An update for poco is now available for openEuler-24.03-LTS-SP1 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4091 Final 1.0 1.0 2026-09-25 Initial 2026-09-25 2026-09-25 openEuler SA Tool V1.0 2026-09-25 poco security update An update for poco is now available for openEuler-24.03-LTS-SP1 This is ROS melodic ros_comm's 3rdparty poco. Security Fix(es): A vulnerability was found in poco up to 1.14.1. It has been rated as problematic. Affected by this issue is the function MultipartInputStream of the file Net/src/MultipartReader.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.14.2 is able to address this issue. The patch is identified as 6f2f85913c191ab9ddfb8fae781f5d66afccf3bf. It is recommended to upgrade the affected component.(CVE-2025-6375) An update for poco is now available for master/openEuler-22.03-LTS-SP3/openEuler-22.03-LTS-SP4/openEuler-24.03-LTS/openEuler-24.03-LTS-Next/openEuler-24.03-LTS-SP1/openEuler-24.03-LTS-SP2/openEuler-24.03-LTS-SP3/openEuler-24.03-LTS-SP4. openEuler Security has rated this update as having a security impact of low. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Low poco https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4091 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-6375 https://nvd.nist.gov/vuln/detail/CVE-2025-6375 openEuler-24.03-LTS-SP1 poco-1.12.5p2-3.oe2403sp1.src.rpm poco-activerecord-1.12.5p2-3.oe2403sp1.aarch64.rpm poco-crypto-1.12.5p2-3.oe2403sp1.aarch64.rpm poco-data-1.12.5p2-3.oe2403sp1.aarch64.rpm poco-debug-1.12.5p2-3.oe2403sp1.aarch64.rpm poco-debuginfo-1.12.5p2-3.oe2403sp1.aarch64.rpm poco-debugsource-1.12.5p2-3.oe2403sp1.aarch64.rpm poco-devel-1.12.5p2-3.oe2403sp1.aarch64.rpm poco-doc-1.12.5p2-3.oe2403sp1.aarch64.rpm poco-encodings-1.12.5p2-3.oe2403sp1.aarch64.rpm poco-foundation-1.12.5p2-3.oe2403sp1.aarch64.rpm poco-json-1.12.5p2-3.oe2403sp1.aarch64.rpm poco-jwt-1.12.5p2-3.oe2403sp1.aarch64.rpm poco-mongodb-1.12.5p2-3.oe2403sp1.aarch64.rpm poco-mysql-1.12.5p2-3.oe2403sp1.aarch64.rpm poco-net-1.12.5p2-3.oe2403sp1.aarch64.rpm poco-netssl-1.12.5p2-3.oe2403sp1.aarch64.rpm poco-odbc-1.12.5p2-3.oe2403sp1.aarch64.rpm poco-pagecompiler-1.12.5p2-3.oe2403sp1.aarch64.rpm poco-prometheus-1.12.5p2-3.oe2403sp1.aarch64.rpm poco-sqlite-1.12.5p2-3.oe2403sp1.aarch64.rpm poco-util-1.12.5p2-3.oe2403sp1.aarch64.rpm poco-xml-1.12.5p2-3.oe2403sp1.aarch64.rpm poco-zip-1.12.5p2-3.oe2403sp1.aarch64.rpm poco-activerecord-1.12.5p2-3.oe2403sp1.x86_64.rpm poco-crypto-1.12.5p2-3.oe2403sp1.x86_64.rpm poco-data-1.12.5p2-3.oe2403sp1.x86_64.rpm poco-debug-1.12.5p2-3.oe2403sp1.x86_64.rpm poco-debuginfo-1.12.5p2-3.oe2403sp1.x86_64.rpm poco-debugsource-1.12.5p2-3.oe2403sp1.x86_64.rpm poco-devel-1.12.5p2-3.oe2403sp1.x86_64.rpm poco-doc-1.12.5p2-3.oe2403sp1.x86_64.rpm poco-encodings-1.12.5p2-3.oe2403sp1.x86_64.rpm poco-foundation-1.12.5p2-3.oe2403sp1.x86_64.rpm poco-json-1.12.5p2-3.oe2403sp1.x86_64.rpm poco-jwt-1.12.5p2-3.oe2403sp1.x86_64.rpm poco-mongodb-1.12.5p2-3.oe2403sp1.x86_64.rpm poco-mysql-1.12.5p2-3.oe2403sp1.x86_64.rpm poco-net-1.12.5p2-3.oe2403sp1.x86_64.rpm poco-netssl-1.12.5p2-3.oe2403sp1.x86_64.rpm poco-odbc-1.12.5p2-3.oe2403sp1.x86_64.rpm poco-pagecompiler-1.12.5p2-3.oe2403sp1.x86_64.rpm poco-prometheus-1.12.5p2-3.oe2403sp1.x86_64.rpm poco-sqlite-1.12.5p2-3.oe2403sp1.x86_64.rpm poco-util-1.12.5p2-3.oe2403sp1.x86_64.rpm poco-xml-1.12.5p2-3.oe2403sp1.x86_64.rpm poco-zip-1.12.5p2-3.oe2403sp1.x86_64.rpm A vulnerability was found in poco up to 1.14.1. It has been rated as problematic. Affected by this issue is the function MultipartInputStream of the file Net/src/MultipartReader.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.14.2 is able to address this issue. The patch is identified as 6f2f85913c191ab9ddfb8fae781f5d66afccf3bf. It is recommended to upgrade the affected component. 2026-09-25 CVE-2025-6375 openEuler-24.03-LTS-SP1 Low 3.3 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L poco security update 2026-09-25 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4091