[Xymon] Re: Additional technical context – divergence between main and 4.x-master

On 1/16/26 12:46, Bruno Manzoni via Xymon wrote:

*MISSING COMMITS without semantic equivalent  (AI powered analysis)* Security / CVE

• 484edeb2 – CVE-2019-* buffer overflow / XSS
• 6dbcd04e – CVE-2016-2056 / 2058 command + JS injection
• 1a4511a7 – CVE-2016-2057 IPC permissions
• df404398 – CVE-2016-2055 config file exposure

Crash / memory safety

• ba47d2f9 – xymongen availability segfault
• 81656c6a – crash on missing allevents
• c3a8a2c9 – RPC buffer size miscalculation
• 4f444be0 – netapp RRD memory leak
• bee6eee8 – double-free in xymond
• 1ab01960 – NULL checks to prevent segfault

Correctness / parsing

• 8ab6c328 – RRD DS comma parsing
• eda84777 – SNMPv3 config parsing
• a123a029 – do_temperature parentheses parsing
• 3f266c08 – do_temperature parsing fixes
• 3227f657 – logfetch off-by-one with triggers
• 95092119 – history logs with dash/underscore names
• 9f62e942 – NONETPAGE parsing tightening

Build / portability

• 4e846f16 – GCC diagnostics guards
• b1414cd8 – stdint.h include tightening
• 3eed090e – Fedora/GCC compile fixes
• 0a546cc1 – avoid unnecessary mod_authz_groupfile loading

This is useful, but I think it would be better served as an issue to investigate opened in the git repo. I will say that while I was fixing another issue I encountered:

• 8ab6c328 – RRD DS comma parsing

so I'll have to investigate this commit further. I think cherry-picking these commits is probably a fairly high priority.

Thanks

Mark