[Mobilitydb-dev] Coordinated Vulnerability Disclosure - MobilityDB / MobilityDB

[Brandon Tarr]

Greetings MobilityDB Security Team,


I'm a vulnerability analyst at VulnCheck <https://www.vulncheck.com/> an
exploit intelligence company and research CVE Numbering Authority (CNA),
where I'm one of several folks who manage our coordinated vulnerability
disclosure (CVD) program.

An external security researcher recently reported
<https://www.vulncheck.com/advisories/report> a potential vulnerability
impacting [MobilityDB / MobilityDB
<https://github.com/MobilityDB/MobilityDB>] and VulnCheck is acting as the
intermediary and coordinator.

VulnCheck follows a 120-day disclosure policy
<https://www.vulncheck.com/vulnerability-disclosure-policy>, meaning we
afford vendors/maintainers up to 120 days from the time of receiving the
report to address the issue before publication of a CVE record and
third-party advisory. For this vulnerability, the 120-day deadline is *January
26, 2027 (26/01/2027)*. Of note, patch publication constitutes public
disclosure — if a patch is issued, we will publish the CVE record at that
time rather than waiting for the full 120-day window.

The researcher has provided us with a comprehensive technical report, which
we have attached to this email. Let us know if you have any questions for
us about the CVD process or for the researcher regarding the reported
vulnerability.

-- 
Thank you,

<https://www.vulncheck.com/>

Brandon Tarr
VulnCheck
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/mobilitydb-dev/attachments/20260928/29905c4b/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: mobilitydb-meos-wkb-oob-read-report.md
Type: text/markdown
Size: 5888 bytes
Desc: not available
URL: <http://lists.osgeo.org/pipermail/mobilitydb-dev/attachments/20260928/29905c4b/attachment-0001.md>