CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: trivy, fq, tekton-chains, kubernetes-dashboard-web, prometheus-alertmanager, protoc-gen-go, crossplane-provider-azure, snyk-cli, influx, pgtimetable, gitleaks, zot, local-static-provisioner, crossplane-provider-azure-authorization, kyverno-policy-reporter, kaniko,...

GHSA-G9PC-8G42-G6VQ vulnerabilities

Vulnerabilities for packages: trivy, fq, tekton-chains, kubernetes-dashboard-web, prometheus-alertmanager, protoc-gen-go, crossplane-provider-azure, snyk-cli, influx, pgtimetable, gitleaks, zot, local-static-provisioner, crossplane-provider-azure-authorization, kyverno-policy-reporter, kaniko,...

CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: jaeger-operator-fips, prometheus, ini-file-fips, fq, kubernetes-csi-livenessprobe, addon-resizer-fips, prometheus-beat-exporter, kubernetes-dashboard-auth-fips, kubernetes-csi-driver-hostpath, metrics-server, cilium-envoy-fips, opa-fips, kubewatch, kaniko-fips, oras,...

RHSA-2025:3772 Red Hat Security Advisory: go-toolset:rhel8 security update

Bulletin has no description...

IP Address Spoofing

github.com/phires/go-guerrilla is vulnerable to IP address spoofing. The vulnerability is due to improper enforcement of the PROXY protocol due to the server accepting multiple PROXY commands, allowing clients to override the original IP address...

SUSE CVE-2025-32024

bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The EXIF data format allows for defining excessively large data structures in relatively small payloads. Before v0.10.0, If you didn't trust the input images, this could be abused to...

SUSE CVE-2025-32025

bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The buffer created for parsing metadata for PNG and WebP images was only bounded by their input data type, which could lead to potentially large memory allocation, and unreasonably...

golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect

A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header redirected to b.com/ will not send that header to b.com. However, the...

Moderate: Red Hat Security Advisory: go-toolset:rhel8 security update

An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints

A flaw was found in the crypto/x509 package of the Golang standard library. A certificate with a URI, which has a IPv6 address with a zone ID, may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI; this...

encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion

A flaw was found in the encoding/gob package of the Golang standard library. Calling Decoder.Decoding, a message that contains deeply nested structures, can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635...

golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect

A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header redirected to b.com/ will not send that header to b.com. However, the...

crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec

A flaw was found in the Golang crypto/internal/nistec package. Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Considering how this function is used, this leaka...

golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints

A flaw was found in the crypto/x509 package of the Golang standard library. A certificate with a URI, which has a IPv6 address with a zone ID, may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI; this...

ALSA-2025:3772 Moderate: go-toolset:rhel8 security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints CVE-2024-45341 golang: net/http: net/http: sensitive headers incorrectly sent after...

go-toolset:ol8 security update

delve 1.24.1-1.0.1 - Disable DWARF compression which has issues Alex Burmashev 1.24.1-1 - Rebase to 1.24.1 - Skip unsupported tests - Resolves: RHEL-83451 golang 1.23.6-1 - Update to Go 1.23.6 - Resolves: RHEL-83824 1.22.11-1 - Rebase to Go1.22.11 to pick up fixes for CVE 2024-45341 and 2024-4533...

Moderate: go-toolset:rhel8 security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints CVE-2024-45341 golang: net/http: net/http: sensitive headers incorrectly sent after...

Oracle Linux 8 : go-toolset:ol8 (ELSA-2025-3772)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-3772 advisory. delve 1.24.1-1.0.1 - Disable DWARF compression which has issues Alex Burmashev 1.24.1-1 - Rebase to 1.24.1 - Skip unsupported tests - Resolves:...

The vulnerability of the Go programming language’s net/http package, related to deficiencies in HTTP request processing, allows attackers to execute arbitrary code.

The vulnerability of the net/http package in the Go programming language is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

AZL-59666 CVE-2025-22871 affecting package golang for versions less than 1.22.7-3

The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext...