CVE-2026-42505

A flaw was found in the crypto/tls package in Go. Handshakes utilizing Encrypted Client Hello ECH could lead to de-anonymization by a passive network observer. This is due to the disclosure of pre-shared key identities within the unencrypted client hello, allowing an attacker to potentially link...

Important: Red Hat Security Advisory: RHTAS 1.4.2 - Tech Preview Release Of the Go based Model Transparency CLI

The Tech Preview release of the Go based RHTAS Model Transparency CLI image. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.4 The Go based RHTAS Model Transparency CLI image can be used to sign and verify AI/M...

USN-8519-1: Go Cryptography vulnerabilities

Jakub Ciolek and Nicola Murino discovered that Go Cryptography incorrectly handled SSH agent responses. An attacker could use this to cause a denial of service. CVE-2025-47913 Yuichi Watanabe discovered that Go Cryptography incorrectly handled SSH key exchanges. An attacker could use this to caus...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass

A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting XSS attacks in applications. Such attacks can result in information...

CVE-2026-42505 vulnerabilities

Vulnerabilities for packages: opensearch-k8s-operator, ocm-kubernetes-controller, crossplane-function-patch-and-transform-fips, athenz-csi-driver-fips, k8s-metacollector-fips, local-static-provisioner, crossplane-provider-aws-kms-fips, policy-bot-fips, docker-cli-buildx, boring-registry-fips,...

openSUSE 16 Security Update : hauler (openSUSE-SU-2026:21262-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21262-1 advisory. Changes in hauler: - update to 2.0.1 bsc1269433, CVE-2026-48702: bump go to 1.26.4 to squash CVE noise Full v2 Release notes:...

ALSA-2026:37436 Important: golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fixes: golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 os: golang: Go os.Root: Symlink following vulnerability allows directory traversal...

Important: golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fixes: golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 os: golang: Go os.Root: Symlink following vulnerability allows directory traversal...

openSUSE 16 Security Update : go1.26-openssl (openSUSE-SU-2026:21254-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21254-1 advisory. Update to go1.26.4 bsc1255111. Security issues fixed: - CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG bsc1261653. -...

RHEL 8 : rhc (RHSA-2026:36776)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:36776 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security Fixes: net...

MiracleLinux 8 : grafana-pcp-5.1.1-16.el8_10 (AXSA:2026-1229:09)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1229:09 advisory. golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 Tenable has extracted the...

AlmaLinux 9 : oci-seccomp-bpf-hook (ALSA-2026:36617)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:36617 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 Tenable has extracted the preceding description block directl...

openSUSE 16 Security Update : buildah (openSUSE-SU-2026:21241-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21241-1 advisory. This update for buildah fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels...

ROS-20260709-73-0021

The vulnerability of the net/http2 library in the Go programming language is related to pointer dereferencing errors. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

go1.25-1.25.12-1.1 on GA media (moderate)

go1.25-1.25.12-1.1 on GA media Announcement ID: openSUSE-SU-2026:11212-1 Rating: moderate Cross-References: CVE-2026-39822 CVE-2026-42505 CVSS scores: CVE-2026-39822 SUSE : 7.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2026-42505 SUSE : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N...

ROS-20260709-73-0023

The vulnerability in the HTTP/2 implementation using the Go programming language arises from executing a loop with an unreachable exit condition when processing the value of SETTINGSMAXFRAMESIZE, which is equal to 0. Exploiting this vulnerability could allow a remote attacker to cause a service...

CVE-2026-44332

Fiber is an Express inspired web framework written in Go. Prior to 3.3.0, the default Authorizer function in the BasicAuth middleware in middleware/basicauth/config.go uses short-circuit evaluation that skips password hash comparison for non-existent usernames, enabling reliable remote username...