283 matches found
golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...
MongoDB Database Tools encryption issue vulnerability
Versions of MongoDB Database Tools prior to 100.20.0 contain an encryption-related vulnerability. This vulnerability stems from the reliance on the TLS implementation within the Go standard library and the use of a system CA for storage; however, Go version 1.26.8 does not include the crypto/x509...
EUVD-2026-108650
JweRsaKeyEncryptionDecryptorImpl.Decrypt passed the JWE's initialization vector to cipher.AEAD.Open without checking its length. The Go standard library panics rather than returning an error when a GCM nonce is not exactly NonceSize bytes, so a JWE carrying a wrong-sized IV crashes the decrypting...
CVE-2026-89318 JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)
JweRsaKeyEncryptionDecryptorImpl.Decrypt passed the JWE's initialization vector to cipher.AEAD.Open without checking its length. The Go standard library panics rather than returning an error when a GCM nonce is not exactly NonceSize bytes, so a JWE carrying a wrong-sized IV crashes the decrypting...
CVE-2026-89318
"JweRsaKeyEncryptionDecryptorImpl.Decrypt" passed the JWE's initialization vector to "cipher.AEAD.Open" without checking its length. The Go standard library panics rather than returning an error when a GCM nonce is not exactly "NonceSize" bytes, so a JWE carrying a wrong-sized IV crashes the...
Eclipse KeyPont - Improper GOSE exception handling vulnerability
Eclipse KeyPont – Versions 0.8.0 through 0.13.0-rc1 and versions prior to 1.0.0-rc4 contain an improper exception handling vulnerability. This vulnerability arises because JweRsaKeyEncryptionDecryptorImpl.Decrypt fails to verify the length of the JWE initialization vector; it passes an incorrectl...
CLSA-2026-1790850483 buildah: Fix of 7 CVEs
Rebuild el96 against golang = 1.25.7-1.el96.tuxcare.els16 to pick up the Go standard library fixes for: - CVE-2026-33818: enforce a recursion limit in encoding/asn1 Unmarshal to prevent stack exhaustion on deeply nested input - CVE-2026-56853: apply ReadHeaderTimeout while sniffing the...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
CLSA-2026-1790802024 skopeo: Fix of 4 CVEs
rebuild with newer golang 1.22.9-1.el92.tuxcare.els26 to fix the following Go standard-library CVEs - CVE-2026-33818: encoding/asn1: enforce a maximum recursion depth in parseField and parseSequenceOf, so a deeply nested crafted DER payload can no longer exhaust the stack while unmarshalling -...
CLSA-2026-1790801022 skopeo: Fix of 5 CVEs
rebuild with newer golang 1.25.7-1.el96.tuxcare.els16 to fix the following Go standard-library CVEs - CVE-2026-33818: encoding/asn1: enforce a maximum recursion depth in parseField and parseSequenceOf, so a deeply nested crafted DER payload can no longer exhaust the stack while unmarshalling -...
CLSA-2026-1790782220 buildah: Fix of 5 CVEs
Rebuild el96 against golang = 1.25.7-1.el96.tuxcare.els16 to pick up the Go standard library fixes for: - CVE-2026-33818: enforce a recursion limit in encoding/asn1 Unmarshal to prevent stack exhaustion on deeply nested input - CVE-2026-56853: apply ReadHeaderTimeout while sniffing the...
golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...
CLSA-2026-1790588952 podman: Fix of 5 CVEs
rebuild with newer golang version 1.22.9-1.el92.tuxcare.els26 to fix the following Go standard-library CVE's - CVE-2026-33818: encoding/asn1: enforce a maximum recursion depth in parseField and parseSequenceOf, so a deeply nested crafted DER payload can no longer exhaust the stack while...
golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
net/mail: golang: net/mail: Denial of Service via pathological email address parsing
A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...
CLSA-2026-1790162911 delve: Fix of 5 CVEs
rebuild with golang 1.22.9-1.el92.tuxcare.els26 to fix five Go standard library CVEs - CVE-2026-33818: encoding/asn1 - enforce a maximum recursion depth when unmarshalling, so deeply nested DER cannot exhaust the stack - CVE-2026-56858: html/template - keep the JavaScript regexp/division context...