CLSA-2026-1781571259 TuxCare security update for org.bouncycastle (3 CVEs)

TuxCare rebuilt 12 org.bouncycastle packages to address 3 CVEs. Fixed in 1.64-tuxcare.5...

CLSA-2026-1780707086 TuxCare security update for @angular (2 CVEs)

TuxCare rebuilt 20 @angular packages to address 2 CVEs. Fixed in 8.0.3-tuxcare.2...

CVE-2024-45340

Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not have access to. By default, unless otherwise set, this only affected credentials stored in the users .netrc file...

CVE-2025-22865

Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed...

CVE-2024-34156

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635...

CVE-2024-24783

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for...