SUSE-SU-2026:3641-1 Security update for go1.26

This update for go1.26 fixes the following issues: Security issues fixed: - CVE-2026-33818: encoding/asn1: enforce maximum recursion depth bsc1275034. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalatio...

Security update for go1.25

This update for go1.25 fixes the following issues: Security issues fixed: CVE-2026-33818: encoding/asn1: enforce maximum recursion depth bsc1275034. CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation...

SUSE-SU-2026:3640-1 Security update for go1.25

This update for go1.25 fixes the following issues: Security issues fixed: - CVE-2026-33818: encoding/asn1: enforce maximum recursion depth bsc1275034. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalatio...

CVE-2026-56859

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

CVE-2026-56859

A Denial of Service vulnerability exists in the golang encoding/xml package due to a flaw in DecodeElement , where the depth counter was improperly reset. This oversight prevents the counter from firing, potentially leading to stack exhaustion when processing certain inputs. The issue is addresse...

CVE-2026-56859 Add recursion depth guard during decode in encoding/xml

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...

CVE-2026-56859 Add recursion depth guard during decode in encoding/xml

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...

Uncontrolled Recursion

Overview std/encoding/xml is a Go standard library package std/encoding/xml Affected versions of this package are vulnerable to Uncontrolled Recursion. Go Vulnerability Report:Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...

GO-2026-6088 Add recursion depth guard during decode in encoding/xml

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...

MiracleLinux 8 : container-tools:4.0 (AXSA:2023-5976:02)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-5976:02 advisory. golang: net/http: improper sanitization of Transfer-Encoding header CVE-2022-1705 golang: go/parser: stack exhaustion in all Parse functions...

EUVD-2020-21877

Malware in sbrugna...

EUVD-2020-21878

Malware in sbrugna...

EUVD-2022-1254

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2020-29510

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows a...

Linux Distros Unpatched Vulnerability : CVE-2020-29511

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The encoding/xml package in Go all versions does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which allow...

Linux Distros Unpatched Vulnerability : CVE-2020-29509

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The encoding/xml package in Go all versions does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which...

RHEL 7 : golang (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - go: encoding/xml: XML element instability CVE-2020-29511 - The x/text package before 0.3.3 for Go has a...

RHEL 7 : cli (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - golang: encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom TokenReader CVE-2021-27918 Note th...