16609 matches found
chainMaker 安全漏洞
chainMaker is a Go library in the Go open source. A security vulnerability exists in chainMaker versions prior to 2.4.0, which stems from logger.go mishandling concurrent writes to mappings, which can lead to read/write conflicts and crashes...
Security update for go1.23
This update for go1.23 fixes the following issues: Update to go1.23.8 CVE-2025-22871: Fix an issue with request smuggling through invalid chunked data. bsc1240550 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...
go-jose: Go JOSE's Parsing Vulnerable to Denial of Service
A flaw was found in GO-JOSE. In affected versions, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code uses strings.Splittoken, "." to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large numb...
golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect
A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header redirected to b.com/ will not send that header to b.com. However, the...
OPENSUSE-SU-2025:14963-1 go1.24-1.24.2-1.1 on GA media
These are all security issues fixed in the go1.24-1.24.2-1.1 package on the GA media of openSUSE Tumbleweed...
ROS-20250403-13
Vulnerability of net/http, x/net/proxy and x/net/http/httpproxy packages of Go programming language is related to incorrect mapping of hosts to proxy server templates. Exploitation of the vulnerability could allow an intruder to affect confidentiality and availability of protected information...
ROS-20250403-04
A vulnerability in the Go programming language is related to improper syntax correctness checking of input. Exploitation of the vulnerability allows an attacker acting remotely to cause a denial of service...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a denial of service in Golang Go [CVE-2024-34155]
Summary IBM Watson Speech Services Cartridge is vulnerable to a denial of service in Golang Go, caused by a stack exhaustion in all Parse functions CVE-2024-34155. Golang Go is used by our Speech utilities. This vulnerabilitiy has been addressed. Please read the details for remediation below...
GO-2025-3588 Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times in github.com/phires/go-guerrilla
Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times in github.com/phires/go-guerrilla...
Security Bulletin: IBM CloudPak for Data Scheduling Service is vulernable to IBM X-Force ID: 350626.
Summary GRPC-Go is used by the CP4D Scheduling Service for inter-process communication. IBM X-Force ID: 350626. Vulnerability Details IBM X-Force ID: 350626 DESCRIPTION: gRPC-Go is vulnerable to a denial of service, caused by a flaw in handling multiplexed streams in the HTTP/2 protocol. By sendi...
SUSE-SU-2025:1099-1 Security update for govulncheck-vulndb
This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20250331T171002 2025-03-31T17:10:02Z jscPED-11136 GO-2025-3443 GO-2025-3548 GO-2025-3557 GO-2025-3558 GO-2025-3559 - Update to version 0.0.20250327T184518 2025-03-27T18:45:18Z jscPED-11136 GO-2025-3526...
PT-2025-19697 · Opensuse +1 · Govulncheck-Vulndb
Name of the Vulnerable Software and Affected Versions: govulncheck-vulndb versions prior to 0.0.20250327T184518 Description: This update addresses multiple issues within govulncheck-vulndb. Recommendations: Update to version 0.0.20250327T184518 or later. Update to version 0.0.20250331T171002 or...
Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times
Summary The PROXY command is accepted multiple times, allowing a client to spoof its IP address when the proxy protocol is being used. Details When ProxyOn is enabled, it looks like the PROXY command will be accepted multiple times, with later invocations overriding earlier ones. The proxy protoc...
CVE-2025-31135
Go-Guerrilla SMTP Daemon is a lightweight SMTP server written in Go. Prior to 1.6.7, when ProxyOn is enabled, the PROXY command will be accepted multiple times, with later invocations overriding earlier ones. The proxy protocol only supports one initial PROXY header; anything after that is...
CVE-2025-31135 Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times
Go-Guerrilla SMTP Daemon is a lightweight SMTP server written in Go. Prior to 1.6.7, when ProxyOn is enabled, the PROXY command will be accepted multiple times, with later invocations overriding earlier ones. The proxy protocol only supports one initial PROXY header; anything after that is...
CVE-2025-31135 Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times
Go-Guerrilla SMTP Daemon is a lightweight SMTP server written in Go. Prior to 1.6.7, when ProxyOn is enabled, the PROXY command will be accepted multiple times, with later invocations overriding earlier ones. The proxy protocol only supports one initial PROXY header; anything after that is...
CVE-2025-31135
CVE-2025-31135 affects Go-Guerrilla SMTP Daemon. Before version 1.6.7, when ProxyOn is enabled, the PROXY command may be accepted multiple times, with later invocations overriding earlier ones. The proxy protocol supports only a single initial PROXY header; subsequent PROXY commands are treated a...
CVE-2025-31135 Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times
Go-Guerrilla SMTP Daemon is a lightweight SMTP server written in Go. Prior to 1.6.7, when ProxyOn is enabled, the PROXY command will be accepted multiple times, with later invocations overriding earlier ones. The proxy protocol only supports one initial PROXY header; anything after that is...
