{ "SchemaVersion": 2, "Trivy": { "Version": "0.70.0" }, "ReportID": "01a1b919-8dac-75dd-8006-de4da472ba9d", "CreatedAt": "2026-11-08T04:00:22.060385524+01:00", "ArtifactID": "sha256:bf66f0682e4cc1291caa4ef367b43ca3568adc11aeec0ae1a08341374dce7949", "ArtifactName": "containrrr/watchtower:latest", "ArtifactType": "container_image", "Metadata": { "Size": 15516672, "ImageID": "sha256:e7dd50d07b86c380dd53caeb7778da052d1a8fc2c606644a419afa35e9f5691e", "DiffIDs": [ "sha256:2e4018e909ea5fa77763f395b09d7472ce2429c4f3764e790a1df25ad48433b3", "sha256:6486464e2aaa6f15e679cdd0480928974cecc2eae1f4bec2e432b453cf45ef5f", "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" ], "RepoTags": [ "containrrr/watchtower:latest" ], "RepoDigests": [ "containrrr/watchtower@sha256:6dd50763bbd632a83cb154d5451700530d1e44200b268a4e9488fefdfcf2b038" ], "Reference": "containrrr/watchtower:latest", "ImageConfig": { "architecture": "amd64", "created": "2023-11-11T18:51:37.413006095Z", "history": [ { "created": "2023-11-11T18:51:37Z", "created_by": "LABEL com.centurylinklabs.watchtower=true", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2023-11-11T18:51:37Z", "created_by": "COPY /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2023-11-11T18:51:37Z", "created_by": "COPY /usr/share/zoneinfo /usr/share/zoneinfo # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2023-11-11T18:51:37Z", "created_by": "EXPOSE map[8080/tcp:{}]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2023-11-11T18:51:37Z", "created_by": "COPY watchtower / # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2023-11-11T18:51:37Z", "created_by": "HEALTHCHECK \u0026{[\"CMD\" \"/watchtower\" \"--health-check\"] \"0s\" \"0s\" \"0s\" '\\x00'}", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2023-11-11T18:51:37Z", "created_by": "ENTRYPOINT [\"/watchtower\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true } ], "os": "linux", "rootfs": { "type": "layers", "diff_ids": [ "sha256:2e4018e909ea5fa77763f395b09d7472ce2429c4f3764e790a1df25ad48433b3", "sha256:6486464e2aaa6f15e679cdd0480928974cecc2eae1f4bec2e432b453cf45ef5f", "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" ] }, "config": { "Healthcheck": { "Test": [ "CMD", "/watchtower", "--health-check" ] }, "Entrypoint": [ "/watchtower" ], "Env": [ "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" ], "Labels": { "com.centurylinklabs.watchtower": "true" }, "WorkingDir": "/", "ExposedPorts": { "8080/tcp": {} } } }, "Layers": [ { "Size": 217600, "DiffID": "sha256:2e4018e909ea5fa77763f395b09d7472ce2429c4f3764e790a1df25ad48433b3" }, { "Size": 1903616, "DiffID": "sha256:6486464e2aaa6f15e679cdd0480928974cecc2eae1f4bec2e432b453cf45ef5f" }, { "Size": 13395456, "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" } ] }, "Results": [ { "Target": "watchtower", "Class": "lang-pkgs", "Type": "gobinary", "Packages": [ { "ID": "stdlib@v1.18.10", "Name": "stdlib", "Identifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "Version": "v1.18.10", "Relationship": "direct", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/beorn7/perks@v1.0.1", "Name": "github.com/beorn7/perks", "Identifier": { "PURL": "pkg:golang/github.com/beorn7/perks@v1.0.1", "UID": "e99d841722f9afbe" }, "Version": "v1.0.1", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cespare/xxhash/v2@v2.2.0", "Name": "github.com/cespare/xxhash/v2", "Identifier": { "PURL": "pkg:golang/github.com/cespare/xxhash/v2@v2.2.0", "UID": "964f75a8d369ae30" }, "Version": "v2.2.0", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/containrrr/shoutrrr@v0.8.0", "Name": "github.com/containrrr/shoutrrr", "Identifier": { "PURL": "pkg:golang/github.com/containrrr/shoutrrr@v0.8.0", "UID": "bb900b489b896cf4" }, "Version": "v0.8.0", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/containrrr/watchtower", "Name": "github.com/containrrr/watchtower", "Identifier": { "PURL": "pkg:golang/github.com/containrrr/watchtower", "UID": "7f85233a767bb352" }, "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/distribution/reference@v0.5.0", "Name": "github.com/distribution/reference", "Identifier": { "PURL": "pkg:golang/github.com/distribution/reference@v0.5.0", "UID": "6a937b6c1c747820" }, "Version": "v0.5.0", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/docker/cli@v24.0.7+incompatible", "Name": "github.com/docker/cli", "Identifier": { "PURL": "pkg:golang/github.com/docker/cli@v24.0.7%2Bincompatible", "UID": "35e4de4ba493d72" }, "Version": "v24.0.7+incompatible", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/docker/distribution@v2.8.3+incompatible", "Name": "github.com/docker/distribution", "Identifier": { "PURL": "pkg:golang/github.com/docker/distribution@v2.8.3%2Bincompatible", "UID": "7091f8a40b81c078" }, "Version": "v2.8.3+incompatible", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/docker/docker@v24.0.7+incompatible", "Name": "github.com/docker/docker", "Identifier": { "PURL": "pkg:golang/github.com/docker/docker@v24.0.7%2Bincompatible", "UID": "b6697276e28baf41" }, "Version": "v24.0.7+incompatible", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/docker/docker-credential-helpers@v0.6.1", "Name": "github.com/docker/docker-credential-helpers", "Identifier": { "PURL": "pkg:golang/github.com/docker/docker-credential-helpers@v0.6.1", "UID": "4f29061f33e0b72b" }, "Version": "v0.6.1", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/docker/go-connections@v0.4.0", "Name": "github.com/docker/go-connections", "Identifier": { "PURL": "pkg:golang/github.com/docker/go-connections@v0.4.0", "UID": "ef36ddb142049c84" }, "Version": "v0.4.0", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/docker/go-units@v0.4.0", "Name": "github.com/docker/go-units", "Identifier": { "PURL": "pkg:golang/github.com/docker/go-units@v0.4.0", "UID": "8f49c25ba6ea3082" }, "Version": "v0.4.0", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/fatih/color@v1.15.0", "Name": "github.com/fatih/color", "Identifier": { "PURL": "pkg:golang/github.com/fatih/color@v1.15.0", "UID": "49606f738627a457" }, "Version": "v1.15.0", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/fsnotify/fsnotify@v1.6.0", "Name": "github.com/fsnotify/fsnotify", "Identifier": { "PURL": "pkg:golang/github.com/fsnotify/fsnotify@v1.6.0", "UID": "66416a554a16fbec" }, "Version": "v1.6.0", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gogo/protobuf@v1.3.2", "Name": "github.com/gogo/protobuf", "Identifier": { "PURL": "pkg:golang/github.com/gogo/protobuf@v1.3.2", "UID": "4e9931843324c686" }, "Version": "v1.3.2", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/golang/protobuf@v1.5.3", "Name": "github.com/golang/protobuf", "Identifier": { "PURL": "pkg:golang/github.com/golang/protobuf@v1.5.3", "UID": "abd3138fd5290448" }, "Version": "v1.5.3", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/hcl@v1.0.0", "Name": "github.com/hashicorp/hcl", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/hcl@v1.0.0", "UID": "13b82a0804b49649" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/magiconair/properties@v1.8.7", "Name": "github.com/magiconair/properties", "Identifier": { "PURL": "pkg:golang/github.com/magiconair/properties@v1.8.7", "UID": "daef8b5dda78ec10" }, "Version": "v1.8.7", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mattn/go-colorable@v0.1.13", "Name": "github.com/mattn/go-colorable", "Identifier": { "PURL": "pkg:golang/github.com/mattn/go-colorable@v0.1.13", "UID": "34dde24bb3228c10" }, "Version": "v0.1.13", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mattn/go-isatty@v0.0.17", "Name": "github.com/mattn/go-isatty", "Identifier": { "PURL": "pkg:golang/github.com/mattn/go-isatty@v0.0.17", "UID": "641c35242ea9da13" }, "Version": "v0.0.17", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/matttproud/golang_protobuf_extensions@v1.0.4", "Name": "github.com/matttproud/golang_protobuf_extensions", "Identifier": { "PURL": "pkg:golang/github.com/matttproud/golang_protobuf_extensions@v1.0.4", "UID": "3264fb0ebffb1e3a" }, "Version": "v1.0.4", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mitchellh/mapstructure@v1.5.0", "Name": "github.com/mitchellh/mapstructure", "Identifier": { "PURL": "pkg:golang/github.com/mitchellh/mapstructure@v1.5.0", "UID": "95ef13f0f5713df0" }, "Version": "v1.5.0", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/opencontainers/go-digest@v1.0.0", "Name": "github.com/opencontainers/go-digest", "Identifier": { "PURL": "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", "UID": "69d31a93e94cfd8a" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/opencontainers/image-spec@v1.0.2", "Name": "github.com/opencontainers/image-spec", "Identifier": { "PURL": "pkg:golang/github.com/opencontainers/image-spec@v1.0.2", "UID": "e02e370e58895f02" }, "Version": "v1.0.2", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/pelletier/go-toml/v2@v2.0.8", "Name": "github.com/pelletier/go-toml/v2", "Identifier": { "PURL": "pkg:golang/github.com/pelletier/go-toml/v2@v2.0.8", "UID": "1a5bc9352d2b23d4" }, "Version": "v2.0.8", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/pkg/errors@v0.9.1", "Name": "github.com/pkg/errors", "Identifier": { "PURL": "pkg:golang/github.com/pkg/errors@v0.9.1", "UID": "e1aa4aa80370d9dc" }, "Version": "v0.9.1", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/client_golang@v1.17.0", "Name": "github.com/prometheus/client_golang", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/client_golang@v1.17.0", "UID": "48fe211bcbf2a889" }, "Version": "v1.17.0", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/client_model@v0.4.1-0.20230718164431-9a2bf3000d16", "Name": "github.com/prometheus/client_model", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/client_model@v0.4.1-0.20230718164431-9a2bf3000d16", "UID": "57c714908fce30b5" }, "Version": "v0.4.1-0.20230718164431-9a2bf3000d16", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/common@v0.44.0", "Name": "github.com/prometheus/common", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/common@v0.44.0", "UID": "24417d342d1b3159" }, "Version": "v0.44.0", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/procfs@v0.11.1", "Name": "github.com/prometheus/procfs", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/procfs@v0.11.1", "UID": "5840fd0223af269f" }, "Version": "v0.11.1", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/robfig/cron@v1.2.0", "Name": "github.com/robfig/cron", "Identifier": { "PURL": "pkg:golang/github.com/robfig/cron@v1.2.0", "UID": "b7eb1644f824b63" }, "Version": "v1.2.0", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sirupsen/logrus@v1.9.3", "Name": "github.com/sirupsen/logrus", "Identifier": { "PURL": "pkg:golang/github.com/sirupsen/logrus@v1.9.3", "UID": "bdd275fdf6f10b86" }, "Version": "v1.9.3", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/spf13/afero@v1.9.5", "Name": "github.com/spf13/afero", "Identifier": { "PURL": "pkg:golang/github.com/spf13/afero@v1.9.5", "UID": "92c728d5ea9e585b" }, "Version": "v1.9.5", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/spf13/cast@v1.5.1", "Name": "github.com/spf13/cast", "Identifier": { "PURL": "pkg:golang/github.com/spf13/cast@v1.5.1", "UID": "c29fec2b5ce94028" }, "Version": "v1.5.1", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/spf13/cobra@v1.8.0", "Name": "github.com/spf13/cobra", "Identifier": { "PURL": "pkg:golang/github.com/spf13/cobra@v1.8.0", "UID": "27007d6003c085af" }, "Version": "v1.8.0", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/spf13/jwalterweatherman@v1.1.0", "Name": "github.com/spf13/jwalterweatherman", "Identifier": { "PURL": "pkg:golang/github.com/spf13/jwalterweatherman@v1.1.0", "UID": "e996561d336c6123" }, "Version": "v1.1.0", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/spf13/pflag@v1.0.5", "Name": "github.com/spf13/pflag", "Identifier": { "PURL": "pkg:golang/github.com/spf13/pflag@v1.0.5", "UID": "c0a8d57d5c1429c6" }, "Version": "v1.0.5", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/spf13/viper@v1.16.0", "Name": "github.com/spf13/viper", "Identifier": { "PURL": "pkg:golang/github.com/spf13/viper@v1.16.0", "UID": "3c999cda02544910" }, "Version": "v1.16.0", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/subosito/gotenv@v1.4.2", "Name": "github.com/subosito/gotenv", "Identifier": { "PURL": "pkg:golang/github.com/subosito/gotenv@v1.4.2", "UID": "ccebdc464bf83d" }, "Version": "v1.4.2", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/net@v0.17.0", "Name": "golang.org/x/net", "Identifier": { "PURL": "pkg:golang/golang.org/x/net@v0.17.0", "UID": "412cf030e9f6be36" }, "Version": "v0.17.0", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/sys@v0.13.0", "Name": "golang.org/x/sys", "Identifier": { "PURL": "pkg:golang/golang.org/x/sys@v0.13.0", "UID": "6fbad9d68b8e4e3d" }, "Version": "v0.13.0", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/text@v0.14.0", "Name": "golang.org/x/text", "Identifier": { "PURL": "pkg:golang/golang.org/x/text@v0.14.0", "UID": "89e1fc67c1b12b3e" }, "Version": "v0.14.0", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/protobuf@v1.31.0", "Name": "google.golang.org/protobuf", "Identifier": { "PURL": "pkg:golang/google.golang.org/protobuf@v1.31.0", "UID": "e1cb7ce0cd70c417" }, "Version": "v1.31.0", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "gopkg.in/ini.v1@v1.67.0", "Name": "gopkg.in/ini.v1", "Identifier": { "PURL": "pkg:golang/gopkg.in/ini.v1@v1.67.0", "UID": "abdbb6edf7bfe22d" }, "Version": "v1.67.0", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" }, { "ID": "gopkg.in/yaml.v3@v3.0.1", "Name": "gopkg.in/yaml.v3", "Identifier": { "PURL": "pkg:golang/gopkg.in/yaml.v3@v3.0.1", "UID": "216b1d062589bd82" }, "Version": "v3.0.1", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "AnalyzedBy": "gobinary" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2025-15558", "VendorIDs": [ "GHSA-p436-gjf2-799p" ], "PkgID": "github.com/docker/cli@v24.0.7+incompatible", "PkgName": "github.com/docker/cli", "PkgIdentifier": { "PURL": "pkg:golang/github.com/docker/cli@v24.0.7%2Bincompatible", "UID": "35e4de4ba493d72" }, "InstalledVersion": "v24.0.7+incompatible", "FixedVersion": "29.2.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-15558", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:b1e4bf2e615e381269d4ee0c2d77a01f62ab3c7b7239d5ba4129b436bdb5445c", "Title": "docker/cli: Docker CLI for Windows: Privilege escalation via malicious plugin binaries", "Description": "Docker CLI for Windows searches for plugin binaries in C:\\ProgramData\\Docker\\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user.\n\nThis issue affects Docker CLI: through 29.1.5 and Windows binaries acting as a CLI-plugin manager using the github.com/docker/cli/cli-plugins/manager https://pkg.go.dev/github.com/docker/cli@v29.1.5+incompatible/cli-plugins/manager  package, such as Docker Compose.\n\nThis issue does not impact non-Windows binaries, and projects not using the plugin-manager code.", "Severity": "HIGH", "CweIDs": [ "CWE-427" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:N/R:U", "V40Score": 7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2025-15558", "https://bugzilla.redhat.com/show_bug.cgi?id=2444574", "https://docs.docker.com/desktop/release-notes", "https://docs.docker.com/desktop/release-notes/", "https://github.com/docker/cli", "https://github.com/docker/cli/commit/13759330b1f7e7cb0d67047ea42c5482548ba7fa", "https://github.com/docker/cli/pull/6713", "https://github.com/docker/cli/security/advisories/GHSA-p436-gjf2-799p", "https://github.com/docker/compose/pull/12300", "https://nvd.nist.gov/vuln/detail/CVE-2025-15558", "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15558.json", "https://www.cve.org/CVERecord?id=CVE-2025-15558", "https://www.zerodayinitiative.com/advisories/ZDI-CAN-28304", "https://www.zerodayinitiative.com/advisories/ZDI-CAN-28304/" ], "PublishedDate": "2026-03-04T17:16:14.763Z", "LastModifiedDate": "2026-07-15T02:17:22.307Z" }, { "VulnerabilityID": "CVE-2024-41110", "VendorIDs": [ "GHSA-v23v-6jw2-98fq" ], "PkgID": "github.com/docker/docker@v24.0.7+incompatible", "PkgName": "github.com/docker/docker", "PkgIdentifier": { "PURL": "pkg:golang/github.com/docker/docker@v24.0.7%2Bincompatible", "UID": "b6697276e28baf41" }, "InstalledVersion": "v24.0.7+incompatible", "FixedVersion": "23.0.15, 26.1.5, 27.1.1, 25.0.6", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-41110", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:6147a025e5c13970f544fdd354d050d48dbf94aacdd4e86e1cb971d4913cc0ba", "Title": "moby: Authz zero length regression", "Description": "Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is low.\n\nUsing a specially-crafted API request, an Engine API client could make the daemon forward the request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it.\n\nA security issue was discovered In 2018, where an attacker could bypass AuthZ plugins using a specially crafted API request. This could lead to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later major versions, resulting in a regression. Anyone who depends on authorization plugins that introspect the request and/or response body to make access control decisions is potentially impacted.\n\nDocker EE v19.03.x and all versions of Mirantis Container Runtime are not vulnerable.\n\ndocker-ce v27.1.1 containes patches to fix the vulnerability. Patches have also been merged into the master, 19.03, 20.0, 23.0, 24.0, 25.0, 26.0, and 26.1 release branches. If one is unable to upgrade immediately, avoid using AuthZ plugins and/or restrict access to the Docker API to trusted parties, following the principle of least privilege.", "Severity": "CRITICAL", "CweIDs": [ "CWE-187", "CWE-444", "CWE-863" ], "VendorSeverity": { "amazon": 3, "azure": 4, "bottlerocket": 3, "cbl-mariner": 4, "ghsa": 4, "photon": 4, "redhat": 4, "ubuntu": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "V3Score": 10, "V40Score": 9.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 9.9 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41110", "https://access.redhat.com/security/cve/CVE-2024-41110", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-2v9q-99m9-j8g2", "https://github.com/moby/moby", "https://github.com/moby/moby/commit/411e817ddf710ff8e08fa193da80cb78af708191", "https://github.com/moby/moby/commit/42f40b1d6dd7562342f832b9cd2adf9e668eeb76", "https://github.com/moby/moby/commit/65cc597cea28cdc25bea3b8a86384b4251872919", "https://github.com/moby/moby/commit/852759a7df454cbf88db4e954c919becd48faa9b", "https://github.com/moby/moby/commit/a31260625655cff9ae226b51757915e275e304b0", "https://github.com/moby/moby/commit/a79fabbfe84117696a19671f4aa88b82d0f64fc1", "https://github.com/moby/moby/commit/ae160b4edddb72ef4bd71f66b975a1a1cc434f00", "https://github.com/moby/moby/commit/ae2b3666c517c96cbc2adf1af5591a6b00d4ec0f", "https://github.com/moby/moby/commit/cc13f952511154a2866bddbb7dddebfe9e83b801", "https://github.com/moby/moby/commit/fc274cd2ff4cf3b48c91697fb327dd1fb95588fb", "https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq", "https://lists.debian.org/debian-lts-announce/2024/10/msg00009.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-41110", "https://security.netapp.com/advisory/ntap-20240802-0001/", "https://ubuntu.com/security/notices/USN-7161-1", "https://ubuntu.com/security/notices/USN-7161-2", "https://ubuntu.com/security/notices/USN-7161-3", "https://www.cve.org/CVERecord?id=CVE-2024-41110", "https://www.docker.com/blog/docker-security-advisory-docker-engine-authz-plugin", "https://www.docker.com/blog/docker-security-advisory-docker-engine-authz-plugin/" ], "PublishedDate": "2024-07-24T17:15:11.053Z", "LastModifiedDate": "2026-06-17T07:47:17.503Z" }, { "VulnerabilityID": "CVE-2026-41567", "VendorIDs": [ "GHSA-x86f-5xw2-fm2r" ], "PkgID": "github.com/docker/docker@v24.0.7+incompatible", "PkgName": "github.com/docker/docker", "PkgIdentifier": { "PURL": "pkg:golang/github.com/docker/docker@v24.0.7%2Bincompatible", "UID": "b6697276e28baf41" }, "InstalledVersion": "v24.0.7+incompatible", "Status": "affected", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-41567", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:9299253050a636e57c6dd1ccbdcec2f8566ccfb4076ec4921db94122e61a819c", "Title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "Description": "Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images", "Severity": "HIGH", "CweIDs": [ "CWE-427" ], "VendorSeverity": { "amazon": 3, "ghsa": 3, "photon": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N", "V3Score": 7.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:51057", "https://access.redhat.com/security/cve/CVE-2026-41567", "https://bugzilla.redhat.com/show_bug.cgi?id=2485356", "https://github.com/moby/moby", "https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r", "https://nvd.nist.gov/vuln/detail/CVE-2026-41567", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41567.json", "https://www.cve.org/CVERecord?id=CVE-2026-41567" ], "PublishedDate": "2026-06-05T02:17:13.817Z", "LastModifiedDate": "2026-09-09T13:19:53.313Z" }, { "VulnerabilityID": "CVE-2026-42306", "VendorIDs": [ "GHSA-rg2x-37c3-w2rh" ], "PkgID": "github.com/docker/docker@v24.0.7+incompatible", "PkgName": "github.com/docker/docker", "PkgIdentifier": { "PURL": "pkg:golang/github.com/docker/docker@v24.0.7%2Bincompatible", "UID": "b6697276e28baf41" }, "InstalledVersion": "v24.0.7+incompatible", "Status": "affected", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42306", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:841dc40c7a4a99c25e8681b03da1398e8ee585b079a6e9c693cd60301bd12b4e", "Title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "Description": "Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.", "Severity": "HIGH", "CweIDs": [ "CWE-61", "CWE-367" ], "VendorSeverity": { "amazon": 3, "ghsa": 3, "nvd": 3, "photon": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.2 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-42306", "https://github.com/moby/moby", "https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh", "https://nvd.nist.gov/vuln/detail/CVE-2026-42306", "https://www.cve.org/CVERecord?id=CVE-2026-42306" ], "PublishedDate": "2026-06-12T19:16:27.49Z", "LastModifiedDate": "2026-06-17T10:47:39.96Z" }, { "VulnerabilityID": "CVE-2023-45288", "VendorIDs": [ "GHSA-4v7x-pqxf-cx7m", "GO-2024-2687" ], "PkgID": "golang.org/x/net@v0.17.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.17.0", "UID": "412cf030e9f6be36" }, "InstalledVersion": "v0.17.0", "FixedVersion": "0.23.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45288", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:296f79bde7271661d39fb79af2edc261ce5970fa629423de7ec70d172fe5b304", "Title": "golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS", "Description": "An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "bottlerocket": 2, "cbl-mariner": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45288", "http://www.openwall.com/lists/oss-security/2024/04/03/16", "http://www.openwall.com/lists/oss-security/2024/04/05/4", "https://access.redhat.com/errata/RHSA-2024:2724", "https://access.redhat.com/security/cve/CVE-2023-45288", "https://bugzilla.redhat.com/2268017", "https://bugzilla.redhat.com/2268018", "https://bugzilla.redhat.com/2268019", "https://bugzilla.redhat.com/2268273", "https://bugzilla.redhat.com/show_bug.cgi?id=2268017", "https://bugzilla.redhat.com/show_bug.cgi?id=2268018", "https://bugzilla.redhat.com/show_bug.cgi?id=2268019", "https://bugzilla.redhat.com/show_bug.cgi?id=2268273", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45288", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45289", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45290", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24783", "https://errata.almalinux.org/9/ALSA-2024-2724.html", "https://errata.rockylinux.org/RLSA-2024:2724", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-c9wf-j9h6-m2r9", "https://go.dev/cl/576155", "https://go.dev/issue/65051", "https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M", "https://kb.cert.org/vuls/id/421644", "https://linux.oracle.com/cve/CVE-2023-45288.html", "https://linux.oracle.com/errata/ELSA-2024-3346.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/", "https://nowotarski.info/http2-continuation-flood/", "https://nvd.nist.gov/vuln/detail/CVE-2023-45288", "https://pkg.go.dev/vuln/GO-2024-2687", "https://security.netapp.com/advisory/ntap-20240419-0009/", "https://ubuntu.com/security/notices/USN-6886-1", "https://ubuntu.com/security/notices/USN-7109-1", "https://ubuntu.com/security/notices/USN-7111-1", "https://www.cve.org/CVERecord?id=CVE-2023-45288", "https://www.kb.cert.org/vuls/id/421644" ], "PublishedDate": "2024-04-04T21:15:16.113Z", "LastModifiedDate": "2026-06-17T06:28:35.58Z" }, { "VulnerabilityID": "CVE-2024-45338", "VendorIDs": [ "GHSA-w32m-9786-jp63", "GO-2024-3333" ], "PkgID": "golang.org/x/net@v0.17.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.17.0", "UID": "412cf030e9f6be36" }, "InstalledVersion": "v0.17.0", "FixedVersion": "0.33.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-45338", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:1c034d14f0ce7881877b24398a0bca7c7ba671c24b2660998a82ca069af7645c", "Title": "golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html", "Description": "An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.", "Severity": "HIGH", "CweIDs": [ "CWE-1333" ], "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 2, "cbl-mariner": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45338", "https://access.redhat.com/security/cve/CVE-2024-45338", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/8.2.0/BRSA-newyz3jucdu5.toml", "https://go-review.googlesource.com/c/net/+/637536", "https://go.dev/cl/637536", "https://go.dev/issue/70906", "https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ", "https://nvd.nist.gov/vuln/detail/CVE-2024-45338", "https://pkg.go.dev/vuln/GO-2024-3333", "https://security.netapp.com/advisory/ntap-20250221-0001/", "https://ubuntu.com/security/notices/USN-7197-1", "https://ubuntu.com/security/notices/USN-8900-1", "https://www.cve.org/CVERecord?id=CVE-2024-45338" ], "PublishedDate": "2024-12-18T21:15:08.173Z", "LastModifiedDate": "2026-06-17T07:54:03.51Z" }, { "VulnerabilityID": "CVE-2026-25681", "VendorIDs": [ "GO-2026-5029" ], "PkgID": "golang.org/x/net@v0.17.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.17.0", "UID": "412cf030e9f6be36" }, "InstalledVersion": "v0.17.0", "FixedVersion": "0.55.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-25681", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:6e6e13edd2d4b08722ea4dc478f046b465aeca8f0d7c8ae2032ab8e9e36b171a", "Title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting", "Description": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "Severity": "HIGH", "CweIDs": [ "CWE-1021" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69293", "https://access.redhat.com/security/cve/CVE-2026-25681", "https://bugzilla.redhat.com/2480757", "https://bugzilla.redhat.com/2480761", "https://bugzilla.redhat.com/2480762", "https://bugzilla.redhat.com/2484830", "https://bugzilla.redhat.com/2493622", "https://bugzilla.redhat.com/show_bug.cgi?id=2480757", "https://bugzilla.redhat.com/show_bug.cgi?id=2480761", "https://bugzilla.redhat.com/show_bug.cgi?id=2480762", "https://bugzilla.redhat.com/show_bug.cgi?id=2484830", "https://bugzilla.redhat.com/show_bug.cgi?id=2493622", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41178", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42502", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55677", "https://errata.almalinux.org/9/ALSA-2026-69293.html", "https://errata.rockylinux.org/RLSA-2026:69293", "https://go.dev/cl/781703", "https://go.dev/issue/79574", "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "https://linux.oracle.com/cve/CVE-2026-25681.html", "https://linux.oracle.com/errata/ELSA-2026-69293.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-25681", "https://pkg.go.dev/vuln/GO-2026-5029", "https://www.cve.org/CVERecord?id=CVE-2026-25681" ], "PublishedDate": "2026-05-22T16:16:19.863Z", "LastModifiedDate": "2026-07-23T16:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-27136", "VendorIDs": [ "GO-2026-5030" ], "PkgID": "golang.org/x/net@v0.17.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.17.0", "UID": "412cf030e9f6be36" }, "InstalledVersion": "v0.17.0", "FixedVersion": "0.55.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27136", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:3f8413a0c7d4c42e5c58ca051ff12e0e5d25013600dceadbe6e652d89e35b6a5", "Title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass", "Description": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "Severity": "HIGH", "CweIDs": [ "CWE-1021" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69293", "https://access.redhat.com/security/cve/CVE-2026-27136", "https://bugzilla.redhat.com/2480757", "https://bugzilla.redhat.com/2480761", "https://bugzilla.redhat.com/2480762", "https://bugzilla.redhat.com/2484830", "https://bugzilla.redhat.com/2493622", "https://bugzilla.redhat.com/show_bug.cgi?id=2480757", "https://bugzilla.redhat.com/show_bug.cgi?id=2480761", "https://bugzilla.redhat.com/show_bug.cgi?id=2480762", "https://bugzilla.redhat.com/show_bug.cgi?id=2484830", "https://bugzilla.redhat.com/show_bug.cgi?id=2493622", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41178", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42502", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55677", "https://errata.almalinux.org/9/ALSA-2026-69293.html", "https://errata.rockylinux.org/RLSA-2026:69293", "https://go.dev/cl/781685", "https://go.dev/issue/79575", "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "https://linux.oracle.com/cve/CVE-2026-27136.html", "https://linux.oracle.com/errata/ELSA-2026-69293.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-27136", "https://pkg.go.dev/vuln/GO-2026-5030", "https://www.cve.org/CVERecord?id=CVE-2026-27136" ], "PublishedDate": "2026-05-22T16:16:20.087Z", "LastModifiedDate": "2026-07-23T16:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-33814", "VendorIDs": [ "GO-2026-4918" ], "PkgID": "golang.org/x/net@v0.17.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.17.0", "UID": "412cf030e9f6be36" }, "InstalledVersion": "v0.17.0", "FixedVersion": "0.53.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33814", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:68deb6be49a80acca61b2d9cb4e8edcbf65ce347b205c387fb1e775522a1bef9", "Title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame", "Description": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.", "Severity": "HIGH", "CweIDs": [ "CWE-835", "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57365", "https://access.redhat.com/errata/RHSA-2026:57367", "https://access.redhat.com/errata/RHSA-2026:57408", "https://access.redhat.com/errata/RHSA-2026:57545", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60441", "https://access.redhat.com/errata/RHSA-2026:60442", "https://access.redhat.com/errata/RHSA-2026:60446", "https://access.redhat.com/errata/RHSA-2026:60447", "https://access.redhat.com/errata/RHSA-2026:60454", "https://access.redhat.com/errata/RHSA-2026:60477", "https://access.redhat.com/errata/RHSA-2026:60478", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:60668", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62410", "https://access.redhat.com/errata/RHSA-2026:62550", "https://access.redhat.com/errata/RHSA-2026:62551", "https://access.redhat.com/errata/RHSA-2026:63046", "https://access.redhat.com/errata/RHSA-2026:63047", "https://access.redhat.com/errata/RHSA-2026:63048", "https://access.redhat.com/errata/RHSA-2026:63050", "https://access.redhat.com/errata/RHSA-2026:63091", "https://access.redhat.com/errata/RHSA-2026:63096", "https://access.redhat.com/errata/RHSA-2026:63097", "https://access.redhat.com/errata/RHSA-2026:63103", "https://access.redhat.com/errata/RHSA-2026:63104", "https://access.redhat.com/errata/RHSA-2026:63636", "https://access.redhat.com/errata/RHSA-2026:63637", "https://access.redhat.com/errata/RHSA-2026:63639", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/security/cve/CVE-2026-33814", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467810", "https://bugzilla.redhat.com/show_bug.cgi?id=2467811", "https://bugzilla.redhat.com/show_bug.cgi?id=2467813", "https://bugzilla.redhat.com/show_bug.cgi?id=2467815", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467823", "https://bugzilla.redhat.com/show_bug.cgi?id=2467825", "https://bugzilla.redhat.com/show_bug.cgi?id=2467826", "https://bugzilla.redhat.com/show_bug.cgi?id=2467827", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501", "https://errata.almalinux.org/9/ALSA-2026-22121.html", "https://errata.rockylinux.org/RLSA-2026:22121", "https://github.com/golang/go/issues/78476", "https://go-review.googlesource.com/c/go/+/761581", "https://go-review.googlesource.com/c/net/+/761640", "https://go.dev/cl/761581", "https://go.dev/cl/761640", "https://go.dev/issue/78476", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-33814.html", "https://linux.oracle.com/errata/ELSA-2026-22121.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33814", "https://pkg.go.dev/vuln/GO-2026-4918", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json", "https://ubuntu.com/security/notices/USN-8430-1", "https://ubuntu.com/security/notices/USN-8471-1", "https://ubuntu.com/security/notices/USN-8472-1", "https://ubuntu.com/security/notices/USN-8473-1", "https://www.cve.org/CVERecord?id=CVE-2026-33814" ], "PublishedDate": "2026-05-07T20:16:42.88Z", "LastModifiedDate": "2026-10-26T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-39821", "VendorIDs": [ "GO-2026-5026" ], "PkgID": "golang.org/x/net@v0.17.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.17.0", "UID": "412cf030e9f6be36" }, "InstalledVersion": "v0.17.0", "FixedVersion": "0.55.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39821", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:9152683d0eab1003df7b15db690075943984a217faf142960d553f5c9d36f7c3", "Title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing", "Description": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".", "Severity": "HIGH", "CweIDs": [ "CWE-1289" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:30650", "https://access.redhat.com/errata/RHSA-2026:30651", "https://access.redhat.com/errata/RHSA-2026:30853", "https://access.redhat.com/errata/RHSA-2026:30854", "https://access.redhat.com/errata/RHSA-2026:30855", "https://access.redhat.com/errata/RHSA-2026:33155", "https://access.redhat.com/errata/RHSA-2026:33160", "https://access.redhat.com/errata/RHSA-2026:33163", "https://access.redhat.com/errata/RHSA-2026:33173", "https://access.redhat.com/errata/RHSA-2026:33183", "https://access.redhat.com/errata/RHSA-2026:33524", "https://access.redhat.com/errata/RHSA-2026:33531", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:34789", "https://access.redhat.com/errata/RHSA-2026:35826", "https://access.redhat.com/errata/RHSA-2026:35827", "https://access.redhat.com/errata/RHSA-2026:35828", "https://access.redhat.com/errata/RHSA-2026:35829", "https://access.redhat.com/errata/RHSA-2026:35830", "https://access.redhat.com/errata/RHSA-2026:35831", "https://access.redhat.com/errata/RHSA-2026:35993", "https://access.redhat.com/errata/RHSA-2026:35994", "https://access.redhat.com/errata/RHSA-2026:36105", "https://access.redhat.com/errata/RHSA-2026:36167", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:36883", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:37435", "https://access.redhat.com/errata/RHSA-2026:37436", "https://access.redhat.com/errata/RHSA-2026:38995", "https://access.redhat.com/errata/RHSA-2026:39005", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39879", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:41930", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42048", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42080", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:44624", "https://access.redhat.com/errata/RHSA-2026:46395", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51341", "https://access.redhat.com/errata/RHSA-2026:52826", "https://access.redhat.com/errata/RHSA-2026:53374", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54395", "https://access.redhat.com/errata/RHSA-2026:54401", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54580", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56143", "https://access.redhat.com/errata/RHSA-2026:56223", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57541", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59546", "https://access.redhat.com/errata/RHSA-2026:59549", "https://access.redhat.com/errata/RHSA-2026:59562", "https://access.redhat.com/errata/RHSA-2026:60315", "https://access.redhat.com/errata/RHSA-2026:60354", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61245", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62549", "https://access.redhat.com/errata/RHSA-2026:63134", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65359", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65851", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/errata/RHSA-2026:66432", "https://access.redhat.com/errata/RHSA-2026:67149", "https://access.redhat.com/errata/RHSA-2026:67159", "https://access.redhat.com/errata/RHSA-2026:67160", "https://access.redhat.com/errata/RHSA-2026:67287", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/security/cve/CVE-2026-39821", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/767220", "https://go.dev/issue/78760", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "https://linux.oracle.com/cve/CVE-2026-39821.html", "https://linux.oracle.com/errata/ELSA-2026-66432-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39821", "https://pkg.go.dev/vuln/GO-2026-5026", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json", "https://ubuntu.com/security/notices/USN-8416-1", "https://ubuntu.com/security/notices/USN-8883-1", "https://ubuntu.com/security/notices/USN-8883-2", "https://ubuntu.com/security/notices/USN-8900-1", "https://ubuntu.com/security/notices/USN-8914-1", "https://www.cve.org/CVERecord?id=CVE-2026-39821" ], "PublishedDate": "2026-05-22T16:16:20.41Z", "LastModifiedDate": "2026-09-17T12:18:05.767Z" }, { "VulnerabilityID": "CVE-2026-46600", "VendorIDs": [ "GO-2026-5942" ], "PkgID": "golang.org/x/net@v0.17.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.17.0", "UID": "412cf030e9f6be36" }, "InstalledVersion": "v0.17.0", "FixedVersion": "0.56.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46600", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:ecdee05d0f8cf48cb84f60852785e7ae2baacb45146d8e483007e6e1d4fb5a58", "Title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing", "Description": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "bitnami": 3, "redhat": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46600", "https://go.dev/cl/786345", "https://go.dev/issue/79795", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://nvd.nist.gov/vuln/detail/CVE-2026-46600", "https://pkg.go.dev/vuln/GO-2026-5942", "https://www.cve.org/CVERecord?id=CVE-2026-46600" ], "PublishedDate": "2026-07-21T20:17:01.213Z", "LastModifiedDate": "2026-10-24T19:10:00.127Z" }, { "VulnerabilityID": "CVE-2026-78661", "VendorIDs": [ "GO-2026-6860" ], "PkgID": "golang.org/x/net@v0.17.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.17.0", "UID": "412cf030e9f6be36" }, "InstalledVersion": "v0.17.0", "FixedVersion": "0.62.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78661", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:3b761a1ec4508d275cdeac5d6f892a80132cb7f6a1588f4b0d4c132da65346c8", "Title": "golang.org/x/net/html: golang.org/x/net/html: Denial of Service via crafted HTML input", "Description": "When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a\u003c/x\u003e\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-78661", "https://go.dev/cl/849365", "https://go.dev/issue/82224", "https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs", "https://nvd.nist.gov/vuln/detail/CVE-2026-78661", "https://pkg.go.dev/vuln/GO-2026-6860", "https://www.cve.org/CVERecord?id=CVE-2026-78661" ], "PublishedDate": "2026-10-27T22:18:05.93Z", "LastModifiedDate": "2026-11-04T17:17:37.673Z" }, { "VulnerabilityID": "CVE-2026-78669", "VendorIDs": [ "GO-2026-6611" ], "PkgID": "golang.org/x/net@v0.17.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.17.0", "UID": "412cf030e9f6be36" }, "InstalledVersion": "v0.17.0", "FixedVersion": "0.60.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78669", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:ce60665c6143a4232e24c53af774d6ea17337d4915710c0ef836483ce74cf238", "Title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "Description": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78669", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81742", "https://go.dev/cl/847186", "https://go.dev/cl/847308", "https://go.dev/issue/81742", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs", "https://linux.oracle.com/cve/CVE-2026-78669.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78669", "https://pkg.go.dev/vuln/GO-2026-6611", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78669", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:04.01Z", "LastModifiedDate": "2026-10-09T17:16:49.857Z" }, { "VulnerabilityID": "CVE-2026-56851", "VendorIDs": [ "GO-2026-6629" ], "PkgID": "golang.org/x/text@v0.14.0", "PkgName": "golang.org/x/text", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/text@v0.14.0", "UID": "89e1fc67c1b12b3e" }, "InstalledVersion": "v0.14.0", "FixedVersion": "0.41.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56851", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:3b823f0a77afec1f64cee027f49a0251a0c35414d26d0eef21a48808b88e1304", "Title": "golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile", "Description": "The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 3, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56851", "https://go.dev/cl/793360", "https://go.dev/issue/80112", "https://nvd.nist.gov/vuln/detail/CVE-2026-56851", "https://pkg.go.dev/vuln/GO-2026-6629", "https://www.cve.org/CVERecord?id=CVE-2026-56851" ], "PublishedDate": "2026-10-07T18:17:20.903Z", "LastModifiedDate": "2026-10-08T21:35:53.89Z" }, { "VulnerabilityID": "CVE-2026-56852", "VendorIDs": [ "GO-2026-5970" ], "PkgID": "golang.org/x/text@v0.14.0", "PkgName": "golang.org/x/text", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/text@v0.14.0", "UID": "89e1fc67c1b12b3e" }, "InstalledVersion": "v0.14.0", "FixedVersion": "0.39.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56852", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:6d26e598753f74db4c53a6dff05f072fa683742a3ad9f5b39b45b7fd7f844bce", "Title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input", "Description": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70201", "https://access.redhat.com/security/cve/CVE-2026-56852", "https://bugzilla.redhat.com/2456335", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2504233", "https://bugzilla.redhat.com/2508234", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456335", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2504233", "https://bugzilla.redhat.com/show_bug.cgi?id=2508234", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2518147", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17106", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19730", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33810", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56852", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/10/ALSA-2026-70201.html", "https://errata.rockylinux.org/RLSA-2026:70201", "https://go.dev/cl/794100", "https://go.dev/issue/80142", "https://linux.oracle.com/cve/CVE-2026-56852.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56852", "https://pkg.go.dev/vuln/GO-2026-5970", "https://www.cve.org/CVERecord?id=CVE-2026-56852" ], "PublishedDate": "2026-07-21T20:17:02.867Z", "LastModifiedDate": "2026-10-24T19:10:00.127Z" }, { "VulnerabilityID": "CVE-2023-24538", "VendorIDs": [ "GO-2023-1703" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.19.8, 1.20.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-24538", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:f6836e82af51d7d7902eee52b04daaef7876124eaa5ae67cf0363dbd35dc2925", "Title": "golang: html/template: backticks not treated as string delimiters", "Description": "Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to terminate the literal, injecting arbitrary Javascript code into the Go template. As ES6 template literals are rather complex, and themselves can do string interpolation, the decision was made to simply disallow Go template actions from being used inside of them (e.g. \"var a = {{.}}\"), since there is no obviously safe way to allow this behavior. This takes the same approach as github.com/google/safehtml. With fix, Template.Parse returns an Error when it encounters templates like this, with an ErrorCode of value 12. This ErrorCode is currently unexported, but will be exported in the release of Go 1.21. Users who rely on the previous behavior can re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat that backticks will now be escaped. This should be used with caution.", "Severity": "CRITICAL", "CweIDs": [ "CWE-94" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 4, "bitnami": 4, "cbl-mariner": 4, "nvd": 4, "oracle-oval": 2, "photon": 4, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2023:6474", "https://access.redhat.com/errata/RHSA-2023:6939", "https://access.redhat.com/security/cve/CVE-2023-24538", "https://bugzilla.redhat.com/2174485", "https://bugzilla.redhat.com/2178358", "https://bugzilla.redhat.com/2178488", "https://bugzilla.redhat.com/2178492", "https://bugzilla.redhat.com/2184481", "https://bugzilla.redhat.com/2184482", "https://bugzilla.redhat.com/2184483", "https://bugzilla.redhat.com/2184484", "https://bugzilla.redhat.com/2196026", "https://bugzilla.redhat.com/2196027", "https://bugzilla.redhat.com/2196029", "https://bugzilla.redhat.com/2222167", "https://bugzilla.redhat.com/2228689", "https://bugzilla.redhat.com/show_bug.cgi?id=2163037", "https://bugzilla.redhat.com/show_bug.cgi?id=2174485", "https://bugzilla.redhat.com/show_bug.cgi?id=2175721", "https://bugzilla.redhat.com/show_bug.cgi?id=2178358", "https://bugzilla.redhat.com/show_bug.cgi?id=2178488", "https://bugzilla.redhat.com/show_bug.cgi?id=2178492", "https://bugzilla.redhat.com/show_bug.cgi?id=2182883", "https://bugzilla.redhat.com/show_bug.cgi?id=2182884", "https://bugzilla.redhat.com/show_bug.cgi?id=2184481", "https://bugzilla.redhat.com/show_bug.cgi?id=2184482", "https://bugzilla.redhat.com/show_bug.cgi?id=2184483", "https://bugzilla.redhat.com/show_bug.cgi?id=2184484", "https://bugzilla.redhat.com/show_bug.cgi?id=2196026", "https://bugzilla.redhat.com/show_bug.cgi?id=2196027", "https://bugzilla.redhat.com/show_bug.cgi?id=2196029", "https://bugzilla.redhat.com/show_bug.cgi?id=2222167", "https://bugzilla.redhat.com/show_bug.cgi?id=2228689", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41723", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41724", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41725", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24536", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24537", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24538", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24539", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24540", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25173", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25809", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27561", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29400", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3978", "https://errata.almalinux.org/9/ALSA-2023-6474.html", "https://errata.rockylinux.org/RLSA-2023:6939", "https://github.com/golang/go/commit/20374d1d759bc4e17486bde1cb9dca5be37d9e52%20%28go1.20.3%29", "https://github.com/golang/go/commit/b1e3ecfa06b67014429a197ec5e134ce4303ad9b%20%28go1.19.8%29", "https://github.com/golang/go/issues/59234", "https://go.dev/cl/482079", "https://go.dev/issue/59234", "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8", "https://linux.oracle.com/cve/CVE-2023-24538.html", "https://linux.oracle.com/errata/ELSA-2023-6939.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-24538", "https://pkg.go.dev/vuln/GO-2023-1703", "https://security.gentoo.org/glsa/202311-09", "https://security.netapp.com/advisory/ntap-20241115-0007/", "https://ubuntu.com/security/notices/USN-6038-1", "https://ubuntu.com/security/notices/USN-6038-2", "https://ubuntu.com/security/notices/USN-6140-1", "https://ubuntu.com/security/notices/USN-7061-1", "https://www.cve.org/CVERecord?id=CVE-2023-24538" ], "PublishedDate": "2023-04-06T16:15:07.8Z", "LastModifiedDate": "2026-06-17T05:39:29.67Z" }, { "VulnerabilityID": "CVE-2023-24540", "VendorIDs": [ "GO-2023-1752" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.19.9, 1.20.4", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-24540", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:1ddb3a521ddd6bf3ce8a2d1461343dc52ac27d8b23ae3397c4564f7979228504", "Title": "golang: html/template: improper handling of JavaScript whitespace", "Description": "Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set \"\\t\\n\\f\\r\\u0020\\u2028\\u2029\" in JavaScript contexts that also contain actions may not be properly sanitized during execution.", "Severity": "CRITICAL", "CweIDs": [ "CWE-77" ], "VendorSeverity": { "alma": 2, "amazon": 3, "bitnami": 4, "cbl-mariner": 4, "nvd": 4, "oracle-oval": 2, "photon": 4, "redhat": 3, "rocky": 2, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2023:6474", "https://access.redhat.com/errata/RHSA-2023:6939", "https://access.redhat.com/security/cve/CVE-2023-24540", "https://bugzilla.redhat.com/2174485", "https://bugzilla.redhat.com/2178358", "https://bugzilla.redhat.com/2178488", "https://bugzilla.redhat.com/2178492", "https://bugzilla.redhat.com/2184481", "https://bugzilla.redhat.com/2184482", "https://bugzilla.redhat.com/2184483", "https://bugzilla.redhat.com/2184484", "https://bugzilla.redhat.com/2196026", "https://bugzilla.redhat.com/2196027", "https://bugzilla.redhat.com/2196029", "https://bugzilla.redhat.com/2222167", "https://bugzilla.redhat.com/2228689", "https://bugzilla.redhat.com/show_bug.cgi?id=2163037", "https://bugzilla.redhat.com/show_bug.cgi?id=2174485", "https://bugzilla.redhat.com/show_bug.cgi?id=2175721", "https://bugzilla.redhat.com/show_bug.cgi?id=2178358", "https://bugzilla.redhat.com/show_bug.cgi?id=2178488", "https://bugzilla.redhat.com/show_bug.cgi?id=2178492", "https://bugzilla.redhat.com/show_bug.cgi?id=2182883", "https://bugzilla.redhat.com/show_bug.cgi?id=2182884", "https://bugzilla.redhat.com/show_bug.cgi?id=2184481", "https://bugzilla.redhat.com/show_bug.cgi?id=2184482", "https://bugzilla.redhat.com/show_bug.cgi?id=2184483", "https://bugzilla.redhat.com/show_bug.cgi?id=2184484", "https://bugzilla.redhat.com/show_bug.cgi?id=2196026", "https://bugzilla.redhat.com/show_bug.cgi?id=2196027", "https://bugzilla.redhat.com/show_bug.cgi?id=2196029", "https://bugzilla.redhat.com/show_bug.cgi?id=2222167", "https://bugzilla.redhat.com/show_bug.cgi?id=2228689", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41723", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41724", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41725", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24536", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24537", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24538", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24539", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24540", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25173", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25809", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27561", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29400", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3978", "https://errata.almalinux.org/9/ALSA-2023-6474.html", "https://errata.rockylinux.org/RLSA-2023:6939", "https://github.com/golang/go/commit/4a28cad66655ee01c6e944271e23c33cab021765%20%28go1.20.4%29", "https://github.com/golang/go/commit/ce7bd33345416e6d8cac901792060591cafc2797%20%28go1.19.9%29", "https://github.com/golang/go/issues/59721", "https://go.dev/cl/491616", "https://go.dev/issue/59721", "https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU", "https://linux.oracle.com/cve/CVE-2023-24540.html", "https://linux.oracle.com/errata/ELSA-2023-6939.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-24540", "https://pkg.go.dev/vuln/GO-2023-1752", "https://security.netapp.com/advisory/ntap-20241115-0008/", "https://ubuntu.com/security/notices/USN-6140-1", "https://www.cve.org/CVERecord?id=CVE-2023-24540" ], "PublishedDate": "2023-05-11T16:15:09.687Z", "LastModifiedDate": "2026-06-17T05:39:30.007Z" }, { "VulnerabilityID": "CVE-2024-24790", "VendorIDs": [ "GO-2024-2887" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.21.11, 1.22.4", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-24790", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:7b7bc01e6206aa6beaa7da4e06fe68714098164088407f837c70802fe636724b", "Title": "golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses", "Description": "The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.", "Severity": "CRITICAL", "VendorSeverity": { "alma": 2, "amazon": 3, "bitnami": 4, "bottlerocket": 2, "cbl-mariner": 4, "nvd": 4, "oracle-oval": 2, "photon": 4, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 6.7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24790", "http://www.openwall.com/lists/oss-security/2024/06/04/1", "https://access.redhat.com/errata/RHSA-2025:7256", "https://access.redhat.com/security/cve/CVE-2024-24790", "https://bugzilla.redhat.com/2237777", "https://bugzilla.redhat.com/2237778", "https://bugzilla.redhat.com/2279814", "https://bugzilla.redhat.com/2292787", "https://bugzilla.redhat.com/2295310", "https://bugzilla.redhat.com/2315719", "https://bugzilla.redhat.com/show_bug.cgi?id=2237777", "https://bugzilla.redhat.com/show_bug.cgi?id=2237778", "https://bugzilla.redhat.com/show_bug.cgi?id=2279814", "https://bugzilla.redhat.com/show_bug.cgi?id=2292787", "https://bugzilla.redhat.com/show_bug.cgi?id=2295310", "https://bugzilla.redhat.com/show_bug.cgi?id=2315719", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39321", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39322", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24788", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24790", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24791", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9355", "https://errata.almalinux.org/9/ALSA-2025-7256.html", "https://errata.rockylinux.org/RLSA-2025:7256", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/2.9.0/BRSA-glvb5gspjgq6.toml", "https://github.com/golang/go/commit/051bdf3fd12a40307606ff9381138039c5f452f0%20%281.21%29", "https://github.com/golang/go/commit/12d5810cdb1f73cf23d7a86462143e9463317fca%20%281.22%29", "https://github.com/golang/go/issues/67680", "https://go.dev/cl/590316", "https://go.dev/issue/67680", "https://groups.google.com/g/golang-announce/c/XbxouI9gY7k", "https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ", "https://linux.oracle.com/cve/CVE-2024-24790.html", "https://linux.oracle.com/errata/ELSA-2025-7256.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-24790", "https://pkg.go.dev/vuln/GO-2024-2887", "https://security.netapp.com/advisory/ntap-20240905-0002/", "https://ubuntu.com/security/notices/USN-6886-1", "https://ubuntu.com/security/notices/USN-7109-1", "https://www.cve.org/CVERecord?id=CVE-2024-24790" ], "PublishedDate": "2024-06-05T16:15:10.56Z", "LastModifiedDate": "2026-06-17T07:14:52.097Z" }, { "VulnerabilityID": "CVE-2025-68121", "VendorIDs": [ "GO-2026-4337" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.24.13, 1.25.7, 1.26.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-68121", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:484bdabd2ba86bb61a2c1c81c77320d3b63cd8bbc6d86afaa068bfd9dfd3280e", "Title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "Description": "During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.", "Severity": "CRITICAL", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "bitnami": 4, "cbl-mariner": 2, "nvd": 4, "oracle-oval": 3, "photon": 4, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "V3Score": 10 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:4177", "https://access.redhat.com/security/cve/CVE-2025-68121", "https://bugzilla.redhat.com/2434432", "https://bugzilla.redhat.com/2437111", "https://bugzilla.redhat.com/show_bug.cgi?id=2434432", "https://bugzilla.redhat.com/show_bug.cgi?id=2437111", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121", "https://errata.almalinux.org/9/ALSA-2026-4177.html", "https://errata.rockylinux.org/RLSA-2026:4177", "https://github.com/golang/go/issues/77113", "https://go.dev/cl/737700", "https://go.dev/issue/77217", "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk", "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc", "https://linux.oracle.com/cve/CVE-2025-68121.html", "https://linux.oracle.com/errata/ELSA-2026-5146.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-68121", "https://pkg.go.dev/vuln/GO-2026-4337", "https://www.cve.org/CVERecord?id=CVE-2025-68121" ], "PublishedDate": "2026-02-05T18:16:10.857Z", "LastModifiedDate": "2026-06-17T09:58:33.833Z" }, { "VulnerabilityID": "CVE-2022-41722", "VendorIDs": [ "GO-2023-1568" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.19.6, 1.20.1", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-41722", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:fcb55c86e97d38907f2b46eaac4affa87feddab9c5dbc6e72957b0088ed05b8f", "Title": "golang: path/filepath: path-filepath filepath.Clean path traversal", "Description": "A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as \"a/../c:/b\" into the valid path \"c:\\b\". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path \".\\c:\\b\".", "Severity": "HIGH", "CweIDs": [ "CWE-22" ], "VendorSeverity": { "amazon": 3, "azure": 3, "bitnami": 3, "cbl-mariner": 3, "nvd": 3, "photon": 3, "redhat": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2022-41722", "https://go.dev/cl/468123", "https://go.dev/issue/57274", "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E", "https://nvd.nist.gov/vuln/detail/CVE-2022-41722", "https://pkg.go.dev/vuln/GO-2023-1568", "https://www.cve.org/CVERecord?id=CVE-2022-41722" ], "PublishedDate": "2023-02-28T18:15:09.887Z", "LastModifiedDate": "2026-06-17T05:03:42.79Z" }, { "VulnerabilityID": "CVE-2022-41723", "VendorIDs": [ "GHSA-vvpx-j8f3-3w6h", "GO-2023-1571" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.19.6, 1.20.1", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-41723", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:73227799edb6f200dcc230687188b2e516964426046058333d41543982d3334f", "Title": "golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding", "Description": "A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.", "Severity": "HIGH", "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "bitnami": 3, "cbl-mariner": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2023:6474", "https://access.redhat.com/errata/RHSA-2023:6939", "https://access.redhat.com/security/cve/CVE-2022-41723", "https://bugzilla.redhat.com/2174485", "https://bugzilla.redhat.com/2178358", "https://bugzilla.redhat.com/2178488", "https://bugzilla.redhat.com/2178492", "https://bugzilla.redhat.com/2184481", "https://bugzilla.redhat.com/2184482", "https://bugzilla.redhat.com/2184483", "https://bugzilla.redhat.com/2184484", "https://bugzilla.redhat.com/2196026", "https://bugzilla.redhat.com/2196027", "https://bugzilla.redhat.com/2196029", "https://bugzilla.redhat.com/2222167", "https://bugzilla.redhat.com/2228689", "https://bugzilla.redhat.com/show_bug.cgi?id=2163037", "https://bugzilla.redhat.com/show_bug.cgi?id=2174485", "https://bugzilla.redhat.com/show_bug.cgi?id=2175721", "https://bugzilla.redhat.com/show_bug.cgi?id=2178358", "https://bugzilla.redhat.com/show_bug.cgi?id=2178488", "https://bugzilla.redhat.com/show_bug.cgi?id=2178492", "https://bugzilla.redhat.com/show_bug.cgi?id=2182883", "https://bugzilla.redhat.com/show_bug.cgi?id=2182884", "https://bugzilla.redhat.com/show_bug.cgi?id=2184481", "https://bugzilla.redhat.com/show_bug.cgi?id=2184482", "https://bugzilla.redhat.com/show_bug.cgi?id=2184483", "https://bugzilla.redhat.com/show_bug.cgi?id=2184484", "https://bugzilla.redhat.com/show_bug.cgi?id=2196026", "https://bugzilla.redhat.com/show_bug.cgi?id=2196027", "https://bugzilla.redhat.com/show_bug.cgi?id=2196029", "https://bugzilla.redhat.com/show_bug.cgi?id=2222167", "https://bugzilla.redhat.com/show_bug.cgi?id=2228689", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41723", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41724", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41725", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24536", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24537", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24538", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24539", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24540", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25173", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25809", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27561", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29400", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3978", "https://errata.almalinux.org/9/ALSA-2023-6474.html", "https://errata.rockylinux.org/RLSA-2023:6939", "https://github.com/advisories/GHSA-vvpx-j8f3-3w6h", "https://go.dev/cl/468135", "https://go.dev/cl/468295", "https://go.dev/issue/57855", "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E", "https://linux.oracle.com/cve/CVE-2022-41723.html", "https://linux.oracle.com/errata/ELSA-2023-6939.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MA5XS5DAOJ5PKKNG5TUXKPQOFHT5VBC/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGW7GE2Z32ZT47UFAQFDRQE33B7Q7LMT/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RLBQ3A7ROLEQXQLXFDLNJ7MYPKG5GULE/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XX3IMUTZKRQ73PBZM4E2JP4BKYH4C6XE/", "https://nvd.nist.gov/vuln/detail/CVE-2022-41723", "https://pkg.go.dev/vuln/GO-2023-1571", "https://security.gentoo.org/glsa/202311-09", "https://security.netapp.com/advisory/ntap-20230331-0010/", "https://ubuntu.com/security/notices/USN-7109-1", "https://ubuntu.com/security/notices/USN-7111-1", "https://ubuntu.com/security/notices/USN-8089-1", "https://ubuntu.com/security/notices/USN-8089-2", "https://ubuntu.com/security/notices/USN-8089-3", "https://ubuntu.com/security/notices/USN-8900-1", "https://vuln.go.dev/ID/GO-2023-1571.json", "https://www.couchbase.com/alerts/", "https://www.cve.org/CVERecord?id=CVE-2022-41723" ], "PublishedDate": "2023-02-28T18:15:09.98Z", "LastModifiedDate": "2026-06-17T05:03:42.9Z" }, { "VulnerabilityID": "CVE-2022-41724", "VendorIDs": [ "GO-2023-1570" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.19.6, 1.20.1", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-41724", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:3c788b59b5b268165005139c87b147ea6558be8c00cc3b9ce1876eb049e9f951", "Title": "golang: crypto/tls: large handshake records may cause panics", "Description": "Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth \u003e= RequestClientCert).", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "bitnami": 3, "cbl-mariner": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2023:6474", "https://access.redhat.com/errata/RHSA-2023:6939", "https://access.redhat.com/security/cve/CVE-2022-41724", "https://bugzilla.redhat.com/2174485", "https://bugzilla.redhat.com/2178358", "https://bugzilla.redhat.com/2178488", "https://bugzilla.redhat.com/2178492", "https://bugzilla.redhat.com/2184481", "https://bugzilla.redhat.com/2184482", "https://bugzilla.redhat.com/2184483", "https://bugzilla.redhat.com/2184484", "https://bugzilla.redhat.com/2196026", "https://bugzilla.redhat.com/2196027", "https://bugzilla.redhat.com/2196029", "https://bugzilla.redhat.com/2222167", "https://bugzilla.redhat.com/2228689", "https://bugzilla.redhat.com/show_bug.cgi?id=2163037", "https://bugzilla.redhat.com/show_bug.cgi?id=2174485", "https://bugzilla.redhat.com/show_bug.cgi?id=2175721", "https://bugzilla.redhat.com/show_bug.cgi?id=2178358", "https://bugzilla.redhat.com/show_bug.cgi?id=2178488", "https://bugzilla.redhat.com/show_bug.cgi?id=2178492", "https://bugzilla.redhat.com/show_bug.cgi?id=2182883", "https://bugzilla.redhat.com/show_bug.cgi?id=2182884", "https://bugzilla.redhat.com/show_bug.cgi?id=2184481", "https://bugzilla.redhat.com/show_bug.cgi?id=2184482", "https://bugzilla.redhat.com/show_bug.cgi?id=2184483", "https://bugzilla.redhat.com/show_bug.cgi?id=2184484", "https://bugzilla.redhat.com/show_bug.cgi?id=2196026", "https://bugzilla.redhat.com/show_bug.cgi?id=2196027", "https://bugzilla.redhat.com/show_bug.cgi?id=2196029", "https://bugzilla.redhat.com/show_bug.cgi?id=2222167", "https://bugzilla.redhat.com/show_bug.cgi?id=2228689", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41723", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41724", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41725", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24536", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24537", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24538", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24539", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24540", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25173", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25809", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27561", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29400", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3978", "https://errata.almalinux.org/9/ALSA-2023-6474.html", "https://errata.rockylinux.org/RLSA-2023:6939", "https://go.dev/cl/468125", "https://go.dev/issue/58001", "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E", "https://linux.oracle.com/cve/CVE-2022-41724.html", "https://linux.oracle.com/errata/ELSA-2023-6939.html", "https://nvd.nist.gov/vuln/detail/CVE-2022-41724", "https://pkg.go.dev/vuln/GO-2023-1570", "https://security.gentoo.org/glsa/202311-09", "https://ubuntu.com/security/notices/USN-6140-1", "https://ubuntu.com/security/notices/USN-7109-1", "https://ubuntu.com/security/notices/USN-7111-1", "https://www.cve.org/CVERecord?id=CVE-2022-41724" ], "PublishedDate": "2023-02-28T18:15:10.043Z", "LastModifiedDate": "2026-06-17T05:03:43.11Z" }, { "VulnerabilityID": "CVE-2022-41725", "VendorIDs": [ "GO-2023-1569" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.19.6, 1.20.1", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-41725", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:c93accfcecde53470e1ed0e9704bddc6f828ba14dd43ad57914aa2ad534bb34d", "Title": "golang: net/http, mime/multipart: denial of service from excessive resource consumption", "Description": "A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented as storing \"up to maxMemory bytes +10MB (reserved for non-file parts) in memory\". File parts which cannot be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file parts is excessively large and can potentially open a denial of service vector on its own. However, ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead, part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In addition, ReadForm contained no limit on the number of disk files created, permitting a relatively small request body to create a large number of disk temporary files. With fix, ReadForm now properly accounts for various forms of memory overhead, and should now stay within its documented limit of 10MB + maxMemory bytes of memory consumption. Users should still be aware that this limit is high and may still be hazardous. In addition, ReadForm now creates at most one on-disk temporary file, combining multiple form parts into a single temporary file. The mime/multipart.File interface type's documentation states, \"If stored on disk, the File's underlying concrete type will be an *os.File.\". This is no longer the case when a form contains more than one file part, due to this coalescing of parts into a single file. The previous behavior of using distinct files for each form part may be reenabled with the environment variable GODEBUG=multipartfiles=distinct. Users should be aware that multipart.ReadForm and the http.Request methods that call it do not limit the amount of disk consumed by temporary files. Callers can limit the size of form data with http.MaxBytesReader.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "bitnami": 3, "cbl-mariner": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2023:6474", "https://access.redhat.com/errata/RHSA-2023:6939", "https://access.redhat.com/security/cve/CVE-2022-41725", "https://bugzilla.redhat.com/2174485", "https://bugzilla.redhat.com/2178358", "https://bugzilla.redhat.com/2178488", "https://bugzilla.redhat.com/2178492", "https://bugzilla.redhat.com/2184481", "https://bugzilla.redhat.com/2184482", "https://bugzilla.redhat.com/2184483", "https://bugzilla.redhat.com/2184484", "https://bugzilla.redhat.com/2196026", "https://bugzilla.redhat.com/2196027", "https://bugzilla.redhat.com/2196029", "https://bugzilla.redhat.com/2222167", "https://bugzilla.redhat.com/2228689", "https://bugzilla.redhat.com/show_bug.cgi?id=2163037", "https://bugzilla.redhat.com/show_bug.cgi?id=2174485", "https://bugzilla.redhat.com/show_bug.cgi?id=2175721", "https://bugzilla.redhat.com/show_bug.cgi?id=2178358", "https://bugzilla.redhat.com/show_bug.cgi?id=2178488", "https://bugzilla.redhat.com/show_bug.cgi?id=2178492", "https://bugzilla.redhat.com/show_bug.cgi?id=2182883", "https://bugzilla.redhat.com/show_bug.cgi?id=2182884", "https://bugzilla.redhat.com/show_bug.cgi?id=2184481", "https://bugzilla.redhat.com/show_bug.cgi?id=2184482", "https://bugzilla.redhat.com/show_bug.cgi?id=2184483", "https://bugzilla.redhat.com/show_bug.cgi?id=2184484", "https://bugzilla.redhat.com/show_bug.cgi?id=2196026", "https://bugzilla.redhat.com/show_bug.cgi?id=2196027", "https://bugzilla.redhat.com/show_bug.cgi?id=2196029", "https://bugzilla.redhat.com/show_bug.cgi?id=2222167", "https://bugzilla.redhat.com/show_bug.cgi?id=2228689", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41723", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41724", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41725", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24536", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24537", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24538", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24539", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24540", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25173", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25809", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27561", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29400", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3978", "https://errata.almalinux.org/9/ALSA-2023-6474.html", "https://errata.rockylinux.org/RLSA-2023:6939", "https://github.com/golang/go/commit/5c55ac9bf1e5f779220294c843526536605f42ab%20%5B1.19%5D", "https://go.dev/cl/468124", "https://go.dev/issue/58006", "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E", "https://linux.oracle.com/cve/CVE-2022-41725.html", "https://linux.oracle.com/errata/ELSA-2023-6939.html", "https://nvd.nist.gov/vuln/detail/CVE-2022-41725", "https://pkg.go.dev/vuln/GO-2023-1569", "https://security.gentoo.org/glsa/202311-09", "https://ubuntu.com/security/notices/USN-6140-1", "https://ubuntu.com/security/notices/USN-7109-1", "https://ubuntu.com/security/notices/USN-7111-1", "https://www.cve.org/CVERecord?id=CVE-2022-41725" ], "PublishedDate": "2023-02-28T18:15:10.12Z", "LastModifiedDate": "2026-06-17T05:03:43.243Z" }, { "VulnerabilityID": "CVE-2023-24534", "VendorIDs": [ "GO-2023-1704" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.19.8, 1.20.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-24534", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:c1b7c71c22f907fe53bd22d6401531fe56f3d28965039b7a594a6bfa6317744a", "Title": "golang: net/http, net/textproto: denial of service from excessive memory allocation", "Description": "HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service. With fix, header parsing now correctly allocates only the memory required to hold parsed headers.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "bitnami": 3, "cbl-mariner": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2023:6474", "https://access.redhat.com/errata/RHSA-2023:6939", "https://access.redhat.com/security/cve/CVE-2023-24534", "https://bugzilla.redhat.com/2174485", "https://bugzilla.redhat.com/2178358", "https://bugzilla.redhat.com/2178488", "https://bugzilla.redhat.com/2178492", "https://bugzilla.redhat.com/2184481", "https://bugzilla.redhat.com/2184482", "https://bugzilla.redhat.com/2184483", "https://bugzilla.redhat.com/2184484", "https://bugzilla.redhat.com/2196026", "https://bugzilla.redhat.com/2196027", "https://bugzilla.redhat.com/2196029", "https://bugzilla.redhat.com/2222167", "https://bugzilla.redhat.com/2228689", "https://bugzilla.redhat.com/show_bug.cgi?id=2163037", "https://bugzilla.redhat.com/show_bug.cgi?id=2174485", "https://bugzilla.redhat.com/show_bug.cgi?id=2175721", "https://bugzilla.redhat.com/show_bug.cgi?id=2178358", "https://bugzilla.redhat.com/show_bug.cgi?id=2178488", "https://bugzilla.redhat.com/show_bug.cgi?id=2178492", "https://bugzilla.redhat.com/show_bug.cgi?id=2182883", "https://bugzilla.redhat.com/show_bug.cgi?id=2182884", "https://bugzilla.redhat.com/show_bug.cgi?id=2184481", "https://bugzilla.redhat.com/show_bug.cgi?id=2184482", "https://bugzilla.redhat.com/show_bug.cgi?id=2184483", "https://bugzilla.redhat.com/show_bug.cgi?id=2184484", "https://bugzilla.redhat.com/show_bug.cgi?id=2196026", "https://bugzilla.redhat.com/show_bug.cgi?id=2196027", "https://bugzilla.redhat.com/show_bug.cgi?id=2196029", "https://bugzilla.redhat.com/show_bug.cgi?id=2222167", "https://bugzilla.redhat.com/show_bug.cgi?id=2228689", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41723", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41724", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41725", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24536", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24537", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24538", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24539", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24540", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25173", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25809", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27561", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29400", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3978", "https://errata.almalinux.org/9/ALSA-2023-6474.html", "https://errata.rockylinux.org/RLSA-2023:6939", "https://github.com/golang/go/commit/3991f6c41c7dfd167e889234c0cf1d840475e93c%20%28go1.20.3%29", "https://github.com/golang/go/commit/d6759e7a059f4208f07aa781402841d7ddaaef96%20%28go1.19.8%29", "https://go.dev/cl/481994", "https://go.dev/issue/58975", "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8", "https://linux.oracle.com/cve/CVE-2023-24534.html", "https://linux.oracle.com/errata/ELSA-2023-6939.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-24534", "https://pkg.go.dev/vuln/GO-2023-1704", "https://security.gentoo.org/glsa/202311-09", "https://security.netapp.com/advisory/ntap-20230526-0007/", "https://ubuntu.com/security/notices/USN-6038-1", "https://ubuntu.com/security/notices/USN-6038-2", "https://ubuntu.com/security/notices/USN-6140-1", "https://www.cve.org/CVERecord?id=CVE-2023-24534" ], "PublishedDate": "2023-04-06T16:15:07.657Z", "LastModifiedDate": "2026-06-17T05:39:28.893Z" }, { "VulnerabilityID": "CVE-2023-24536", "VendorIDs": [ "GO-2023-1705" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.19.8, 1.20.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-24536", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:63e4a8c6fc9cc0d15713f10ded4e70c74440b50bbbddd903c664c8a05f6d6438", "Title": "golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption", "Description": "Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed, leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3. ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage collector. The combination of these factors can permit an attacker to cause an program that parses multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service. This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. With fix, ReadForm now does a better job of estimating the memory consumption of parsed forms, and performs many fewer short-lived allocations. In addition, the fixed mime/multipart.Reader imposes the following limits on the size of parsed forms: 1. Forms parsed with ReadForm may contain no more than 1000 parts. This limit may be adjusted with the environment variable GODEBUG=multipartmaxparts=. 2. Form parts parsed with NextPart and NextRawPart may contain no more than 10,000 header fields. In addition, forms parsed with ReadForm may contain no more than 10,000 header fields across all parts. This limit may be adjusted with the environment variable GODEBUG=multipartmaxheaders=.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 2, "amazon": 3, "bitnami": 3, "cbl-mariner": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2023:6474", "https://access.redhat.com/errata/RHSA-2023:6939", "https://access.redhat.com/security/cve/CVE-2023-24536", "https://bugzilla.redhat.com/2174485", "https://bugzilla.redhat.com/2178358", "https://bugzilla.redhat.com/2178488", "https://bugzilla.redhat.com/2178492", "https://bugzilla.redhat.com/2184481", "https://bugzilla.redhat.com/2184482", "https://bugzilla.redhat.com/2184483", "https://bugzilla.redhat.com/2184484", "https://bugzilla.redhat.com/2196026", "https://bugzilla.redhat.com/2196027", "https://bugzilla.redhat.com/2196029", "https://bugzilla.redhat.com/2222167", "https://bugzilla.redhat.com/2228689", "https://bugzilla.redhat.com/show_bug.cgi?id=2163037", "https://bugzilla.redhat.com/show_bug.cgi?id=2174485", "https://bugzilla.redhat.com/show_bug.cgi?id=2175721", "https://bugzilla.redhat.com/show_bug.cgi?id=2178358", "https://bugzilla.redhat.com/show_bug.cgi?id=2178488", "https://bugzilla.redhat.com/show_bug.cgi?id=2178492", "https://bugzilla.redhat.com/show_bug.cgi?id=2182883", "https://bugzilla.redhat.com/show_bug.cgi?id=2182884", "https://bugzilla.redhat.com/show_bug.cgi?id=2184481", "https://bugzilla.redhat.com/show_bug.cgi?id=2184482", "https://bugzilla.redhat.com/show_bug.cgi?id=2184483", "https://bugzilla.redhat.com/show_bug.cgi?id=2184484", "https://bugzilla.redhat.com/show_bug.cgi?id=2196026", "https://bugzilla.redhat.com/show_bug.cgi?id=2196027", "https://bugzilla.redhat.com/show_bug.cgi?id=2196029", "https://bugzilla.redhat.com/show_bug.cgi?id=2222167", "https://bugzilla.redhat.com/show_bug.cgi?id=2228689", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41723", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41724", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41725", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24536", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24537", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24538", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24539", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24540", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25173", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25809", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27561", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29400", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3978", "https://errata.almalinux.org/9/ALSA-2023-6474.html", "https://errata.rockylinux.org/RLSA-2023:6939", "https://github.com/golang/go/commit/7917b5f31204528ea72e0629f0b7d52b35b27538%20%28go.1.19.8%29", "https://github.com/golang/go/commit/bf8c7c575c8a552d9d79deb29e80854dc88528d0%20%28go1.20.3%29", "https://go.dev/cl/482075", "https://go.dev/cl/482076", "https://go.dev/cl/482077", "https://go.dev/issue/59153", "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8", "https://linux.oracle.com/cve/CVE-2023-24536.html", "https://linux.oracle.com/errata/ELSA-2023-6939.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-24536", "https://pkg.go.dev/vuln/GO-2023-1705", "https://security.gentoo.org/glsa/202311-09", "https://security.netapp.com/advisory/ntap-20230526-0007/", "https://ubuntu.com/security/notices/USN-7109-1", "https://ubuntu.com/security/notices/USN-7111-1", "https://www.cve.org/CVERecord?id=CVE-2023-24536" ], "PublishedDate": "2023-04-06T16:15:07.71Z", "LastModifiedDate": "2026-06-17T05:39:29.287Z" }, { "VulnerabilityID": "CVE-2023-24537", "VendorIDs": [ "GO-2023-1702" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.19.8, 1.20.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-24537", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:36ecda3a8485388ff70b33e52112f911703ecae68b66ce1fda0631b6dc0a9401", "Title": "golang: go/parser: Infinite loop in parsing", "Description": "Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "bitnami": 3, "cbl-mariner": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2023:6474", "https://access.redhat.com/errata/RHSA-2023:6939", "https://access.redhat.com/security/cve/CVE-2023-24537", "https://bugzilla.redhat.com/2174485", "https://bugzilla.redhat.com/2178358", "https://bugzilla.redhat.com/2178488", "https://bugzilla.redhat.com/2178492", "https://bugzilla.redhat.com/2184481", "https://bugzilla.redhat.com/2184482", "https://bugzilla.redhat.com/2184483", "https://bugzilla.redhat.com/2184484", "https://bugzilla.redhat.com/2196026", "https://bugzilla.redhat.com/2196027", "https://bugzilla.redhat.com/2196029", "https://bugzilla.redhat.com/2222167", "https://bugzilla.redhat.com/2228689", "https://bugzilla.redhat.com/show_bug.cgi?id=2163037", "https://bugzilla.redhat.com/show_bug.cgi?id=2174485", "https://bugzilla.redhat.com/show_bug.cgi?id=2175721", "https://bugzilla.redhat.com/show_bug.cgi?id=2178358", "https://bugzilla.redhat.com/show_bug.cgi?id=2178488", "https://bugzilla.redhat.com/show_bug.cgi?id=2178492", "https://bugzilla.redhat.com/show_bug.cgi?id=2182883", "https://bugzilla.redhat.com/show_bug.cgi?id=2182884", "https://bugzilla.redhat.com/show_bug.cgi?id=2184481", "https://bugzilla.redhat.com/show_bug.cgi?id=2184482", "https://bugzilla.redhat.com/show_bug.cgi?id=2184483", "https://bugzilla.redhat.com/show_bug.cgi?id=2184484", "https://bugzilla.redhat.com/show_bug.cgi?id=2196026", "https://bugzilla.redhat.com/show_bug.cgi?id=2196027", "https://bugzilla.redhat.com/show_bug.cgi?id=2196029", "https://bugzilla.redhat.com/show_bug.cgi?id=2222167", "https://bugzilla.redhat.com/show_bug.cgi?id=2228689", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41723", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41724", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41725", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24536", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24537", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24538", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24539", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24540", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25173", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25809", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27561", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29400", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3978", "https://errata.almalinux.org/9/ALSA-2023-6474.html", "https://errata.rockylinux.org/RLSA-2023:6939", "https://github.com/golang/go/commit/126a1d02da82f93ede7ce0bd8d3c51ef627f2104%20%28go1.19.8%29", "https://github.com/golang/go/commit/e7c4b07ecf6b367f1afc9cc48cde963829dd0aab%20%28go1.20.3%29", "https://github.com/golang/go/issues/59180", "https://go.dev/cl/482078", "https://go.dev/issue/59180", "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8", "https://linux.oracle.com/cve/CVE-2023-24537.html", "https://linux.oracle.com/errata/ELSA-2023-6939.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-24537", "https://pkg.go.dev/vuln/GO-2023-1702", "https://security.gentoo.org/glsa/202311-09", "https://security.netapp.com/advisory/ntap-20241129-0004/", "https://ubuntu.com/security/notices/USN-6038-1", "https://ubuntu.com/security/notices/USN-6038-2", "https://ubuntu.com/security/notices/USN-6140-1", "https://www.cve.org/CVERecord?id=CVE-2023-24537" ], "PublishedDate": "2023-04-06T16:15:07.753Z", "LastModifiedDate": "2026-06-17T05:39:29.483Z" }, { "VulnerabilityID": "CVE-2023-24539", "VendorIDs": [ "GO-2023-1751" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.19.9, 1.20.4", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-24539", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:e8d777ddff5ca899b8ef035149abbdfc8aa37006b8b2d415d5459e299986c87f", "Title": "golang: html/template: improper sanitization of CSS values", "Description": "Angle brackets (\u003c\u003e) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input.", "Severity": "HIGH", "CweIDs": [ "CWE-74", "CWE-94" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "bitnami": 3, "cbl-mariner": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 7.3 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 7.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2023:6474", "https://access.redhat.com/errata/RHSA-2023:6939", "https://access.redhat.com/security/cve/CVE-2023-24539", "https://bugzilla.redhat.com/2174485", "https://bugzilla.redhat.com/2178358", "https://bugzilla.redhat.com/2178488", "https://bugzilla.redhat.com/2178492", "https://bugzilla.redhat.com/2184481", "https://bugzilla.redhat.com/2184482", "https://bugzilla.redhat.com/2184483", "https://bugzilla.redhat.com/2184484", "https://bugzilla.redhat.com/2196026", "https://bugzilla.redhat.com/2196027", "https://bugzilla.redhat.com/2196029", "https://bugzilla.redhat.com/2222167", "https://bugzilla.redhat.com/2228689", "https://bugzilla.redhat.com/show_bug.cgi?id=2163037", "https://bugzilla.redhat.com/show_bug.cgi?id=2174485", "https://bugzilla.redhat.com/show_bug.cgi?id=2175721", "https://bugzilla.redhat.com/show_bug.cgi?id=2178358", "https://bugzilla.redhat.com/show_bug.cgi?id=2178488", "https://bugzilla.redhat.com/show_bug.cgi?id=2178492", "https://bugzilla.redhat.com/show_bug.cgi?id=2182883", "https://bugzilla.redhat.com/show_bug.cgi?id=2182884", "https://bugzilla.redhat.com/show_bug.cgi?id=2184481", "https://bugzilla.redhat.com/show_bug.cgi?id=2184482", "https://bugzilla.redhat.com/show_bug.cgi?id=2184483", "https://bugzilla.redhat.com/show_bug.cgi?id=2184484", "https://bugzilla.redhat.com/show_bug.cgi?id=2196026", "https://bugzilla.redhat.com/show_bug.cgi?id=2196027", "https://bugzilla.redhat.com/show_bug.cgi?id=2196029", "https://bugzilla.redhat.com/show_bug.cgi?id=2222167", "https://bugzilla.redhat.com/show_bug.cgi?id=2228689", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41723", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41724", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41725", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24536", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24537", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24538", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24539", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24540", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25173", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25809", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27561", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29400", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3978", "https://errata.almalinux.org/9/ALSA-2023-6474.html", "https://errata.rockylinux.org/RLSA-2023:6939", "https://github.com/golang/go/commit/090590fdccc8442728aa31601927da1bf2ef1288%20%28go1.20.4%29", "https://github.com/golang/go/commit/e49282327b05192e46086bf25fd3ac691205fe80%20%28go1.19.9%29", "https://github.com/golang/go/issues/59720", "https://go.dev/cl/491615", "https://go.dev/issue/59720", "https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU", "https://linux.oracle.com/cve/CVE-2023-24539.html", "https://linux.oracle.com/errata/ELSA-2023-6939.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-24539", "https://pkg.go.dev/vuln/GO-2023-1751", "https://security.netapp.com/advisory/ntap-20241129-0005/", "https://ubuntu.com/security/notices/USN-6140-1", "https://www.cve.org/CVERecord?id=CVE-2023-24539" ], "PublishedDate": "2023-05-11T16:15:09.6Z", "LastModifiedDate": "2026-06-17T05:39:29.84Z" }, { "VulnerabilityID": "CVE-2023-29400", "VendorIDs": [ "GO-2023-1753" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.19.9, 1.20.4", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-29400", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:ab7c706da5b7abc044e2c3c056241fa38a32e7032956233e13378751991adc4f", "Title": "golang: html/template: improper handling of empty HTML attributes", "Description": "Templates containing actions in unquoted HTML attributes (e.g. \"attr={{.}}\") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.", "Severity": "HIGH", "CweIDs": [ "CWE-74", "CWE-94" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "bitnami": 3, "cbl-mariner": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 7.3 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 7.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/errata/RHSA-2023:6474", "https://access.redhat.com/errata/RHSA-2023:6939", "https://access.redhat.com/security/cve/CVE-2023-29400", "https://bugzilla.redhat.com/2174485", "https://bugzilla.redhat.com/2178358", "https://bugzilla.redhat.com/2178488", "https://bugzilla.redhat.com/2178492", "https://bugzilla.redhat.com/2184481", "https://bugzilla.redhat.com/2184482", "https://bugzilla.redhat.com/2184483", "https://bugzilla.redhat.com/2184484", "https://bugzilla.redhat.com/2196026", "https://bugzilla.redhat.com/2196027", "https://bugzilla.redhat.com/2196029", "https://bugzilla.redhat.com/2222167", "https://bugzilla.redhat.com/2228689", "https://bugzilla.redhat.com/show_bug.cgi?id=2163037", "https://bugzilla.redhat.com/show_bug.cgi?id=2174485", "https://bugzilla.redhat.com/show_bug.cgi?id=2175721", "https://bugzilla.redhat.com/show_bug.cgi?id=2178358", "https://bugzilla.redhat.com/show_bug.cgi?id=2178488", "https://bugzilla.redhat.com/show_bug.cgi?id=2178492", "https://bugzilla.redhat.com/show_bug.cgi?id=2182883", "https://bugzilla.redhat.com/show_bug.cgi?id=2182884", "https://bugzilla.redhat.com/show_bug.cgi?id=2184481", "https://bugzilla.redhat.com/show_bug.cgi?id=2184482", "https://bugzilla.redhat.com/show_bug.cgi?id=2184483", "https://bugzilla.redhat.com/show_bug.cgi?id=2184484", "https://bugzilla.redhat.com/show_bug.cgi?id=2196026", "https://bugzilla.redhat.com/show_bug.cgi?id=2196027", "https://bugzilla.redhat.com/show_bug.cgi?id=2196029", "https://bugzilla.redhat.com/show_bug.cgi?id=2222167", "https://bugzilla.redhat.com/show_bug.cgi?id=2228689", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3064", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41723", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41724", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41725", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24536", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24537", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24538", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24539", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24540", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25173", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25809", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27561", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29400", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3978", "https://errata.almalinux.org/9/ALSA-2023-6474.html", "https://errata.rockylinux.org/RLSA-2023:6939", "https://github.com/golang/go/commit/337dd75343145b74ed2073d793322eb4103b56ad%20%28go1.20.4%29", "https://github.com/golang/go/commit/9db0e74f606b8afb28cc71d4b1c8b4ed24cabbf5%20%28go1.19.9%29", "https://github.com/golang/go/issues/59722", "https://go.dev/cl/491617", "https://go.dev/issue/59722", "https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU", "https://linux.oracle.com/cve/CVE-2023-29400.html", "https://linux.oracle.com/errata/ELSA-2023-6939.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-29400", "https://pkg.go.dev/vuln/GO-2023-1753", "https://security.netapp.com/advisory/ntap-20241213-0005/", "https://ubuntu.com/security/notices/USN-6140-1", "https://www.cve.org/CVERecord?id=CVE-2023-29400" ], "PublishedDate": "2023-05-11T16:15:09.85Z", "LastModifiedDate": "2026-06-17T05:49:57.937Z" }, { "VulnerabilityID": "CVE-2023-29403", "VendorIDs": [ "GO-2023-1840" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.19.10, 1.20.5", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-29403", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:3555e22db2f9717efcf2a4b871b6b784997cceba305ea35b8ab4667e110bb276", "Title": "golang: runtime: unexpected behavior of setuid/setgid binaries", "Description": "On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.", "Severity": "HIGH", "CweIDs": [ "CWE-668" ], "VendorSeverity": { "alma": 4, "amazon": 3, "azure": 3, "bitnami": 3, "cbl-mariner": 3, "nvd": 3, "oracle-oval": 4, "photon": 3, "redhat": 3, "rocky": 4, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2023:3923", "https://access.redhat.com/security/cve/CVE-2023-29403", "https://bugzilla.redhat.com/2216965", "https://bugzilla.redhat.com/2217562", "https://bugzilla.redhat.com/2217565", "https://bugzilla.redhat.com/2217569", "https://bugzilla.redhat.com/show_bug.cgi?id=2216965", "https://bugzilla.redhat.com/show_bug.cgi?id=2217562", "https://bugzilla.redhat.com/show_bug.cgi?id=2217565", "https://bugzilla.redhat.com/show_bug.cgi?id=2217569", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29403", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29404", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29405", "https://errata.almalinux.org/9/ALSA-2023-3923.html", "https://errata.rockylinux.org/RLSA-2023:3923", "https://github.com/golang/go/commit/36144ba429ef2650940c72e7a0b932af3612d420%20%28go1.20.5%29", "https://github.com/golang/go/commit/a7b1cd452ddc69a6606c2f35ac5786dc892e62cb%20%28go1.19.10%29", "https://github.com/golang/go/issues/60272", "https://go.dev/cl/501223", "https://go.dev/issue/60272", "https://groups.google.com/g/golang-announce/c/q5135a9d924", "https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ", "https://linux.oracle.com/cve/CVE-2023-29403.html", "https://linux.oracle.com/errata/ELSA-2023-3923.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/", "https://nvd.nist.gov/vuln/detail/CVE-2023-29403", "https://pkg.go.dev/vuln/GO-2023-1840", "https://security.gentoo.org/glsa/202311-09", "https://security.netapp.com/advisory/ntap-20241220-0009/", "https://ubuntu.com/security/notices/USN-7061-1", "https://ubuntu.com/security/notices/USN-7109-1", "https://www.cve.org/CVERecord?id=CVE-2023-29403" ], "PublishedDate": "2023-06-08T21:15:16.927Z", "LastModifiedDate": "2026-06-17T05:49:58.43Z" }, { "VulnerabilityID": "CVE-2023-39325", "VendorIDs": [ "GHSA-4374-p667-p6c8", "GO-2023-2102" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.20.10, 1.21.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-39325", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:6011d968d6954401f96cca4ca028846e5f0c847da659880d79d491694226fa56", "Title": "golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)", "Description": "A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "bitnami": 3, "bottlerocket": 3, "cbl-mariner": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 2, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39325", "https://access.redhat.com/errata/RHSA-2023:6077", "https://access.redhat.com/security/cve/CVE-2023-39325", "https://access.redhat.com/security/cve/CVE-2023-44487", "https://bugzilla.redhat.com/2242803", "https://bugzilla.redhat.com/2243296", "https://bugzilla.redhat.com/show_bug.cgi?id=2242803", "https://bugzilla.redhat.com/show_bug.cgi?id=2243296", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39325", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487", "https://errata.almalinux.org/9/ALSA-2023-6077.html", "https://errata.rockylinux.org/RLSA-2023:6077", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-48vh-q3rp-4grw", "https://github.com/golang/go/commit/24ae2d927285c697440fdde3ad7f26028354bcf3%20%5Bgolang-%201.21%5D", "https://github.com/golang/go/commit/e175f27f58aa7b9cd4d79607ae65d2cd5baaee68%20%5Bgolang-1.20%5D", "https://github.com/golang/go/issues/63417", "https://go.dev/cl/534215", "https://go.dev/cl/534235", "https://go.dev/issue/63417", "https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ", "https://linux.oracle.com/cve/CVE-2023-39325.html", "https://linux.oracle.com/errata/ELSA-2023-5867.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OVW5V2DM5K5IC3H7O42YDUGNJ74J35O/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WJ4QVX2AMUJ2F2S27POOAHRC4K3CHU4/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FTMJ3NJIDAZFWJQQSP3L22MUFJ3UP2PT/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPWCNYB5PQ5PCVZ4NJT6G56ZYFZ5QBU6/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5E5JSJBZLYXOTZWXHJKRVCIXIHVWKJ6/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZQYOOKHQDQ57LV2IAG6NRFOVXKHJJ3Z/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODBY7RVMGZCBSTWF2OZGIZS57FNFUL67/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PJCUNGIQDUMZ4Z6HWVYIMR66A35F5S74/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXOU2JZUBEBP7GBKAYIJRPRBZSJCD7ST/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LZSWTV4NV4SNQARNXG5T6LRHP26EW2/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJWHBLVZDM5KQSDFRBFRKU5KSSOLIRQ4/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/", "https://nvd.nist.gov/vuln/detail/CVE-2023-39325", "https://pkg.go.dev/vuln/GO-2023-2102", "https://security.gentoo.org/glsa/202311-09", "https://security.netapp.com/advisory/ntap-20231110-0008/", "https://ubuntu.com/security/notices/USN-6574-1", "https://ubuntu.com/security/notices/USN-7061-1", "https://ubuntu.com/security/notices/USN-7109-1", "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487", "https://www.cve.org/CVERecord?id=CVE-2023-39325" ], "PublishedDate": "2023-10-11T22:15:09.88Z", "LastModifiedDate": "2026-06-17T06:12:02.173Z" }, { "VulnerabilityID": "CVE-2023-45283", "VendorIDs": [ "GO-2023-2185" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.20.11, 1.21.4, 1.20.12, 1.21.5", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45283", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:2a25fcbb4cac597fe6d62bf9b7741fa5eb37a433267cc80f3d8a352dfa150778", "Title": "The filepath package does not recognize paths with a \\??\\ prefix as sp ...", "Description": "The filepath package does not recognize paths with a \\??\\ prefix as special. On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x. Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b. Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b. In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored.", "Severity": "HIGH", "CweIDs": [ "CWE-22" ], "VendorSeverity": { "amazon": 2, "bitnami": 3, "cbl-mariner": 3, "nvd": 3, "photon": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2023/12/05/2", "https://go.dev/cl/540277", "https://go.dev/cl/541175", "https://go.dev/issue/63713", "https://go.dev/issue/64028", "https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY", "https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ", "https://nvd.nist.gov/vuln/detail/CVE-2023-45283", "https://pkg.go.dev/vuln/GO-2023-2185", "https://security.netapp.com/advisory/ntap-20231214-0008/" ], "PublishedDate": "2023-11-09T17:15:08.757Z", "LastModifiedDate": "2026-06-17T06:28:34.863Z" }, { "VulnerabilityID": "CVE-2023-45287", "VendorIDs": [ "GO-2023-2375" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.20.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45287", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:69256a611fc8d7f588edbbf566ebebc1a2533a3102463d8bec4b669d0abb897a", "Title": "golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges.", "Description": "Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS#1 padding may leak timing information, which in turn could be used to recover session key bits. In Go 1.20, the crypto/tls library switched to a fully constant time RSA implementation, which we do not believe exhibits any timing side channels.", "Severity": "HIGH", "CweIDs": [ "CWE-203" ], "VendorSeverity": { "alma": 2, "azure": 3, "bitnami": 3, "cbl-mariner": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2024:2272", "https://access.redhat.com/errata/RHSA-2024:2988", "https://access.redhat.com/security/cve/CVE-2023-45287", "https://bugzilla.redhat.com/2253193", "https://bugzilla.redhat.com/2253330", "https://bugzilla.redhat.com/show_bug.cgi?id=1983596", "https://bugzilla.redhat.com/show_bug.cgi?id=1989575", "https://bugzilla.redhat.com/show_bug.cgi?id=2132867", "https://bugzilla.redhat.com/show_bug.cgi?id=2132868", "https://bugzilla.redhat.com/show_bug.cgi?id=2132872", "https://bugzilla.redhat.com/show_bug.cgi?id=2228743", "https://bugzilla.redhat.com/show_bug.cgi?id=2237773", "https://bugzilla.redhat.com/show_bug.cgi?id=2237776", "https://bugzilla.redhat.com/show_bug.cgi?id=2237777", "https://bugzilla.redhat.com/show_bug.cgi?id=2237778", "https://bugzilla.redhat.com/show_bug.cgi?id=2244340", "https://bugzilla.redhat.com/show_bug.cgi?id=2246840", "https://bugzilla.redhat.com/show_bug.cgi?id=2253193", "https://bugzilla.redhat.com/show_bug.cgi?id=2253330", "https://bugzilla.redhat.com/show_bug.cgi?id=2254210", "https://bugzilla.redhat.com/show_bug.cgi?id=2262272", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25091", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33198", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34558", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2880", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41715", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29409", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39318", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39319", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39321", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39322", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39326", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45287", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45803", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-48795", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23650", "https://errata.almalinux.org/9/ALSA-2024-2272.html", "https://errata.rockylinux.org/RLSA-2024:2988", "https://go.dev/cl/326012/26", "https://go.dev/issue/20654", "https://groups.google.com/g/golang-announce/c/QMK8IQALDvA", "https://linux.oracle.com/cve/CVE-2023-45287.html", "https://linux.oracle.com/errata/ELSA-2024-2988.html", "https://nvd.nist.gov/vuln/detail/CVE-2023-45287", "https://people.redhat.com/~hkario/marvin/", "https://pkg.go.dev/vuln/GO-2023-2375", "https://security.netapp.com/advisory/ntap-20240112-0005/", "https://www.cve.org/CVERecord?id=CVE-2023-45287" ], "PublishedDate": "2023-12-05T17:15:08.57Z", "LastModifiedDate": "2026-06-17T06:28:35.46Z" }, { "VulnerabilityID": "CVE-2023-45288", "VendorIDs": [ "GHSA-4v7x-pqxf-cx7m", "GO-2024-2687" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.21.9, 1.22.2", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45288", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:1a6d08626330f8e582272018a99cbe6ad74d584eaaa2a25a6ac1c598d5073650", "Title": "golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS", "Description": "An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "bottlerocket": 2, "cbl-mariner": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45288", "http://www.openwall.com/lists/oss-security/2024/04/03/16", "http://www.openwall.com/lists/oss-security/2024/04/05/4", "https://access.redhat.com/errata/RHSA-2024:2724", "https://access.redhat.com/security/cve/CVE-2023-45288", "https://bugzilla.redhat.com/2268017", "https://bugzilla.redhat.com/2268018", "https://bugzilla.redhat.com/2268019", "https://bugzilla.redhat.com/2268273", "https://bugzilla.redhat.com/show_bug.cgi?id=2268017", "https://bugzilla.redhat.com/show_bug.cgi?id=2268018", "https://bugzilla.redhat.com/show_bug.cgi?id=2268019", "https://bugzilla.redhat.com/show_bug.cgi?id=2268273", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45288", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45289", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45290", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24783", "https://errata.almalinux.org/9/ALSA-2024-2724.html", "https://errata.rockylinux.org/RLSA-2024:2724", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-c9wf-j9h6-m2r9", "https://go.dev/cl/576155", "https://go.dev/issue/65051", "https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M", "https://kb.cert.org/vuls/id/421644", "https://linux.oracle.com/cve/CVE-2023-45288.html", "https://linux.oracle.com/errata/ELSA-2024-3346.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/", "https://nowotarski.info/http2-continuation-flood/", "https://nvd.nist.gov/vuln/detail/CVE-2023-45288", "https://pkg.go.dev/vuln/GO-2024-2687", "https://security.netapp.com/advisory/ntap-20240419-0009/", "https://ubuntu.com/security/notices/USN-6886-1", "https://ubuntu.com/security/notices/USN-7109-1", "https://ubuntu.com/security/notices/USN-7111-1", "https://www.cve.org/CVERecord?id=CVE-2023-45288", "https://www.kb.cert.org/vuls/id/421644" ], "PublishedDate": "2024-04-04T21:15:16.113Z", "LastModifiedDate": "2026-06-17T06:28:35.58Z" }, { "VulnerabilityID": "CVE-2024-34156", "VendorIDs": [ "GO-2024-3106" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.22.7, 1.23.1", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-34156", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:3b19898955085fccd0a0c09c1011efd53120e8804f61cc88126ae744f6db9346", "Title": "encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion", "Description": "Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2025:3773", "https://access.redhat.com/security/cve/CVE-2024-34156", "https://bugzilla.redhat.com/2310528", "https://bugzilla.redhat.com/show_bug.cgi?id=2310528", "https://bugzilla.redhat.com/show_bug.cgi?id=2341750", "https://bugzilla.redhat.com/show_bug.cgi?id=2341751", "https://bugzilla.redhat.com/show_bug.cgi?id=2344219", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45336", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45341", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22866", "https://errata.almalinux.org/9/ALSA-2025-3773.html", "https://errata.rockylinux.org/RLSA-2025:3773", "https://github.com/golang/go/commit/2092294f2b097c5828f4eace6c98a322c1510b01%20%28go1.22.7%29", "https://github.com/golang/go/commit/fa8ff1a46deb6c816304441ec6740ec112e19012%20%28go1.23.1%29", "https://go.dev/cl/611239", "https://go.dev/issue/69139", "https://groups.google.com/g/golang-announce/c/K-cEzDeCtpc", "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk", "https://linux.oracle.com/cve/CVE-2024-34156.html", "https://linux.oracle.com/errata/ELSA-2025-3773.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-34156", "https://pkg.go.dev/vuln/GO-2024-3106", "https://security.netapp.com/advisory/ntap-20240926-0004/", "https://ubuntu.com/security/notices/USN-7081-1", "https://ubuntu.com/security/notices/USN-7109-1", "https://ubuntu.com/security/notices/USN-7111-1", "https://www.cve.org/CVERecord?id=CVE-2024-34156" ], "PublishedDate": "2024-09-06T21:15:12.02Z", "LastModifiedDate": "2026-06-17T07:33:00.72Z" }, { "VulnerabilityID": "CVE-2025-61726", "VendorIDs": [ "GO-2026-4341" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.24.12, 1.25.6", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-61726", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:c5fd4b6bed5c4ff824eef8d130497c05518fc15295a5400d180aae1733004524", "Title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url", "Description": "The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bitnami": 3, "cbl-mariner": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10096", "https://access.redhat.com/errata/RHSA-2026:10104", "https://access.redhat.com/errata/RHSA-2026:10184", "https://access.redhat.com/errata/RHSA-2026:10225", "https://access.redhat.com/errata/RHSA-2026:10250", "https://access.redhat.com/errata/RHSA-2026:11408", "https://access.redhat.com/errata/RHSA-2026:11414", "https://access.redhat.com/errata/RHSA-2026:11747", "https://access.redhat.com/errata/RHSA-2026:11749", "https://access.redhat.com/errata/RHSA-2026:12028", "https://access.redhat.com/errata/RHSA-2026:12029", "https://access.redhat.com/errata/RHSA-2026:12030", "https://access.redhat.com/errata/RHSA-2026:12031", "https://access.redhat.com/errata/RHSA-2026:12032", "https://access.redhat.com/errata/RHSA-2026:12033", "https://access.redhat.com/errata/RHSA-2026:12279", "https://access.redhat.com/errata/RHSA-2026:12282", "https://access.redhat.com/errata/RHSA-2026:13542", "https://access.redhat.com/errata/RHSA-2026:13548", "https://access.redhat.com/errata/RHSA-2026:13571", "https://access.redhat.com/errata/RHSA-2026:14100", "https://access.redhat.com/errata/RHSA-2026:14774", "https://access.redhat.com/errata/RHSA-2026:14868", "https://access.redhat.com/errata/RHSA-2026:14879", "https://access.redhat.com/errata/RHSA-2026:15091", "https://access.redhat.com/errata/RHSA-2026:15984", "https://access.redhat.com/errata/RHSA-2026:16102", "https://access.redhat.com/errata/RHSA-2026:16696", "https://access.redhat.com/errata/RHSA-2026:17040", "https://access.redhat.com/errata/RHSA-2026:17084", "https://access.redhat.com/errata/RHSA-2026:17446", "https://access.redhat.com/errata/RHSA-2026:17460", "https://access.redhat.com/errata/RHSA-2026:17463", "https://access.redhat.com/errata/RHSA-2026:17468", "https://access.redhat.com/errata/RHSA-2026:17595", "https://access.redhat.com/errata/RHSA-2026:17598", "https://access.redhat.com/errata/RHSA-2026:18913", "https://access.redhat.com/errata/RHSA-2026:19013", "https://access.redhat.com/errata/RHSA-2026:19132", "https://access.redhat.com/errata/RHSA-2026:19375", "https://access.redhat.com/errata/RHSA-2026:19634", "https://access.redhat.com/errata/RHSA-2026:19712", "https://access.redhat.com/errata/RHSA-2026:20041", "https://access.redhat.com/errata/RHSA-2026:21017", "https://access.redhat.com/errata/RHSA-2026:21657", "https://access.redhat.com/errata/RHSA-2026:21691", "https://access.redhat.com/errata/RHSA-2026:22450", "https://access.redhat.com/errata/RHSA-2026:22627", "https://access.redhat.com/errata/RHSA-2026:22714", "https://access.redhat.com/errata/RHSA-2026:22937", "https://access.redhat.com/errata/RHSA-2026:23228", "https://access.redhat.com/errata/RHSA-2026:23361", "https://access.redhat.com/errata/RHSA-2026:24977", "https://access.redhat.com/errata/RHSA-2026:25089", "https://access.redhat.com/errata/RHSA-2026:25127", "https://access.redhat.com/errata/RHSA-2026:25248", "https://access.redhat.com/errata/RHSA-2026:25250", "https://access.redhat.com/errata/RHSA-2026:25251", "https://access.redhat.com/errata/RHSA-2026:25252", "https://access.redhat.com/errata/RHSA-2026:25253", "https://access.redhat.com/errata/RHSA-2026:26420", "https://access.redhat.com/errata/RHSA-2026:26527", "https://access.redhat.com/errata/RHSA-2026:26541", "https://access.redhat.com/errata/RHSA-2026:26636", "https://access.redhat.com/errata/RHSA-2026:2681", "https://access.redhat.com/errata/RHSA-2026:2706", "https://access.redhat.com/errata/RHSA-2026:2708", "https://access.redhat.com/errata/RHSA-2026:2709", "https://access.redhat.com/errata/RHSA-2026:2754", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:2844", "https://access.redhat.com/errata/RHSA-2026:28441", "https://access.redhat.com/errata/RHSA-2026:28886", "https://access.redhat.com/errata/RHSA-2026:28961", "https://access.redhat.com/errata/RHSA-2026:2914", "https://access.redhat.com/errata/RHSA-2026:2920", "https://access.redhat.com/errata/RHSA-2026:3035", "https://access.redhat.com/errata/RHSA-2026:3040", "https://access.redhat.com/errata/RHSA-2026:3089", "https://access.redhat.com/errata/RHSA-2026:3092", "https://access.redhat.com/errata/RHSA-2026:3184", "https://access.redhat.com/errata/RHSA-2026:3186", "https://access.redhat.com/errata/RHSA-2026:3187", "https://access.redhat.com/errata/RHSA-2026:3188", "https://access.redhat.com/errata/RHSA-2026:3192", "https://access.redhat.com/errata/RHSA-2026:3193", "https://access.redhat.com/errata/RHSA-2026:3291", "https://access.redhat.com/errata/RHSA-2026:3296", "https://access.redhat.com/errata/RHSA-2026:3297", "https://access.redhat.com/errata/RHSA-2026:3298", "https://access.redhat.com/errata/RHSA-2026:3336", "https://access.redhat.com/errata/RHSA-2026:3337", "https://access.redhat.com/errata/RHSA-2026:3340", "https://access.redhat.com/errata/RHSA-2026:3341", "https://access.redhat.com/errata/RHSA-2026:3343", "https://access.redhat.com/errata/RHSA-2026:3391", "https://access.redhat.com/errata/RHSA-2026:3416", "https://access.redhat.com/errata/RHSA-2026:3427", "https://access.redhat.com/errata/RHSA-2026:3459", "https://access.redhat.com/errata/RHSA-2026:3468", "https://access.redhat.com/errata/RHSA-2026:3469", "https://access.redhat.com/errata/RHSA-2026:3470", "https://access.redhat.com/errata/RHSA-2026:3471", "https://access.redhat.com/errata/RHSA-2026:3472", "https://access.redhat.com/errata/RHSA-2026:3473", "https://access.redhat.com/errata/RHSA-2026:3489", "https://access.redhat.com/errata/RHSA-2026:3506", "https://access.redhat.com/errata/RHSA-2026:3556", "https://access.redhat.com/errata/RHSA-2026:3559", "https://access.redhat.com/errata/RHSA-2026:3668", "https://access.redhat.com/errata/RHSA-2026:3669", "https://access.redhat.com/errata/RHSA-2026:36873", "https://access.redhat.com/errata/RHSA-2026:36882", "https://access.redhat.com/errata/RHSA-2026:3699", "https://access.redhat.com/errata/RHSA-2026:3713", "https://access.redhat.com/errata/RHSA-2026:37275", "https://access.redhat.com/errata/RHSA-2026:3752", "https://access.redhat.com/errata/RHSA-2026:3753", "https://access.redhat.com/errata/RHSA-2026:3782", "https://access.redhat.com/errata/RHSA-2026:3812", "https://access.redhat.com/errata/RHSA-2026:3813", "https://access.redhat.com/errata/RHSA-2026:3814", "https://access.redhat.com/errata/RHSA-2026:3815", "https://access.redhat.com/errata/RHSA-2026:3816", "https://access.redhat.com/errata/RHSA-2026:3817", "https://access.redhat.com/errata/RHSA-2026:3818", "https://access.redhat.com/errata/RHSA-2026:3820", "https://access.redhat.com/errata/RHSA-2026:3821", "https://access.redhat.com/errata/RHSA-2026:3822", "https://access.redhat.com/errata/RHSA-2026:3831", "https://access.redhat.com/errata/RHSA-2026:3833", "https://access.redhat.com/errata/RHSA-2026:3835", "https://access.redhat.com/errata/RHSA-2026:3836", "https://access.redhat.com/errata/RHSA-2026:3838", "https://access.redhat.com/errata/RHSA-2026:3839", "https://access.redhat.com/errata/RHSA-2026:3840", "https://access.redhat.com/errata/RHSA-2026:3841", "https://access.redhat.com/errata/RHSA-2026:3843", "https://access.redhat.com/errata/RHSA-2026:3854", "https://access.redhat.com/errata/RHSA-2026:3855", "https://access.redhat.com/errata/RHSA-2026:3856", "https://access.redhat.com/errata/RHSA-2026:3864", "https://access.redhat.com/errata/RHSA-2026:3869", "https://access.redhat.com/errata/RHSA-2026:3874", "https://access.redhat.com/errata/RHSA-2026:3875", "https://access.redhat.com/errata/RHSA-2026:3879", "https://access.redhat.com/errata/RHSA-2026:3880", "https://access.redhat.com/errata/RHSA-2026:3884", "https://access.redhat.com/errata/RHSA-2026:3898", "https://access.redhat.com/errata/RHSA-2026:3905", "https://access.redhat.com/errata/RHSA-2026:3906", "https://access.redhat.com/errata/RHSA-2026:3928", "https://access.redhat.com/errata/RHSA-2026:3929", "https://access.redhat.com/errata/RHSA-2026:3930", "https://access.redhat.com/errata/RHSA-2026:3931", "https://access.redhat.com/errata/RHSA-2026:3932", "https://access.redhat.com/errata/RHSA-2026:3958", "https://access.redhat.com/errata/RHSA-2026:3959", "https://access.redhat.com/errata/RHSA-2026:3960", "https://access.redhat.com/errata/RHSA-2026:3970", "https://access.redhat.com/errata/RHSA-2026:3971", "https://access.redhat.com/errata/RHSA-2026:3972", "https://access.redhat.com/errata/RHSA-2026:3973", "https://access.redhat.com/errata/RHSA-2026:3974", "https://access.redhat.com/errata/RHSA-2026:3977", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:3985", "https://access.redhat.com/errata/RHSA-2026:40924", "https://access.redhat.com/errata/RHSA-2026:4164", "https://access.redhat.com/errata/RHSA-2026:4166", "https://access.redhat.com/errata/RHSA-2026:4170", "https://access.redhat.com/errata/RHSA-2026:4174", "https://access.redhat.com/errata/RHSA-2026:4177", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:41941", "https://access.redhat.com/errata/RHSA-2026:4211", "https://access.redhat.com/errata/RHSA-2026:4220", "https://access.redhat.com/errata/RHSA-2026:4256", "https://access.redhat.com/errata/RHSA-2026:4264", "https://access.redhat.com/errata/RHSA-2026:4267", "https://access.redhat.com/errata/RHSA-2026:4270", "https://access.redhat.com/errata/RHSA-2026:4276", "https://access.redhat.com/errata/RHSA-2026:4434", "https://access.redhat.com/errata/RHSA-2026:4435", "https://access.redhat.com/errata/RHSA-2026:4460", "https://access.redhat.com/errata/RHSA-2026:4466", "https://access.redhat.com/errata/RHSA-2026:4467", "https://access.redhat.com/errata/RHSA-2026:4498", "https://access.redhat.com/errata/RHSA-2026:4500", "https://access.redhat.com/errata/RHSA-2026:4510", "https://access.redhat.com/errata/RHSA-2026:4511", "https://access.redhat.com/errata/RHSA-2026:4672", "https://access.redhat.com/errata/RHSA-2026:46903", "https://access.redhat.com/errata/RHSA-2026:4753", "https://access.redhat.com/errata/RHSA-2026:4892", "https://access.redhat.com/errata/RHSA-2026:4901", "https://access.redhat.com/errata/RHSA-2026:4907", "https://access.redhat.com/errata/RHSA-2026:4939", "https://access.redhat.com/errata/RHSA-2026:4942", "https://access.redhat.com/errata/RHSA-2026:4943", "https://access.redhat.com/errata/RHSA-2026:4952", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:5022", "https://access.redhat.com/errata/RHSA-2026:5030", "https://access.redhat.com/errata/RHSA-2026:5031", "https://access.redhat.com/errata/RHSA-2026:5076", "https://access.redhat.com/errata/RHSA-2026:5077", "https://access.redhat.com/errata/RHSA-2026:5078", "https://access.redhat.com/errata/RHSA-2026:5079", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:5110", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:5129", "https://access.redhat.com/errata/RHSA-2026:5130", "https://access.redhat.com/errata/RHSA-2026:5131", "https://access.redhat.com/errata/RHSA-2026:5132", "https://access.redhat.com/errata/RHSA-2026:5145", "https://access.redhat.com/errata/RHSA-2026:5146", "https://access.redhat.com/errata/RHSA-2026:5168", "https://access.redhat.com/errata/RHSA-2026:5327", "https://access.redhat.com/errata/RHSA-2026:5394", "https://access.redhat.com/errata/RHSA-2026:5439", "https://access.redhat.com/errata/RHSA-2026:5444", "https://access.redhat.com/errata/RHSA-2026:5447", "https://access.redhat.com/errata/RHSA-2026:5452", "https://access.redhat.com/errata/RHSA-2026:5461", "https://access.redhat.com/errata/RHSA-2026:5463", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:5533", "https://access.redhat.com/errata/RHSA-2026:5544", "https://access.redhat.com/errata/RHSA-2026:5549", "https://access.redhat.com/errata/RHSA-2026:5636", "https://access.redhat.com/errata/RHSA-2026:56366", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:5645", "https://access.redhat.com/errata/RHSA-2026:5649", "https://access.redhat.com/errata/RHSA-2026:5665", "https://access.redhat.com/errata/RHSA-2026:57013", "https://access.redhat.com/errata/RHSA-2026:5807", "https://access.redhat.com/errata/RHSA-2026:5851", "https://access.redhat.com/errata/RHSA-2026:5852", "https://access.redhat.com/errata/RHSA-2026:5853", "https://access.redhat.com/errata/RHSA-2026:5948", "https://access.redhat.com/errata/RHSA-2026:5950", "https://access.redhat.com/errata/RHSA-2026:5952", "https://access.redhat.com/errata/RHSA-2026:5968", "https://access.redhat.com/errata/RHSA-2026:6184", "https://access.redhat.com/errata/RHSA-2026:6192", "https://access.redhat.com/errata/RHSA-2026:6226", "https://access.redhat.com/errata/RHSA-2026:6251", "https://access.redhat.com/errata/RHSA-2026:6277", "https://access.redhat.com/errata/RHSA-2026:6278", "https://access.redhat.com/errata/RHSA-2026:6428", "https://access.redhat.com/errata/RHSA-2026:6429", "https://access.redhat.com/errata/RHSA-2026:6497", "https://access.redhat.com/errata/RHSA-2026:6554", "https://access.redhat.com/errata/RHSA-2026:6564", "https://access.redhat.com/errata/RHSA-2026:6567", "https://access.redhat.com/errata/RHSA-2026:6568", "https://access.redhat.com/errata/RHSA-2026:66401", "https://access.redhat.com/errata/RHSA-2026:7052", "https://access.redhat.com/errata/RHSA-2026:7249", "https://access.redhat.com/errata/RHSA-2026:7291", "https://access.redhat.com/errata/RHSA-2026:7385", "https://access.redhat.com/errata/RHSA-2026:7676", "https://access.redhat.com/errata/RHSA-2026:7854", "https://access.redhat.com/errata/RHSA-2026:7942", "https://access.redhat.com/errata/RHSA-2026:8151", "https://access.redhat.com/errata/RHSA-2026:8167", "https://access.redhat.com/errata/RHSA-2026:8218", "https://access.redhat.com/errata/RHSA-2026:8229", "https://access.redhat.com/errata/RHSA-2026:8337", "https://access.redhat.com/errata/RHSA-2026:8338", "https://access.redhat.com/errata/RHSA-2026:8431", "https://access.redhat.com/errata/RHSA-2026:8433", "https://access.redhat.com/errata/RHSA-2026:8483", "https://access.redhat.com/errata/RHSA-2026:9097", "https://access.redhat.com/errata/RHSA-2026:9098", "https://access.redhat.com/errata/RHSA-2026:9108", "https://access.redhat.com/errata/RHSA-2026:9109", "https://access.redhat.com/errata/RHSA-2026:9848", "https://access.redhat.com/security/cve/CVE-2025-61726", "https://bugzilla.redhat.com/2434432", "https://bugzilla.redhat.com/2437111", "https://bugzilla.redhat.com/show_bug.cgi?id=2434432", "https://bugzilla.redhat.com/show_bug.cgi?id=2437111", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121", "https://errata.almalinux.org/9/ALSA-2026-4177.html", "https://errata.rockylinux.org/RLSA-2026:4177", "https://go.dev/cl/736712", "https://go.dev/issue/77101", "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc", "https://linux.oracle.com/cve/CVE-2025-61726.html", "https://linux.oracle.com/errata/ELSA-2026-5146.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-61726", "https://pkg.go.dev/vuln/GO-2026-4341", "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61726.json", "https://www.cve.org/CVERecord?id=CVE-2025-61726" ], "PublishedDate": "2026-01-28T20:16:09.713Z", "LastModifiedDate": "2026-09-17T12:17:11.443Z" }, { "VulnerabilityID": "CVE-2025-61729", "VendorIDs": [ "GO-2025-4155" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.24.11, 1.25.5", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-61729", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:e0fe67a61b860e46523d17a59af12717766caab3115346e0ca75f563a10a7ff1", "Title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate", "Description": "Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "cbl-mariner": 1, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:3928", "https://access.redhat.com/security/cve/CVE-2025-61729", "https://bugzilla.redhat.com/2418462", "https://bugzilla.redhat.com/2434432", "https://bugzilla.redhat.com/2437111", "https://bugzilla.redhat.com/show_bug.cgi?id=2418462", "https://bugzilla.redhat.com/show_bug.cgi?id=2434432", "https://bugzilla.redhat.com/show_bug.cgi?id=2437111", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121", "https://errata.almalinux.org/9/ALSA-2026-3928.html", "https://errata.rockylinux.org/RLSA-2026:3928", "https://go.dev/cl/725920", "https://go.dev/issue/76445", "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4", "https://linux.oracle.com/cve/CVE-2025-61729.html", "https://linux.oracle.com/errata/ELSA-2026-5146.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-61729", "https://pkg.go.dev/vuln/GO-2025-4155", "https://www.cve.org/CVERecord?id=CVE-2025-61729" ], "PublishedDate": "2025-12-02T19:15:51.447Z", "LastModifiedDate": "2026-10-18T18:10:00.1Z" }, { "VulnerabilityID": "CVE-2026-111943", "VendorIDs": [ "GO-2026-6809" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.26.10, 1.27.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-111943", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:f1a82231ea4e5e2facbe2687453bbc353d6996b6b9083f856879d111c6e8eca3", "Title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "Description": "On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.", "Severity": "HIGH", "CweIDs": [ "CWE-299" ], "VendorSeverity": { "alma": 3, "amazon": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 6.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/20/29", "https://access.redhat.com/errata/RHSA-2026:95518", "https://access.redhat.com/security/cve/CVE-2026-111943", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-95518.html", "https://errata.rockylinux.org/RLSA-2026:95518", "https://github.com/golang/go/issues/82345", "https://go.dev/cl/851047", "https://go.dev/issue/82345", "https://groups.google.com/g/golang-announce/c/66pojueaQek", "https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU", "https://linux.oracle.com/cve/CVE-2026-111943.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-111943", "https://pkg.go.dev/vuln/GO-2026-6809", "https://www.cve.org/CVERecord?id=CVE-2026-111943" ], "PublishedDate": "2026-10-21T01:17:20.797Z", "LastModifiedDate": "2026-10-30T13:18:28.74Z" }, { "VulnerabilityID": "CVE-2026-25679", "VendorIDs": [ "GO-2026-4601" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.25.8, 1.26.1", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-25679", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:cd297c67c91a95d1550242798677eca144336c452b2db5ee671841ef4f44c49b", "Title": "net/url: Incorrect parsing of IPv6 host literals in net/url", "Description": "url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.", "Severity": "HIGH", "CweIDs": [ "CWE-425", "CWE-1286" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10065", "https://access.redhat.com/errata/RHSA-2026:10125", "https://access.redhat.com/errata/RHSA-2026:10133", "https://access.redhat.com/errata/RHSA-2026:10140", "https://access.redhat.com/errata/RHSA-2026:10141", "https://access.redhat.com/errata/RHSA-2026:10158", "https://access.redhat.com/errata/RHSA-2026:10169", "https://access.redhat.com/errata/RHSA-2026:10175", "https://access.redhat.com/errata/RHSA-2026:10184", "https://access.redhat.com/errata/RHSA-2026:10225", "https://access.redhat.com/errata/RHSA-2026:10250", "https://access.redhat.com/errata/RHSA-2026:10701", "https://access.redhat.com/errata/RHSA-2026:10712", "https://access.redhat.com/errata/RHSA-2026:10929", "https://access.redhat.com/errata/RHSA-2026:11217", "https://access.redhat.com/errata/RHSA-2026:11375", "https://access.redhat.com/errata/RHSA-2026:11412", "https://access.redhat.com/errata/RHSA-2026:11413", "https://access.redhat.com/errata/RHSA-2026:11686", "https://access.redhat.com/errata/RHSA-2026:11688", "https://access.redhat.com/errata/RHSA-2026:11747", "https://access.redhat.com/errata/RHSA-2026:11749", "https://access.redhat.com/errata/RHSA-2026:11768", "https://access.redhat.com/errata/RHSA-2026:11800", "https://access.redhat.com/errata/RHSA-2026:11856", "https://access.redhat.com/errata/RHSA-2026:11916", "https://access.redhat.com/errata/RHSA-2026:11996", "https://access.redhat.com/errata/RHSA-2026:12028", "https://access.redhat.com/errata/RHSA-2026:12029", "https://access.redhat.com/errata/RHSA-2026:12030", "https://access.redhat.com/errata/RHSA-2026:12031", "https://access.redhat.com/errata/RHSA-2026:12032", "https://access.redhat.com/errata/RHSA-2026:12033", "https://access.redhat.com/errata/RHSA-2026:12282", "https://access.redhat.com/errata/RHSA-2026:13508", "https://access.redhat.com/errata/RHSA-2026:13512", "https://access.redhat.com/errata/RHSA-2026:13545", "https://access.redhat.com/errata/RHSA-2026:13642", "https://access.redhat.com/errata/RHSA-2026:13643", "https://access.redhat.com/errata/RHSA-2026:13671", "https://access.redhat.com/errata/RHSA-2026:13791", "https://access.redhat.com/errata/RHSA-2026:13829", "https://access.redhat.com/errata/RHSA-2026:14020", "https://access.redhat.com/errata/RHSA-2026:14100", "https://access.redhat.com/errata/RHSA-2026:14774", "https://access.redhat.com/errata/RHSA-2026:14868", "https://access.redhat.com/errata/RHSA-2026:14879", "https://access.redhat.com/errata/RHSA-2026:15091", "https://access.redhat.com/errata/RHSA-2026:16102", "https://access.redhat.com/errata/RHSA-2026:16696", "https://access.redhat.com/errata/RHSA-2026:16874", "https://access.redhat.com/errata/RHSA-2026:16875", "https://access.redhat.com/errata/RHSA-2026:17040", "https://access.redhat.com/errata/RHSA-2026:17084", "https://access.redhat.com/errata/RHSA-2026:17287", "https://access.redhat.com/errata/RHSA-2026:17598", "https://access.redhat.com/errata/RHSA-2026:19017", "https://access.redhat.com/errata/RHSA-2026:19022", "https://access.redhat.com/errata/RHSA-2026:19026", "https://access.redhat.com/errata/RHSA-2026:19027", "https://access.redhat.com/errata/RHSA-2026:19031", "https://access.redhat.com/errata/RHSA-2026:19032", "https://access.redhat.com/errata/RHSA-2026:19049", "https://access.redhat.com/errata/RHSA-2026:19055", "https://access.redhat.com/errata/RHSA-2026:19126", "https://access.redhat.com/errata/RHSA-2026:19128", "https://access.redhat.com/errata/RHSA-2026:19132", "https://access.redhat.com/errata/RHSA-2026:19133", "https://access.redhat.com/errata/RHSA-2026:19135", "https://access.redhat.com/errata/RHSA-2026:19181", "https://access.redhat.com/errata/RHSA-2026:19184", "https://access.redhat.com/errata/RHSA-2026:19185", "https://access.redhat.com/errata/RHSA-2026:19207", "https://access.redhat.com/errata/RHSA-2026:19350", "https://access.redhat.com/errata/RHSA-2026:19353", "https://access.redhat.com/errata/RHSA-2026:19375", "https://access.redhat.com/errata/RHSA-2026:19475", "https://access.redhat.com/errata/RHSA-2026:19634", "https://access.redhat.com/errata/RHSA-2026:19719", "https://access.redhat.com/errata/RHSA-2026:19720", "https://access.redhat.com/errata/RHSA-2026:19721", "https://access.redhat.com/errata/RHSA-2026:19750", "https://access.redhat.com/errata/RHSA-2026:20041", "https://access.redhat.com/errata/RHSA-2026:20088", "https://access.redhat.com/errata/RHSA-2026:20581", "https://access.redhat.com/errata/RHSA-2026:20582", "https://access.redhat.com/errata/RHSA-2026:20584", "https://access.redhat.com/errata/RHSA-2026:20889", "https://access.redhat.com/errata/RHSA-2026:21017", "https://access.redhat.com/errata/RHSA-2026:21655", "https://access.redhat.com/errata/RHSA-2026:21657", "https://access.redhat.com/errata/RHSA-2026:21691", "https://access.redhat.com/errata/RHSA-2026:21696", "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:22423", "https://access.redhat.com/errata/RHSA-2026:22450", "https://access.redhat.com/errata/RHSA-2026:22627", "https://access.redhat.com/errata/RHSA-2026:22714", "https://access.redhat.com/errata/RHSA-2026:22733", "https://access.redhat.com/errata/RHSA-2026:22862", "https://access.redhat.com/errata/RHSA-2026:22937", "https://access.redhat.com/errata/RHSA-2026:23228", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/errata/RHSA-2026:24386", "https://access.redhat.com/errata/RHSA-2026:24853", "https://access.redhat.com/errata/RHSA-2026:25043", "https://access.redhat.com/errata/RHSA-2026:25127", "https://access.redhat.com/errata/RHSA-2026:25180", "https://access.redhat.com/errata/RHSA-2026:25248", "https://access.redhat.com/errata/RHSA-2026:25250", "https://access.redhat.com/errata/RHSA-2026:25251", "https://access.redhat.com/errata/RHSA-2026:25252", "https://access.redhat.com/errata/RHSA-2026:25253", "https://access.redhat.com/errata/RHSA-2026:26445", "https://access.redhat.com/errata/RHSA-2026:26527", "https://access.redhat.com/errata/RHSA-2026:26541", "https://access.redhat.com/errata/RHSA-2026:26568", "https://access.redhat.com/errata/RHSA-2026:26585", "https://access.redhat.com/errata/RHSA-2026:26636", "https://access.redhat.com/errata/RHSA-2026:27076", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:28441", "https://access.redhat.com/errata/RHSA-2026:28886", "https://access.redhat.com/errata/RHSA-2026:28893", "https://access.redhat.com/errata/RHSA-2026:28961", "https://access.redhat.com/errata/RHSA-2026:29035", "https://access.redhat.com/errata/RHSA-2026:29195", "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:29702", "https://access.redhat.com/errata/RHSA-2026:29703", "https://access.redhat.com/errata/RHSA-2026:29854", "https://access.redhat.com/errata/RHSA-2026:33722", "https://access.redhat.com/errata/RHSA-2026:34097", "https://access.redhat.com/errata/RHSA-2026:34365", "https://access.redhat.com/errata/RHSA-2026:36317", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:48036", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:5110", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:52389", "https://access.redhat.com/errata/RHSA-2026:52390", "https://access.redhat.com/errata/RHSA-2026:52391", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:5549", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:5941", "https://access.redhat.com/errata/RHSA-2026:5942", "https://access.redhat.com/errata/RHSA-2026:5943", "https://access.redhat.com/errata/RHSA-2026:5944", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:6341", "https://access.redhat.com/errata/RHSA-2026:6344", "https://access.redhat.com/errata/RHSA-2026:6382", "https://access.redhat.com/errata/RHSA-2026:6383", "https://access.redhat.com/errata/RHSA-2026:6388", "https://access.redhat.com/errata/RHSA-2026:6564", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:66401", "https://access.redhat.com/errata/RHSA-2026:6720", "https://access.redhat.com/errata/RHSA-2026:6802", "https://access.redhat.com/errata/RHSA-2026:6949", "https://access.redhat.com/errata/RHSA-2026:7005", "https://access.redhat.com/errata/RHSA-2026:7009", "https://access.redhat.com/errata/RHSA-2026:7011", "https://access.redhat.com/errata/RHSA-2026:7259", "https://access.redhat.com/errata/RHSA-2026:7291", "https://access.redhat.com/errata/RHSA-2026:7315", "https://access.redhat.com/errata/RHSA-2026:7328", "https://access.redhat.com/errata/RHSA-2026:7385", "https://access.redhat.com/errata/RHSA-2026:7665", "https://access.redhat.com/errata/RHSA-2026:7669", "https://access.redhat.com/errata/RHSA-2026:7674", "https://access.redhat.com/errata/RHSA-2026:7833", "https://access.redhat.com/errata/RHSA-2026:7834", "https://access.redhat.com/errata/RHSA-2026:7876", "https://access.redhat.com/errata/RHSA-2026:7877", "https://access.redhat.com/errata/RHSA-2026:7878", "https://access.redhat.com/errata/RHSA-2026:7879", "https://access.redhat.com/errata/RHSA-2026:7883", "https://access.redhat.com/errata/RHSA-2026:7992", "https://access.redhat.com/errata/RHSA-2026:8151", "https://access.redhat.com/errata/RHSA-2026:8167", "https://access.redhat.com/errata/RHSA-2026:8314", "https://access.redhat.com/errata/RHSA-2026:8322", "https://access.redhat.com/errata/RHSA-2026:8324", "https://access.redhat.com/errata/RHSA-2026:8337", "https://access.redhat.com/errata/RHSA-2026:8338", "https://access.redhat.com/errata/RHSA-2026:8433", "https://access.redhat.com/errata/RHSA-2026:8434", "https://access.redhat.com/errata/RHSA-2026:8456", "https://access.redhat.com/errata/RHSA-2026:8483", "https://access.redhat.com/errata/RHSA-2026:8484", "https://access.redhat.com/errata/RHSA-2026:8490", "https://access.redhat.com/errata/RHSA-2026:8491", "https://access.redhat.com/errata/RHSA-2026:8493", "https://access.redhat.com/errata/RHSA-2026:8840", "https://access.redhat.com/errata/RHSA-2026:8841", "https://access.redhat.com/errata/RHSA-2026:8842", "https://access.redhat.com/errata/RHSA-2026:8845", "https://access.redhat.com/errata/RHSA-2026:8847", "https://access.redhat.com/errata/RHSA-2026:8848", "https://access.redhat.com/errata/RHSA-2026:8849", "https://access.redhat.com/errata/RHSA-2026:8851", "https://access.redhat.com/errata/RHSA-2026:8852", "https://access.redhat.com/errata/RHSA-2026:8853", "https://access.redhat.com/errata/RHSA-2026:8855", "https://access.redhat.com/errata/RHSA-2026:8856", "https://access.redhat.com/errata/RHSA-2026:8860", "https://access.redhat.com/errata/RHSA-2026:8877", "https://access.redhat.com/errata/RHSA-2026:8878", "https://access.redhat.com/errata/RHSA-2026:8879", "https://access.redhat.com/errata/RHSA-2026:8881", "https://access.redhat.com/errata/RHSA-2026:8882", "https://access.redhat.com/errata/RHSA-2026:8930", "https://access.redhat.com/errata/RHSA-2026:8931", "https://access.redhat.com/errata/RHSA-2026:8949", "https://access.redhat.com/errata/RHSA-2026:9043", "https://access.redhat.com/errata/RHSA-2026:9044", "https://access.redhat.com/errata/RHSA-2026:9052", "https://access.redhat.com/errata/RHSA-2026:9090", "https://access.redhat.com/errata/RHSA-2026:9093", "https://access.redhat.com/errata/RHSA-2026:9094", "https://access.redhat.com/errata/RHSA-2026:9097", "https://access.redhat.com/errata/RHSA-2026:9098", "https://access.redhat.com/errata/RHSA-2026:9108", "https://access.redhat.com/errata/RHSA-2026:9109", "https://access.redhat.com/errata/RHSA-2026:9385", "https://access.redhat.com/errata/RHSA-2026:9434", "https://access.redhat.com/errata/RHSA-2026:9435", "https://access.redhat.com/errata/RHSA-2026:9436", "https://access.redhat.com/errata/RHSA-2026:9439", "https://access.redhat.com/errata/RHSA-2026:9440", "https://access.redhat.com/errata/RHSA-2026:9448", "https://access.redhat.com/errata/RHSA-2026:9453", "https://access.redhat.com/errata/RHSA-2026:9461", "https://access.redhat.com/errata/RHSA-2026:9695", "https://access.redhat.com/errata/RHSA-2026:9742", "https://access.redhat.com/errata/RHSA-2026:9872", "https://access.redhat.com/security/cve/CVE-2026-25679", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://errata.almalinux.org/9/ALSA-2026-9044.html", "https://errata.rockylinux.org/RLSA-2026:9044", "https://go.dev/cl/752180", "https://go.dev/issue/77578", "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk", "https://linux.oracle.com/cve/CVE-2026-25679.html", "https://linux.oracle.com/errata/ELSA-2026-9044.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-25679", "https://pkg.go.dev/vuln/GO-2026-4601", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25679.json", "https://www.cve.org/CVERecord?id=CVE-2026-25679" ], "PublishedDate": "2026-03-06T22:16:00.72Z", "LastModifiedDate": "2026-09-18T13:17:30.067Z" }, { "VulnerabilityID": "CVE-2026-27145", "VendorIDs": [ "GO-2026-5037" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.25.11, 1.26.4", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27145", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:3790efe7d7176cd1a2ea219265e7895fec274b46ca09c1874b575278c1d4b535", "Title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries", "Description": "(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.", "Severity": "HIGH", "CweIDs": [ "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:29980", "https://access.redhat.com/errata/RHSA-2026:29981", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:35832", "https://access.redhat.com/errata/RHSA-2026:36317", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:38995", "https://access.redhat.com/errata/RHSA-2026:39005", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39879", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41930", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42080", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42946", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:46394", "https://access.redhat.com/errata/RHSA-2026:46395", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49703", "https://access.redhat.com/errata/RHSA-2026:49705", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:49729", "https://access.redhat.com/errata/RHSA-2026:49744", "https://access.redhat.com/errata/RHSA-2026:49765", "https://access.redhat.com/errata/RHSA-2026:49770", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:51057", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:52946", "https://access.redhat.com/errata/RHSA-2026:53374", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53416", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54168", "https://access.redhat.com/errata/RHSA-2026:54401", "https://access.redhat.com/errata/RHSA-2026:54427", "https://access.redhat.com/errata/RHSA-2026:54432", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54500", "https://access.redhat.com/errata/RHSA-2026:54525", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:55899", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:59556", "https://access.redhat.com/errata/RHSA-2026:59557", "https://access.redhat.com/errata/RHSA-2026:59558", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:59579", "https://access.redhat.com/errata/RHSA-2026:59593", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60315", "https://access.redhat.com/errata/RHSA-2026:60354", "https://access.redhat.com/errata/RHSA-2026:60386", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60388", "https://access.redhat.com/errata/RHSA-2026:60390", "https://access.redhat.com/errata/RHSA-2026:60391", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:63016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68335", "https://access.redhat.com/security/cve/CVE-2026-27145", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/2484207", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2484207", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27145", "https://errata.almalinux.org/9/ALSA-2026-36317.html", "https://errata.rockylinux.org/RLSA-2026:36317", "https://go.dev/cl/783621", "https://go.dev/issue/79694", "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw", "https://linux.oracle.com/cve/CVE-2026-27145.html", "https://linux.oracle.com/errata/ELSA-2026-53416.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-27145", "https://pkg.go.dev/vuln/GO-2026-5037", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27145.json", "https://www.cve.org/CVERecord?id=CVE-2026-27145" ], "PublishedDate": "2026-06-02T23:16:35.57Z", "LastModifiedDate": "2026-09-18T13:17:43.283Z" }, { "VulnerabilityID": "CVE-2026-32280", "VendorIDs": [ "GO-2026-4947" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.25.9, 1.26.2", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32280", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:fc1cd07bbee8663b309673590ef464b2a1c5631e8e61bbadf3cf004526331782", "Title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building", "Description": "During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10217", "https://access.redhat.com/errata/RHSA-2026:10219", "https://access.redhat.com/errata/RHSA-2026:10704", "https://access.redhat.com/errata/RHSA-2026:11507", "https://access.redhat.com/errata/RHSA-2026:11514", "https://access.redhat.com/errata/RHSA-2026:11688", "https://access.redhat.com/errata/RHSA-2026:13545", "https://access.redhat.com/errata/RHSA-2026:13791", "https://access.redhat.com/errata/RHSA-2026:13826", "https://access.redhat.com/errata/RHSA-2026:13829", "https://access.redhat.com/errata/RHSA-2026:14020", "https://access.redhat.com/errata/RHSA-2026:14162", "https://access.redhat.com/errata/RHSA-2026:14200", "https://access.redhat.com/errata/RHSA-2026:14391", "https://access.redhat.com/errata/RHSA-2026:15980", "https://access.redhat.com/errata/RHSA-2026:16021", "https://access.redhat.com/errata/RHSA-2026:16024", "https://access.redhat.com/errata/RHSA-2026:16101", "https://access.redhat.com/errata/RHSA-2026:16476", "https://access.redhat.com/errata/RHSA-2026:16477", "https://access.redhat.com/errata/RHSA-2026:16505", "https://access.redhat.com/errata/RHSA-2026:16508", "https://access.redhat.com/errata/RHSA-2026:16532", "https://access.redhat.com/errata/RHSA-2026:16534", "https://access.redhat.com/errata/RHSA-2026:16535", "https://access.redhat.com/errata/RHSA-2026:16537", "https://access.redhat.com/errata/RHSA-2026:16542", "https://access.redhat.com/errata/RHSA-2026:16874", "https://access.redhat.com/errata/RHSA-2026:16875", "https://access.redhat.com/errata/RHSA-2026:17084", "https://access.redhat.com/errata/RHSA-2026:17287", "https://access.redhat.com/errata/RHSA-2026:18027", "https://access.redhat.com/errata/RHSA-2026:18032", "https://access.redhat.com/errata/RHSA-2026:19133", "https://access.redhat.com/errata/RHSA-2026:19135", "https://access.redhat.com/errata/RHSA-2026:19144", "https://access.redhat.com/errata/RHSA-2026:19350", "https://access.redhat.com/errata/RHSA-2026:19353", "https://access.redhat.com/errata/RHSA-2026:19375", "https://access.redhat.com/errata/RHSA-2026:19450", "https://access.redhat.com/errata/RHSA-2026:19550", "https://access.redhat.com/errata/RHSA-2026:19634", "https://access.redhat.com/errata/RHSA-2026:19714", "https://access.redhat.com/errata/RHSA-2026:19715", "https://access.redhat.com/errata/RHSA-2026:19719", "https://access.redhat.com/errata/RHSA-2026:19720", "https://access.redhat.com/errata/RHSA-2026:19721", "https://access.redhat.com/errata/RHSA-2026:19722", "https://access.redhat.com/errata/RHSA-2026:19750", "https://access.redhat.com/errata/RHSA-2026:19839", "https://access.redhat.com/errata/RHSA-2026:20556", "https://access.redhat.com/errata/RHSA-2026:20569", "https://access.redhat.com/errata/RHSA-2026:20570", "https://access.redhat.com/errata/RHSA-2026:20571", "https://access.redhat.com/errata/RHSA-2026:20607", "https://access.redhat.com/errata/RHSA-2026:20608", "https://access.redhat.com/errata/RHSA-2026:20609", "https://access.redhat.com/errata/RHSA-2026:20889", "https://access.redhat.com/errata/RHSA-2026:21017", "https://access.redhat.com/errata/RHSA-2026:21338", "https://access.redhat.com/errata/RHSA-2026:21655", "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:21772", "https://access.redhat.com/errata/RHSA-2026:22130", "https://access.redhat.com/errata/RHSA-2026:22141", "https://access.redhat.com/errata/RHSA-2026:22258", "https://access.redhat.com/errata/RHSA-2026:22260", "https://access.redhat.com/errata/RHSA-2026:22268", "https://access.redhat.com/errata/RHSA-2026:22309", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:22415", "https://access.redhat.com/errata/RHSA-2026:22422", "https://access.redhat.com/errata/RHSA-2026:22465", "https://access.redhat.com/errata/RHSA-2026:22485", "https://access.redhat.com/errata/RHSA-2026:22709", "https://access.redhat.com/errata/RHSA-2026:22713", "https://access.redhat.com/errata/RHSA-2026:22840", "https://access.redhat.com/errata/RHSA-2026:22862", "https://access.redhat.com/errata/RHSA-2026:22958", "https://access.redhat.com/errata/RHSA-2026:22959", "https://access.redhat.com/errata/RHSA-2026:22960", "https://access.redhat.com/errata/RHSA-2026:22961", "https://access.redhat.com/errata/RHSA-2026:22962", "https://access.redhat.com/errata/RHSA-2026:23102", "https://access.redhat.com/errata/RHSA-2026:23103", "https://access.redhat.com/errata/RHSA-2026:23244", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/errata/RHSA-2026:23361", "https://access.redhat.com/errata/RHSA-2026:24337", "https://access.redhat.com/errata/RHSA-2026:24359", "https://access.redhat.com/errata/RHSA-2026:24470", "https://access.redhat.com/errata/RHSA-2026:24478", "https://access.redhat.com/errata/RHSA-2026:24716", "https://access.redhat.com/errata/RHSA-2026:24761", "https://access.redhat.com/errata/RHSA-2026:24762", "https://access.redhat.com/errata/RHSA-2026:24853", "https://access.redhat.com/errata/RHSA-2026:24977", "https://access.redhat.com/errata/RHSA-2026:25089", "https://access.redhat.com/errata/RHSA-2026:25127", "https://access.redhat.com/errata/RHSA-2026:25180", "https://access.redhat.com/errata/RHSA-2026:25248", "https://access.redhat.com/errata/RHSA-2026:25250", "https://access.redhat.com/errata/RHSA-2026:25251", "https://access.redhat.com/errata/RHSA-2026:25252", "https://access.redhat.com/errata/RHSA-2026:25253", "https://access.redhat.com/errata/RHSA-2026:26447", "https://access.redhat.com/errata/RHSA-2026:26568", "https://access.redhat.com/errata/RHSA-2026:26571", "https://access.redhat.com/errata/RHSA-2026:26585", "https://access.redhat.com/errata/RHSA-2026:26636", "https://access.redhat.com/errata/RHSA-2026:27076", "https://access.redhat.com/errata/RHSA-2026:28038", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:28074", "https://access.redhat.com/errata/RHSA-2026:28196", "https://access.redhat.com/errata/RHSA-2026:28198", "https://access.redhat.com/errata/RHSA-2026:28441", "https://access.redhat.com/errata/RHSA-2026:28886", "https://access.redhat.com/errata/RHSA-2026:28961", "https://access.redhat.com/errata/RHSA-2026:29035", "https://access.redhat.com/errata/RHSA-2026:29195", "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:29702", "https://access.redhat.com/errata/RHSA-2026:29703", "https://access.redhat.com/errata/RHSA-2026:29854", "https://access.redhat.com/errata/RHSA-2026:33722", "https://access.redhat.com/errata/RHSA-2026:34097", "https://access.redhat.com/errata/RHSA-2026:34192", "https://access.redhat.com/errata/RHSA-2026:34196", "https://access.redhat.com/errata/RHSA-2026:34197", "https://access.redhat.com/errata/RHSA-2026:34365", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:39894", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:47712", "https://access.redhat.com/errata/RHSA-2026:47714", "https://access.redhat.com/errata/RHSA-2026:47716", "https://access.redhat.com/errata/RHSA-2026:47719", "https://access.redhat.com/errata/RHSA-2026:47721", "https://access.redhat.com/errata/RHSA-2026:47722", "https://access.redhat.com/errata/RHSA-2026:47910", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:48036", "https://access.redhat.com/errata/RHSA-2026:48790", "https://access.redhat.com/errata/RHSA-2026:49509", "https://access.redhat.com/errata/RHSA-2026:49526", "https://access.redhat.com/errata/RHSA-2026:49600", "https://access.redhat.com/errata/RHSA-2026:49838", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56855", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:56913", "https://access.redhat.com/errata/RHSA-2026:57409", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:59834", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61685", "https://access.redhat.com/errata/RHSA-2026:61906", "https://access.redhat.com/errata/RHSA-2026:61907", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66401", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:9385", "https://access.redhat.com/security/cve/CVE-2026-32280", "https://bugzilla.redhat.com/2456333", "https://bugzilla.redhat.com/2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-49838.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/758320", "https://go.dev/issue/78282", "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "https://linux.oracle.com/cve/CVE-2026-32280.html", "https://linux.oracle.com/errata/ELSA-2026-65886-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-32280", "https://pkg.go.dev/vuln/GO-2026-4947", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32280.json", "https://www.cve.org/CVERecord?id=CVE-2026-32280" ], "PublishedDate": "2026-04-08T02:16:03.247Z", "LastModifiedDate": "2026-09-18T13:17:45.92Z" }, { "VulnerabilityID": "CVE-2026-32281", "VendorIDs": [ "GO-2026-4946" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.25.9, 1.26.2", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32281", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:3bb07b7ef76a07e995c9d4243f32da79aab5f9b55c30c7ef1c7d18290baedd4a", "Title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation", "Description": "Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:49838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/security/cve/CVE-2026-32281", "https://bugzilla.redhat.com/2456333", "https://bugzilla.redhat.com/2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-49838.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/758061", "https://go.dev/issue/78281", "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "https://linux.oracle.com/cve/CVE-2026-32281.html", "https://linux.oracle.com/errata/ELSA-2026-67148-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-32281", "https://pkg.go.dev/vuln/GO-2026-4946", "https://www.cve.org/CVERecord?id=CVE-2026-32281" ], "PublishedDate": "2026-04-08T02:16:03.35Z", "LastModifiedDate": "2026-07-25T10:10:00.167Z" }, { "VulnerabilityID": "CVE-2026-32283", "VendorIDs": [ "GO-2026-4870" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.25.9, 1.26.2", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32283", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:72e6c3c2ad0e629da61fae39f5fea35d7d523045fec243a7deecc0b0ece4bae1", "Title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages", "Description": "If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.", "Severity": "HIGH", "CweIDs": [ "CWE-770", "CWE-764" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10217", "https://access.redhat.com/errata/RHSA-2026:10219", "https://access.redhat.com/errata/RHSA-2026:10704", "https://access.redhat.com/errata/RHSA-2026:11507", "https://access.redhat.com/errata/RHSA-2026:11514", "https://access.redhat.com/errata/RHSA-2026:11704", "https://access.redhat.com/errata/RHSA-2026:11711", "https://access.redhat.com/errata/RHSA-2026:11712", "https://access.redhat.com/errata/RHSA-2026:11863", "https://access.redhat.com/errata/RHSA-2026:11881", "https://access.redhat.com/errata/RHSA-2026:14162", "https://access.redhat.com/errata/RHSA-2026:14200", "https://access.redhat.com/errata/RHSA-2026:14391", "https://access.redhat.com/errata/RHSA-2026:15980", "https://access.redhat.com/errata/RHSA-2026:16021", "https://access.redhat.com/errata/RHSA-2026:16024", "https://access.redhat.com/errata/RHSA-2026:16101", "https://access.redhat.com/errata/RHSA-2026:16102", "https://access.redhat.com/errata/RHSA-2026:16875", "https://access.redhat.com/errata/RHSA-2026:17075", "https://access.redhat.com/errata/RHSA-2026:17084", "https://access.redhat.com/errata/RHSA-2026:17287", "https://access.redhat.com/errata/RHSA-2026:18027", "https://access.redhat.com/errata/RHSA-2026:18032", "https://access.redhat.com/errata/RHSA-2026:19126", "https://access.redhat.com/errata/RHSA-2026:19132", "https://access.redhat.com/errata/RHSA-2026:19133", "https://access.redhat.com/errata/RHSA-2026:19134", "https://access.redhat.com/errata/RHSA-2026:19135", "https://access.redhat.com/errata/RHSA-2026:19136", "https://access.redhat.com/errata/RHSA-2026:19137", "https://access.redhat.com/errata/RHSA-2026:19139", "https://access.redhat.com/errata/RHSA-2026:19144", "https://access.redhat.com/errata/RHSA-2026:19156", "https://access.redhat.com/errata/RHSA-2026:19350", "https://access.redhat.com/errata/RHSA-2026:19351", "https://access.redhat.com/errata/RHSA-2026:19352", "https://access.redhat.com/errata/RHSA-2026:19353", "https://access.redhat.com/errata/RHSA-2026:19369", "https://access.redhat.com/errata/RHSA-2026:19450", "https://access.redhat.com/errata/RHSA-2026:19550", "https://access.redhat.com/errata/RHSA-2026:19634", "https://access.redhat.com/errata/RHSA-2026:19714", "https://access.redhat.com/errata/RHSA-2026:19715", "https://access.redhat.com/errata/RHSA-2026:19719", "https://access.redhat.com/errata/RHSA-2026:19720", "https://access.redhat.com/errata/RHSA-2026:19721", "https://access.redhat.com/errata/RHSA-2026:19722", "https://access.redhat.com/errata/RHSA-2026:19750", "https://access.redhat.com/errata/RHSA-2026:19839", "https://access.redhat.com/errata/RHSA-2026:20556", "https://access.redhat.com/errata/RHSA-2026:20569", "https://access.redhat.com/errata/RHSA-2026:20570", "https://access.redhat.com/errata/RHSA-2026:20571", "https://access.redhat.com/errata/RHSA-2026:20607", "https://access.redhat.com/errata/RHSA-2026:20608", "https://access.redhat.com/errata/RHSA-2026:20609", "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:22423", "https://access.redhat.com/errata/RHSA-2026:22450", "https://access.redhat.com/errata/RHSA-2026:22485", "https://access.redhat.com/errata/RHSA-2026:22709", "https://access.redhat.com/errata/RHSA-2026:22713", "https://access.redhat.com/errata/RHSA-2026:22714", "https://access.redhat.com/errata/RHSA-2026:22937", "https://access.redhat.com/errata/RHSA-2026:23102", "https://access.redhat.com/errata/RHSA-2026:23103", "https://access.redhat.com/errata/RHSA-2026:23228", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/errata/RHSA-2026:24337", "https://access.redhat.com/errata/RHSA-2026:24470", "https://access.redhat.com/errata/RHSA-2026:24761", "https://access.redhat.com/errata/RHSA-2026:24762", "https://access.redhat.com/errata/RHSA-2026:25248", "https://access.redhat.com/errata/RHSA-2026:25250", "https://access.redhat.com/errata/RHSA-2026:25251", "https://access.redhat.com/errata/RHSA-2026:25252", "https://access.redhat.com/errata/RHSA-2026:26447", "https://access.redhat.com/errata/RHSA-2026:26571", "https://access.redhat.com/errata/RHSA-2026:26636", "https://access.redhat.com/errata/RHSA-2026:27076", "https://access.redhat.com/errata/RHSA-2026:28038", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:28074", "https://access.redhat.com/errata/RHSA-2026:29035", "https://access.redhat.com/errata/RHSA-2026:29195", "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:29703", "https://access.redhat.com/errata/RHSA-2026:33722", "https://access.redhat.com/errata/RHSA-2026:34192", "https://access.redhat.com/errata/RHSA-2026:34196", "https://access.redhat.com/errata/RHSA-2026:34197", "https://access.redhat.com/errata/RHSA-2026:34365", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:47712", "https://access.redhat.com/errata/RHSA-2026:47714", "https://access.redhat.com/errata/RHSA-2026:47716", "https://access.redhat.com/errata/RHSA-2026:47719", "https://access.redhat.com/errata/RHSA-2026:47721", "https://access.redhat.com/errata/RHSA-2026:47722", "https://access.redhat.com/errata/RHSA-2026:47910", "https://access.redhat.com/errata/RHSA-2026:48036", "https://access.redhat.com/errata/RHSA-2026:48790", "https://access.redhat.com/errata/RHSA-2026:49509", "https://access.redhat.com/errata/RHSA-2026:49600", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:55898", "https://access.redhat.com/errata/RHSA-2026:55900", "https://access.redhat.com/errata/RHSA-2026:55901", "https://access.redhat.com/errata/RHSA-2026:55902", "https://access.redhat.com/errata/RHSA-2026:55903", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:57409", "https://access.redhat.com/errata/RHSA-2026:57801", "https://access.redhat.com/errata/RHSA-2026:57802", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65343", "https://access.redhat.com/errata/RHSA-2026:65514", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66084", "https://access.redhat.com/errata/RHSA-2026:66401", "https://access.redhat.com/errata/RHSA-2026:66523", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:7291", "https://access.redhat.com/errata/RHSA-2026:7385", "https://access.redhat.com/security/cve/CVE-2026-32283", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/2456333", "https://bugzilla.redhat.com/2456338", "https://bugzilla.redhat.com/2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456338", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283", "https://errata.almalinux.org/9/ALSA-2026-29703.html", "https://errata.rockylinux.org/RLSA-2026:29703", "https://go.dev/cl/763767", "https://go.dev/issue/78334", "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "https://linux.oracle.com/cve/CVE-2026-32283.html", "https://linux.oracle.com/errata/ELSA-2026-48790.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-32283", "https://pkg.go.dev/vuln/GO-2026-4870", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32283.json", "https://www.cve.org/CVERecord?id=CVE-2026-32283" ], "PublishedDate": "2026-04-08T02:16:03.58Z", "LastModifiedDate": "2026-09-18T13:17:48.437Z" }, { "VulnerabilityID": "CVE-2026-33811", "VendorIDs": [ "GO-2026-4981" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33811", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:79ffbfd528a2cc52870e4b443484de4e0efe69d53220ccfce956d9206fedf671", "Title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME", "Description": "When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.", "Severity": "HIGH", "CweIDs": [ "CWE-415", "CWE-1341" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:35832", "https://access.redhat.com/errata/RHSA-2026:35993", "https://access.redhat.com/errata/RHSA-2026:35994", "https://access.redhat.com/errata/RHSA-2026:35995", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36617", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36776", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:38504", "https://access.redhat.com/errata/RHSA-2026:39266", "https://access.redhat.com/errata/RHSA-2026:39272", "https://access.redhat.com/errata/RHSA-2026:39319", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40119", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42048", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:42946", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49703", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51057", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51341", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54168", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54500", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54556", "https://access.redhat.com/errata/RHSA-2026:54584", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56790", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56855", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:56913", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60302", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:61313", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:67149", "https://access.redhat.com/errata/RHSA-2026:67287", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/security/cve/CVE-2026-33811", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-39319.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/767860", "https://go.dev/issue/78803", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-33811.html", "https://linux.oracle.com/errata/ELSA-2026-65886-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33811", "https://pkg.go.dev/vuln/GO-2026-4981", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33811.json", "https://www.cve.org/CVERecord?id=CVE-2026-33811" ], "PublishedDate": "2026-05-07T20:16:42.77Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-33814", "VendorIDs": [ "GO-2026-4918" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33814", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:45c59e41cd54ce1b8cc3942117eaa20e2b4693888b3c9b3873c31ee51f455abb", "Title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame", "Description": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.", "Severity": "HIGH", "CweIDs": [ "CWE-835", "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57365", "https://access.redhat.com/errata/RHSA-2026:57367", "https://access.redhat.com/errata/RHSA-2026:57408", "https://access.redhat.com/errata/RHSA-2026:57545", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60441", "https://access.redhat.com/errata/RHSA-2026:60442", "https://access.redhat.com/errata/RHSA-2026:60446", "https://access.redhat.com/errata/RHSA-2026:60447", "https://access.redhat.com/errata/RHSA-2026:60454", "https://access.redhat.com/errata/RHSA-2026:60477", "https://access.redhat.com/errata/RHSA-2026:60478", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:60668", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62410", "https://access.redhat.com/errata/RHSA-2026:62550", "https://access.redhat.com/errata/RHSA-2026:62551", "https://access.redhat.com/errata/RHSA-2026:63046", "https://access.redhat.com/errata/RHSA-2026:63047", "https://access.redhat.com/errata/RHSA-2026:63048", "https://access.redhat.com/errata/RHSA-2026:63050", "https://access.redhat.com/errata/RHSA-2026:63091", "https://access.redhat.com/errata/RHSA-2026:63096", "https://access.redhat.com/errata/RHSA-2026:63097", "https://access.redhat.com/errata/RHSA-2026:63103", "https://access.redhat.com/errata/RHSA-2026:63104", "https://access.redhat.com/errata/RHSA-2026:63636", "https://access.redhat.com/errata/RHSA-2026:63637", "https://access.redhat.com/errata/RHSA-2026:63639", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/security/cve/CVE-2026-33814", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467810", "https://bugzilla.redhat.com/show_bug.cgi?id=2467811", "https://bugzilla.redhat.com/show_bug.cgi?id=2467813", "https://bugzilla.redhat.com/show_bug.cgi?id=2467815", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467823", "https://bugzilla.redhat.com/show_bug.cgi?id=2467825", "https://bugzilla.redhat.com/show_bug.cgi?id=2467826", "https://bugzilla.redhat.com/show_bug.cgi?id=2467827", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501", "https://errata.almalinux.org/9/ALSA-2026-22121.html", "https://errata.rockylinux.org/RLSA-2026:22121", "https://github.com/golang/go/issues/78476", "https://go-review.googlesource.com/c/go/+/761581", "https://go-review.googlesource.com/c/net/+/761640", "https://go.dev/cl/761581", "https://go.dev/cl/761640", "https://go.dev/issue/78476", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-33814.html", "https://linux.oracle.com/errata/ELSA-2026-22121.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33814", "https://pkg.go.dev/vuln/GO-2026-4918", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json", "https://ubuntu.com/security/notices/USN-8430-1", "https://ubuntu.com/security/notices/USN-8471-1", "https://ubuntu.com/security/notices/USN-8472-1", "https://ubuntu.com/security/notices/USN-8473-1", "https://www.cve.org/CVERecord?id=CVE-2026-33814" ], "PublishedDate": "2026-05-07T20:16:42.88Z", "LastModifiedDate": "2026-10-26T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-33818", "VendorIDs": [ "GO-2026-5972" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33818", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:f298130569fe50bafb19844c374c6d997904fba7a3c07dccd6e1f3457f63ba8e", "Title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal", "Description": "Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-33818", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://github.com/golang/go/issues/80405", "https://go.dev/cl/814980", "https://go.dev/issue/80405", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-33818.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33818", "https://pkg.go.dev/vuln/GO-2026-5972", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-33818" ], "PublishedDate": "2026-08-13T22:17:19.84Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-39820", "VendorIDs": [ "GO-2026-4986" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39820", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:036e71949c53e2461d450c0b9625f18d2afd43796b855e47d0a7654087d42540", "Title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs", "Description": "Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.", "Severity": "HIGH", "CweIDs": [ "CWE-770", "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36754", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54555", "https://access.redhat.com/errata/RHSA-2026:54583", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:54883", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57401", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57487", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:57914", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:62406", "https://access.redhat.com/errata/RHSA-2026:62407", "https://access.redhat.com/errata/RHSA-2026:62753", "https://access.redhat.com/errata/RHSA-2026:62754", "https://access.redhat.com/errata/RHSA-2026:62803", "https://access.redhat.com/errata/RHSA-2026:63022", "https://access.redhat.com/errata/RHSA-2026:65116", "https://access.redhat.com/errata/RHSA-2026:65117", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65335", "https://access.redhat.com/errata/RHSA-2026:65336", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:65895", "https://access.redhat.com/errata/RHSA-2026:66016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66327", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:67974", "https://access.redhat.com/errata/RHSA-2026:67975", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:68527", "https://access.redhat.com/security/cve/CVE-2026-39820", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/759940", "https://go.dev/issue/78566", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-39820.html", "https://linux.oracle.com/errata/ELSA-2026-65895-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39820", "https://pkg.go.dev/vuln/GO-2026-4986", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39820.json", "https://www.cve.org/CVERecord?id=CVE-2026-39820" ], "PublishedDate": "2026-05-07T20:16:43.187Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-39821", "VendorIDs": [ "GO-2026-5026" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39821", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:79e2013babdd68f5a3a3dec11a4865ee051c8a3b01ac9dfeacbb228c21af9528", "Title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing", "Description": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".", "Severity": "HIGH", "CweIDs": [ "CWE-1289" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:30650", "https://access.redhat.com/errata/RHSA-2026:30651", "https://access.redhat.com/errata/RHSA-2026:30853", "https://access.redhat.com/errata/RHSA-2026:30854", "https://access.redhat.com/errata/RHSA-2026:30855", "https://access.redhat.com/errata/RHSA-2026:33155", "https://access.redhat.com/errata/RHSA-2026:33160", "https://access.redhat.com/errata/RHSA-2026:33163", "https://access.redhat.com/errata/RHSA-2026:33173", "https://access.redhat.com/errata/RHSA-2026:33183", "https://access.redhat.com/errata/RHSA-2026:33524", "https://access.redhat.com/errata/RHSA-2026:33531", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:34789", "https://access.redhat.com/errata/RHSA-2026:35826", "https://access.redhat.com/errata/RHSA-2026:35827", "https://access.redhat.com/errata/RHSA-2026:35828", "https://access.redhat.com/errata/RHSA-2026:35829", "https://access.redhat.com/errata/RHSA-2026:35830", "https://access.redhat.com/errata/RHSA-2026:35831", "https://access.redhat.com/errata/RHSA-2026:35993", "https://access.redhat.com/errata/RHSA-2026:35994", "https://access.redhat.com/errata/RHSA-2026:36105", "https://access.redhat.com/errata/RHSA-2026:36167", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:36883", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:37435", "https://access.redhat.com/errata/RHSA-2026:37436", "https://access.redhat.com/errata/RHSA-2026:38995", "https://access.redhat.com/errata/RHSA-2026:39005", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39879", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:41930", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42048", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42080", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:44624", "https://access.redhat.com/errata/RHSA-2026:46395", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51341", "https://access.redhat.com/errata/RHSA-2026:52826", "https://access.redhat.com/errata/RHSA-2026:53374", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54395", "https://access.redhat.com/errata/RHSA-2026:54401", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54580", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56143", "https://access.redhat.com/errata/RHSA-2026:56223", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57541", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59546", "https://access.redhat.com/errata/RHSA-2026:59549", "https://access.redhat.com/errata/RHSA-2026:59562", "https://access.redhat.com/errata/RHSA-2026:60315", "https://access.redhat.com/errata/RHSA-2026:60354", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61245", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62549", "https://access.redhat.com/errata/RHSA-2026:63134", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65359", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65851", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/errata/RHSA-2026:66432", "https://access.redhat.com/errata/RHSA-2026:67149", "https://access.redhat.com/errata/RHSA-2026:67159", "https://access.redhat.com/errata/RHSA-2026:67160", "https://access.redhat.com/errata/RHSA-2026:67287", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/security/cve/CVE-2026-39821", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/767220", "https://go.dev/issue/78760", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "https://linux.oracle.com/cve/CVE-2026-39821.html", "https://linux.oracle.com/errata/ELSA-2026-66432-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39821", "https://pkg.go.dev/vuln/GO-2026-5026", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json", "https://ubuntu.com/security/notices/USN-8416-1", "https://ubuntu.com/security/notices/USN-8883-1", "https://ubuntu.com/security/notices/USN-8883-2", "https://ubuntu.com/security/notices/USN-8900-1", "https://ubuntu.com/security/notices/USN-8914-1", "https://www.cve.org/CVERecord?id=CVE-2026-39821" ], "PublishedDate": "2026-05-22T16:16:20.41Z", "LastModifiedDate": "2026-09-17T12:18:05.767Z" }, { "VulnerabilityID": "CVE-2026-39822", "VendorIDs": [ "GO-2026-4970" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.25.12, 1.26.5, 1.27.0-rc.2", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39822", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:62574578830f18d2515f5a807862b46f42e5ca51cb7c8a22e3e59f8746f2e563", "Title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal", "Description": "On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root.", "Severity": "HIGH", "CweIDs": [ "CWE-61" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:38878", "https://access.redhat.com/security/cve/CVE-2026-39822", "https://bugzilla.redhat.com/2498152", "https://bugzilla.redhat.com/show_bug.cgi?id=2498152", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39822", "https://errata.almalinux.org/9/ALSA-2026-38878.html", "https://errata.rockylinux.org/RLSA-2026:38878", "https://github.com/golang/go/issues/79005", "https://go.dev/cl/797880", "https://go.dev/issue/79005", "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc", "https://linux.oracle.com/cve/CVE-2026-39822.html", "https://linux.oracle.com/errata/ELSA-2026-38995.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39822", "https://pkg.go.dev/vuln/GO-2026-4970", "https://www.cve.org/CVERecord?id=CVE-2026-39822" ], "PublishedDate": "2026-07-08T17:17:21.31Z", "LastModifiedDate": "2026-10-25T17:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-39836", "VendorIDs": [ "GO-2026-4971" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39836", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:cb372e0248ca88a99256aee61c296213155bebf032865ff6ae130bb76df0194b", "Title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows", "Description": "The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/security/cve/CVE-2026-39836", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467810", "https://bugzilla.redhat.com/show_bug.cgi?id=2467811", "https://bugzilla.redhat.com/show_bug.cgi?id=2467813", "https://bugzilla.redhat.com/show_bug.cgi?id=2467815", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467823", "https://bugzilla.redhat.com/show_bug.cgi?id=2467825", "https://bugzilla.redhat.com/show_bug.cgi?id=2467826", "https://bugzilla.redhat.com/show_bug.cgi?id=2467827", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501", "https://errata.almalinux.org/9/ALSA-2026-22121.html", "https://errata.rockylinux.org/RLSA-2026:22121", "https://go.dev/cl/775320", "https://go.dev/issue/79006", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-39836.html", "https://linux.oracle.com/errata/ELSA-2026-22121.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39836", "https://pkg.go.dev/vuln/GO-2026-4971", "https://www.cve.org/CVERecord?id=CVE-2026-39836" ], "PublishedDate": "2026-05-07T20:16:43.593Z", "LastModifiedDate": "2026-10-26T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-42499", "VendorIDs": [ "GO-2026-4977" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42499", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:a366ed3ceefb530623b21754d383770d19f692af5721f76efe29d10ea701c432", "Title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing", "Description": "Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.", "Severity": "HIGH", "CweIDs": [ "CWE-1046" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:17713", "https://access.redhat.com/errata/RHSA-2026:17714", "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36754", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54555", "https://access.redhat.com/errata/RHSA-2026:54583", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57487", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:57914", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:62406", "https://access.redhat.com/errata/RHSA-2026:62407", "https://access.redhat.com/errata/RHSA-2026:62753", "https://access.redhat.com/errata/RHSA-2026:62754", "https://access.redhat.com/errata/RHSA-2026:62803", "https://access.redhat.com/errata/RHSA-2026:63022", "https://access.redhat.com/errata/RHSA-2026:63163", "https://access.redhat.com/errata/RHSA-2026:63332", "https://access.redhat.com/errata/RHSA-2026:63636", "https://access.redhat.com/errata/RHSA-2026:64818", "https://access.redhat.com/errata/RHSA-2026:65116", "https://access.redhat.com/errata/RHSA-2026:65117", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65335", "https://access.redhat.com/errata/RHSA-2026:65336", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:65895", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66327", "https://access.redhat.com/errata/RHSA-2026:67148", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:67974", "https://access.redhat.com/errata/RHSA-2026:67975", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:68527", "https://access.redhat.com/security/cve/CVE-2026-42499", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/771520", "https://go.dev/issue/78987", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-42499.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42499", "https://pkg.go.dev/vuln/GO-2026-4977", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42499.json", "https://www.cve.org/CVERecord?id=CVE-2026-42499" ], "PublishedDate": "2026-05-07T20:16:44.54Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-42504", "VendorIDs": [ "GO-2026-5038" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.25.11, 1.26.4", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42504", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:9577e73d0640ce91ca6ebec3f9ae9e949ede0eabf0ba124d408c3bf3185f04ff", "Title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header", "Description": "Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/security/cve/CVE-2026-42504", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/774481", "https://go.dev/issue/79217", "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw", "https://linux.oracle.com/cve/CVE-2026-42504.html", "https://linux.oracle.com/errata/ELSA-2026-69308.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42504", "https://pkg.go.dev/vuln/GO-2026-5038", "https://www.cve.org/CVERecord?id=CVE-2026-42504" ], "PublishedDate": "2026-06-02T23:16:37.927Z", "LastModifiedDate": "2026-07-22T19:10:00.12Z" }, { "VulnerabilityID": "CVE-2026-56853", "VendorIDs": [ "GO-2026-6089" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56853", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:a18cbd1a46586c05a1db703032d62c8665fe6b8478e27c5f121ef14a0f025981", "Title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service", "Description": "When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56853", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/795540", "https://go.dev/issue/80205", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56853.html", "https://linux.oracle.com/errata/ELSA-2026-89752.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56853", "https://pkg.go.dev/vuln/GO-2026-6089", "https://www.cve.org/CVERecord?id=CVE-2026-56853" ], "PublishedDate": "2026-08-13T22:17:22.093Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56858", "VendorIDs": [ "GO-2026-6091" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56858", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:051a5a934432a858d3ceb3990f92cec82ddff2f4dc7766915e1ab611a80611f3", "Title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input", "Description": "Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.", "Severity": "HIGH", "CweIDs": [ "CWE-79" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "V3Score": 6.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56858", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/807100", "https://go.dev/issue/80435", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56858.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56858", "https://pkg.go.dev/vuln/GO-2026-6091", "https://www.cve.org/CVERecord?id=CVE-2026-56858" ], "PublishedDate": "2026-08-13T22:17:22.207Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56859", "VendorIDs": [ "GO-2026-6088" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56859", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:d82854ed5b0db04813476881fff7f8193c45c85ee3266f4e0b3f2209fb8f26dc", "Title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue", "Description": "Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69961", "https://access.redhat.com/security/cve/CVE-2026-56859", "https://bugzilla.redhat.com/2480684", "https://bugzilla.redhat.com/2508234", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2480684", "https://bugzilla.redhat.com/show_bug.cgi?id=2508234", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2518147", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17106", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19730", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39830", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-69961.html", "https://errata.rockylinux.org/RLSA-2026:69961", "https://github.com/golang/go/issues/80481", "https://go.dev/cl/803320", "https://go.dev/issue/80481", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56859.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56859", "https://pkg.go.dev/vuln/GO-2026-6088", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-56859" ], "PublishedDate": "2026-08-13T22:17:22.32Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56860", "VendorIDs": [ "GO-2026-6218" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56860", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:4aecd036172a5494934c09d9e9f2ece190f1626e14afdd2eef25f6c862622395", "Title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution", "Description": "Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56860", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/803681", "https://go.dev/issue/80494", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56860.html", "https://linux.oracle.com/errata/ELSA-2026-71619.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56860", "https://pkg.go.dev/vuln/GO-2026-6218", "https://www.cve.org/CVERecord?id=CVE-2026-56860" ], "PublishedDate": "2026-08-13T22:17:22.44Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56862", "VendorIDs": [ "GO-2026-6090" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56862", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:5a2b11ea788e3fc12ff270f78e13dbf9fd818c11a5240e99ee2fb783f81096f2", "Title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages", "Description": "Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56862", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://github.com/golang/go/issues/80528", "https://go.dev/cl/804261", "https://go.dev/issue/80528", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56862.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56862", "https://pkg.go.dev/vuln/GO-2026-6090", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-56862" ], "PublishedDate": "2026-08-13T22:17:22.55Z", "LastModifiedDate": "2026-10-24T16:10:00.153Z" }, { "VulnerabilityID": "CVE-2026-78667", "VendorIDs": [ "GO-2026-6609" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78667", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:12e301e1e5d54348b3acb9e26c5bb438f8513a74cc1d5cbe2a5e46c5f4ef4b7f", "Title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers", "Description": "When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78667", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81858", "https://go.dev/cl/847309", "https://go.dev/issue/81858", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://linux.oracle.com/cve/CVE-2026-78667.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78667", "https://pkg.go.dev/vuln/GO-2026-6609", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78667", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:03.88Z", "LastModifiedDate": "2026-10-09T17:16:49.69Z" }, { "VulnerabilityID": "CVE-2026-78669", "VendorIDs": [ "GO-2026-6611" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78669", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:ec935cb65d68dcc1391a94e0ec166282d8178f5363863a0dd18a42b4d7ca3bf9", "Title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "Description": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78669", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81742", "https://go.dev/cl/847186", "https://go.dev/cl/847308", "https://go.dev/issue/81742", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs", "https://linux.oracle.com/cve/CVE-2026-78669.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78669", "https://pkg.go.dev/vuln/GO-2026-6611", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78669", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:04.01Z", "LastModifiedDate": "2026-10-09T17:16:49.857Z" }, { "VulnerabilityID": "CVE-2026-97031", "VendorIDs": [ "GO-2026-6607" ], "PkgID": "stdlib@v1.18.10", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.18.10", "UID": "abe17c52e09f5ed6" }, "InstalledVersion": "v1.18.10", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:9423f022686c20238e98700bee344feac57d847776a70da57947dc6d4dd8b4e5" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-97031", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:ff6216746098b58bcf9fcb6f70a73ff5b6cb0fa3a9373861e054612ac25a060d", "Title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references", "Description": "Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:95518", "https://access.redhat.com/security/cve/CVE-2026-97031", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-95518.html", "https://errata.rockylinux.org/RLSA-2026:95518", "https://go.dev/cl/847312", "https://go.dev/issue/81855", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://linux.oracle.com/cve/CVE-2026-97031.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-97031", "https://pkg.go.dev/vuln/GO-2026-6607", "https://www.cve.org/CVERecord?id=CVE-2026-97031" ], "PublishedDate": "2026-10-08T23:17:06.037Z", "LastModifiedDate": "2026-10-09T16:35:35.9Z" } ] } ] }