CVE-2026-54580
mport index decompression can leave partial or corrupt index data after zstd failures
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal in mport_decompress_zstd(), and libmport/fetch.c did not consistently propagate those failures to index-fetch callers. A malicious or faulty mirror could supply compressed package index data that caused ZSTD_decompressStream() or an output write to fail while leaving partial index output available for later use, resulting in package-index integrity loss or denial of service. This issue is fixed in version 2.7.8.
| CWE | CWE-354 CWE-755 |
| Vendor | midnightbsd |
| Product | mport |
| Published | Sep 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for midnightbsd mport
Be the first to know when new unknown vulnerabilities affecting midnightbsd mport are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
MidnightBSD / mport
< 2.7.8
References
github.com: https://github.com/MidnightBSD/mport/security/advisories/GHSA-ffqj-j42r-747w github.com: https://github.com/MidnightBSD/mport/pull/135 github.com: https://github.com/MidnightBSD/mport/commit/b3e11ba078351402082a881209ee6fda5d332e3d github.com: https://github.com/MidnightBSD/mport/releases/tag/2.7.8