openSUSE 16 Security Update : google-guest-agent (openSUSE-SU-2026:21476-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21476-1 advisory. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege...

openSUSE 16 Security Update : amazon-ecs-init (openSUSE-SU-2026:21455-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21455-1 advisory. This update for amazon-ecs-init fixes the following issue - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 inp...

Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266603. CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of input...

OPENSUSE-SU-2026:21456-1 Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266603. - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of...

CVE-2026-64647

Summary: Next.js versions affected include 12.0.0–15.5.20 and 16.0.0–16.2.10. A server-side fetch with a request body can return a cached response body from a different request to the same URL when the request body uses a non-UTF-8 charset, causing confidential data in the POST response to leak t...

SUSE-SU-2026:3300-1 Security update for ignition

This update for ignition fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266606. - CVE-2026-56852: golang.org/x/text/unicode/norm: handling of input containing invali...

SUSE-SU-2026:22952-1 Security update for distribution

This update for distribution fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266629. - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on...

NPM: Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

NPM: Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences vulnerability discovered by ? in WordPress Npm next versions = 13.0.0, 15.5.21...

DEBIAN-CVE-2026-56852

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

CVE-2026-56852

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

CVE-2026-56852 Infinite loop on invalid input in golang.org/x/text

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

CVE-2026-56852

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

JLSEC-2026-773

The bsonvalidate function may return early on specific inputs and incorrectly report success. This behavior could result in skipping validation for BSON data, allowing malformed or invalid UTF-8 sequences to bypass validation and be processed incorrectly. The issue may affect applications that re...

GO-2026-5970 Infinite loop on invalid input in golang.org/x/text

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

GHSA-P7H3-7Q52-72W8 printenv: environment variables with invalid UTF-8 are silently skipped (evades inspection)

The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in environment strings, the uutils implementation silently skips these entries rather than printing the raw bytes. This vulnerability allows...

UBUNTU-CVE-2026-54911

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps or ujson.dump or ujson.encode have a rejectbytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different...

Astra Linux – Vulnerability in libtomcrypt

In LibTomCrypt version 1.18.2, the derdecodeutf8string function located in derdecodeutf8string.c does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service such as out-of-bounds reads and crashes or to read information from other...

CVE-2026-42327

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocspresponders returns OCSP responder URLs from a certificate's AIA extension as OpensslString, whose Deref wraps the raw bytes with str::fromutf8unchecked. OpenSSL does not enforce th...

GHSA-7259-CWHX-3XX3 Duplicate Advisory: uutils coreutils has an Improper Check for Unusual or Exceptional Conditions

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p7h3-7q52-72w8. This link is maintained to preserve external references. Original Description The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte...

Duplicate Advisory: uutils coreutils has an Improper Check for Unusual or Exceptional Conditions

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p7h3-7q52-72w8. This link is maintained to preserve external references. Original Description The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte...