CVE-2024-24787-PoC

CVE-2024-24787-PoC En Darwin, compilar un módulo de Go que contenga CGO puede desencadenar la ejecución de código arbitrario al usar la versión de ld de Apple, debido al uso de la bandera -ltolibrary en una directiva 'cgo LDFLAGS'. Este no es mi error, solo hice un PoC para el mismo. Referencia...

CVE-2018-6574

CVE-2018-6574 Steps to reproduce: 1. Create a .c file containing the malicious command revshell: include include static void malicious attributeconstructor; void malicious system""; 2. Compile it using GCC. You must compile it on the exact architecture and OS as the target e.g. Linux x8664: gcc...

CVE-2018-6574

CVE-2018-6574 Exploit for remote command execution in Golang go get command. Introduction When you go get a package, Go is designed to build and install the package without running any code from it. The intent is that you can safely get, build, and even install Go packages without trusting them a...

CVE-2018-6574

CVE-2018-6574 POC Exploit POC For CVE-2018-6574 Compile 1. Create an exploit file with the following: include include static void malicious attributeconstructor; void malicious system"COMMAND"; 2. Compile it: gcc -shared -o exploit.so -fPIC exploit.c 3. Finally, you need the go code that will tel...

Rocky Linux 10.1 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (crlsa-2026_2706)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20262706 advisory. golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61728 golang: net/url: Memory exhaustion in query...

Rocky Linux 9 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (crlsa-2023_3923)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20233923 advisory. golang: cmd/go: go command may generate unexpected code at build time when using cgo CVE-2023-29402 golang: cmd/go: go command may execute arbitrary code a...

AlmaLinux 9.6 [TuxCare] Security Update: git-lfs (ALMALINUX9.6:CLSA-2026:1784541123)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784541123 advisory. - When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...

AlmaLinux 9.2 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1772039226)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1772039226 advisory. - The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters ...

AlmaLinux 9.2 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1780946485)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780946485 advisory. - SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time...

Rocky Linux 9.6 [TuxCare] Security Update: git-lfs (ALMALINUX9.6:CLSA-2026:1784541123)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784541123 advisory. - When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...

AlmaLinux 9.6 [TuxCare] Security Update: oci-seccomp-bpf-hook / oci-seccomp-bpf-hook-tests (ALMALINUX9.6:CLSA-2026:1784646805)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784646805 advisory. - When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...

Rocky Linux 9.6 [TuxCare] Security Update: oci-seccomp-bpf-hook / oci-seccomp-bpf-hook-tests (ALMALINUX9.6:CLSA-2026:1784646805)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784646805 advisory. - When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...

AlmaLinux 9.2 [TuxCare] Security Update: oci-seccomp-bpf-hook (ALMALINUX9.2:CLSA-2026:1784707996)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784707996 advisory. - When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...

Go-Get-RCE-CVE-2018-6574-POC

CVE-2018-6574 POC LINK https://nvd.nist.gov/vuln/detail/CVE-2018-6574 http://blog.nsfocus.net/cve-2018-6574/ RUN go get github.com/neargle/CVE-2018-6574-POC DETAIL payload at: https://github.com/neargle/CVE-2018-6574-POC/blob/master/calc.cL10 Now it supports all platforms using CGO features. Afte...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124477)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124477 advisory. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. Tenable has extracted the preceding...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

EulerOS 2.0 SP10 : golang (EulerOS-SA-2026-3692)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.CVE-2026-42499 Well-crafted inputs...