PT-2026-76442

These are all security issues fixed in the go1.25-1.25.13-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11516-1 go1.25-1.25.13-1.1 on GA media

These are all security issues fixed in the go1.25-1.25.13-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11514-1 containerized-data-importer1.66-api-1.66.0-1.1 on GA media

These are all security issues fixed in the containerized-data-importer1.66-api-1.66.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11517-1 go1.26-1.26.6-1.1 on GA media

These are all security issues fixed in the go1.26-1.26.6-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2026-33818

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

SUSE CVE-2026-56864

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...

SUSE CVE-2026-56865

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...

CVE-2026-33818 vulnerabilities

Vulnerabilities for packages: runc, terraform-provider-acme, spark-operator, kube-vip, gatekeeper, kubeflow, rabbitmq-messaging-topology-operator, gitlab-pages, pdfcpu, terraform-provider-grafana, policy-controller, kubescape-operator, terraform-provider-tls, controller-gen, kapp, rancher-fleet,...

GO-2026-6090 vulnerabilities

Vulnerabilities for packages: runc, terraform-provider-acme, spark-operator, kube-vip, gatekeeper, kubeflow, rabbitmq-messaging-topology-operator, gitlab-pages, pdfcpu, terraform-provider-grafana, policy-controller, kubescape-operator, terraform-provider-tls, controller-gen, kapp, rancher-fleet,...

CVE-2026-56862 vulnerabilities

Vulnerabilities for packages: runc, terraform-provider-acme, spark-operator, kube-vip, gatekeeper, kubeflow, rabbitmq-messaging-topology-operator, gitlab-pages, pdfcpu, terraform-provider-grafana, policy-controller, kubescape-operator, terraform-provider-tls, controller-gen, kapp, rancher-fleet,...

GO-2026-5972 vulnerabilities

Vulnerabilities for packages: runc, terraform-provider-acme, spark-operator, kube-vip, gatekeeper, kubeflow, rabbitmq-messaging-topology-operator, gitlab-pages, pdfcpu, terraform-provider-grafana, policy-controller, kubescape-operator, terraform-provider-tls, controller-gen, kapp, rancher-fleet,...

CVE-2026-56853 vulnerabilities

Vulnerabilities for packages: cosign, runc, terraform-provider-acme, cluster-proportional-autoscaler, kyverno, cis-operator, kapp-controller, kubernetes-dns-node-cache, spark-operator, kube-vip, yunikorn-web, kubeflow, cluster-api-azure-controller, cadvisor, vault-env, k8sgpt, kyverno-notation-aw...

CVE-2026-33818

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

CVE-2026-56860

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2026-56859

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

CVE-2026-56858

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-56853

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

CVE-2026-72817

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the fir...

CVE-2026-72815

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...

CVE-2026-72816

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...