Astra Linux – Vulnerability in containerd-app

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to a Denial-of-Service DoS attack if an attacker provides specially crafted HTML content...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

Photon OS 5.0: Go PHSA-2026-5.0-91-0869

An update of the go package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0869. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Go PHSA-2026-5.0-92-0763

An update of the go package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0763. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Go PHSA-2026-5.0-91-0763

An update of the go package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0763. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Go PHSA-2026-5.0-90-0763

An update of the go package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-90-0763. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Pmd PHSA-2023-5.0-91-0037

An update of the pmd package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0037. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

MiracleLinux 9 : podman-5.8.2-5.el9_8 (AXSA:2026-1501:08)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1501:08 advisory. os: golang: Go os.Root: Symlink following vulnerability allows directory traversal CVE-2026-39822 Tenable has extracted the preceding description block...

CVE-2026-19354

CVE-2026-19354 affects lock-upme OPMS. The vulnerability is a SQL injection in an unknown function of controllers/messages/message.go within the IN Clause Handler. Manipulating the argument ids can be exploited remotely (attack vector: network). The product uses a rolling release, so specific aff...

Exploit for CVE-2026-71557

CVE-2026-71557: Go-Git path traversal PoC English versionR...

CVE-2026-49343

Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, the account-data trie syncers are vulnerable to a resource-exhaustion flaw that leaks bounded throttler slots on error paths. In syncDataTrie in both userAccountsSyncer.go and kappAccountsSyncer.go,...

CVE-2026-52880

Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST APIs are started with the Gin Engine.Run convenience method, which serves requests through Go's default HTTP server with ...

CVE-2026-47249

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resolver request handling logic is vulnerable to hash-array amplification. A connected peer can send a compressed RequestDataTypeHashArrayType direct request that is only 442 bytes on the wire but expan...

CVE-2026-52880

Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST APIs are started with the Gin Engine.Run convenience method, which serves requests through Go's default HTTP server with ...

CVE-2026-52880

Klever-Go REST API (seednode and node) in versions 1.7.14–1.7.17 is affected by a denial-of-service via slow-header connections. The issue stems from Gin Engine.Run using Go’s default http.ListenAndServe with no ReadHeaderTimeout, ReadTimeout, or MaxHeaderBytes, allowing an unauthenticated client...

CVE-2026-52880 Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Run

Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST APIs are started with the Gin Engine.Run convenience method, which serves requests through Go's default HTTP server with ...

CVE-2026-52879 Klever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS

Klever-Go is the Go implementation of the Klever blockchain protocol. In versions 1.7.14 through 1.7.17, the direct-message ingress handler spawns a new goroutine for every incoming direct message before the processor-level antiflood layer makes any admission decision, with no semaphore, throttle...

CVE-2026-52879 Klever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS

Klever-Go is the Go implementation of the Klever blockchain protocol. In versions 1.7.14 through 1.7.17, the direct-message ingress handler spawns a new goroutine for every incoming direct message before the processor-level antiflood layer makes any admission decision, with no semaphore, throttle...

CVE-2026-52879

Summary: CVE-2026-52879 affects Klever-Go (Go implementation of Klever) where the direct-message ingress path spawns a new goroutine for every incoming direct message before the antiflood layer decides admission. This creates unbounded goroutine growth per peer, increasing stack allocations and G...