CVE-2026-52879

Summary: CVE-2026-52879 affects Klever-Go (Go implementation of Klever) where the direct-message ingress path spawns a new goroutine for every incoming direct message before the antiflood layer decides admission. This creates unbounded goroutine growth per peer, increasing stack allocations and G...

CVE-2026-15972 Unauthenticated denial of service via unbounded external gRPC connection acceptance

Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplet...

CVE-2026-52879: Uncontrolled Resource Consumption

Klever-Go is the Go implementation of the Klever blockchain protocol. In versions 1.7.14 through 1.7.17, the direct-message ingress handler spawns a new goroutine for every incoming direct message before the processor-level antiflood layer makes any admission decision, with no semaphore, throttle...

rclone: Infinite Scale TUS Creation Transport Error Causes a Nil-Response Panic

Summary A transport failure during the initial Infinite Scale TUS creation POST can return nil response, non-nil error. Rclone dereferences the nil response before processing the error and panics. The production CreateUploader path reproduced the crash against a closed endpoint. The security...

rclone: Verbose Stack Trace Disclosure in RC API Error Responses

Summary When an RC API call triggers a panic recovered by the job runner, the full Go stack trace is included in the JSON error response. This leaks internal file paths, Go module versions, goroutine state, and memory addresses to the API caller. Details The panic recovery in...

PT-2026-81367

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.75.0 Description A denial of service issue exists in the WebDAV TUS creation handler. The problem occurs when the system dereferences a nil response before verifying transport errors. A malicious or compromised...

PT-2026-68321

Name of the Vulnerable Software and Affected Versions boringproxy versions prior to 0.10.1 Description An authenticated user can cause resource exhaustion by sending requests to the 'GET /loading' endpoint using a malicious id query parameter. The issue occurs because the handler lacks a map-look...

CVE-2026-70616: Deadlock

boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, goroutines, and memory by sending requests to the GET /loading endpoint with attacker-supplied id query parameter values. Because the handler...

SUSE CVE-2026-42594

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the webhook middleware spawns a goroutine that holds a reference to the request's echo.Context after the synchronous handler returns ErrAsyncProcess and Echo recycles the context back to its sync.Pool. When a concurrent...

SUSE CVE-2026-55882

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD server mounts Go net/http/pprof handlers under /debug with no access control. When the HUD or apiserver listener is network-exposed, an unauthenticated caller can read process memor...

CVE-2026-41186

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

EUVD-2026-51155

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

CVE-2026-41186

The CVE-2026-41186 issue affects Calico components (shared debug server used by kube-controllers and Goldmane). When enabled, the Go pprof debug listener binds to 0.0.0.0 and lacks authentication, allowing any pod with network reachability to access internal memory state via the heap, goroutine s...

CVE-2026-41186 Unauthenticated Go pprof exposure in Calico debug server

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

CVE-2026-41186

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

PT-2026-71356

Name of the Vulnerable Software and Affected Versions etcd versions prior to 3.5.33 etcd versions prior to 3.6.14 etcd versions prior to 3.7.1 Description A network attacker capable of reaching an etcd TLS listener can initiate numerous TCP connections without sending a ClientHello. Within the fi...

GO-2026-5975 Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions in github.com/SpectoLabs/hoverfly

Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions in github.com/SpectoLabs/hoverfly...

Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions

Summary: Remote post-serve actions use http.DefaultClient without any timeout configuration. When the remote endpoint is unreachable or intentionally slow accepts TCP connection but never responds, each triggered proxy request spawns a goroutine that blocks indefinitely on http.DefaultClient.Do. ...

GHSA-42J2-W334-QXW7 Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions

Summary: Remote post-serve actions use http.DefaultClient without any timeout configuration. When the remote endpoint is unreachable or intentionally slow accepts TCP connection but never responds, each triggered proxy request spawns a goroutine that blocks indefinitely on http.DefaultClient.Do. ...

PT-2026-58942

Summary: Remote post-serve actions use http.DefaultClient without any timeout configuration. When the remote endpoint is unreachable or intentionally slow accepts TCP connection but never responds, each triggered proxy request spawns a goroutine that blocks indefinitely on http.DefaultClient.Do. ...