osquery

v5.23.0 Security

This release includes 4 security fixes for security teams reviewing exposed deployments.

Published 3mo Forensics & Incident Response

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 4 known CVEs

Topics

intrusion-detection monitoring security sql

Affected surfaces

rce_ssrf deps

Summary

AI summary

Fix format string vulnerability in shell.cpp disconnect_socket() and update expat to fix CVE-2026-25210.

Full changelog

What's Changed

Features

Add process memory scanning capability to yara table by @brian-mckinney in https://github.com/osquery/osquery/pull/8782
Split yara tables into yara_process and yara_file by @brian-mckinney in https://github.com/osquery/osquery/pull/8835
Add Windows process_open_handles table by @brian-mckinney in https://github.com/osquery/osquery/pull/8795
Add secureboot_certificates table for Linux by @zwass in https://github.com/osquery/osquery/pull/8844
Extend python_packages and npm_packages to cover modern package managers by @ariary in https://github.com/osquery/osquery/pull/8801
Add level filtering to the unified_log table by @directionless in https://github.com/osquery/osquery/pull/8788
Disallow newlines in curl custom headers by @directionless in https://github.com/osquery/osquery/pull/8787
Supplement LaunchServices with directory scanning in apps table (#8789) by @getvictor in https://github.com/osquery/osquery/pull/8790
Command line flags for query input and output by @directionless in https://github.com/osquery/osquery/pull/8786
New header-based authentication mechanism for remote APIs by @juan-fdz-hawa in https://github.com/osquery/osquery/pull/8805
Add recursion to npm_packages by @directionless in https://github.com/osquery/osquery/pull/8809
Make profile.py performance thresholds configurable via CLI flags by @stefanamaerz in https://github.com/osquery/osquery/pull/8841
Add ROOT\default to WMI tables by @directionless in https://github.com/osquery/osquery/pull/8810

Build & Dependencies

Update expat to 2.7.4 to fix CVE-2026-25210 by @Sampriti2803 in https://github.com/osquery/osquery/pull/8794
Fix GCC 15 compatibility by @carlsmedstad in https://github.com/osquery/osquery/pull/8837

Fixes

Fix macOS keychain corruption when accessing non-SSV keychain files by copying to temporary files first by @lucasmrod in https://github.com/osquery/osquery/pull/8840
Fix incorrect example queries in table specs by @edwardsb in https://github.com/osquery/osquery/pull/8791
Improve network_name detection on macOS wifi_status table by @lucasmrod in https://github.com/osquery/osquery/pull/8781
Fix a bug in apt_sources parsing by @directionless in https://github.com/osquery/osquery/pull/8785
Add NOCASE and VERSION collation to various columns by @directionless in https://github.com/osquery/osquery/pull/8813
Increase the limit on systemd unit iteration by @directionless in https://github.com/osquery/osquery/pull/8802
Fix format string vulnerability in shell.cpp disconnect_socket() by @directionless in https://github.com/osquery/osquery/pull/8824
Fix saving file times in file carves by @zwass in https://github.com/osquery/osquery/pull/8819
Fix empty results from office_mru table by @thierryfranzetti in https://github.com/osquery/osquery/pull/8838
Fix multiple security vulnerabilities in smc_keys.cpp by @directionless in https://github.com/osquery/osquery/pull/8820
Fix gatekeeper table on macOS 15+ by @thierryfranzetti in https://github.com/osquery/osquery/pull/8831
Fix container bounds checking vulnerabilities by @directionless in https://github.com/osquery/osquery/pull/8825
Reduce noisy logs from chrome_extensions by @lucasmrod in https://github.com/osquery/osquery/pull/8792

New Contributors

@edwardsb made their first contribution in https://github.com/osquery/osquery/pull/8791
@Sampriti2803 made their first contribution in https://github.com/osquery/osquery/pull/8794
@ariary made their first contribution in https://github.com/osquery/osquery/pull/8801
@juan-fdz-hawa made their first contribution in https://github.com/osquery/osquery/pull/8805
@thierryfranzetti made their first contribution in https://github.com/osquery/osquery/pull/8838
@stefanamaerz made their first contribution in https://github.com/osquery/osquery/pull/8841

Full Changelog: https://github.com/osquery/osquery/compare/5.22.1...5.23.0

Security Fixes

CVE-2026-25210 — update expat to 2.7.4 fixes the vulnerability
Fix format string vulnerability in shell.cpp disconnect_socket()
Fix multiple security vulnerabilities in smc_keys.cpp
Fix container bounds checking vulnerabilities

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track osquery

Get notified when new releases ship.

About osquery

SQL powered operating system instrumentation, monitoring, and analytics

All releases →