238949626874537383624799227340961","91057373537920558804273305304659679011","257660415420928539487168048420879924442","68255568272259003946998349206003701392","311791982136376080149514111693465292710","265018424889668156976643022915695394469","112800010796803087182615053341756372216"]},"id":"CVE-2026-54581-1e377afe","signature_type":"Line","signature_version":"v1"},{"target":{"file":"libmport/util.c","function":"mport_decompress_zstd"},"deprecated":false,"digest":{"function_hash":"228860771419624533693889587099451733372","length":1724},"id":"CVE-2026-54581-9697aa24","signature_type":"Function","signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/b3e11ba078351402082a881209ee6fda5d332e3d"},{"signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/64ebf3f60dc3df72a3b47fbb20a7f8072c0a0f5e","target":{"function":"mport_fetch_bootstrap_index","file":"libmport/fetch.c"},"deprecated":false,"digest":{"function_hash":"49002796473091456156458222690498865897","length":1195},"id":"CVE-2026-54581-bde99094","signature_type":"Function"},{"source":"https://github.com/midnightbsd/mport/commit/b3e11ba078351402082a881209ee6fda5d332e3d","target":{"file":"libmport/fetch.c","function":"mport_fetch_index"},"deprecated":false,"digest":{"function_hash":"209395942731077130336847032314305746970","length":1848},"id":"CVE-2026-54581-bf826610","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"168883938179142272866881669702208103556","length":1165},"id":"CVE-2026-54581-c0a107f3","signature_type":"Function","signature_version":"v1","source":"https://github.com/midnightbsd/mport/commit/b3e11ba078351402082a881209ee6fda5d332e3d","target":{"file":"libmport/fetch.c","function":"mport_fetch_bootstrap_index"}},{"source":"https://github.com/midnightbsd/mport/commit/b3e11ba078351402082a881209ee6fda5d332e3d","target":{"file":"libmport/fetch.c"},"deprecated":false,"digest":{"line_hashes":["28155665265217389570373726260696265733","270546140310395727864820072664402228878","17189134069191075523197834239154910312","44484155967387362857806185456147595087","252824991807596761603464753526964202824","242500639577386535065508131056626515885","94449469585795167323269339478392859836","45325448920302085866589026156451866140","7449633375845181586455225165922152434","287251875171957920869938498977625021603","139701436355309232264874963606483723538","13139320937628813329424206767234075353","122491412888024131315075349147469244866"],"threshold":0.9},"id":"CVE-2026-54581-fa360697","signature_type":"Line","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N"}]}