Fedora 43 : dotnet10.0 (2026-91c099294a)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-91c099294a advisory. Update to .NET SDK 10.0.111 and Runtime 10.0.11 Fixes:...

Fedora 43 : dotnet9.0 (2026-9c8770dffb)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9c8770dffb advisory. Update to .NET SDK 9.0.120 and Runtime 9.0.19 Fixes:...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls

A flaw was found in the net/http/httputil package, specifically within the ReverseProxy component. This vulnerability allows the ReverseProxy to forward query parameters that are not visible to Rewrite functions. This occurs because the ReverseProxy does not correctly consider the url.ParseQuery...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

net/textproto: golang: Golang net/textproto: Misleading error messages via input injection

A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead...

CVE-2026-74310

A flaw was found in the Linux kernel's vhost/net component. This use-after-free vulnerability occurs due to incorrect handling of zerocopy user buffers, where the system may prematurely complete buffer operations while other parts of the system still hold references to the same memory. This can...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

Security update for ctop (important)

openSUSE Security Update: Security update for ctop Announcement ID: openSUSE-SU-2026:0292-1 Rating: important References: 1248710 1257431 1265800 1266632 1267805 Cross-References: CVE-2022-21698 CVE-2024-45310 CVE-2026-10722 CVE-2026-33814 CVE-2026-39821 CVSS scores: CVE-2022-21698 SUSE: 7.5...

CVE-2026-72491

A flaw was found in the Linux kernel's net/9p RDMA transport module. An inconsistent locking mechanism around the rdma-state field allows for a race condition during connection teardown. This can lead to lost state transitions, corrupting the connection state machine. Consequently, a use-after-fr...

CVE-2026-75589

A flaw was found in Net::OAuth. This vulnerability arises from a non-constant-time comparison used when verifying HMAC-SHA1, HMAC-SHA256, and PLAINTEXT signatures. A remote attacker could exploit this by timing the responses to submitted messages, allowing them to recover valid signatures or, in...

CVE-2026-74493

A flaw was found in the Linux kernel's net/smc component. A use-after-free vulnerability occurs during link group termination when a concurrent close operation unregisters a connection and frees its socket before the termination worker can properly hold the socket. This race condition can lead to...

CVE-2026-72414

A flaw was found in the Linux kernel's net: dsa: sja1105 component. This vulnerability occurs when processing specific timing parameters, where very small user-provided values are converted to zero. This incorrect conversion can lead to a division-by-zero error in the futurebasetime function, whi...

CVE-2026-72344

A flaw was found in the Linux kernel's net/mlx5e driver. When the mlx5laggetdevseq function encounters an error, such as a peer not being in the Link Aggregation Group LAG or no master device being marked, the system attempts to clean up peer flows without proper validation. This improper handlin...

CVE-2026-72343

A flaw was found in the net/mlx5e component of the Linux kernel. A zero-sized buffer is allocated during the initialization of HV VHCA statistics. When the hypervisor later attempts to enable statistics reporting, a write operation is performed on this invalid memory address. This can lead to a...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...