SUSE-SU-2026:3473-1 Security update for aws-iam-authenticator

This update for aws-iam-authenticator fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266651. Changes for aws-iam-authenticator: - Update golang.org/x/net to v0.57.0...

Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issue: CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266604. Changes for google-cloud-sap-agent: Update golang.org/x/net to v0.57.0...

Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issue: CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266604. Changes for google-cloud-sap-agent: Update golang.org/x/net to v0.57.0...

SUSE-SU-2026:3471-1 Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266604. Changes for google-cloud-sap-agent: - Update golang.org/x/net to v0.57....

crypto/x509: Incorrect enforcement of email constraints in crypto/x509

A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly...

crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries

A flaw was found in the crypto/x509 package of golang. This vulnerability allows a remote attacker to cause a Denial of Service DoS by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name SAN entries. The certificate verification process, specifical...

cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction

A flaw was found in the "go tool pack" subcommand, a component of the Go programming language tools. This vulnerability allows an attacker to craft a malicious archive file. When this archive is extracted using the "pack" subcommand, it can lead to arbitrary file writes on the filesystem,...

net/textproto: golang: Golang net/textproto: Misleading error messages via input injection

A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead...

Important: Red Hat Security Advisory: golang security update

An update for golang is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/crypto-v0.45.0 which is vulnerable to multiple vulnerabilities

Summary IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/crypto-v0.45.0 which is vulnerable to CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595...

openSUSE 16: warewulf4 / warewulf4-dracut / warewulf4-man / warewulf4-overlay / etc (openSUSE-SU-2026:21509-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21509-1 advisory. Changes in warewulf4: - updated golang.org/x/text to v0.40.0 to fix CVE-2026-56852 bsc1272014 Tenable has extracted the preceding description block...

Security update for warewulf4 (moderate)

openSUSE security update: security update for warewulf4 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21509-1 Rating: moderate References: bsc1272014 Cross-References: CVE-2026-56852 CVSS scores: CVE-2026-56852 SUSE : 5.9...

OPENSUSE-SU-2026:11436-1 golang-github-prometheus-prometheus-3.13.2-1.1 on GA media

These are all security issues fixed in the golang-github-prometheus-prometheus-3.13.2-1.1 package on the GA media of openSUSE Tumbleweed...

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

openSUSE 16 Security Update : vexctl (openSUSE-SU-2026:21481-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21481-1 advisory. - CVE-2024-45337: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto...

DEBIAN-CVE-2026-54909

pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3...

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

Security Bulletin: IBM Storage Protect Server is susceptible to vulnerabilities due to Golang library related to ObjectAgent(CVE-2026-39824).

Summary Golang library is used by the IBM Storage Protect Server OSSM and ObjectAgent component. Golang is affected by multiple vulnerabilities that may cause data integrity issues, or memory handling problems when processing specially crafted input. This bulletin identifies the steps to address...

Security Bulletin: IBM Storage Protect Server is susceptible to a vulnerability due to Golang net library (CVE-22026-33814)

Summary Golang net library is used by the IBM Storage Protect Server OSSM and ObjectAgent component. Golang net is affected by vulnerability that may allow prototype pollution, allowing attackers to manipulate object prototype attributes through vulnerable merge and object conversion APIs...