RLSA-2025:21815 Moderate: delve and golang security update

The Go Programming Language. Security Fixes: golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-58183 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE pages listed in the...

RHSA-2025:21815 Red Hat Security Advisory: delve and golang security update

Bulletin has no description...

GHSA-F6X5-JH6R-WRFV vulnerabilities

Vulnerabilities for packages: flux, cluster-api-aws-controller, juicefs-csi-driver, opa-envoy, docker-compose, fscrypt, docker-machine-driver-harvester, aws-node-termination-handler, pulumi-language-yaml, oras, witness, git-lfs, crossplane-provider-azure-managedidentity, caddy,...

CVE-2025-47914 vulnerabilities

Vulnerabilities for packages: flux, cluster-api-aws-controller, juicefs-csi-driver, opa-envoy, docker-compose, fscrypt, docker-machine-driver-harvester, aws-node-termination-handler, pulumi-language-yaml, oras, witness, git-lfs, crossplane-provider-azure-managedidentity, caddy,...

CVE-2025-58181 vulnerabilities

Vulnerabilities for packages: flux, cluster-api-aws-controller, juicefs-csi-driver, opa-envoy, docker-compose, fscrypt, docker-machine-driver-harvester, aws-node-termination-handler, pulumi-language-yaml, oras, witness, git-lfs, crossplane-provider-azure-managedidentity, caddy,...

GHSA-J5W8-Q4QC-RX2X vulnerabilities

Vulnerabilities for packages: flux, cluster-api-aws-controller, juicefs-csi-driver, opa-envoy, docker-compose, fscrypt, docker-machine-driver-harvester, aws-node-termination-handler, pulumi-language-yaml, oras, witness, git-lfs, crossplane-provider-azure-managedidentity, caddy,...

The vulnerability of the Go programming language component tar Reader, which allows a hacker to trigger a denial-of-service attack

The vulnerability of the Go programming language component tar Reader is related to unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability of the `net/http` component in the Go programming language, which allows a hacker to trigger a service failure

The vulnerability of the net/http component in the Go programming language is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability of the Go programming language’s encoding/ASN1 component, which allows a hacker to trigger a service failure.

The vulnerability of the Go programming language’s encoding/ASN1 component is related to the lack of memory release after the effective lifespan of the component. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

The vulnerability of the crypto/tls component in the Go programming language, which allows a perpetrator to disclose protected information

The vulnerability of the crypto/tls component in the Go programming language is related to errors in processing input data. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

The vulnerability of the Parse() function in the net-url component of the Go programming language allows a hacker to execute arbitrary code.

The vulnerability of the Parse function in the net-url component of the Go programming language is related to improper validation of syntax correctness in input. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

The vulnerability of the Equal() function in the crypto-x509 component of the Go programming language allows a perpetrator to trigger a service failure.

The vulnerability of the Equal function in the crypto-x509 component of the Go programming language is related to improper cleaning or release of resources. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures...

RHEL 10 : delve and golang (RHSA-2025:21816)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:21816 advisory. The Go Programming Language. Security Fixes: golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-58183 For more details...

The 2025 Go Cryptography State of the Union

This past August, I delivered my traditional Go Cryptography State of the Union talk at GopherCon US 2025 in New York. It goes into everything that happened at the intersection of Go and cryptography over the last year. You can watch the video with manually edited subtitles, for my fellow subtitl...

RHSA-2025:21779 Red Hat Security Advisory: golang security update

Bulletin has no description...

Moderate: Red Hat Security Advisory: delve and golang security update

An update for multiple packages is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

net/http: Request smuggling due to acceptance of invalid chunked data in net/http

A flaw was found in the net/http golang package. The net/http package incorrectly accepts messages that end with a line feed LF instead of the proper line ending. When used with another server that also misinterprets this, it can lead to request smuggling—where an attacker tricks the system to se...

Moderate: Red Hat Security Advisory: delve and golang security update

An update for multiple packages is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

golang: archive/tar: Unbounded allocation when parsing GNU sparse map

A flaw was found in the archive/tar package in the Go standard library. tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A specially crafted tar archive with a pax header indicating a big number of sparse regions can cause a Go...

Moderate: Red Hat Security Advisory: golang security update

An update for golang is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...