encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending oversized or invalid baggage headers. The Parse function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

GO-2026-6453 Unbounded memory allocation via streaming row reader in github.com/xuri/excelize

In github.com/xuri/excelize/v2, the streaming worksheet reader used by Rows and GetRows does not enforce the maximum row limit TotalRows on row "r" attributes. A crafted spreadsheet with an out-of-bounds row index causes GetRows to allocate empty row slices up to the specified row number, leading...

CVE-2026-85731

A flaw was found in oras-go, a Go library for managing OCI Open Container Initiative artifacts. A remote attacker can exploit a symlink-chain bypass vulnerability during tar extraction of OCI layers. This allows a malicious archive to create or overwrite any file writable by the process outside t...

CVE-2026-85732

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then...

DEBIAN-CVE-2026-85732

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then...

CVE-2026-85731

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets...

DEBIAN-CVE-2026-85731

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets...

GO-2026-6473 ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions in github.com/zitadel/zitadel

ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive repor...

GO-2026-6451 webhookd: Unrestricted HTTP Header to Shell Variable Injection in github.com/ncarlier/webhookd

webhookd: Unrestricted HTTP Header to Shell Variable Injection in github.com/ncarlier/webhookd...

GO-2026-6447 LF Edge eKuiper: SSRF in External Service in github.com/lf-edge/ekuiper

LF Edge eKuiper: SSRF in External Service in github.com/lf-edge/ekuiper...

GO-2026-6444 containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service in github.com/containerd/containerd

containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service in github.com/containerd/containerd...

GO-2026-6466 Traefik HTTP/3 Backend NTLM Connection Reuse in github.com/traefik/traefik

Traefik HTTP/3 Backend NTLM Connection Reuse in github.com/traefik/traefik...

GO-2026-6467 Traefik entrypoint header-name sanitization bypassed via request trailers in github.com/traefik/traefik

Traefik entrypoint header-name sanitization bypassed via request trailers in github.com/traefik/traefik...

GO-2026-6470 ZITADEL: Auto-linking by email: IdP-side email verification is not checked in github.com/zitadel/zitadel

ZITADEL: Auto-linking by email: IdP-side email verification is not checked in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2026-6449 Komari: Management Interface CSRF in github.com/komari-monitor/komari

Komari: Management Interface CSRF in github.com/komari-monitor/komari...

CVE-2026-85731

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2 , the content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true is vulnerable to an arbitrary file-write outside the store's working directory. The root cause lies in the pushDir path: extractTarDire...

CVE-2026-85731 oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets...

CVE-2026-85731 oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets...