GO-2026-5879 Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go

Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go...

GO-2026-5543 Go-ntlmssp NTLM challenges can panic on malformed payloads in github.com/Azure/go-ntlmssp

Go-ntlmssp NTLM challenges can panic on malformed payloads in github.com/Azure/go-ntlmssp...

GO-2026-5074 Go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation in github.com/go-git/go-git

Go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation in github.com/go-git/go-git...

GO-2026-5884 ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go

ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go...

GO-2026-5880 Hardlink path traversal during tar extraction in oras.land/oras-go

Hardlink path traversal during tar extraction in oras.land/oras-go...

GO-2026-5490 Go-billy: Symlink resolution lack of cycle detection leads to infinite loop in github.com/go-git/go-billy

Go-billy: Symlink resolution lack of cycle detection leads to infinite loop in github.com/go-git/go-billy...

GO-2026-5105 Go-git: Credential leak via cross-host redirect in smart HTTP transport in github.com/go-git/go-git

Go-git: Credential leak via cross-host redirect in smart HTTP transport in github.com/go-git/go-git...

GO-2026-5327 Mongo-go-driver: Heap Out-of-Bounds Read in GSSAPI Error Handling in go.mongodb.org/mongo-driver

Mongo-go-driver: Heap Out-of-Bounds Read in GSSAPI Error Handling in go.mongodb.org/mongo-driver...

GO-2026-5506 OpenTelemetry-Go: Multi-value baggage header extraction causes excessive allocations in go.opentelemetry.io/otel

OpenTelemetry-Go: Multi-value baggage header extraction causes excessive allocations in go.opentelemetry.io/otel...

GO-2026-5774 Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi

Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi...

GO-2026-5336 Go-git: Crafted repositories may modify main and submodule .git directories in github.com/go-git/go-git

Go-git: Crafted repositories may modify main and submodule .git directories in github.com/go-git/go-git...

GO-2026-5208 Go Markdown has an out-of-bounds read in SmartypantsRenderer in github.com/gomarkdown/markdown

Go Markdown has an out-of-bounds read in SmartypantsRenderer in github.com/gomarkdown/markdown...

GO-2026-5885 Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go

Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go...

GO-2026-5158 Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel...

OESA-2026-3175 buildah security update

The package provides a command line tool which can be used to create a working container from scratch or create a working container from an image as a starting point mount/umount a working container's root file system for manipulation save container's root file system layer to create a new image...

OESA-2026-3174 buildah security update

The package provides a command line tool which can be used to create a working container from scratch or create a working container from an image as a starting point mount/umount a working container's root file system for manipulation save container's root file system layer to create a new image...

RHSA-2025:23737 Red Hat Security Advisory: go-toolset:rhel8 security update

Bulletin has no description...

RHSA-2025:22668 Red Hat Security Advisory: go-toolset:rhel8 security update

Bulletin has no description...

CVE-2026-15704 CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components

In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router configuration used Chi's middleware.StripSlashes,...

EUVD-2026-48523

In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router configuration used Chi's middleware.StripSlashes,...