Amazon Linux 2 : golang, --advisory ALAS2-2026-3819 (ALAS-2026-3819)

The version of golang installed on the remote host is prior to 1.25.12-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3819 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final...

MGASA-2026-0276 Updated golang packages fix security vulnerabilities

The updated packages fix security vulnerabilities: mime: quadratic complexity in WordDecoder.DecodeHeader. CVE-2026-42504 net/textproto: arbitrary input are included in errors without any escaping. CVE-2026-42507 crypto/x509: split candidate hostname only once. CVE-2026-27145 os: Root escape via...

netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake

A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a crafted TLS Transport Layer Security ClientHello message. This can lead to an eager allocation of a large memory buffer, causing a Denial of Service DoS due to excessive memor...

Malicious code in hello-world-test-mh3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 876b02450317c42447a25bd7f858fab9b44469580c662fbf4cd48ebf7a299edd Package is a trivial hello-world test artifact. setup.py contains an execbase64.b64decode... call at install time, but the decoded payload is a singl...

Malicious code in hello-world-test-mh2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68a70ea37beb115e4464b5e9ebaf58986f4cd75434257163f4ddb82f5624ea13 setup.py decodes a base64 string and passes the result to exec at install time. The decoded payload is a single print statement that emits a benign...

MAL-2026-10907 Malicious code in hello-world-test-mh2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68a70ea37beb115e4464b5e9ebaf58986f4cd75434257163f4ddb82f5624ea13 setup.py decodes a base64 string and passes the result to exec at install time. The decoded payload is a single print statement that emits a benign...

MAL-2026-10908 Malicious code in hello-world-test-mh3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 876b02450317c42447a25bd7f858fab9b44469580c662fbf4cd48ebf7a299edd Package is a trivial hello-world test artifact. setup.py contains an execbase64.b64decode... call at install time, but the decoded payload is a singl...

Amazon Linux 2023 : golang-github-burntsushi-toml, golang-github-burntsushi-toml-devel (ALAS2023-2026-1978)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1978 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

Medium: golang

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

Amazon Linux 2023 : credentials-fetcher (ALAS2023-2026-1975)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1975 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

Amazon Linux 2023 : compat-golang-github-cpuguy83-md2man-2-devel, golang-github-cpuguy83-md2man, golang-github-cpuguy83-md2man-devel (ALAS2023-2026-1989)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1989 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

Medium: credentials-fetcher

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

Medium: golang-github-burntsushi-toml-test

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

Amazon Linux 2023 : golist (ALAS2023-2026-1976)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1976 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

SUSE SLES16 Security Update : go1.25 (SUSE-SU-2026:22643-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22643-1 advisory. This update for go1.25 fixes the following issues - Update to version go1.25.12 bsc1244485. - CVE-2026-25679: net/url: reject IPv6...

DEBIAN-CVE-2026-44452

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientHello message over TLS or QUIC and it contains a zero-length SNI extension, the h2o server runs over the zero-length hostname while trying to copy the hostname, assuming that it ...

CVE-2026-44452

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientHello message over TLS or QUIC and it contains a zero-length SNI extension, the h2o server runs over the zero-length hostname while trying to copy the hostname, assuming that it ...

CVE-2026-44452

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientHello message over TLS or QUIC and it contains a zero-length SNI extension, the h2o server runs over the zero-length hostname while trying to copy the hostname, assuming that it ...

CVE-2026-44452

CVE-2026-44452 affects the h2o HTTP server (supports HTTP/1.x, 2, 3). Affected behavior occurs when a TLS/QUIC ClientHello contains a zero-length SNI extension; h2o can attempt to copy the hostname assuming NULL-termination, causing a heap/segmentation fault that may enable a denial-of-service. T...

CVE-2026-44452 h2o is vulnerable to heap overrun

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientHello message over TLS or QUIC and it contains a zero-length SNI extension, the h2o server runs over the zero-length hostname while trying to copy the hostname, assuming that it ...