DEBIAN-CVE-2026-73232

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently...

CVE-2026-73232

CVE-2026-73232 affects ffuf (Go) prior to 2.2.0. The vulnerability arises when a malicious server uses HTTP responses with compressed content: the guard in pkg/runner/simple.go checks only Content-Length, while io.ReadAll can read gzip, brotli, deflate, or chunked bodies without a decompressed-si...

CVE-2026-73232 ffuf denial of service (OOM) via HTTP response decompression bomb

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently...

CVE-2026-73232 ffuf denial of service (OOM) via HTTP response decompression bomb

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently...

OPENSUSE-SU-2026:21562-1 Security update for go-sendxmpp

This update for go-sendxmpp fixes the following issues: Changes in go-sendxmpp: - Update to 0.17.0: Add --ox-transfer-private-key to transfer the encrypted private key to PEP to transfer it to other devices requires go-xmpp = v0.3.7. Add --ox-receive-private-key to receive the encrypted private k...

CVE-2026-49834

A flaw was found in sigstore-go, a Go library for Sigstore signing and verification. This vulnerability allows a single compromised transparency log or Certificate Transparency CT log to bypass the multi-log threshold requirements. An attacker could exploit this by compromising a single log,...

CVE-2026-71556

A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

go-git: Malicious reference names may modify files outside the reference storage

...

SUSE CVE-2026-41178

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes Parse to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue...

SUSE CVE-2026-46384

iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, several Avro decoder paths read attacker-controlled 64-bit values from the wire format and either narrowed them to platform-sized int before bounds-checking, or summed them with overflow-prone signed-int arithmetic. On 32-bit targets...

SUSE CVE-2026-46385

iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, the Avro array and map decoders looped over an attacker-controlled block-count value without checking the underlying reader's error state inside the loop body. Reader.ReadBlockHeader returns the count as a Go int, which is 64-bit on amd64 ...

OPENSUSE-SU-2026:11494-1 clusterctl-1.14.0-1.1 on GA media

These are all security issues fixed in the clusterctl-1.14.0-1.1 package on the GA media of openSUSE Tumbleweed...

Security update for go-sendxmpp (important)

openSUSE Security Update: Security update for go-sendxmpp Announcement ID: openSUSE-SU-2026:0280-1 Rating: important References: 1266617 Cross-References: CVE-2026-39821 CVSS scores: CVE-2026-39821 SUSE: 9.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Affected Products: openSU...

CVE-2026-19496

A flaw was found in sources-api-go. An authenticated remote user can exploit a SQL injection vulnerability by injecting arbitrary SQL expressions through query parameter filtering. This can lead to unauthorized information disclosure of internal database fields, arbitrary PostgreSQL function...

SUSE-SU-2026:23216-1 Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z jscPED-11136: Go CVE Numbering Authority IDs added or updated with aliases: GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv...

SUSE-SU-2026:23227-1 Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z jscPED-11136: Go CVE Numbering Authority IDs added or updated with aliases: GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv...

DEBIAN-CVE-2026-18503

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...