GO-2025-3503 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-gcp, syft, trillian, opa-envoy, jaeger-operator, wave, cadvisor, cass-operator, distribution, pulumi-language-java, opa, fq, buildkitd, cert-manager-istio-csr, terraform-provider-time, terraform-provider-azurerm, wireguard-go,...

GO-2024-2824 vulnerabilities

Vulnerabilities for packages: docker-credential-ecr-login, dockerize, cosign, secrets-store-csi-driver-provider-gcp, src-fingerprint, wgcf, metrics-server, newrelic-infra-operator, spicedb, govulncheck, trillian, sops, k9s, golangci-lint, tekton-chains, tfsec, wave, cadvisor, gitleaks, opa, flyte...

GO-2024-2887 vulnerabilities

Vulnerabilities for packages: docker-credential-ecr-login, secrets-store-csi-driver-provider-gcp, syft, aws-flb-kinesis, trillian, wave, cadvisor, cass-operator, pulumi-language-java, opa, wazero, fq, buildkitd, yam, terraform-provider-azurerm, wireguard-go, grpc-health-probe, kube-state-metrics,...

GO-2024-3005 vulnerabilities

Vulnerabilities for packages: neuvector-scanner, docker-credential-gcr, cosign, helm-push, helm-operator, goreleaser, tkn, flux, dagdotdev, flux-image-reflector-controller, syft, grype, chartmuseum, k9s, k3d, tekton-chains, newrelic-infrastructure-agent, k3s, slsa-verifier,...

GO-2025-3447 vulnerabilities

Vulnerabilities for packages: docker-credential-ecr-login, secrets-store-csi-driver-provider-gcp, syft, aws-flb-kinesis, trillian, opa-envoy, jaeger-operator, wave, cadvisor, cass-operator, distribution, pulumi-language-java, opa, wazero, fq, buildkitd, cert-manager-istio-csr, yam,...

GO-2024-3250 vulnerabilities

Vulnerabilities for packages: pulumi-kubernetes-operator, cosign, minio, goreleaser, tkn, azcopy, flux-image-reflector-controller, crossplane-provider-azure-sql, chartmuseum, git-sync, kubernetes, tekton-chains, k3s, kine, doppler-kubernetes-operator, terraform, crossplane-provider-azure-storage,...

GO-2024-3333 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-gcp, syft, trillian, opa-envoy, jaeger-operator, wave, cadvisor, cass-operator, distribution, pulumi-language-java, opa, fq, buildkitd, cert-manager-istio-csr, kubernetes-replicator, terraform-provider-azurerm, wireguard-go,...

GO-2024-2963 vulnerabilities

Vulnerabilities for packages: docker-credential-ecr-login, secrets-store-csi-driver-provider-gcp, syft, aws-flb-kinesis, trillian, wave, cadvisor, cass-operator, pulumi-language-java, opa, wazero, yam, terraform-provider-azurerm, wireguard-go, kube-state-metrics, paranoia, nri-apache, helm-push,...

GO-2025-3373 vulnerabilities

Vulnerabilities for packages: docker-credential-ecr-login, secrets-store-csi-driver-provider-gcp, aws-flb-kinesis, trillian, opa-envoy, wave, cadvisor, cass-operator, distribution, wazero, fq, kubernetes-replicator, wireguard-go, grpc-health-probe, kube-state-metrics, paranoia, falco-exporter,...

GO-2024-3105 vulnerabilities

Vulnerabilities for packages: docker-credential-ecr-login, secrets-store-csi-driver-provider-gcp, syft, aws-flb-kinesis, trillian, wave, cadvisor, cass-operator, distribution, pulumi-language-java, opa, wazero, fq, buildkitd, yam, terraform-provider-azurerm, wireguard-go, grpc-health-probe,...

GO-2024-2719 vulnerabilities

Vulnerabilities for packages: goreleaser, tkn, tekton-chains, slsa-verifier, wolfictl, aactl, gitsign, spire-server, flux-source-controller, ko, apko, skaffold, policy-controller, melange, kubescape, zarf, vexctl, falcoctl, neuvector-sigstore-interface, zot...

GO-2024-2718 vulnerabilities

Vulnerabilities for packages: goreleaser, tkn, tekton-chains, slsa-verifier, wolfictl, aactl, gitsign, spire-server, flux-source-controller, ko, apko, skaffold, policy-controller, melange, kubescape, zarf, vexctl, falcoctl, neuvector-sigstore-interface, zot...

GO-2024-2687 vulnerabilities

Vulnerabilities for packages: docker-credential-ecr-login, secrets-store-csi-driver-provider-gcp, aws-flb-kinesis, trillian, cadvisor, cass-operator, pulumi-language-java, wazero, fq, buildkitd, yam, terraform-provider-azurerm, wireguard-go, grpc-health-probe, kube-state-metrics, paranoia,...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: golang1.26: golang1.26-1.26.6-0.1.hum1 aarch64, x8664 golang1.26-bin-1.26.6-0.1.hum1 aarch64, x8664 golang1.26-docs-1.26.6-0.1.hum1 noarch golang1.26-misc-1.26.6-0.1.hum1 noarch...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...