16821 matches found
GHSA-G6V3-7XMC-W563 GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS
Summary The sFlow ExtendedGatewayFlow record decoder in github.com/gopacket/gopacket allocates a slice with makeuint32, n where n is an attacker-controlled 32-bit wire field that has no upper bound. Because the allocation happens before the read loop that would consume the corresponding bytes, a...
CVE-2026-54345
gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size from an attacker-controlled AVP Length field, so a vendor-flagged AVP whose Length is smaller than the 12-byte header...
CVE-2026-54345
gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size from an attacker-controlled AVP Length field, so a vendor-flagged AVP whose Length is smaller than the 12-byte header...
RHSA-2026:46394 Red Hat Security Advisory: go-fdo-client security update
Bulletin has no description...
RHSA-2026:46395 Red Hat Security Advisory: go-fdo-server security update
Bulletin has no description...
BIT-THRIFT-2026-43871 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit
Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...
SUSE-SU-2026:22997-1 Security update for hawk-apiserver
This update for hawk-apiserver fixes the following issues: Changes in hawk-apiserver: - Bump ClusterLabs/go-pacemaker v0.0.0-20260609131737-256130b189e0 bsc1267454 Version 0.1.0+git.1773234993.db3c82f: handle /cib/live/primitives//edit in hawk-apiserver - Bump github.com/stretchr/testify.v1.11.0...
OPENSUSE-SU-2026:21456-1 Security update for google-osconfig-agent
This update for google-osconfig-agent fixes the following issues: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266603. - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of...
RLSA-2026:46391 Important: grafana security, bug fix, and enhancement update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation CVE-2026-44740 Bug Fixes and Enhancements: grafana / rhel-8.10.z Remo...
RockyLinux 8 : grafana (RLSA-2026:46391)
The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:46391 advisory. github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation CVE-2026-44740 Bug Fixes and Enhancements: grafana /...
Oracle Linux 10 : go-fdo-server (ELSA-2026-46395)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-46395 advisory. 1.0.1-3 - Rebuild against updated golang Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...
RockyLinux 10 : go-fdo-client (RLSA-2026:46394)
The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:46394 advisory. crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries CVE-2026-27145 Tenable has extracted the preceding...
Oracle Linux 10 : go-fdo-client (ELSA-2026-46394)
The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-46394 advisory. 1.0.0-5 - Rebuild against updated golang Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that...
RockyLinux 10 : go-fdo-server (RLSA-2026:46395)
The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:46395 advisory. golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 crypto/x509: golang:...
thrift: github.com/apache/thrift: Apache Thrift: Denial of Service via integer overflow or wraparound
A flaw was found in Apache Thrift's C++, cglib, Go, netstd, Delphi, and Haxe bindings. This integer overflow or wraparound vulnerability allows a remote attacker to cause a denial of service DoS by sending specially crafted input. The flaw can lead to the affected service becoming unavailable...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: go-fdo-client: go-fdo-client-1.0.0-2.1.hum1 aarch64, x8664 go-fdo-client-1.0.0-2.1.hum1.src src Security Fixes: go-fdo-client: CVE-2026-56852...
golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...
SUSE-SU-2026:3300-1 Security update for ignition
This update for ignition fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266606. - CVE-2026-56852: golang.org/x/text/unicode/norm: handling of input containing invali...