EUVD-2026-58756

erlangquic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was not validated, and the hostname was not compared against the certificat...

CVE-2026-49457

CVE-2026-49457 affects erlang_quic prior to 1.4.4, where the QUIC client did not authenticate the server during TLS 1.3 handshakes. Specifically, CertificateVerify signature checks were missing, the certificate chain was not validated, and hostname verification was skipped, effectively making ver...

CVE-2026-49457

erlangquic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was not validated, and the hostname was not compared against the certificat...

CVE-2026-56862

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

GO-2026-5593 vulnerabilities

Vulnerabilities for packages: sftpgo, traefik-fips, traefik...

GO-2026-5575 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kyverno, kyverno-notation-aws-fips...

GO-2020-0005 vulnerabilities

Vulnerabilities for packages: etcd-fips, etcd, dgraph...

GO-2026-5289 vulnerabilities

Vulnerabilities for packages: cert-manager-istio-csr, cert-manager-istio-csr-fips...

GO-2025-4068 vulnerabilities

Vulnerabilities for packages: step-issuer-fips, step, caddy-fips, step-ca, step-ca-fips, step-issuer, step-fips, caddy...

GO-2026-4985 vulnerabilities

Vulnerabilities for packages: hydra, harbor-registry-fips, flux, gitlab-workhorse-ce, commercial-grafana, gitlab-kas-fips, terraform-fips, bento-fips, hubble, buildkitd, terraform-mcp-server, elastic-agent-fips, harbor, frankenphp-8.2, ory-kratos-fips, opa-fips-envoy, ingress-nginx-controller,...

GO-2025-4193 vulnerabilities

Vulnerabilities for packages: prometheus-podman-exporter-fips, vexctl, portieris-fips, undock, zarf, flux-source-controller-fips, portieris, image-factory, image-factory-fips, cosign, skopeo, tekton-chains, chainctl, witness, sigstore-scaffolding-fips, falcoctl-fips, tkn-fips, gitsign,...

GO-2025-3646 vulnerabilities

Vulnerabilities for packages: k3s...

GO-2026-4458 vulnerabilities

Vulnerabilities for packages: step-ca, step, caddy, step-issuer...

GO-2026-5885 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, rancher-helm, argocd-image-updater, falcoctl, ratify, gatekeeper, rancher-agent, rancher-fleet, kyverno-notation-aws, helm-set-status, k8sgpt, kots, kyverno, kargo, headlamp, argo-cd, kubescape-operator, helm-mapkubeapis, consul-k8s, triv...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kinesis, crossplane-provider-aws-memorydb, datadog-agent, falcoctl, cluster-api-azure-controller, zot, minio, slsa-verifier, splunk-otel-collector, docker-compose, cert-manager, kubernetes, chezmoi, crossplane-provider-aws-rds, gatus, k3s, hel...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

EUVD-2026-58511

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely...

EUVD-2026-58510

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this...

MiracleLinux 9 : [security - high] ruby:4.0, ruby-4.0.3-33.module+el9+1172+b3ab8c11 (AXSA:2026-1542:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1542:01 advisory. ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses CVE-2026-42245 ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via...