Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

ALSA-2026:38491 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Linux kernel: Memory leak in networking due to incorrect GRO packet handling CVE-2026-22979 kernel: rtmutex: Use waiter::task instead of current in removewaiter CVE-2026-43499 kernel: net...

RHEL 9 : kernel (RHSA-2026:38491)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:38491 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Linux kernel: Memory leak in...

AlmaLinux 9 : kernel (ALSA-2026:38491)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:38491 advisory. kernel: Linux kernel: Memory leak in networking due to incorrect GRO packet handling CVE-2026-22979 kernel: rtmutex: Use waiter::task instead of current ...

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Linux kernel: Memory leak in networking due to incorrect GRO packet handling CVE-2026-22979 kernel: rtmutex: Use waiter::task instead of current in removewaiter CVE-2026-43499 kernel: net...

PT-2026-57824

Name of the Vulnerable Software and Affected Versions Storable versions prior to 3.41 Description A signed integer overflow occurs during the deserialization of a specially crafted SX HOOK record. The function retrieve hook common reads a signed 32-bit item count and passes it to av extend after...

CVE-2026-54063

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the checkSheet function in github.com/xuri/excelize/v2 uses an attacker-controlled XML attribute value directly as the length argument to makexlsxRow, row without validating it against the Exc...

CVE-2026-54063 Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS)

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the checkSheet function in github.com/xuri/excelize/v2 uses an attacker-controlled XML attribute value directly as the length argument to makexlsxRow, row without validating it against the Exc...

EUVD-2026-42937

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice, allowing an XLSX file containing a shared-string cell with ...

CVE-2026-59162

CVE-2026-59162 affects the Go library Excelize (reading/writing Excel spreadsheets). Before 2.11.0, shared-string values are parsed with strconv.Atoi and only the upper bound is checked when indexing the shared string slice, which allows a -1 index to be used (sharedStrings[-1]) and causes a pani...

CVE-2026-59162 Excelize: Negative shared-string index causes panic in GetCellValue and GetRows

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice, allowing an XLSX file containing a shared-string cell with ...

CVE-2026-59162 Excelize: Negative shared-string index causes panic in GetCellValue and GetRows

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice, allowing an XLSX file containing a shared-string cell with ...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index in the validation process for BGP UPDATE messages containing an empty ASPATH attribute. An attacker can cause a panic and terminate the peer session by sending a malformed UPDATE with a zero-length...

golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate

A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to...

GHSA-4HGP-59H5-GVRJ ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)

Summary The public parser entrypoint ratexparser::parse&str panics on the 9-byte input \verbéxé i.e. \verb followed by the non-ASCII delimiter é. When handling a \verb command, the parser slices the verbatim argument with byte indices arg1..arg.len - 1; if the delimiter character is multibyte...

GO-2026-5764 DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream

DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream...

golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate

A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to...

ALSA-2026:36349 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: tcp: fix potential race in tcpv6synrecvsock CVE-2026-43198 kernel: netfilter: nfnetlinkcthelper: fix OOB read in nfnlcthelperdumptable CVE-2026-43450 kernel: sctp: revalidate list cursor...

Security Bulletin: Vulnerability in golang.org/x/net package bundled with IBM Fusion, IBM Fusion HCI, IBM Fusion Data Cataloging and IBM Fusion Content-Aware Storage

Summary IBM Fusion, IBM Fusion HCI, IBM Fusion Data Cataloging and IBM Fusion Content-Aware Storage include the golang.org/x/net package. It cause a running server to panic. CVE-2026-27141 Vulnerability Details CVEID:CVE-2026-27141 DESCRIPTION: Due to missing nil check, sending 0x0a-0x0f HTTP/2...

OPENSUSE-SU-2026:21241-1 Security update for buildah

This update for buildah fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266648. - CVE-2026-39829: golang.org/x/crypto/ssh: pathological RSA/DSA parameters may cause D...