Rocky Linux 9 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc Multiple Vulnerabilities (crlsa-2024_3827)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243827 advisory. golang: net/http: memory exhaustion in Request.ParseMultipartForm CVE-2023-45290 jose-go: improper handling of highly compressed data CVE-2024-28180 builda...

CLEANSTART-2026-MP78954 malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go ...

CVE-2026-56865 affects multiple packages. A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. See references for individual vulnerabilit...

CLEANSTART-2026-QN15413 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the cosign package. gRPC-Go is the Go language implementation of gRPC...

CLEANSTART-2026-SC17390 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-24051 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-TF52309 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the containerd package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-YQ07083 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the containerd package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-ZK08124 spdystream is a Go library for multiplexing streams over SPDY connections

Security vulnerability affects the containerd package. spdystream is a Go library for multiplexing streams over SPDY connections...

CLEANSTART-2026-OJ68067 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

Security vulnerability affects the containerd package. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards...

CLEANSTART-2025-KH04903 Go before 1

Security vulnerability affects the containerd package. Go before 1...

CLEANSTART-2026-TP40136 Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content

Security vulnerability affects the coredns package. Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content...

CLEANSTART-2025-JA36317 issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input

Security vulnerability affects the coredns package. An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input...

CLEANSTART-2026-DA21677 go command may execute unexpected commands when operating in untrusted VCS repositories

Security vulnerability affects the buildkitd package. The go command may execute unexpected commands when operating in untrusted VCS repositories...

CLEANSTART-2024-ZT93221 flaw was found in Go

Security vulnerability affects the buildah package. A flaw was found in Go...

ROOT-APP-GOBINARY-CVE-2025-22872 CVE-2025-22872 in golang.org/x/net - Patched by Root

Root has patched CVE-2025-22872 in the golang.org/x/net package for Root:Go. Multiple fixed versions available...

CLEANSTART-2026-OA61681 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the alertmanager package. gRPC-Go is the Go language implementation of gRPC...

CVE-2026-103396

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view...

SUSE CVE-2026-81870

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration...

CVE-2026-103396 bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view...

CVE-2026-103396

bbs-go through version 4.4.6 is vulnerable to a permission bypass within the AdminMiddleware authorization logic. The root cause is that the dashboard.user.view permission rule incorrectly matches the /api/admin/user/synccount endpoint before the required dashboard.user.update rule is evaluated. ...

CVE-2026-103396 bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view...