ALSA-2026:49838 Important: osbuild-composer security, bug fix, and enhancement update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes: crypto/x50...

crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries

A flaw was found in the crypto/x509 package of golang. This vulnerability allows a remote attacker to cause a Denial of Service DoS by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name SAN entries. The certificate verification process, specifical...

crypto/x509: Incorrect enforcement of email constraints in crypto/x509

A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

crypto/x509: Incorrect enforcement of email constraints in crypto/x509

A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

crypto/x509: Incorrect enforcement of email constraints in crypto/x509

A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries

A flaw was found in the crypto/x509 package of golang. This vulnerability allows a remote attacker to cause a Denial of Service DoS by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name SAN entries. The certificate verification process, specifical...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/crypto-v0.45.0 which is vulnerable to multiple vulnerabilities

Summary IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/crypto-v0.45.0 which is vulnerable to CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595...

bramble v1.14.0-chromium

Bramble A password manager that keeps your secrets on your own devices. No account, no server holding your vault, no company to get breached and leak everything. You hold the vault, you hold the password, and that's it. Bramble runs where you do: Browser extension for Chromium browsers Brave,...

A week in security (July 27 – August 2)

Last week on Malwarebytes Labs: Fake Fortnite rewards are stealing players’ accounts Fake Flash Player installs AtlasRAT Malwarebytes for Windows, now available on the Microsoft Store Hims & Hers sued over alleged health data privacy failures Hidden prompt turns Microsoft Copilot into an AI worm...

com.walterjwhite.java.examples:ssh (0.0.17), com.walterjwhite.java.modules.linux-builder.modules.cli.providers:cdi (0.0.17) +24 more potentially affected by CVE-2026-12816 via org.bouncycastle:bcprov-ext-jdk14 (>=1.45, <=1.72)

org.bouncycastle:bcprov-ext-jdk14 MAVEN version =1.45, =0.1.0, =0.1.0, =0.1.2 and more Source cves: CVE-2026-12816 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519174...

ae.vigilancer.android-run-app:ae.vigilancer.android-run-app.gradle.plugin (>=1.0.1, <=1.0.2), aero.m-click:mcpdf (>=0.2.3, <=0.2.10) +30622 more potentially affected by CVE-2026-58061 via org.bouncycastle:bcprov-jdk15on (>=1.46, <=1.70)

org.bouncycastle:bcprov-jdk15on MAVEN version =1.46, =1.0.1, =0.2.3, =4.4.0.0, =0.42.1, =0.1.12, =0.1.2, =0.28.0, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.3 and more Source cves: CVE-2026-58061 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519133...

com.amazonaws.s3:jets3t (0.5.0), org.bouncycastle:bcpg-jdk12 (130) +2 more potentially affected by CVE-2026-13506 via org.bouncycastle:bcprov-jdk12 (130)

org.bouncycastle:bcprov-jdk12 MAVEN version 130 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcprov-jdk12 and may be impacted: - com.amazonaws.s3:jets3t 0.5.0 - org.bouncycastle:bcpg-jdk12 130 - org.vafer:jdeb =0.2, =0.2.1, =0.5.0...

com.github.fmjsjx:libnetty-example (>=3.7.2, <=3.8.0-rc1), com.omnistrate.licensing:omnistrate-licensing-sdk-java (0.1.37) +53 more potentially affected by CVE-2026-13586 via org.bouncycastle:bcpkix-lts8on (>=2.73.6, <=2.73.11)

org.bouncycastle:bcpkix-lts8on MAVEN version =2.73.6, =3.7.2, =4.12, =4.12, =7.0, =7.0, =7.0, =7.0, =7.0, =7.0, =7.0, =2.73.8, =2.73.8, =2.73.11 - org.brylex:sancus-core 0.2 and more Source cves: CVE-2026-13586 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18518999...

ae.vigilancer.android-run-app:ae.vigilancer.android-run-app.gradle.plugin (>=1.0.1, <=1.0.2), aero.m-click:mcpdf (>=0.2.3, <=0.2.10) +21490 more potentially affected by CVE-2026-15055 via org.bouncycastle:bcpkix-jdk15on (>=1.47, <=1.70)

org.bouncycastle:bcpkix-jdk15on MAVEN version =1.47, =1.0.1, =0.2.3, =4.4.0.0, =0.1.12, =0.1.2, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.24 and more Source cves: CVE-2026-15055 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18517498...

com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.16.0, <=4.0.11.0), com.itextpdf:bouncy-castle-fips-adapter (>=9.0.0, <=9.5.0) +10 more potentially affected by CVE-2026-59647 via org.bouncycastle:bcpkix-fips (>=2.0.7, <=2.0.11)

org.bouncycastle:bcpkix-fips MAVEN version =2.0.7, =3.0.16.0, =9.0.0, =4.0.7.1, =4.0.7.1, =3.0.15, =26.0.0, =3.0.0-beta1, =3.0.0-beta1, =3.0.0-beta1, =3.0.0-beta1, =3.0.0 Source cves: CVE-2026-59647 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18513020...

cn.ponfee:commons-core (1.0), com.alipay.chainstack:chainstack-mychain-drc (2.0.1-rc) +120 more potentially affected by CVE-2026-59646 via org.bouncycastle:bctls-jdk15on (>=1.57, <=1.70)

org.bouncycastle:bctls-jdk15on MAVEN version =1.57, =2.0.0-rc, =2.0.0-rc, =2.0.0-rc, =0.10.2.24.5, =1.0, =1.0, =2.0, =2.12, =4.1 and more Source cves: CVE-2026-59646 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18512882...

Uncontrolled Recursion

Overview org.bouncycastle:bcprov-debug-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Uncontrolled Recursion in the OERInputStream.parseElement method, which processes the SEQ, CHOICE, and Supplier children of an IEEE 1609.2...