go-toolset:rhel8 security, bug fix, and enhancement update

An update is available for golang, module.golang, module.delve, delve. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Go Toolset provides the Go programming...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.44 packages and security update

Red Hat OpenShift Container Platform release 4.19.44 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a...

RockyLinux 8 : go-toolset:rhel8 (RLSA-2026:60305)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:60305 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial o...

RHCOS 4 : OpenShift Container Platform 4.18.54 (RHSA-2026:57482)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57482 advisory. - net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 - crypto/x509: golang: golang crypto/x509: Denial of...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.30 security and extras update

Red Hat OpenShift Container Platform release 4.21.30 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a security impact of...

SUSE-SU-2026:3785-1 Security update for rootlesskit

This update for rootlesskit rebuilds it against the current go security release...

SUSE-SU-2026:3784-1 Security update for buildah

This update for buildah rebuilds it against the current go security release...

RHEL 10 : ignition (RHSA-2026:59546)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:59546 advisory. Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks, formatting partitions, writing...

tailscale v1.102.3

Tailscale https://tailscale.com Private WireGuard® networks made easy Overview This repository contains the majority of Tailscale's open source code. Notably, it includes the tailscaled daemon and the tailscale CLI tool. The tailscaled daemon runs on Linux, Windows, macOS, and to varying degrees ...

html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping

A flaw was found in html/template. A trusted template author could craft a script tag with an empty or whitespace-only 'type' attribute. This vulnerability causes the template engine to incorrectly escape data passed into the script block, potentially leading to cross-site scripting XSS. An...

whosthere v0.8.3

Whosthere Local Area Network discovery tool with an interactive Terminal User Interface TUI written in Go. Discover, explore, and understand your LAN in an intuitive way. Whosthere performs unprivileged, concurrent scans using mDNS and SSDP scanners. Additionally, it sweeps the local subnet by...

dnscontrol v5.0.0-rc9

DNSControl DNSControl is Infrastructure as Code for DNS. It includes a full-featured configuration language Javascript-compatible, plus "plug-ins" that speak to DNS provider APIs such as AWS Route 53, Cloudflare, and Gandi. It can send the same DNS records to multiple providers. It runs anywhere ...

Smap v1.0.0-beta

nmap alternative powered by shodan.io Smap is a passive port scanner built with shodan.io's free API. It takes the same command line arguments as Nmap and produces the same output, which makes it a drop-in replacement for Nmap. Features Scans 200 hosts per second Doesn't require any account/api k...

CVE-2026-72816

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: kots, trivy-operator, steampipe, kyverno-notation-aws, teleport, kyverno, xeol, chartmuseum, eksctl, cert-manager-cmctl, helm, maru, tigera-operator, opentofu, helm-mapkubeapis, conftest, falcoctl, k9s, argo-cd, kargo, k8ssandra-client, kube-arangodb, rancher-agent,...

brutus v1.11.0

Brutus "Et tu, Brute?" — The last words before credentials fall. Modern credential testing tool in pure Go Installation • Quick Start • Pipeline • Protocols • Enumeration • Proxy • Library Overview Brutus is a multi-protocol authentication testing tool designed to address a critical gap in...

The vulnerability of adding additional tools and integration libraries for the Go language that use OpenTelemetry, related to uncontrolled memory allocation, allows attackers to trigger a memory exhaustion condition.

The vulnerability of adding additional tools and integration libraries for the Go language with OpenTelemetry is related to uncontrolled memory allocation. Exploiting this vulnerability can allow a remote attacker to cause memory exhaustion...

CVE-2026-73232 ffuf denial of service (OOM) via HTTP response decompression bomb

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently...

CVE-2026-73232

CVE-2026-73232 affects ffuf (Go) prior to 2.2.0. The vulnerability arises when a malicious server uses HTTP responses with compressed content: the guard in pkg/runner/simple.go checks only Content-Length, while io.ReadAll can read gzip, brotli, deflate, or chunked bodies without a decompressed-si...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...