272 matches found
EUVD-2026-108650
JweRsaKeyEncryptionDecryptorImpl.Decrypt passed the JWE's initialization vector to cipher.AEAD.Open without checking its length. The Go standard library panics rather than returning an error when a GCM nonce is not exactly NonceSize bytes, so a JWE carrying a wrong-sized IV crashes the decrypting...
CVE-2026-89318 JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)
JweRsaKeyEncryptionDecryptorImpl.Decrypt passed the JWE's initialization vector to cipher.AEAD.Open without checking its length. The Go standard library panics rather than returning an error when a GCM nonce is not exactly NonceSize bytes, so a JWE carrying a wrong-sized IV crashes the decrypting...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...
golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
net/mail: golang: net/mail: Denial of Service via pathological email address parsing
A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...
net/mail: golang: net/mail: Denial of Service via pathological email address parsing
A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...
Important: Red Hat Security Advisory: rhc-worker-playbook security update
An update for rhc-worker-playbook is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...
Important: Red Hat Security Advisory: grafana-pcp security update
An update for grafana-pcp is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...
Important: Red Hat Security Advisory: delve security update
An update for delve is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
RHEL 10 : rhc-worker-playbook (RHSA-2026:67464)
The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:67464 advisory. A worker for yggdrasil that receives Ansible playbooks and executes them against the local host. Security Fixes: encoding/asn1: golang: Go...
golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...
Important: Red Hat Security Advisory: osbuild-composer security, bug fix, and enhancement update
An update for osbuild-composer is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
MiracleLinux 8 : grafana-9.2.10-33.el8_10 (AXSA:2026-1795:29)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1795:29 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service...
RLSA-2026:65116 Important: opentelemetry-collector security update
Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs...