Oracle Linux 10 : golang (ELSA-2026-10217)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-10217 advisory. 1.25.9-3 - Do not ignore any tests in check 1.25.9-2 - Skip terminal test in container 1.25.9-1 - Update to Go 1.25.9 fips-2 Tenable has extracted th...

CVE-2026-32952

go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using ntlmssp.Negotiator as an HTTP transport. Version 0.1.1 patches the issue...

golang security update

1.25.9-1 - Update to Go 1.25.9 fips-2 - Resolves: RHEL-169931...

go-ntlmssp 输入验证错误漏洞

go-ntlmssp is an open-source HTTP NTLM authentication protocol implementation by Microsoft Azure. Versions of go-ntlmssp prior to 0.1.1 contained a vulnerability related to input validation errors. This vulnerability stemmed from malicious NTLM challenge messages that could lead to out-of-bounds...

golang security update

1.25.9-3 - Do not ignore any tests in check 1.25.9-2 - Skip terminal test in container 1.25.9-1 - Update to Go 1.25.9 fips-2...

Oracle Linux 9 : golang (ELSA-2026-10219)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-10219 advisory. 1.25.9-1 - Update to Go 1.25.9 fips-2 - Resolves: RHEL-169931 Tenable has extracted the preceding description block directly from the Oracle Linux...

golang-github-prometheus-prometheus-3.11.2-1.1 on GA media (moderate)

golang-github-prometheus-prometheus-3.11.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:10607-1 Rating: moderate Cross-References: CVE-2026-40179 CVSS scores: CVE-2026-40179 SUSE : 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVE-2026-40179 SUSE : 5.3...

golang: cmd/compile: possible memory corruption after bound check elimination

A flaw was found in the cmd/compile package in the Go standard library. The compiler fails to correctly check for integer overflow or underflow in arithmetic operations involving loop induction variables. As a result, the compiler allows invalid memory indexing to occur at runtime, potentially...

crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages

A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...

cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names

A flaw was found in the Go programming language golang and its command-line tool cmd/go. A remote attacker could exploit this during the build process by crafting malicious SWIG Simplified Wrapper and Interface Generator file names that contain "cgo" and specific payloads. This could lead to code...

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...

golang: cmd/compile: no-op interface conversion bypasses overlap checking

A flaw was found in the cmd/compile package in the Go standard library. A no-op interface conversion prevented the compiler from correctly identifying non-overlapping memory moves. As a result, the compiler allows unsafe memory move operations to occur at runtime, potentially causing data...

GHSA-PJCQ-XVWQ-HHPJ go-ntlmssp NTLM challenges can panic on malformed payloads

go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using ntlmssp.Negotiator as an HTTP transport. Version 0.1.1 patches the issue...

go-ntlmssp NTLM challenges can panic on malformed payloads

go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using ntlmssp.Negotiator as an HTTP transport. Version 0.1.1 patches the issue...

CLSA-2026-1776954912 osbuild-composer: Fix of CVE-2026-25679

rebuild with newer golang 1.25.7-1.el96.tuxcare.els2 to fix CVE-2026-25679 net/url: reject IPv6 literal not at start of host...

GHSA-J88V-2CHJ-QFWX vulnerabilities

Vulnerabilities for packages: sqlexporter, dapr, spire-server, keda, kine, falcosidekick, openfga, telegraf, kots, jitsucom-bulker, rke2-cloud-provider, bento, step-ca, temporal, grafana-alloy, cerbos, sftpgo, src, certificate-transparency, opentelemetry-collector-contrib, trillian, spicedb,...

CLSA-2026-1776966842 go-rpm-macros: Fix of CVE-2026-25679

CVE-2026-25679: rebuild against golang-1.25.7-1.tuxcare.els2 which contains the net/url IPv6 host-literal parsing fix...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

Security update for go1.25-openssl

This update for go1.25-openssl fixes the following issues: Update to go1.25.9 bsc1244485. CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG bsc1261653. CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination bsc1261654. CVE-2026-27144: cmd/compile:...