GHSA-C8W8-3PQP-WR83 SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream

Summary Two checks on the same WebSocket request URI parse it differently. The authentication exemption for keepalive sessions matches raw substrings, while the quarantine introduced to contain those sessions reads a parsed query parameter. Because Go's url.Values.Get returns only the first value...

SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream

Summary Two checks on the same WebSocket request URI parse it differently. The authentication exemption for keepalive sessions matches raw substrings, while the quarantine introduced to contain those sessions reads a parsed query parameter. Because Go's url.Values.Get returns only the first value...

SUSE CVE-2026-89090

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range...

CVE-2026-89090

A flaw was found in the event stream header decoder of the Amazon AWS SDK for Go v2. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted event stream response frame. This frame, containing a header value type outside the valid range, would cause an...

CVE-2026-89090

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range...

CVE-2026-89090 Denial of service in the event stream header decoder in AWS SDK for Go v2

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range...

CVE-2026-89090

CVE-2026-89090 affects the event stream header decoder in the AWS SDK for Go v2 (versions before release-2026-03-23). An unrecovered panic occurs when a crafted event stream response frame contains a header value type outside the valid range, allowing an unauthenticated remote actor to terminate ...

CVE-2026-89090 Denial of service in the event stream header decoder in AWS SDK for Go v2

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range...

EUVD-2026-76157

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range...

CVE-2026-89090 Denial of service in the event stream header decoder in AWS SDK for Go v2

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range...

CVE-2026-89090: Uncaught Exception

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range...

SUSE CVE-2026-55499

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner's parent folder and subscribes to that folder topic, allowing an authenticated share recipient to receive names, paths, rename targets...

br.jus.stf.digital:core (>=2.0.0, <=2.3.1), cn.hyperchain.javasdk:hyperchainsdk (>=4.2.1, <=4.2.3) +123 more potentially affected by CVE-2026-63335 via com.rabbitmq:amqp-client (4.0.2)

com.rabbitmq:amqp-client MAVEN version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - br.jus.stf.digital:core =2.0.0, =4.2.1, =1.1.0, =0.10, =0.10, =1.2.0, =1.2.0, =0.10, =0.10, =1.0.0-rc1,...

GO-2026-6102 Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings in github.com/cloudreve/Cloudreve

Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings in github.com/cloudreve/Cloudreve...

PT-2026-80348

Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings in github.com/cloudreve/Cloudreve...

Duplicate Advisory: SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream, defeating the fix for GHSA-xp2m-98x8-rpj6

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c8w8-3pqp-wr83. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by...

PT-2026-122434

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c8w8-3pqp-wr83. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by...

CVE-2026-73054

SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocket URI with duplicated...

CVE-2026-73054 SiYuan before v3.7.4 Authentication Bypass via WebSocket

SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocket URI with duplicated...

CVE-2026-73054

SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocket URI with duplicated...