46827 matches found
RLSA-2026:70391 Important: containernetworking-plugins security update
The Container Network Interface CNI project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated...
runc security update
An update is available for runc. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The runC tool is a lightweight, portable implementation of the Open Container...
RLSA-2026:70191 Important: runc security update
The runC tool is a lightweight, portable implementation of the Open Container Format OCF that provides container runtime. Security Fixes: net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56860 For more details about the security issues,...
Security update for the Linux Kernel (Live Patch 40 for SUSE Linux Enterprise 15 SP5)
This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.166 fixes various security issues: The following security issues were fixed: CVE-2026-46150: fanotify: fix false positive on permission events bsc1267388. CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on devic...
Linux Kernel Security Vulnerabilities
The Linux kernel versions from 6.12.35 to 6.12.109, 6.15.4 to 6.16, and 6.16 contain security vulnerabilities. These vulnerabilities stem from the fact that the function rvrdmardmaaccept fails to check rndone before calling rpcrdmarnunregister, resulting in an unbalanced reference count and...
net/mail: golang: net/mail: Denial of Service via pathological email address parsing
A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...
net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...
net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...
learn-s90f
Samsung S90F STS timezone root-command execution This reposit...
CLSA-2026-1790162911 delve: Fix of 5 CVEs
rebuild with golang 1.22.9-1.el92.tuxcare.els26 to fix five Go standard library CVEs - CVE-2026-33818: encoding/asn1 - enforce a maximum recursion depth when unmarshalling, so deeply nested DER cannot exhaust the stack - CVE-2026-56858: html/template - keep the JavaScript regexp/division context...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.48 security and extras update
Red Hat OpenShift Container Platform release 4.19.48 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a security impact of...
kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads
A flaw was found in the net/mlx5 driver of the Linux kernel. When the driver attempts to read the MCIA register from a device advertising the mcia32dwords capability, the mlx5querymcia function can read more data than the allocated buffer can hold. This leads to a buffer overflow, which can cause...
Malicious code in turbo-ws (npm)
Source: amazon-inspector a25d8c29cbfb317e1c88568514a999618bdeee25b2716b76e3db5062e9dd7a67 package.json at line 43 declares the sole dependency 'node-net-pool' as an HTTPS tarball of the 'main' branch of an unrelated GitHub account...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
Important: Red Hat Security Advisory: runc security update
An update for runc is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...
Malicious code in turbo-ws (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a25d8c29cbfb317e1c88568514a999618bdeee25b2716b76e3db5062e9dd7a67 package.json at line 43 declares the sole dependency 'node-net-pool' as an HTTPS tarball of the 'main' branch of an unrelated GitHub account...