Amazon Linux 2 : golang, --advisory ALAS2-2026-3893 (ALAS-2026-3893)

The version of golang installed on the remote host is prior to 1.26.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3893 advisory. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

Security update for go1.26-openssl (important)

openSUSE security update: security update for go1.26-openssl ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21705-1 Rating: important References: bsc1255111 bsc1266609 bsc1275024 bsc1275025 bsc1275026 bsc1275028 bsc1275029 bsc1275032 bsc1275033...

Important: golang

Issue Overview: Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. CVE-2026-33818 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2026-2114)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2114 advisory. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. CVE-2026-33818 When a server is configured to support unencrypted HTTP/2, i...

SUSE SLED15 / SLES15 Security Update : go1.25-openssl (SUSE-SU-2026:3815-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3815-1 advisory. Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged...

Updated golang packages fix security vulnerabilities

CVE-2026-56865 A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. CVE-2026-56864 A malicious GOSUMDB was capable of serving arbitrary...

MGASA-2026-0341 Updated golang packages fix security vulnerabilities

CVE-2026-56865 A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. CVE-2026-56864 A malicious GOSUMDB was capable of serving arbitrary...

Linux Distros Unpatched Vulnerability : CVE-2026-73209

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is...

ALPINE-CVE-2026-73209

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

CVE-2026-73209

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

AZL-98283 CVE-2026-73209 affecting package dovecot 2.3.20-1

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

EUVD-2026-67681

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

CVE-2026-73209

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

CVE-2026-73209

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

CVE-2026-73209

CVE-2026-73209 affects the IMAP process in Open-Xchange Dovecot , where an attacker with valid credentials can send crafted compressed data that causes the process to exhaust its stack and crash. The resulting process termination can lead to degradation or denial of service for IMAP services. The...

UBUNTU-CVE-2026-73209

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

PT-2026-83075

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description An attacker with valid credentials can send specially crafted compressed data that leads to stack exhaustion, causing the affected process to crash. This termination of the process can result in...

CVE-2026-73209

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

TencentOS Server 3: php:8.2 (TSSA-2026:0930)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0930 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...