107 matches found
Updated golang packages fix security vulnerabilities
net/http: HTTP/2 server crash due to HPACK encoder race net/http: HTTP/2 server memory exhaustion due to Trailer headers crypto/tls: reject malformed ECH outer extension references cmd/go: checksum bypass for golang.org/fips140 cmd/go: checksum database bypass for golang.org/toolchain...
SUSE-SU-2026:4629-1 Security update for go1.26
This update for go1.26 fixes the following issues: Update to go 1.26.9 bsc1255111: - CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on Windows bsc1284766. - CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection bsc1284767. -...
CLEANSTART-2026-BB23669 When returning errors, functions in the net/textproto package would include its input as part of the error
Security vulnerability affects the victoria-metrics package. When returning errors, functions in the net/textproto package would include its input as part of the error...
CVE-2026-94440 Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes...
CVE-2026-94440 Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes...
CVE-2026-94440
Parsing a multipart form can bypass memory limits and allow an attacker to read an arbitrarily long line into memory. This occurs specifically when the remaining limit at the start of a part is less than 400 bytes . The vulnerability is associated with CWE-770 (Allocation of Resources Without Lim...
GO-2026-6608 Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes...
CLEANSTART-2026-KG46723 When returning errors, functions in the net/textproto package would include its input as part of the error
CVE-2026-42507 affects multiple packages. When returning errors, functions in the net/textproto package would include its input as part of the error. See references for individual vulnerability details...
CLEANSTART-2026-FF24840 When returning errors, functions in the net/textproto package would include its input as part of the error
Security vulnerability affects the temporal-server package. When returning errors, functions in the net/textproto package would include its input as part of the error...
CLEANSTART-2026-RM75636 When returning errors, functions in the net/textproto package would include its input as part of the error
Security vulnerability affects the consul package. When returning errors, functions in the net/textproto package would include its input as part of the error...
CLEANSTART-2026-HI26609 When returning errors, functions in the net/textproto package would include its input as part of the error
Security vulnerability affects the cri-tools package. When returning errors, functions in the net/textproto package would include its input as part of the error...
CLEANSTART-2026-LG89593 When returning errors, functions in the net/textproto package would include its input as part of the error
Security vulnerability affects the cri-tools package. When returning errors, functions in the net/textproto package would include its input as part of the error...
Rocky Linux 10.2 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (crlsa-2026_29980)
The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202629980 advisory. net/textproto: golang: Golang net/textproto: Misleading error messages via input injection CVE-2026-42507 Bug Fixes and Enhancements: Update Go to version...
AlmaLinux 9.2 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.2:CLSA-2026:1782910319)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1782910319 advisory. - When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to...
CLEANSTART-2026-VF61334 When returning errors, functions in the net/textproto package would include its input as part of the error
CVE-2026-42507 affects multiple packages. When returning errors, functions in the net/textproto package would include its input as part of the error. See references for individual vulnerability details...
CLEANSTART-2026-BX08713 When returning errors, functions in the net/textproto package would include its input as part of the error
Security vulnerability affects the minio-operator package. When returning errors, functions in the net/textproto package would include its input as part of the error...
Rocky Linux 9.6 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.6:CLSA-2026:1782908606)
The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782908606 advisory. - When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker ...
AlmaLinux 9.6 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.6:CLSA-2026:1782908606)
The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782908606 advisory. - When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to...
CLEANSTART-2026-HE08866 When returning errors, functions in the net/textproto package would include its input as part of the error
Security vulnerability affects the loki package. When returning errors, functions in the net/textproto package would include its input as part of the error...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124469)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124469 advisory. When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content...