medium 6.5

CVE-2026-43804 json

This issue was addressed through improved state management.

published 2026-07-27 3 mo ago modified 2026-07-28 3 mo ago also EUVD-2026-49434

cvss: 6.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits: 0; none known

This issue was addressed through improved state management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6. Visiting a website may lead to an app denial-of-service.

Patch / fix

fixed in 4 distros 7

Apple Safari 26.6
Apple iOS and iPadOS 26.6
Apple macOS 26.6
Apple visionOS 26.6

debian ubuntu red hat suse opensuse almalinux rocky linux

wpewebkit Debian 14 2.52.6-1
webkit2gtk Debian 13 2.52.6-1~deb13u1
webkit2gtk Debian 14 2.52.6-1

debian advisories DEBIAN-CVE-2026-43804

webkit2gtk Ubuntu 24.04 LTS 2.52.6-0ubuntu0.24.04.1
webkit2gtk Ubuntu 26.04 LTS 2.52.6-0ubuntu0.26.04.1

ubuntu advisories UBUNTU-CVE-2026-43804

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

webkit2gtk3 RHEL 8 2.54.0-1.el8_10
webkit2gtk3-jsc RHEL 8 2.54.0-1.el8_10
webkit2gtk3 RHEL 9 2.54.0-1.el9_8
webkit2gtk3-jsc RHEL 9 2.54.0-1.el9_8

red hat advisories RHSA-2026:74084 RHSA-2026:69098

webkit2gtk3 SLES for SAP applications 16.0, SLES 16.0 2.54.1-160000.1.1
webkit2gtk4 SLES for SAP applications 16.0, SLES 16.0 2.54.1-160000.1.1
webkit2gtk3 SLE Module for Desktop Applications 15 SP7 2.52.6-150600.12.74.1
webkit2gtk4 SLE Module for Development Tools 15 SP7, SLE Module for Basesystem 15 SP7 2.52.6-150600.12.74.1
webkit2gtk3-soup2 SLE Module for Basesystem 15 SP7 2.52.6-150600.12.74.1
webkit2gtk3 SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 2.52.6-150400.4.149.2
webkit2gtk4 SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 2.52.6-150400.4.149.2
webkit2gtk3-soup2 SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 2.52.6-150400.4.149.2

suse advisories SUSE-SU-2026:24225-1 SUSE-SU-2026:4020-1 SUSE-SU-2026:4001-1

webkit2gtk3 openSUSE Leap 16.0 2.54.1-160000.1.1
webkit2gtk4 openSUSE Leap 16.0 2.54.1-160000.1.1
webkit2gtk3-soup2 openSUSE Leap 16.0 2.54.1-160000.1.1

opensuse advisories openSUSE-SU-2026:22076-1

webkit2gtk3 AlmaLinux 8 2.54.0-1.el8_10
webkit2gtk3-jsc AlmaLinux 8 2.54.0-1.el8_10
webkit2gtk3 AlmaLinux 9 2.54.0-1.el9_8
webkit2gtk3-jsc AlmaLinux 9 2.54.0-1.el9_8

almalinux advisories ALSA-2026:74084 ALSA-2026:69098

webkit2gtk3 Rocky Linux 8 2.54.0-1.el8_10
webkit2gtk3 Rocky Linux 9 2.54.0-1.el9_8

rocky linux advisories RLSA-2026:74084 RLSA-2026:69098

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-43804 updated 2026-11-06 cvss 6.5

webkitgtk: Visiting a website may lead to an app denial-of-service

Red Hat Enterprise Linux 6 webkitgtk
affected: workaround, no fix planned “Out of support scope”
Red Hat Enterprise Linux AppStream (v. 8) webkit2gtk3 2.54.0-1.el8_10, webkit2gtk3-jsc 2.54.0-1.el8_10
fixed: vendor fix RHSA-2026:74084
Red Hat Enterprise Linux AppStream (v. 9) webkit2gtk3 2.54.0-1.el9_8, webkit2gtk3-jsc 2.54.0-1.el9_8
fixed: vendor fix RHSA-2026:69098
Red Hat Enterprise Linux AppStream AUS (v.8.4) webkit2gtk3 2.54.0-1.el8_4, webkit2gtk3-jsc 2.54.0-1.el8_4
fixed: vendor fix RHSA-2026:95403
Red Hat Enterprise Linux AppStream AUS (v.8.6) webkit2gtk3 2.54.0-1.el8_6, webkit2gtk3-jsc 2.54.0-1.el8_6
fixed: vendor fix RHSA-2026:92339
Red Hat Enterprise Linux AppStream E4S (v.8.8) webkit2gtk3 2.54.0-1.el8_8, webkit2gtk3-jsc 2.54.0-1.el8_8
fixed: vendor fix RHSA-2026:93435
Red Hat Enterprise Linux AppStream E4S (v.9.2) webkit2gtk3 2.54.0-1.el9_2, webkit2gtk3-jsc 2.54.0-1.el9_2
fixed: vendor fix RHSA-2026:89822
Red Hat Enterprise Linux AppStream E4S (v.9.4) webkit2gtk3 2.54.0-1.el9_4, webkit2gtk3-jsc 2.54.0-1.el9_4
fixed: vendor fix RHSA-2026:92216

show 6 more

Red Hat Enterprise Linux AppStream EUS (v.9.6) webkit2gtk3 2.54.0-1.el9_6, webkit2gtk3-jsc 2.54.0-1.el9_6
fixed: vendor fix RHSA-2026:89821
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) webkit2gtk3 2.54.0-1.el8_4, webkit2gtk3-jsc 2.54.0-1.el8_4
fixed: vendor fix RHSA-2026:95403
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) webkit2gtk3 2.54.0-1.el8_6, webkit2gtk3-jsc 2.54.0-1.el8_6
fixed: vendor fix RHSA-2026:92339
Red Hat Enterprise Linux AppStream TUS (v.8.8) webkit2gtk3 2.54.0-1.el8_8, webkit2gtk3-jsc 2.54.0-1.el8_8
fixed: vendor fix RHSA-2026:93435
Red Hat Enterprise Linux Server (v. 7 ELS) webkitgtk4 2.54.0-1.el7_9, webkitgtk4-jsc 2.54.0-1.el7_9 Red Hat Enterprise Linux Server Optional (v. 7 ELS) webkitgtk4-doc 2.54.0-1.el7_9, webkitgtk4-devel 2.54.0-1.el7_9, webkitgtk4-debuginfo 2.54.0-1.el7_9, webkitgtk4-jsc-devel 2.54.0-1.el7_9
fixed: vendor fix RHSA-2026:91631
Red Hat Enterprise Linux 7 webkitgtk3, libwebkit2gtk
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 3 mo ago (2026-07-28)

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CNA	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Apple Safari
Apple iOS and iPadOS
Apple macOS
Apple visionOS

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption

References

support.apple.com /en-us/128066
release-notes, vendor-advisory
support.apple.com /en-us/128067
release-notes, vendor-advisory
support.apple.com /en-us/128070
release-notes, vendor-advisory
support.apple.com /en-us/128073
release-notes, vendor-advisory

Sources

CVE List CVE-2026-43804
NVD CVE-2026-43804

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary