CLEANSTART-2026-CA40991 mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS

CVE-2026-2303 affects multiple packages. The mongo-go-driver repository contains CGo bindings for GSSAPI Kerberos authentication on Linux and macOS. See references for individual vulnerability details...

CLEANSTART-2026-YC32527 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the consul package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-JQ09832 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84445 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-TQ62696 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the consul package. gRPC-Go is the Go language implementation of gRPC...

PT-2026-104332

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description An allocation of resources without limits or throttling issue exists in the Apache Thrift Go bindings. This can lead to an unauthenticated single-packet crash of Go Thrift servers through the...

PT-2026-104334

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description An allocation of resources without limits or throttling issue exists in the C++, Java, Go, netstd, Python, and Delphi bindings. Specifically, the TJSONProtocol accepts a single JSON string or...

Xalgorix Autonomous AI Pentesting Agent 4.6.136

Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported - so you get proof, not a pile of maybes to triage. Self-hosted, private, and bring-your-own-LLM. Built in Go + TypeScript...

CVE-2026-83663: Uncontrolled Recursion

Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call Read again instead of looping. A peer produces such a frame for 4 bytes in TFramedTransport...

CVE-2026-63772: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94637: Improper Handling of Highly Compressed Data (Data Amplification)

Improper handling of highly compressed data data amplification vulnerability in Apache Thrift Go bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

openSUSE 16 Security Update : rclone (openSUSE-SU-2026:21999-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21999-1 advisory. Changes in rclone: - Update to version 1.75.1: boo1279548 - Security - archive - Fix zip slip path traversal in untrusted zip files...

PT-2026-104327

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description An uncontrolled recursion issue exists in the Go bindings. Both Go transports attempt to satisfy a read from a buffered frame; if the frame contains no payload bytes, the system reads the next...

PT-2026-104297

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Apache Thrift Go bindings contain an issue involving the improper handling of highly compressed data, which can lead to data amplification. Data amplification occurs when a small amount of inp...

CVE-2026-66055: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

MAL-2026-17453 Malicious code in gocommunity.io/orderedbtree (Go)

Part of the Graphalgo campaign. The module, first published around 2026-08-11, contains a second-stage remote access trojan in plaintext that runs automatically. The RAT collects system information, executes decrypted Go or JavaScript payloads, and polls two command-and-control channels every 3-1...

MAL-2026-17454 Malicious code in gogets.dev/btreex (Go)

Part of the Graphalgo campaign. The module, first published around 2026-09-08, hides its payload in a ZIP archive disguised as a SQL file btreex.sql. The payload is triggered when a specific price integer value is passed, and drops the same dual-channel RAT Ethereum smart contract dead drop plus...

CVE-2026-82458: Memory Allocation with Excessive Size Value

Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.18.56 packages and security update

Red Hat OpenShift Container Platform release 4.18.56 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.18. Red Hat Product Security has rated this update as having a...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...