PT-2025-42738

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.24.9-alt1 OpenTofu versions =2.10.0 Description The issue is a memory exhaustion flaw in the encoding/asn1 package of the Go programming language. The code pre-allocates memory based on fields within a DER structure befo...

PT-2025-42744

Name of the Vulnerable Software and Affected Versions golang versions 1.15 golang versions 1.19 Description The Reader.ReadResponse function in the net/textproto package experiences excessive CPU consumption. Recommendations Update to a newer version of golang that contains a fix for this...

PT-2025-28646

Name of the Vulnerable Software and Affected Versions: Go versions prior to 1.24.5 Go versions prior to 1.23.11 Description: The issue concerns unexpected command execution in untrusted VCS repositories when using the Go toolchain. This can occur when the toolchain is used in directories fetched...

PT-2025-42741

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.24.9-alt1 Gobuster version 3.8.2 complyctl affected versions not specified containernetworking-plugins version 1.9.0 OpenTofu affected versions not specified Description The Go programming language contains a flaw in the...

PT-2025-14376

Name of the Vulnerable Software and Affected Versions Go versions 1.23 through 1.23.7 Go versions 1.24 through 1.24.1 Description The issue concerns a security fix for the net/http package. Recommendations For Go versions 1.23 through 1.23.7, update to version 1.23.8. For Go versions 1.24 through...

PT-2025-42745

Name of the Vulnerable Software and Affected Versions golang versions 1.15 golang versions 1.19 Description The ParseAddress function in the net/mail package experiences excessive CPU consumption. Recommendations Update to a newer version of golang that contains a fix for this vulnerability...

PT-2025-42736

Name of the Vulnerable Software and Affected Versions golang versions 1.15 golang versions 1.19 Description The net/url package does not properly validate bracketed IPv6 hostnames. This can lead to issues when parsing URLs containing IPv6 addresses enclosed in brackets. Recommendations Update to ...

PT-2025-42739

Name of the Vulnerable Software and Affected Versions golang versions 1.15 and 1.19 Description A flaw exists in the cookie parsing functionality of the net/http package. An absence of limits during cookie parsing can lead to excessive memory consumption, potentially resulting in memory exhaustio...

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: Update to version 0.0.20241218T202206 2024-12-18T20:22:06Z. jscPED-11136 Go CVE Numbering Authority IDs added or updated with aliases: GO-2024-3333 Update to version 0.0.20241218T163557 2024-12-18T16:35:57Z. jscPED-11136 Go CVE...

OESA-2024-2582 podman security update

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library. Security Fixes: Templates do not properly consider backticks as Javascript string delimiters, and do not escape them as expected. Backticks are used,...

[SECURITY] Fedora 41 Update: age-1.2.1-1.fc41

A simple, modern and secure encryption tool and Go library with small explicit keys, no config options, and UNIX-style composability...

SUSE CVE-2020-8912

A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this i...

SUSE CVE-2024-55885

beego is an open-source web framework for the Go programming language. Versions of beego prior to 2.3.4 use MD5 as a hashing algorithm. MD5 is no longer considered secure against well-funded opponents due to its vulnerability to collision attacks. Version 2.3.4 replaces MD5 with SHA256...

Malicious code in go-dependency-submission (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aa0e3837d434167d18ab0ba251b0ce73d56ed83a0c773df12c8ebd99542f8eaa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[SECURITY] Fedora 41 Update: golang-github-task-3.40.1-1.fc41

A task runner / simpler Make alternative written in Go...

GHSA-W32M-9786-JP63 Non-linear parsing of case-insensitive content in golang.org/x/net/html

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

GO-2024-3333 Non-linear parsing of case-insensitive content in golang.org/x/net/html

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

Malicious code in interview-question (npm)

This package has a preinstall script to download an execute a Go-variant of the Cobalt Strike beacon...

Malicious code in flybook-table (npm)

This package has a preinstall script to download an execute a Go-variant of the Cobalt Strike beacon...

Malicious code in @dz-lib/icon (npm)

This package has a preinstall script to download an execute a Go-variant of the Cobalt Strike beacon. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48177d2f5e82546462b55524174635af9b9c224b960955ce998919a80db4d812 Any computer that has this package installed or...