net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting

A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering

A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting XSS attacks, where...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

SUSE-SU-2026:23764-1 Security update for the Linux Kernel (Live Patch 28 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-51.1 fixes various security issues: The following security issues were fixed: - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction bsc1275458. - CVE-2026-68138: net/sched: serialize qdiscrtablist against...

SUSE-SU-2026:23839-1 Security update for the Linux Kernel (Live Patch 28 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-51.1 fixes various security issues: The following security issues were fixed: - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction bsc1275458. - CVE-2026-68138: net/sched: serialize qdiscrtablist against...

SUSE-SU-2026:23838-1 Security update for the Linux Kernel (Live Patch 27 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-50.2 fixes various security issues: The following security issues were fixed: - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction bsc1275458. - CVE-2026-64561: KVM: x86: Check for invalid/obsolete root...

SUSE-SU-2026:23763-1 Security update for the Linux Kernel (Live Patch 27 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-50.2 fixes various security issues: The following security issues were fixed: - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction bsc1275458. - CVE-2026-64561: KVM: x86: Check for invalid/obsolete root...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.33 security and extras update

Red Hat OpenShift Container Platform release 4.21.33 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a security impact of...

SUSE-SU-2026:23832-1 Security update for the Linux Kernel RT (Live Patch 11 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-32.1 fixes various security issues: The following security issues were fixed: - CVE-2026-46150: fanotify: fix false positive on permission events bsc1267388. - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device...

SUSE-SU-2026:23837-1 Security update for the Linux Kernel (Live Patch 26 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-49.1 fixes various security issues: The following security issues were fixed: - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction bsc1275458. - CVE-2026-64561: KVM: x86: Check for invalid/obsolete root...

SUSE-SU-2026:23761-1 Security update for the Linux Kernel (Live Patch 25 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-48.1 fixes various security issues: The following security issues were fixed: - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction bsc1275458. - CVE-2026-64561: KVM: x86: Check for invalid/obsolete root...

SUSE-SU-2026:23762-1 Security update for the Linux Kernel (Live Patch 26 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-49.1 fixes various security issues: The following security issues were fixed: - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction bsc1275458. - CVE-2026-64561: KVM: x86: Check for invalid/obsolete root...

RLSA-2026:67161 Important: git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal...

git-lfs security update

An update is available for git-lfs. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Git Large File Storage LFS replaces large files such as audio samples, videos...