GHSA-XVQR-69V8-F3GV vulnerabilities

Vulnerabilities for packages: grpcurl, harbor-registry, dask-gateway, kuberlr, spire-controller-manager, helm-docs, cloud-provider-vsphere, cfssl, yace, crossplane-provider-aws-lambda, timescaledb-parallel-copy, rancher-telemetry, kubernetes-dns-node-cache, cluster-api-gcp-controller,...

BIT-GOLANG-2025-68119 Unexpected code execution when invoking toolchain in cmd/go

Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial hg installed, downloading modules from non-standard sources e.g., custom domains can cause unexpected code execution due to how external VCS commands are constructed. This iss...

BIT-GOLANG-2025-61731 Arbitrary file write using cgo pkg-config directive in cmd/go

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a...

BIT-GOLANG-2025-61726 Memory exhaustion in query parameter parsing in net/url

The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containi...

Vulnerability of the VerifyDelegate() function in the metadata framework used for software update security in the go-tuf framework. This allows attackers to gain access to and modify data.

The vulnerability of the VerifyDelegate function in the software update security framework for systems managed by Go-TUF is related to errors in verifying the cryptographic signature due to incorrect validation of the set threshold value. Exploiting this vulnerability could allow an attacker to...

SUSE-SU-2026:0354-1 Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: Update to version 0.0.20260128T190828 2026-01-28T19:08:28Z jscPED-11136: Go CVE Numbering Authority IDs added or updated with aliases: GO-2026-4338 CVE-2025-68119 CVE-2025-68119 GO-2026-4339 CVE-2025-61731 CVE-2025-61731 GO-2026-4340...

CLEANSTART-2026-TY78539 ParseAddress function constructs domain-literal address components through repeated string concatenation

Multiple security vulnerabilities affect the go-fips-1.24 package. The ParseAddress function constructs domain-literal address components through repeated string concatenation. See references for individual vulnerability details...

CLEANSTART-2026-VS64679 ParseAddress function constructs domain-literal address components through repeated string concatenation

Multiple security vulnerabilities affect the go-fips-1.24 package. The ParseAddress function constructs domain-literal address components through repeated string concatenation. See references for individual vulnerability details...

CLEANSTART-2026-WG18689 attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests

Multiple security vulnerabilities affect the minio-client-fips package. An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. See references for individual vulnerability details...

CLEANSTART-2026-AN66259 attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests

Multiple security vulnerabilities affect the minio-client-fips package. An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. See references for individual vulnerability details...

CLEANSTART-2026-HV28992 Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3

Multiple security vulnerabilities affect the cert-manager-webhook-pdns-fips package. Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3. See references for individual vulnerability details...

CLEANSTART-2026-BZ92766 beego is an open-source web framework for the Go programming language

Multiple security vulnerabilities affect the harbor-fips package. beego is an open-source web framework for the Go programming language. See references for individual vulnerability details...

CLEANSTART-2026-QK01721 go-redis is the official Redis client library for the Go programming language

Multiple security vulnerabilities affect the harbor-registry-fips package. go-redis is the official Redis client library for the Go programming language. See references for individual vulnerability details...

CLEANSTART-2026-RY09679 go-redis is the official Redis client library for the Go programming language

Security vulnerability affects the harbor-registry-fips package. go-redis is the official Redis client library for the Go programming language...

CLEANSTART-2026-PO40318 go-redis is the official Redis client library for the Go programming language

Multiple security vulnerabilities affect the harbor-registry-fips package. go-redis is the official Redis client library for the Go programming language. See references for individual vulnerability details...

CLEANSTART-2026-ZO91195 go-redis is the official Redis client library for the Go programming language

Multiple security vulnerabilities affect the harbor-registry-fips package. go-redis is the official Redis client library for the Go programming language. See references for individual vulnerability details...

CLEANSTART-2026-YS66739 Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3

Multiple security vulnerabilities affect the kyverno-policy-reporter-kyverno-plugin-fips package. Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3. See references for individual vulnerability details...

Rust and Go Directed Fuzzing with LibAFL-DiFuzz

In modern SSDLC, program analysis and automated testing are essential for minimizing vulnerabilities before software release, with fuzzing being a fast and widely used dynamic testing method. However, traditional coverage-guided fuzzing may be less effective in specific tasks like verifying stati...

Security update for coredns (important)

openSUSE Security Update: Security update for coredns Announcement ID: openSUSE-SU-2026:0032-1 Rating: important References: 1255345 Cross-References: CVE-2025-61726 CVE-2025-61728 CVE-2025-61731 CVE-2025-68119 CVE-2025-68121 CVE-2025-68156 CVSS scores: CVE-2025-61726 SUSE: 6.9...

CVE-2026-24845 malcontent's OCI image scanning could expose registry credentials

malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 0.10.0 and prior to version 1.20.3, malcontent could be made to expose Docker registry credentials if it scanned a specially crafted OCI image reference. malcontent uses...