Fedora 41 : golang (2025-ef6e0fa117)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-ef6e0fa117 advisory. go1.23.11 released 2025-07-08 includes security fixes to the go command, as well as bug fixes to the compiler, the linker, and the runtime. See the issue...

GO-2025-3770 Host header injection which leads to open redirect in RedirectSlashes in github.com/go-chi/chi

Host header injection which leads to open redirect in RedirectSlashes in github.com/go-chi/chi...

CVE-2025-7806

A vulnerability classified as critical was found in Tenda FH451 1.0.0.9. This vulnerability affects the function fromSafeClientFilter of the file /goform/SafeClientFilter. The manipulation of the argument Go/page leads to stack-based buffer overflow. The attack can be initiated remotely. The...

CVE-2025-7807

A vulnerability, which was classified as critical, has been found in Tenda FH451 1.0.0.9. This issue affects the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. The manipulation of the argument Go/page leads to stack-based buffer overflow. The attack may be initiated remotely. The...

net/http: Request smuggling due to acceptance of invalid chunked data in net/http

A flaw was found in the net/http golang package. The net/http package incorrectly accepts messages that end with a line feed LF instead of the proper line ending. When used with another server that also misinterprets this, it can lead to request smuggling—where an attacker tricks the system to se...

net/http: Request smuggling due to acceptance of invalid chunked data in net/http

A flaw was found in the net/http golang package. The net/http package incorrectly accepts messages that end with a line feed LF instead of the proper line ending. When used with another server that also misinterprets this, it can lead to request smuggling—where an attacker tricks the system to se...

Tenda FH451 安全漏洞

The Tenda FH451 is a router from the Chinese company Tenda. The Tenda FH451 version 1.0.0.9 suffers from a buffer overflow vulnerability that originates from a failure to properly validate the length of input data for the parameter Go/page in the file /goform/SafeUrlFilter, which could be exploit...

Tenda FH451 安全漏洞

The Tenda FH451 is a router from the Chinese company Tenda. The Tenda FH451 version 1.0.0.9 suffers from a buffer overflow vulnerability that originates from the parameter Go/page in file /goform/SafeClientFilter that fails to properly validate the length of the input data, which can be exploited...

The vulnerability of the implementation package for the JWE, JWS, and JWT go-jose standards in the Go programming language lies in its uncontrolled resource consumption, allowing attackers to cause service failures.

The vulnerability of the implementation package for the JWE, JWS, and JWT go-jose standards in the Go programming language is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the Golang programming language, related to insufficient protection of sensitive data, allows attackers to gain access to potentially confidential information.

The vulnerability of the Golang programming language is related to the insufficient protection of sensitive data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to potentially confidential information...

Exploit for CVE-2025-22870

CVE-2025-22870 – Proxy Bypass via IPv6 Zone Parsing in Go 🔐...

The vulnerability of the Go programming language’s Verify component allows attackers to circumvent existing security restrictions.

The vulnerability of the Go programming language’s Verify component is related to the improper assignment of permissions for a critical resource. Exploiting this vulnerability can allow an attacker to bypass existing security restrictions remotely...

The vulnerability of the parse.ParseUnverified() function in the golang-jwt library for handling web tokens allows attackers to disclose sensitive information that should be protected.

The vulnerability of the parse.ParseUnverified function in the golang-jwt library for handling web tokens in the Go programming language is related to uncontrolled resource consumption. Exploiting this vulnerability allows an attacker to disclose protected information...

go-toolset:rhel8 security update

delve 1.24.1-1.0.1 - Disable DWARF compression which has issues Alex Burmashev golang 1.24.4-1 - Update to Go 1.24.4 fips-1 - Resolves: RHEL-85264 go-toolset 1.24.4-1 - Update to Go 1.24.4 fips-1 - Resolves: RHEL-85264...

The vulnerability of the Golang programming language, related to improper validation of input data, allows attackers to execute arbitrary code.

The vulnerability of the Golang programming language is related to incorrect validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Oracle Linux 8 : go-toolset:rhel8 (ELSA-2025-10672)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-10672 advisory. delve 1.24.1-1.0.1 - Disable DWARF compression which has issues Alex Burmashev golang 1.24.4-1 - Update to Go 1.24.4 fips-1 - Resolves: RHEL-85264 go-toolset...

CVE-2025-7452

A vulnerability was found in kone-net go-chat up to f9e58d0afa9bbdb31faf25e7739da330692c4c63. It has been declared as critical. This vulnerability affects the function GetFile of the file go-chat/api/v1/filecontroller.go of the component Endpoint. The manipulation of the argument fileName leads t...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the SplitRTR function in the rtr.go file, which allows access to data without checking the input length. An attacker can cause a denial of service by sending specially crafted input. Remediation Upgrade...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the SplitRTR function in the rtr.go file, which allows access to data without checking the input length. An attacker can cause a denial of service by sending specially crafted input. Remediation Upgrade...

DEBIAN-CVE-2025-7464

A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is the function SplitRTR of the file pkg/packet/rtr/rtr.go. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The complexity of an attack is rather high. The...