net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

SUSE CVE-2026-74689

In the Linux kernel, the following vulnerability has been resolved: net/atm: fix slab-out-of-bounds read in vccsetsockopt vccsetsockopt contained an ineffective optlen check: if SOLEVELMATCHoptname, level && optlen != SOSIZEoptname return -EINVAL; If SOLEVELMATCHoptname, level evaluated to false...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: use RCU with deferred freeing for action lifecycle When NEWTFILTER and DELFILTER are run concurrently, a race involving an associated action can occur. Let’s illustrate this with CPU0 running NEWTFILTER and CPU...

CVE-2026-65810

A flaw was found in .NET Framework. This vulnerability, caused by a relative path traversal, allows an unauthorized local attacker to elevate their privileges. By exploiting this flaw, an attacker can gain higher access rights than intended, potentially leading to unauthorized actions on the...

CVE-2026-80731

In the Linux kernel, the following vulnerability has been resolved: net: remove CAPSYSRAWIO zero-padding in devvalidateheader devvalidateheader reads dev-hardheaderlen directly when zero-padding short link layer headers for CAPSYSRAWIO holders: if capableCAPSYSRAWIO memsetllheader + len, 0,...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

CVE-2026-62872

A flaw was found in .NET Framework. An authorized attacker could exploit incorrect authorization over a network to elevate their privileges. Mitigation No mitigation is required. Red Hat does not ship the Windows-only .NET Framework runtime...

CVE-2026-58641

A flaw was found in .NET. This vulnerability, caused by an integer overflow or wraparound, allows an unauthorized attacker to locally elevate their privileges. This could lead to an attacker gaining higher access rights than intended on the affected system. Mitigation No mitigation is required. R...

RLSA-2026:62631 Important: golang-github-openprinting-ipp-usb security update

HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. Security Fixes: mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header CVE-2026-42504 encoding/asn1: golang: Go...

CVE-2026-62897

A flaw was found in .NET Framework. This integer overflow or wraparound vulnerability allows an unauthorized attacker to execute code locally. By exploiting this flaw, an attacker could gain control over the affected system. Mitigation No mitigation is required. Red Hat's .NET packages do not shi...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2026-70354

A flaw was found in .NET. This vulnerability, caused by an out-of-bounds write, could allow an unauthorized attacker to execute code locally. Exploitation requires local access and user interaction, but if successful, it can lead to significant impact on the system's confidentiality, integrity, a...

CVE-2026-62871

A flaw was found in .NET. An out-of-bounds write vulnerability allows an unauthorized attacker to execute arbitrary code locally. This could lead to a complete compromise of the affected system. Mitigation No mitigation is required. Red Hat's .NET packages do not ship the Windows Desktop runtime...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting

A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering

A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting XSS attacks, where...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass

A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting XSS attacks in applications. Such attacks can result in information...