net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

openSUSE 16 Security Update : c-ares (openSUSE-SU-2026:21721-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21721-1 advisory. Updat to c-ares 1.36.8. - CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via aresgetaddrinfo over...

link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897

The existing advisory GHSA-4gp8-rjrq-ch6q / CVE-2026-43897 states that the SSRF issue was fixed in 4.0.1. However, 4.0.3 remains bypassable when the documented resolveDNSHost mitigation is used. Root cause: The library validates one resolved IP address through resolveDNSHost, but later performs...

EUVD-2026-63439

link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897...

nimux v1.0.5

Pure-Nim network enumeration and remote execution toolkit nimux - Native Operator Toolkit nimux is a native command surface for authorized security assessments. It combines network enumeration, lightweight web discovery, credential validation, Active Directory operations, Kerberos workflows, remo...

EUVD-2026-64334

NLTK: SSRF Fail-Open in validatenetworkurl via DNS Resolution Failure...

Security Bulletin: Multiple vulnerabilies in Netty impacting IBM webMethods API Management

Summary Multiple vulnerabilities in Netty have been addressed in IBM webMethods developer portal and IBM webMethods ControlPlane Vulnerability Details CVEID:CVE-2026-42579 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final,...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

SUSE CVE-2026-81928

Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sigdata when re-encoding a message with a misplaced TSIG record. sigdata signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

MITM (Man-in-the-Middle) Netty Dependency in Confluence Data Center

This is a vulnerability in a non-Atlassian Confluence dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This High severity MITM Man-in-the-Middle vulnerability known as CVE-2026-45674 was introduced in versions 7.4.0, 7.13.0, 7.19.0, 8.5.0, 8.9.0...

Security Bulletin: IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint

Summary IBM ContextForge MCP Gateway contains a server-side request forgery SSRF vulnerability in its Agent-to-Agent A2A invocation endpoint POST /a2a/agentname/invoke. Unlike every other outbound egress path in the gateway, the A2A invocation path does not pin the DNS-resolved IP address at...

Security Bulletin: IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation

Summary IBM ContextForge MCP Gateway mcp-contextforge-gateway validates REST tool target URLs for server-side request forgery SSRF only once, at tool-registration time. When the same tool is later invoked, the stored URL is used directly without re-validation or DNS-resolution pinning, allowing a...

resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses

A flaw was found in the resolv gem. An attacker controlling DNS responses e.g., a spoofed response or a malicious upstream DNS server can exploit this by sending crafted DNS responses containing many distinct unknown DNS resource record pairs or SvcParamKeys. This leads to uncontrolled memory...

resolv: Resolv gem: DNS allowlist and egress bypass, and cache poisoning via crafted hostnames

A flaw was found in the resolv gem. This vulnerability arises from the incorrect handling of DNS label lengths during message encoding. A remote attacker could exploit this by providing a specially crafted hostname to an application utilizing the resolv gem. This could lead to the bypass of...

resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses

A flaw was found in the resolv gem. An attacker controlling DNS responses e.g., a spoofed response or a malicious upstream DNS server can exploit this by sending crafted DNS responses containing many distinct unknown DNS resource record pairs or SvcParamKeys. This leads to uncontrolled memory...

resolv: Resolv gem: DNS allowlist and egress bypass, and cache poisoning via crafted hostnames

A flaw was found in the resolv gem. This vulnerability arises from the incorrect handling of DNS label lengths during message encoding. A remote attacker could exploit this by providing a specially crafted hostname to an application utilizing the resolv gem. This could lead to the bypass of...

MITM (Man-in-the-Middle) Netty Dependency in Confluence Data Center

This is a vulnerability in a non-Atlassian Confluence dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This High severity MITM Man-in-the-Middle vulnerability known as CVE-2026-47691 was introduced in versions 7.4.0, 7.13.0, 7.19.0, 8.5.0, 8.9.0...

github.com/mark3labs/mcp-go: mcp-go: DNS Rebinding vulnerability due to missing Host header validation

A flaw was found in mcp-go. This component failed to validate the Host header in HTTP requests, specifically within its StreamableHTTPServer and SSEServer transports. A remote attacker could exploit this by using a crafted web page to perform a DNS rebinding attack. This allows the attacker to...

github.com/mark3labs/mcp-go: mcp-go: DNS Rebinding vulnerability due to missing Host header validation

A flaw was found in mcp-go. This component failed to validate the Host header in HTTP requests, specifically within its StreamableHTTPServer and SSEServer transports. A remote attacker could exploit this by using a crafted web page to perform a DNS rebinding attack. This allows the attacker to...