29 matches found
Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2026-3225)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3225 advisory. When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server reject...
Amazon Linux 2 : golang (ALAS-2026-4005)
The version of golang installed on the remote host is prior to 1.26.9-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4005 advisory. When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the...
Important: golang
Issue Overview: When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connectio...
Important: golang
Issue Overview: When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connectio...
OESA-2026-4435 golang security update
. Security Fixes: On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return ...
OESA-2026-4433 golang security update
. Security Fixes: On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return ...
OESA-2026-4434 golang security update
. Security Fixes: When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the...
OESA-2026-4432 golang security update
. Security Fixes: On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return ...
Golang 1.26.x < 1.26.9 / 1.27.x < 1.27.2 Multiple Vulnerabilities
The version of Golang running on the remote host is 1.26.x prior to 1.26.9, or 1.27.x prior to 1.27.2. It is, therefore, affected by multiple vulnerabilities in the standard library and the toolchain, as referenced in the golang-announce advisory, including: - On Windows, when the target of...
PT-2026-115876
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle...
SUSE CVE-2026-56866
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle...
EUVD-2026-95421
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle...
Linux Distros Unpatched Vulnerability : CVE-2026-56866
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the reque...
CVE-2026-56866
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle...
AZL-107460 CVE-2026-56866 affecting package golang 1.26.7-1
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle...
AZL-107492 CVE-2026-56866 affecting package golang 1.27.1-1
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle...
AZL-107928 CVE-2026-56866 affecting package tensorflow 2.16.1-11
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle...
AZL-107399 CVE-2026-56866 affecting package gcc 13.2.0-7
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle...
DEBIAN-CVE-2026-56866
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle...
CVE-2026-56866
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle...