865 matches found
BIT-GOLANG-2026-56865 Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...
BIT-GOLANG-2026-56864 Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...
SUSE SLED15 / SLES15 Security Update : go1.25 (SUSE-SU-2026:3640-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3640-1 advisory. Security issues fixed: - CVE-2026-33818: encoding/asn1: enforce maximum recursion depth bsc1275034. -...
SUSE CVE-2026-56864
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...
SUSE CVE-2026-56865
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...
GO-2026-5264 vulnerabilities
Vulnerabilities for packages: prometheus-operator, prometheus-operator-fips, trillian, amazon-cloudwatch-agent-operator-fips, node-problem-detector, google-cloud-otel-ops-collector, mc-fips, minio, node-problem-detector-fips, istio, jaeger-fips, keda, grafana, agentbeat, telegraf, mc, loki-fips,...
GO-2024-2978 vulnerabilities
Vulnerabilities for packages: kots, sops, pulumi-language-dotnet, spicedb, melange, minio, tflint, restic, k8sgpt-operator, tempo, guac, cilium-cli, vcluster, k8sgpt, sigstore-scaffolding, ksops, spire-server, step-ca, terragrunt, smarter-device-manager, gomplate, step, dbmate,...
GO-2026-5662 vulnerabilities
Vulnerabilities for packages: mc, jaeger, tempo, minio-object-browser, telegraf, karma, datadog-agent, aws-otel-collector, splunk-otel-collector, trillian, istio, loki, cloud-sql-proxy, minio-operator, keda, grafana-pyroscope, prometheus-pushgateway, mcp-grafana, minio, certificate-transparency...
GO-2026-5381 vulnerabilities
Vulnerabilities for packages: mc, jaeger, tempo, minio-object-browser, k8sgpt, telegraf, opentelemetry-collector-contrib, karma, datadog-agent, aws-otel-collector, opentelemetry-operator, node-problem-detector, certificate-transparency, metrics-server, splunk-otel-collector, trillian,...
GO-2026-5264 vulnerabilities
Vulnerabilities for packages: mc, jaeger, tempo, k8sgpt, karma, datadog-agent, aws-otel-collector, node-problem-detector, certificate-transparency, metrics-server, splunk-otel-collector, trillian, opentelemetry-collector, amazon-cloudwatch-agent-operator, grafana, prometheus, istio, loki,...
GO-2026-4503 vulnerabilities
Vulnerabilities for packages: kots, ratify, sops, nri-mysql, envoy-gateway, hydra, spicedb, minio, amass, cerbos, age, trufflehog, argo-workflows, chezmoi, juicefs, k3s, nuclei, ksops, spire-server, telegraf, step-ca, tailscale, mattermost, terragrunt, step, dbmate, croc, gitsign, tkn,...
Linux Distros Unpatched Vulnerability : CVE-2026-56865
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist...
Linux Distros Unpatched Vulnerability : CVE-2026-56864
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and...
CVE-2026-56864
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...
CVE-2026-56865
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...
DEBIAN-CVE-2026-56864
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...
CVE-2026-56865
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...
CVE-2026-56864 Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...
CVE-2026-56864
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...
CVE-2026-56865
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...