crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

bramble v1.29.0-chromium

Bramble A password manager that keeps your secrets on your own devices. No account, no server holding your vault, no company to get breached and leak everything. You hold the vault, you hold the password, and that's it. Bramble runs where you do: Browser extension for Chromium browsers Brave,...

CVE-2026-93155: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: keembay - Fix AEAD unregister count in error path registeraesalgs registers the AEAD algorithms before registering the skcipher algorithms. If skcipher registration fails, the function unwinds the earlier AEAD registratio...

PT-2026-94417

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the crypto acomp component where ACOMP REQUEST ON STACK reserves insufficient storage for asynchronous fallbacks. When an async implementation is selected, the acomp...

CVE-2026-93158: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: sa2ul - stop probe if context pool creation fails saulprobe calls sainitmem to create the DMA pool used for security context buffers, but ignores its return value. If pool creation fails, probe still continues with DMA...

CVE-2026-92476: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: keembay - Initialize completion before requesting IRQ kmbocsaesprobe requests the device IRQ before initializing irqcompletion. Once the handler is registered it can run immediately, and ocsaesirqhandler unconditionally...

CVE-2026-90069: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: acomp - allocate async request context when cloning ACOMPREQUESTONSTACK reserves only enough storage for the synchronous fallback. When an async implementation is selected, callers clone that stack request before retrying...

CVE-2026-93161: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - clear AES key schedule from stack qatalgxtsreversekey expands the forward XTS AES key on the stack. That schedule contains key material and can remain in the stack frame. Clear the temporary cryptoaesctx with...

CVE-2026-92939: Process Control

vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports still execute with host-process authority. Sandboxed JavaScript can therefore call...

PT-2026-105489

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-46pr-c5wc-xffx. This link is maintained to preserve external references. Original Description vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is...

CVE-2026-93156: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: rk3288 - fail ahash requests on HASH idle timeout rkhashrun waits for RKCRYPTOHASHSTS to become idle after the final DMA transfer, but ignores the poll result. If the hash engine never becomes idle, the driver still reads...

CVE-2026-93162: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - cancel work on re-enable SR-IOV timeout The QAT reset worker queues SR-IOV reenable work using a workstruct and completion embedded in an on-stack adfsriovdevdata. If the completion wait times out, the reset worker...

PT-2026-94954

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the sa2ul crypto component where the sa ul probe function calls sa init mem to create a DMA Direct Memory Access pool for security context buffers but fails to check t...

PT-2026-94955

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A heap information leak exists in the atmel-sha204a crypto component. The nonblocking RNG path allocates a work data structure to track asynchronous I2C requests, storing the pointer in...

Security update for gh (important)

openSUSE security update: security update for gh ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21861-1 Rating: important References: bsc1278604 Cross-References: CVE-2026-56854 CVE-2026-56855 CVE-2026-78662 CVSS scores: CVE-2026-56854 SUSE : 8.1...

MAL-2026-16242 Malicious code in trongappy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 145727605bb141edc0fa9697253b211a1b0e467db2a484a2cedd163bcc6df1b7 The package exposes a single public function permprivatekey that POSTs its privatekey argument as JSON to the hardcoded URL...

Malicious code in trongappy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 145727605bb141edc0fa9697253b211a1b0e467db2a484a2cedd163bcc6df1b7 The package exposes a single public function permprivatekey that POSTs its privatekey argument as JSON to the hardcoded URL...

crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries

A flaw was found in the crypto/x509 package of golang. This vulnerability allows a remote attacker to cause a Denial of Service DoS by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name SAN entries. The certificate verification process, specifical...