GO-2025-3447 vulnerabilities

Vulnerabilities for packages: sbom-scorecard, falco-exporter, kubernetes, nri-mysql, actions-runner-controller, step, k8ssandra-operator, argo-events, nri-elasticsearch, mage, grafana-agent-operator, grafana-operator, cert-exporter, terraform-provider-google, chezmoi, docker-credential-ecr-login,...

GO-2024-2824 vulnerabilities

Vulnerabilities for packages: mkcert, kubernetes-csi-livenessprobe, tempo, flux-image-reflector-controller, spicedb, mods, go-bindata, kubernetes-dashboard-metrics-scraper, kubernetes-ingress-defaultbackend, spark-operator, step, vault-k8s, kube-bench, nats-server, mage, libnvidia-container,...

GO-2024-2887 vulnerabilities

Vulnerabilities for packages: sbom-scorecard, bazelisk, nri-mysql, actions-runner-controller, step, k8ssandra-operator, nri-elasticsearch, mage, grafana-agent-operator, grafana-operator, cert-exporter, terraform-provider-google, chezmoi, docker-credential-ecr-login, vt-cli, yam, nri-apache,...

GO-2024-3005 vulnerabilities

Vulnerabilities for packages: harbor-scanner-trivy, helm-push, falcoctl, apko, kaniko, cosign, k3s, bom, flux-image-reflector-controller, vexctl, kpt, policy-controller, docker, trivy, scorecard, vcluster, slsa-verifier, ctop, grafana-alloy, helm-operator, cadvisor, grype, neuvector-scanner, tkn,...

GO-2024-3250 vulnerabilities

Vulnerabilities for packages: flux-notification-controller, promxy, falcoctl, kubernetes-dashboard-auth, kaniko, cosign, gitea, crossplane-provider-azure-authorization, doppler-kubernetes-operator, k3s, kubernetes, git-sync, flux-image-reflector-controller, vexctl, argo-rollouts, policy-controlle...

GO-2024-3333 vulnerabilities

Vulnerabilities for packages: falco-exporter, kubernetes, actions-runner-controller, step, k8ssandra-operator, argo-events, grafana-agent-operator, grafana-operator, cert-exporter, terraform-provider-google, chezmoi, distribution, authservice, wal-g, rclone, dbmate, nuclei, kine, rook,...

GO-2024-2963 vulnerabilities

Vulnerabilities for packages: sbom-scorecard, bazelisk, nri-mysql, actions-runner-controller, step, k8ssandra-operator, nri-elasticsearch, mage, grafana-agent-operator, cert-exporter, terraform-provider-google, docker-credential-ecr-login, vt-cli, yam, authservice, nri-apache, render-template,...

GO-2025-3373 vulnerabilities

Vulnerabilities for packages: sbom-scorecard, bazelisk, falco-exporter, kubernetes, actions-runner-controller, k8ssandra-operator, argo-events, mage, grafana-operator, docker-credential-ecr-login, vt-cli, distribution, render-template, pdfcpu, nuclei, metrics-server, cni-plugins, trust-manager,...

GO-2024-3105 vulnerabilities

Vulnerabilities for packages: sbom-scorecard, bazelisk, kubernetes, nri-mysql, actions-runner-controller, step, k8ssandra-operator, nri-elasticsearch, mage, grafana-agent-operator, grafana-operator, cert-exporter, terraform-provider-google, chezmoi, docker-credential-ecr-login, vt-cli, yam,...

GO-2024-2718 vulnerabilities

Vulnerabilities for packages: falcoctl, apko, vexctl, policy-controller, slsa-verifier, wolfictl, tkn, flux-source-controller, neuvector-sigstore-interface, zarf, zot, kubescape, gitsign, skaffold, spire-server, aactl, ko, goreleaser, melange, tekton-chains...

GO-2024-2719 vulnerabilities

Vulnerabilities for packages: falcoctl, apko, vexctl, policy-controller, slsa-verifier, wolfictl, tkn, flux-source-controller, neuvector-sigstore-interface, zarf, zot, kubescape, gitsign, skaffold, spire-server, aactl, ko, goreleaser, melange, tekton-chains...

GO-2024-2687 vulnerabilities

Vulnerabilities for packages: sbom-scorecard, bazelisk, kubernetes, nri-mysql, actions-runner-controller, step, k8ssandra-operator, nri-elasticsearch, mage, grafana-agent-operator, grafana-operator, cert-exporter, terraform-provider-google, chezmoi, docker-credential-ecr-login, vt-cli, yam,...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: golang1.26: golang1.26-1.26.6-0.1.hum1 aarch64, x8664 golang1.26-bin-1.26.6-0.1.hum1 aarch64, x8664 golang1.26-docs-1.26.6-0.1.hum1 noarch golang1.26-misc-1.26.6-0.1.hum1 noarch...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...