net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

PSF-2026-39

When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...

[SECURITY] Fedora 43 Update: python3.13-3.13.15-1.fc43

Python 3.13 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.13 package provides the "python3.13" executable:...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

GHSA-22W5-2FXG-VRWX OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers

Impact Unauthenticated denial of service. Summary When OpenTofu performs requests against an untrusted or compromised third-party server or connects to an attacker-controlled server, the initial connection negotiation can produce high CPU usage, leading to possible denial of service. These...

PT-2026-80724

This update for python311 fixes the following issues: - Regression in http.cookies bsc1263083...

[SECURITY] Fedora 43 Update: python3.14-3.14.7-1.fc43

Python 3.14 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries...

[SECURITY] Fedora 44 Update: python3.12-3.12.14-1.fc44

Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable:...

MINI-F857-C9JM-X8RP

Bulletin has no description...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: firefox (UTSA-2026-100957)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100957 advisory. Integer overflow in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140....

PT-2026-73369

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...

MINI-3JQ3-2PVH-HPRR

Bulletin has no description...

MINI-88Q6-52FF-J422

Bulletin has no description...

SUSE CVE-2026-33818

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

GO-2025-3774 vulnerabilities

Vulnerabilities for packages: azurefile-csi-fips, blob-csi-fips, calico, cloud-provider-gcp-cloud-controller-manager-fips, emissary, rancher-system-agent, rancher, calico-fips, longhorn-share-manager, azurefile-csi, argo-cd-fips, azuredisk-csi, blob-csi, cluster-autoscaler,...

GO-2025-4193 vulnerabilities

Vulnerabilities for packages: tekton-chains-fips, image-factory, ratify, podman, tkn, cosign-fips, image-factory-fips, buildah, aactl, kyverno-policy-reporter-plugins-kyverno, falcoctl, prometheus-podman-exporter-fips, tekton-chains, kyverno-notation-aws, cg, portieris, kyverno, witness, zarf,...

GO-2025-3646 vulnerabilities

Vulnerabilities for packages: k3s...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

CVE-2026-33818

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

Denial of Service (DoS)

Overview std/net/url is a Go standard library package std/net/url Affected versions of this package are vulnerable to Denial of Service DoS. Go Vulnerability Report:Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on...