{ "SchemaVersion": 2, "Trivy": { "Version": "0.70.0" }, "ReportID": "01a1b919-99b1-741e-8317-fd0bc2700655", "CreatedAt": "2026-11-08T04:00:25.137271396+01:00", "ArtifactID": "sha256:4ce3dabf792e8cc63d89363c0a4b6765cff06abc3a64ae27505762a15e5e2fcb", "ArtifactName": "gcr.io/cadvisor/cadvisor:v0.49.1", "ArtifactType": "container_image", "Metadata": { "Size": 81285632, "OS": { "Family": "alpine", "Name": "3.18.6", "EOSL": true }, "ImageID": "sha256:c02cf39d3dba9fcf5531f23358e33377e50fcc6065d97a27e68a4242229c67a0", "DiffIDs": [ "sha256:aedc3bda2944bb9bcb6c3d475bee8b460db9a9b0f3e0b33a6ed2fd1ae0f1d445", "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff", "sha256:a5bc6098f199dde360ce970c5117c5793c5b283f8729b11fa47b4ac348c554a9", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef", "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" ], "RepoTags": [ "gcr.io/cadvisor/cadvisor:v0.49.1" ], "RepoDigests": [ "gcr.io/cadvisor/cadvisor@sha256:3cde6faf0791ebf7b41d6f8ae7145466fed712ea6f252c935294d2608b1af388" ], "Reference": "gcr.io/cadvisor/cadvisor:v0.49.1", "ImageConfig": { "architecture": "amd64", "author": "dengnan@google.com vmarmol@google.com vishnuk@google.com jimmidyson@gmail.com stclair@google.com", "created": "2024-03-02T20:59:01.440808486Z", "history": [ { "created": "2024-01-27T00:30:56Z", "created_by": "/bin/sh -c #(nop) ADD file:8729f9c0258836b640e9e789c7ab029cf4547e0596557d54dd4a4d7d8e4a785f in / " }, { "created": "2024-01-27T00:30:56Z", "created_by": "/bin/sh -c #(nop) CMD [\"/bin/sh\"]", "empty_layer": true }, { "created": "2024-03-02T20:58:06Z", "created_by": "MAINTAINER dengnan@google.com vmarmol@google.com vishnuk@google.com jimmidyson@gmail.com stclair@google.com", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2024-03-02T20:58:06Z", "created_by": "RUN /bin/sh -c apk --no-cache add libc6-compat device-mapper findutils ndctl zfs \u0026\u0026 apk --no-cache add thin-provisioning-tools --repository http://dl-3.alpinelinux.org/alpine/edge/main/ \u0026\u0026 echo 'hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4' \u003e\u003e /etc/nsswitch.conf \u0026\u0026 rm -rf /var/cache/apk/* # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2024-03-02T20:59:01Z", "created_by": "COPY /usr/local/lib/libpfm.so* /usr/local/lib/ # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2024-03-02T20:59:01Z", "created_by": "COPY /usr/local/lib/libipmctl.so* /usr/local/lib/ # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2024-03-02T20:59:01Z", "created_by": "COPY /go/src/github.com/google/cadvisor/_output/cadvisor /usr/bin/cadvisor # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2024-03-02T20:59:01Z", "created_by": "EXPOSE map[8080/tcp:{}]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2024-03-02T20:59:01Z", "created_by": "ENV CADVISOR_HEALTHCHECK_URL=http://localhost:8080/healthz", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2024-03-02T20:59:01Z", "created_by": "HEALTHCHECK \u0026{[\"CMD-SHELL\" \"wget --quiet --tries=1 --spider $CADVISOR_HEALTHCHECK_URL || exit 1\"] \"30s\" \"3s\" \"0s\" \"0s\" '\\x00'}", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2024-03-02T20:59:01Z", "created_by": "ENTRYPOINT [\"/usr/bin/cadvisor\" \"-logtostderr\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true } ], "os": "linux", "rootfs": { "type": "layers", "diff_ids": [ "sha256:aedc3bda2944bb9bcb6c3d475bee8b460db9a9b0f3e0b33a6ed2fd1ae0f1d445", "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff", "sha256:a5bc6098f199dde360ce970c5117c5793c5b283f8729b11fa47b4ac348c554a9", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef", "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" ] }, "config": { "Healthcheck": { "Test": [ "CMD-SHELL", "wget --quiet --tries=1 --spider $CADVISOR_HEALTHCHECK_URL || exit 1" ], "Interval": 30000000000, "Timeout": 3000000000 }, "Entrypoint": [ "/usr/bin/cadvisor", "-logtostderr" ], "Env": [ "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "CADVISOR_HEALTHCHECK_URL=http://localhost:8080/healthz" ], "ExposedPorts": { "8080/tcp": {} } } }, "Layers": [ { "Size": 7629824, "DiffID": "sha256:aedc3bda2944bb9bcb6c3d475bee8b460db9a9b0f3e0b33a6ed2fd1ae0f1d445" }, { "Size": 15087104, "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, { "Size": 12175360, "DiffID": "sha256:a5bc6098f199dde360ce970c5117c5793c5b283f8729b11fa47b4ac348c554a9" }, { "Size": 1024, "DiffID": "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" }, { "Size": 46392320, "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" } ] }, "Results": [ { "Target": "gcr.io/cadvisor/cadvisor:v0.49.1 (alpine 3.18.6)", "Class": "os-pkgs", "Type": "alpine", "Packages": [ { "ID": "alpine-baselayout@3.4.3-r1", "Name": "alpine-baselayout", "Identifier": { "PURL": "pkg:apk/alpine/alpine-baselayout@3.4.3-r1?arch=x86_64\u0026distro=3.18.6", "UID": "cc76de6c61f8a455" }, "Version": "3.4.3-r1", "Arch": "x86_64", "SrcName": "alpine-baselayout", "SrcVersion": "3.4.3-r1", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "alpine-baselayout-data@3.4.3-r1", "busybox-binsh@1.36.1-r5" ], "Layer": { "DiffID": "sha256:aedc3bda2944bb9bcb6c3d475bee8b460db9a9b0f3e0b33a6ed2fd1ae0f1d445" }, "Digest": "sha1:cf0bca32762cd5be9974f4c127467b0f93f78f20", "InstalledFiles": [ "etc/motd", "etc/crontabs/root", "etc/modprobe.d/aliases.conf", "etc/modprobe.d/blacklist.conf", "etc/modprobe.d/i386.conf", "etc/modprobe.d/kms.conf", "etc/profile.d/20locale.sh", "etc/profile.d/README", "etc/profile.d/color_prompt.sh.disabled", "lib/sysctl.d/00-alpine.conf", "var/run", "var/spool/mail", "var/spool/cron/crontabs" ], "AnalyzedBy": "apk" }, { "ID": "alpine-baselayout-data@3.4.3-r1", "Name": "alpine-baselayout-data", "Identifier": { "PURL": "pkg:apk/alpine/alpine-baselayout-data@3.4.3-r1?arch=x86_64\u0026distro=3.18.6", "UID": "1e8895b73dc8ed99" }, "Version": "3.4.3-r1", "Arch": "x86_64", "SrcName": "alpine-baselayout", "SrcVersion": "3.4.3-r1", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:aedc3bda2944bb9bcb6c3d475bee8b460db9a9b0f3e0b33a6ed2fd1ae0f1d445" }, "Digest": "sha1:602007ee374ed96f35e9bf39b1487d67c6afe027", "InstalledFiles": [ "etc/fstab", "etc/group", "etc/hostname", "etc/hosts", "etc/inittab", "etc/modules", "etc/mtab", "etc/nsswitch.conf", "etc/passwd", "etc/profile", "etc/protocols", "etc/services", "etc/shadow", "etc/shells", "etc/sysctl.conf" ], "AnalyzedBy": "apk" }, { "ID": "alpine-keys@2.4-r1", "Name": "alpine-keys", "Identifier": { "PURL": "pkg:apk/alpine/alpine-keys@2.4-r1?arch=x86_64\u0026distro=3.18.6", "UID": "58cde6a7a797ed69" }, "Version": "2.4-r1", "Arch": "x86_64", "SrcName": "alpine-keys", "SrcVersion": "2.4-r1", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:aedc3bda2944bb9bcb6c3d475bee8b460db9a9b0f3e0b33a6ed2fd1ae0f1d445" }, "Digest": "sha1:ec3a3d5ef4c7a168d09516097bb3219ca77c1534", "InstalledFiles": [ "etc/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "etc/apk/keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", "etc/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", "etc/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", "etc/apk/keys/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", "usr/share/apk/keys/mips64/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub" ], "AnalyzedBy": "apk" }, { "ID": "apk-tools@2.14.0-r2", "Name": "apk-tools", "Identifier": { "PURL": "pkg:apk/alpine/apk-tools@2.14.0-r2?arch=x86_64\u0026distro=3.18.6", "UID": "b6df41e94e27a0ad" }, "Version": "2.14.0-r2", "Arch": "x86_64", "SrcName": "apk-tools", "SrcVersion": "2.14.0-r2", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "ca-certificates-bundle@20230506-r0", "libcrypto3@3.1.4-r5", "libssl3@3.1.4-r5", "musl@1.2.4-r2", "zlib@1.2.13-r1" ], "Layer": { "DiffID": "sha256:aedc3bda2944bb9bcb6c3d475bee8b460db9a9b0f3e0b33a6ed2fd1ae0f1d445" }, "Digest": "sha1:8cde25f239ebf691cd135a3954e5193c1ac2ae13", "InstalledFiles": [ "lib/libapk.so.2.14.0", "sbin/apk" ], "AnalyzedBy": "apk" }, { "ID": "busybox@1.36.1-r5", "Name": "busybox", "Identifier": { "PURL": "pkg:apk/alpine/busybox@1.36.1-r5?arch=x86_64\u0026distro=3.18.6", "UID": "2aa2fa99653e0bba" }, "Version": "1.36.1-r5", "Arch": "x86_64", "SrcName": "busybox", "SrcVersion": "1.36.1-r5", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", "DependsOn": [ "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:aedc3bda2944bb9bcb6c3d475bee8b460db9a9b0f3e0b33a6ed2fd1ae0f1d445" }, "Digest": "sha1:6815afd4a9f601238b4a151e0cfa122daa33b8cb", "InstalledFiles": [ "bin/busybox", "etc/securetty", "etc/udhcpd.conf", "etc/busybox-paths.d/busybox", "etc/logrotate.d/acpid", "etc/network/if-up.d/dad", "usr/share/udhcpc/default.script" ], "AnalyzedBy": "apk" }, { "ID": "busybox-binsh@1.36.1-r5", "Name": "busybox-binsh", "Identifier": { "PURL": "pkg:apk/alpine/busybox-binsh@1.36.1-r5?arch=x86_64\u0026distro=3.18.6", "UID": "a0671015e84b124" }, "Version": "1.36.1-r5", "Arch": "x86_64", "SrcName": "busybox", "SrcVersion": "1.36.1-r5", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", "DependsOn": [ "busybox@1.36.1-r5" ], "Layer": { "DiffID": "sha256:aedc3bda2944bb9bcb6c3d475bee8b460db9a9b0f3e0b33a6ed2fd1ae0f1d445" }, "Digest": "sha1:e5f0647021e1092cbe3fa4cf4a9b6eab22ab7f46", "InstalledFiles": [ "bin/sh" ], "AnalyzedBy": "apk" }, { "ID": "ca-certificates-bundle@20230506-r0", "Name": "ca-certificates-bundle", "Identifier": { "PURL": "pkg:apk/alpine/ca-certificates-bundle@20230506-r0?arch=x86_64\u0026distro=3.18.6", "UID": "3d9ea4a2b739554" }, "Version": "20230506-r0", "Arch": "x86_64", "SrcName": "ca-certificates", "SrcVersion": "20230506-r0", "Licenses": [ "MPL-2.0", "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:aedc3bda2944bb9bcb6c3d475bee8b460db9a9b0f3e0b33a6ed2fd1ae0f1d445" }, "Digest": "sha1:47f485d08670a9eb21ebf10e70ae65dc43ab6c3d", "InstalledFiles": [ "etc/ssl/cert.pem", "etc/ssl/certs/ca-certificates.crt", "etc/ssl1.1/cert.pem", "etc/ssl1.1/certs" ], "AnalyzedBy": "apk" }, { "ID": "device-mapper@2.03.21-r3", "Name": "device-mapper", "Identifier": { "PURL": "pkg:apk/alpine/device-mapper@2.03.21-r3?arch=x86_64\u0026distro=3.18.6", "UID": "15db9df99d01496e" }, "Version": "2.03.21-r3", "Arch": "x86_64", "SrcName": "lvm2", "SrcVersion": "2.03.21-r3", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.1-or-later", "BSD-2-Clause" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "device-mapper-libs@2.03.21-r3", "lvm2-libs@2.03.21-r3", "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:d9464a10fab558d8b0853dacda64518ab93cdabc", "InstalledFiles": [ "sbin/dmsetup", "sbin/dmstats" ], "AnalyzedBy": "apk" }, { "ID": "device-mapper-event-libs@2.03.21-r3", "Name": "device-mapper-event-libs", "Identifier": { "PURL": "pkg:apk/alpine/device-mapper-event-libs@2.03.21-r3?arch=x86_64\u0026distro=3.18.6", "UID": "80514d9fb0738359" }, "Version": "2.03.21-r3", "Arch": "x86_64", "SrcName": "lvm2", "SrcVersion": "2.03.21-r3", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.1-or-later", "BSD-2-Clause" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "device-mapper-libs@2.03.21-r3", "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:4516948e9bcda80346d2e95aa89803424d940734", "InstalledFiles": [ "lib/libdevmapper-event.so.1.02" ], "AnalyzedBy": "apk" }, { "ID": "device-mapper-libs@2.03.21-r3", "Name": "device-mapper-libs", "Identifier": { "PURL": "pkg:apk/alpine/device-mapper-libs@2.03.21-r3?arch=x86_64\u0026distro=3.18.6", "UID": "d1dd280e04dcadd3" }, "Version": "2.03.21-r3", "Arch": "x86_64", "SrcName": "lvm2", "SrcVersion": "2.03.21-r3", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.1-or-later", "BSD-2-Clause" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:60ee61fb81465b32893523bbfe011c9faa00062e", "InstalledFiles": [ "lib/libdevmapper.so.1.02" ], "AnalyzedBy": "apk" }, { "ID": "eudev-libs@3.2.11-r8", "Name": "eudev-libs", "Identifier": { "PURL": "pkg:apk/alpine/eudev-libs@3.2.11-r8?arch=x86_64\u0026distro=3.18.6", "UID": "66beb2f3ee9f583e" }, "Version": "3.2.11-r8", "Arch": "x86_64", "SrcName": "eudev", "SrcVersion": "3.2.11-r8", "Licenses": [ "GPL-2.0-or-later" ], "Maintainer": "Ariadne Conill \u003cariadne@dereferenced.org\u003e", "DependsOn": [ "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:a84ffdb524060aa8fa7b6f8e4c971c2fc73486ef", "InstalledFiles": [ "lib/libudev.so.1", "lib/libudev.so.1.6.3" ], "AnalyzedBy": "apk" }, { "ID": "findutils@4.9.0-r5", "Name": "findutils", "Identifier": { "PURL": "pkg:apk/alpine/findutils@4.9.0-r5?arch=x86_64\u0026distro=3.18.6", "UID": "536575d9b0b355a9" }, "Version": "4.9.0-r5", "Arch": "x86_64", "SrcName": "findutils", "SrcVersion": "4.9.0-r5", "Licenses": [ "GPL-3.0-or-later" ], "Maintainer": "Michael Mason \u003cms13sp@gmail.com\u003e", "DependsOn": [ "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:d71605ce59abc9ec62429f505e1acb43a0b71b1a", "InstalledFiles": [ "usr/bin/find", "usr/bin/xargs" ], "AnalyzedBy": "apk" }, { "ID": "iniparser@4.1-r3", "Name": "iniparser", "Identifier": { "PURL": "pkg:apk/alpine/iniparser@4.1-r3?arch=x86_64\u0026distro=3.18.6", "UID": "32fc699de0a9e8a4" }, "Version": "4.1-r3", "Arch": "x86_64", "SrcName": "iniparser", "SrcVersion": "4.1-r3", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:73dc825da9ab66e787ba52bee0a6d218c22d7a03", "InstalledFiles": [ "usr/lib/libiniparser.so.1" ], "AnalyzedBy": "apk" }, { "ID": "json-c@0.16-r3", "Name": "json-c", "Identifier": { "PURL": "pkg:apk/alpine/json-c@0.16-r3?arch=x86_64\u0026distro=3.18.6", "UID": "fb551bab6fdde79d" }, "Version": "0.16-r3", "Arch": "x86_64", "SrcName": "json-c", "SrcVersion": "0.16-r3", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:c9a0b9667de062c7a4c06ac5c32dbb98c44a135b", "InstalledFiles": [ "usr/lib/libjson-c.so.5", "usr/lib/libjson-c.so.5.2.0" ], "AnalyzedBy": "apk" }, { "ID": "keyutils-libs@1.6.3-r3", "Name": "keyutils-libs", "Identifier": { "PURL": "pkg:apk/alpine/keyutils-libs@1.6.3-r3?arch=x86_64\u0026distro=3.18.6", "UID": "32e64289f0a9ae61" }, "Version": "1.6.3-r3", "Arch": "x86_64", "SrcName": "keyutils", "SrcVersion": "1.6.3-r3", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:ebd11787a4f71ac7b1dc19af0bdd453c56d93c3f", "InstalledFiles": [ "usr/lib/libkeyutils.so.1", "usr/lib/libkeyutils.so.1.10" ], "AnalyzedBy": "apk" }, { "ID": "kmod@30-r3", "Name": "kmod", "Identifier": { "PURL": "pkg:apk/alpine/kmod@30-r3?arch=x86_64\u0026distro=3.18.6", "UID": "85ca4c5eb7480603" }, "Version": "30-r3", "Arch": "x86_64", "SrcName": "kmod", "SrcVersion": "30-r3", "Licenses": [ "GPL-2.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "busybox-binsh@1.36.1-r5", "libcrypto3@3.1.4-r5", "musl@1.2.4-r2", "xz-libs@5.4.3-r0", "zlib@1.2.13-r1", "zstd-libs@1.5.5-r4" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:b0338df85a778d60c3cf626a17735b3423b93b0d", "InstalledFiles": [ "bin/kmod", "bin/lsmod", "bin/modinfo", "sbin/depmod", "sbin/insmod", "sbin/lsmod", "sbin/modinfo", "sbin/modprobe", "sbin/rmmod" ], "AnalyzedBy": "apk" }, { "ID": "kmod-libs@30-r3", "Name": "kmod-libs", "Identifier": { "PURL": "pkg:apk/alpine/kmod-libs@30-r3?arch=x86_64\u0026distro=3.18.6", "UID": "eecc9b9f2ee42c7d" }, "Version": "30-r3", "Arch": "x86_64", "SrcName": "kmod", "SrcVersion": "30-r3", "Licenses": [ "LGPL-2.1-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libcrypto3@3.1.4-r5", "musl@1.2.4-r2", "xz-libs@5.4.3-r0", "zlib@1.2.13-r1", "zstd-libs@1.5.5-r4" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:b62ca12e5a2c84af5cc7a1a070a91542397c10b4", "InstalledFiles": [ "lib/libkmod.so.2", "lib/libkmod.so.2.4.0" ], "AnalyzedBy": "apk" }, { "ID": "krb5-conf@1.0-r2", "Name": "krb5-conf", "Identifier": { "PURL": "pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64\u0026distro=3.18.6", "UID": "12dabe13b712d514" }, "Version": "1.0-r2", "Arch": "x86_64", "SrcName": "krb5-conf", "SrcVersion": "1.0-r2", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:ab7661ee508ccdd60f9f24ee41c973b62bdaa363", "InstalledFiles": [ "etc/krb5.conf" ], "AnalyzedBy": "apk" }, { "ID": "krb5-libs@1.20.1-r1", "Name": "krb5-libs", "Identifier": { "PURL": "pkg:apk/alpine/krb5-libs@1.20.1-r1?arch=x86_64\u0026distro=3.18.6", "UID": "aab7b89b1d7ce6e" }, "Version": "1.20.1-r1", "Arch": "x86_64", "SrcName": "krb5", "SrcVersion": "1.20.1-r1", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "keyutils-libs@1.6.3-r3", "krb5-conf@1.0-r2", "libcom_err@1.47.0-r2", "libcrypto3@3.1.4-r5", "libssl3@3.1.4-r5", "libverto@0.3.2-r2", "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:b6dac0b473becbd4f20aded3bb87476ac01de3cd", "InstalledFiles": [ "usr/lib/libgssapi_krb5.so.2", "usr/lib/libgssapi_krb5.so.2.2", "usr/lib/libgssrpc.so.4", "usr/lib/libgssrpc.so.4.2", "usr/lib/libk5crypto.so.3", "usr/lib/libk5crypto.so.3.1", "usr/lib/libkadm5clnt_mit.so.12", "usr/lib/libkadm5clnt_mit.so.12.0", "usr/lib/libkadm5srv_mit.so.12", "usr/lib/libkadm5srv_mit.so.12.0", "usr/lib/libkdb5.so.10", "usr/lib/libkdb5.so.10.0", "usr/lib/libkrad.so.0", "usr/lib/libkrad.so.0.0", "usr/lib/libkrb5.so.3", "usr/lib/libkrb5.so.3.3", "usr/lib/libkrb5support.so.0", "usr/lib/libkrb5support.so.0.1", "usr/lib/krb5/plugins/kdb/db2.so", "usr/lib/krb5/plugins/preauth/otp.so", "usr/lib/krb5/plugins/preauth/spake.so", "usr/lib/krb5/plugins/preauth/test.so", "usr/lib/krb5/plugins/tls/k5tls.so" ], "AnalyzedBy": "apk" }, { "ID": "libaio@0.3.113-r1", "Name": "libaio", "Identifier": { "PURL": "pkg:apk/alpine/libaio@0.3.113-r1?arch=x86_64\u0026distro=3.18.6", "UID": "1f3e07458c82d6ac" }, "Version": "0.3.113-r1", "Arch": "x86_64", "SrcName": "libaio", "SrcVersion": "0.3.113-r1", "Licenses": [ "LGPL-2.1-or-later" ], "Maintainer": "Leonardo Arena \u003crnalrd@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:1209f9c01d79a3e3db4c4697751c92d124a918f0", "InstalledFiles": [ "usr/lib/libaio.so.1", "usr/lib/libaio.so.1.0.2" ], "AnalyzedBy": "apk" }, { "ID": "libblkid@2.38.1-r8", "Name": "libblkid", "Identifier": { "PURL": "pkg:apk/alpine/libblkid@2.38.1-r8?arch=x86_64\u0026distro=3.18.6", "UID": "2487a996555c0ad1" }, "Version": "2.38.1-r8", "Arch": "x86_64", "SrcName": "util-linux", "SrcVersion": "2.38.1-r8", "Licenses": [ "LGPL-2.1-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:ca867f5ba13938e50885f66dfbe1671a2647a58b", "InstalledFiles": [ "lib/libblkid.so.1", "lib/libblkid.so.1.1.0" ], "AnalyzedBy": "apk" }, { "ID": "libc-utils@0.7.2-r5", "Name": "libc-utils", "Identifier": { "PURL": "pkg:apk/alpine/libc-utils@0.7.2-r5?arch=x86_64\u0026distro=3.18.6", "UID": "51876d4fd99585f1" }, "Version": "0.7.2-r5", "Arch": "x86_64", "SrcName": "libc-dev", "SrcVersion": "0.7.2-r5", "Licenses": [ "BSD-2-Clause", "BSD-3-Clause" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl-utils@1.2.4-r2" ], "Layer": { "DiffID": "sha256:aedc3bda2944bb9bcb6c3d475bee8b460db9a9b0f3e0b33a6ed2fd1ae0f1d445" }, "Digest": "sha1:2e59dafeb8bca0786540846c686f121ae8348a42", "AnalyzedBy": "apk" }, { "ID": "libc6-compat@1.2.4-r2", "Name": "libc6-compat", "Identifier": { "PURL": "pkg:apk/alpine/libc6-compat@1.2.4-r2?arch=x86_64\u0026distro=3.18.6", "UID": "14521b0ca0ff95dc" }, "Version": "1.2.4-r2", "Arch": "x86_64", "SrcName": "musl", "SrcVersion": "1.2.4-r2", "Licenses": [ "MIT" ], "Maintainer": "Timo Teräs \u003ctimo.teras@iki.fi\u003e", "DependsOn": [ "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:d7ac07ac33a532e03d15cacd38ec81a7c8fcb164", "InstalledFiles": [ "lib/libc.so.6", "lib/libcrypt.so.1", "lib/libm.so.6", "lib/libpthread.so.0", "lib/librt.so.1", "lib/libutil.so.1", "lib64/ld-linux-x86-64.so.2" ], "AnalyzedBy": "apk" }, { "ID": "libcom_err@1.47.0-r2", "Name": "libcom_err", "Identifier": { "PURL": "pkg:apk/alpine/libcom_err@1.47.0-r2?arch=x86_64\u0026distro=3.18.6", "UID": "6c7b2213bc53cdd8" }, "Version": "1.47.0-r2", "Arch": "x86_64", "SrcName": "e2fsprogs", "SrcVersion": "1.47.0-r2", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.0-or-later", "BSD-3-Clause", "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:26d8a8094824fc883691e98013014fe590b9099f", "InstalledFiles": [ "lib/libcom_err.so.2", "lib/libcom_err.so.2.1" ], "AnalyzedBy": "apk" }, { "ID": "libcrypto3@3.1.4-r5", "Name": "libcrypto3", "Identifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.1.4-r5?arch=x86_64\u0026distro=3.18.6", "UID": "8293acc3a9a93559" }, "Version": "3.1.4-r5", "Arch": "x86_64", "SrcName": "openssl", "SrcVersion": "3.1.4-r5", "Licenses": [ "Apache-2.0" ], "Maintainer": "Ariadne Conill \u003cariadne@dereferenced.org\u003e", "DependsOn": [ "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:aedc3bda2944bb9bcb6c3d475bee8b460db9a9b0f3e0b33a6ed2fd1ae0f1d445" }, "Digest": "sha1:629c8026baa81f150476c44c92fe15a2041fd395", "InstalledFiles": [ "etc/ssl/ct_log_list.cnf", "etc/ssl/ct_log_list.cnf.dist", "etc/ssl/openssl.cnf", "etc/ssl/openssl.cnf.dist", "etc/ssl/misc/CA.pl", "etc/ssl/misc/tsget", "etc/ssl/misc/tsget.pl", "lib/libcrypto.so.3", "usr/lib/libcrypto.so.3", "usr/lib/engines-3/afalg.so", "usr/lib/engines-3/capi.so", "usr/lib/engines-3/loader_attic.so", "usr/lib/engines-3/padlock.so", "usr/lib/ossl-modules/legacy.so" ], "AnalyzedBy": "apk" }, { "ID": "libgcc@13.2.1_git20231014-r1", "Name": "libgcc", "Identifier": { "PURL": "pkg:apk/alpine/libgcc@13.2.1_git20231014-r1?arch=x86_64\u0026distro=3.18.6", "UID": "2bb090497a96d417" }, "Version": "13.2.1_git20231014-r1", "Arch": "x86_64", "SrcName": "gcc", "SrcVersion": "13.2.1_git20231014-r1", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.1-or-later" ], "Maintainer": "Ariadne Conill \u003cariadne@dereferenced.org\u003e", "DependsOn": [ "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:0f8124e1c36dd6c366867d6dc5137d87ae9c12ba", "InstalledFiles": [ "usr/lib/libgcc_s.so.1" ], "AnalyzedBy": "apk" }, { "ID": "libintl@0.21.1-r7", "Name": "libintl", "Identifier": { "PURL": "pkg:apk/alpine/libintl@0.21.1-r7?arch=x86_64\u0026distro=3.18.6", "UID": "4a407a365caf1d38" }, "Version": "0.21.1-r7", "Arch": "x86_64", "SrcName": "gettext", "SrcVersion": "0.21.1-r7", "Licenses": [ "LGPL-2.1-or-later" ], "Maintainer": "Carlo Landmeter \u003cclandmeter@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:c904c4d87a2f2b824646ab78fad7c134cf2d5eb8", "InstalledFiles": [ "usr/lib/libintl.so.8", "usr/lib/libintl.so.8.3.0" ], "AnalyzedBy": "apk" }, { "ID": "libssl3@3.1.4-r5", "Name": "libssl3", "Identifier": { "PURL": "pkg:apk/alpine/libssl3@3.1.4-r5?arch=x86_64\u0026distro=3.18.6", "UID": "cb6143d4e3627ca9" }, "Version": "3.1.4-r5", "Arch": "x86_64", "SrcName": "openssl", "SrcVersion": "3.1.4-r5", "Licenses": [ "Apache-2.0" ], "Maintainer": "Ariadne Conill \u003cariadne@dereferenced.org\u003e", "DependsOn": [ "libcrypto3@3.1.4-r5", "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:aedc3bda2944bb9bcb6c3d475bee8b460db9a9b0f3e0b33a6ed2fd1ae0f1d445" }, "Digest": "sha1:503141b0806637d28bf84138e7b51dd4d3745d21", "InstalledFiles": [ "lib/libssl.so.3", "usr/lib/libssl.so.3" ], "AnalyzedBy": "apk" }, { "ID": "libtirpc@1.3.3-r2", "Name": "libtirpc", "Identifier": { "PURL": "pkg:apk/alpine/libtirpc@1.3.3-r2?arch=x86_64\u0026distro=3.18.6", "UID": "3a95711c20323043" }, "Version": "1.3.3-r2", "Arch": "x86_64", "SrcName": "libtirpc", "SrcVersion": "1.3.3-r2", "Licenses": [ "BSD-3-Clause" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "krb5-libs@1.20.1-r1", "libtirpc-conf@1.3.3-r2", "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:7754d642335f524528e3748be440894d67321e0b", "InstalledFiles": [ "usr/lib/libtirpc.so.3", "usr/lib/libtirpc.so.3.0.0" ], "AnalyzedBy": "apk" }, { "ID": "libtirpc-conf@1.3.3-r2", "Name": "libtirpc-conf", "Identifier": { "PURL": "pkg:apk/alpine/libtirpc-conf@1.3.3-r2?arch=x86_64\u0026distro=3.18.6", "UID": "3ea51a393c519cf9" }, "Version": "1.3.3-r2", "Arch": "x86_64", "SrcName": "libtirpc", "SrcVersion": "1.3.3-r2", "Licenses": [ "BSD-3-Clause" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:103db6093ad8e9ed23da82e3ee9aefd210fb91f4", "InstalledFiles": [ "etc/bindresvport.blacklist", "etc/netconfig" ], "AnalyzedBy": "apk" }, { "ID": "libtraceevent@1.7.2-r0", "Name": "libtraceevent", "Identifier": { "PURL": "pkg:apk/alpine/libtraceevent@1.7.2-r0?arch=x86_64\u0026distro=3.18.6", "UID": "8f21f92c009424b3" }, "Version": "1.7.2-r0", "Arch": "x86_64", "SrcName": "libtraceevent", "SrcVersion": "1.7.2-r0", "Licenses": [ "LGPL-2.1-or-later", "GPL-2.0-or-later" ], "Maintainer": "psykose \u003calice@ayaya.dev\u003e", "DependsOn": [ "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:5d70e4e1cad10b46fc4c1ff5b4ffcc9ff018b404", "InstalledFiles": [ "usr/lib/libtraceevent.so.1", "usr/lib/libtraceevent.so.1.7.2" ], "AnalyzedBy": "apk" }, { "ID": "libtracefs@1.6.4-r0", "Name": "libtracefs", "Identifier": { "PURL": "pkg:apk/alpine/libtracefs@1.6.4-r0?arch=x86_64\u0026distro=3.18.6", "UID": "2e491d6a62832bff" }, "Version": "1.6.4-r0", "Arch": "x86_64", "SrcName": "libtracefs", "SrcVersion": "1.6.4-r0", "Licenses": [ "LGPL-2.1-or-later" ], "Maintainer": "psykose \u003calice@ayaya.dev\u003e", "DependsOn": [ "libtraceevent@1.7.2-r0", "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:27eb11b889a8c9c90f424b32479111a9bb96d203", "InstalledFiles": [ "usr/lib/libtracefs.so.1", "usr/lib/libtracefs.so.1.6.4" ], "AnalyzedBy": "apk" }, { "ID": "libuuid@2.38.1-r8", "Name": "libuuid", "Identifier": { "PURL": "pkg:apk/alpine/libuuid@2.38.1-r8?arch=x86_64\u0026distro=3.18.6", "UID": "2134b2c87c7e29c1" }, "Version": "2.38.1-r8", "Arch": "x86_64", "SrcName": "util-linux", "SrcVersion": "2.38.1-r8", "Licenses": [ "BSD-3-Clause" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:4e11cfb72fbebef845c1486b0eb603ec29b25012", "InstalledFiles": [ "lib/libuuid.so.1", "lib/libuuid.so.1.3.0" ], "AnalyzedBy": "apk" }, { "ID": "libverto@0.3.2-r2", "Name": "libverto", "Identifier": { "PURL": "pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64\u0026distro=3.18.6", "UID": "162808760625ec6c" }, "Version": "0.3.2-r2", "Arch": "x86_64", "SrcName": "libverto", "SrcVersion": "0.3.2-r2", "Licenses": [ "MIT" ], "Maintainer": "Francesco Colista \u003cfcolista@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:712b8f300c4363fb78e138f996d1fa87ac5e62f5", "InstalledFiles": [ "usr/lib/libverto.so.1", "usr/lib/libverto.so.1.0.0" ], "AnalyzedBy": "apk" }, { "ID": "lvm2-libs@2.03.21-r3", "Name": "lvm2-libs", "Identifier": { "PURL": "pkg:apk/alpine/lvm2-libs@2.03.21-r3?arch=x86_64\u0026distro=3.18.6", "UID": "3d7929595b80420a" }, "Version": "2.03.21-r3", "Arch": "x86_64", "SrcName": "lvm2", "SrcVersion": "2.03.21-r3", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.1-or-later", "BSD-2-Clause" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "device-mapper-event-libs@2.03.21-r3", "device-mapper-libs@2.03.21-r3", "libaio@0.3.113-r1", "libblkid@2.38.1-r8", "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:fa2f838062ef6dd540bb71c692fafe114126eef8", "InstalledFiles": [ "lib/libdevmapper-event-lvm2.so.2.03", "lib/liblvm2cmd.so.2.03", "lib/device-mapper/libdevmapper-event-lvm2mirror.so", "lib/device-mapper/libdevmapper-event-lvm2raid.so", "lib/device-mapper/libdevmapper-event-lvm2snapshot.so", "lib/device-mapper/libdevmapper-event-lvm2thin.so", "lib/device-mapper/libdevmapper-event-lvm2vdo.so" ], "AnalyzedBy": "apk" }, { "ID": "musl@1.2.4-r2", "Name": "musl", "Identifier": { "PURL": "pkg:apk/alpine/musl@1.2.4-r2?arch=x86_64\u0026distro=3.18.6", "UID": "ed590eea03f1e3ce" }, "Version": "1.2.4-r2", "Arch": "x86_64", "SrcName": "musl", "SrcVersion": "1.2.4-r2", "Licenses": [ "MIT" ], "Maintainer": "Timo Teräs \u003ctimo.teras@iki.fi\u003e", "Layer": { "DiffID": "sha256:aedc3bda2944bb9bcb6c3d475bee8b460db9a9b0f3e0b33a6ed2fd1ae0f1d445" }, "Digest": "sha1:a1db4862d2b238283ab2e17f703698a7280bee1c", "InstalledFiles": [ "lib/ld-musl-x86_64.so.1", "lib/libc.musl-x86_64.so.1" ], "AnalyzedBy": "apk" }, { "ID": "musl-utils@1.2.4-r2", "Name": "musl-utils", "Identifier": { "PURL": "pkg:apk/alpine/musl-utils@1.2.4-r2?arch=x86_64\u0026distro=3.18.6", "UID": "6d5f6f9a2f072221" }, "Version": "1.2.4-r2", "Arch": "x86_64", "SrcName": "musl", "SrcVersion": "1.2.4-r2", "Licenses": [ "MIT", "BSD-2-Clause", "GPL-2.0-or-later" ], "Maintainer": "Timo Teräs \u003ctimo.teras@iki.fi\u003e", "DependsOn": [ "musl@1.2.4-r2", "scanelf@1.3.7-r1" ], "Layer": { "DiffID": "sha256:aedc3bda2944bb9bcb6c3d475bee8b460db9a9b0f3e0b33a6ed2fd1ae0f1d445" }, "Digest": "sha1:e7d3d748b5d59b030103457f166beb049a1ba5a9", "InstalledFiles": [ "sbin/ldconfig", "usr/bin/getconf", "usr/bin/getent", "usr/bin/iconv", "usr/bin/ldd" ], "AnalyzedBy": "apk" }, { "ID": "ndctl@77-r0", "Name": "ndctl", "Identifier": { "PURL": "pkg:apk/alpine/ndctl@77-r0?arch=x86_64\u0026distro=3.18.6", "UID": "c90e7512c84f15a2" }, "Version": "77-r0", "Arch": "x86_64", "SrcName": "ndctl", "SrcVersion": "77-r0", "Licenses": [ "GPL-2.0-only", "LGPL-2.1-only" ], "DependsOn": [ "iniparser@4.1-r3", "json-c@0.16-r3", "keyutils-libs@1.6.3-r3", "kmod@30-r3", "libtraceevent@1.7.2-r0", "libtracefs@1.6.4-r0", "libuuid@2.38.1-r8", "musl@1.2.4-r2", "ndctl-libs@77-r0" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:6b03702b8a99b77b062a8f8a1e7afe95d9ae10d7", "InstalledFiles": [ "etc/daxctl.conf.d/daxctl.example.conf", "etc/modprobe.d/nvdimm-security.conf", "etc/ndctl.conf.d/monitor.conf", "etc/ndctl.conf.d/ndctl.conf", "etc/ndctl/keys/keys.readme", "usr/bin/cxl", "usr/bin/daxctl", "usr/bin/ndctl", "usr/share/daxctl/daxctl.conf" ], "AnalyzedBy": "apk" }, { "ID": "ndctl-libs@77-r0", "Name": "ndctl-libs", "Identifier": { "PURL": "pkg:apk/alpine/ndctl-libs@77-r0?arch=x86_64\u0026distro=3.18.6", "UID": "ffc65725b4c6189a" }, "Version": "77-r0", "Arch": "x86_64", "SrcName": "ndctl", "SrcVersion": "77-r0", "Licenses": [ "GPL-2.0-only", "LGPL-2.1-only" ], "DependsOn": [ "eudev-libs@3.2.11-r8", "kmod-libs@30-r3", "libuuid@2.38.1-r8", "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:64f02370c5c5bb2393e8f2b0b7e02159d9fb9478", "InstalledFiles": [ "usr/lib/libcxl.so.1", "usr/lib/libcxl.so.1.0.4", "usr/lib/libdaxctl.so.1", "usr/lib/libdaxctl.so.1.2.5", "usr/lib/libndctl.so.6", "usr/lib/libndctl.so.6.1.21" ], "AnalyzedBy": "apk" }, { "ID": "scanelf@1.3.7-r1", "Name": "scanelf", "Identifier": { "PURL": "pkg:apk/alpine/scanelf@1.3.7-r1?arch=x86_64\u0026distro=3.18.6", "UID": "e9b581783b86d3" }, "Version": "1.3.7-r1", "Arch": "x86_64", "SrcName": "pax-utils", "SrcVersion": "1.3.7-r1", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:aedc3bda2944bb9bcb6c3d475bee8b460db9a9b0f3e0b33a6ed2fd1ae0f1d445" }, "Digest": "sha1:e27abda38faea3635a2db4d50d007751ea280b43", "InstalledFiles": [ "usr/bin/scanelf" ], "AnalyzedBy": "apk" }, { "ID": "ssl_client@1.36.1-r5", "Name": "ssl_client", "Identifier": { "PURL": "pkg:apk/alpine/ssl_client@1.36.1-r5?arch=x86_64\u0026distro=3.18.6", "UID": "9ec5e4127a796afc" }, "Version": "1.36.1-r5", "Arch": "x86_64", "SrcName": "busybox", "SrcVersion": "1.36.1-r5", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", "DependsOn": [ "libcrypto3@3.1.4-r5", "libssl3@3.1.4-r5", "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:aedc3bda2944bb9bcb6c3d475bee8b460db9a9b0f3e0b33a6ed2fd1ae0f1d445" }, "Digest": "sha1:d8a372950f5be975b770deabc17cd9bbcd06721a", "InstalledFiles": [ "usr/bin/ssl_client" ], "AnalyzedBy": "apk" }, { "ID": "thin-provisioning-tools@1.0.4-r0", "Name": "thin-provisioning-tools", "Identifier": { "PURL": "pkg:apk/alpine/thin-provisioning-tools@1.0.4-r0?arch=x86_64\u0026distro=3.18.6", "UID": "34f322fd6f3a0008" }, "Version": "1.0.4-r0", "Arch": "x86_64", "SrcName": "thin-provisioning-tools", "SrcVersion": "1.0.4-r0", "Licenses": [ "GPL-3.0-or-later" ], "DependsOn": [ "libgcc@13.2.1_git20231014-r1", "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:ed9355a86c139444a970e570fa8124aa02afdacb", "InstalledFiles": [ "usr/sbin/cache_check", "usr/sbin/cache_dump", "usr/sbin/cache_metadata_size", "usr/sbin/cache_repair", "usr/sbin/cache_restore", "usr/sbin/cache_writeback", "usr/sbin/era_check", "usr/sbin/era_dump", "usr/sbin/era_invalidate", "usr/sbin/era_restore", "usr/sbin/pdata_tools", "usr/sbin/thin_check", "usr/sbin/thin_delta", "usr/sbin/thin_dump", "usr/sbin/thin_ls", "usr/sbin/thin_metadata_pack", "usr/sbin/thin_metadata_size", "usr/sbin/thin_metadata_unpack", "usr/sbin/thin_repair", "usr/sbin/thin_restore", "usr/sbin/thin_rmap", "usr/sbin/thin_trim" ], "AnalyzedBy": "apk" }, { "ID": "xz-libs@5.4.3-r0", "Name": "xz-libs", "Identifier": { "PURL": "pkg:apk/alpine/xz-libs@5.4.3-r0?arch=x86_64\u0026distro=3.18.6", "UID": "9121c02b4daea091" }, "Version": "5.4.3-r0", "Arch": "x86_64", "SrcName": "xz", "SrcVersion": "5.4.3-r0", "Licenses": [ "GPL-2.0-or-later", "Public-Domain", "LGPL-2.1-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:9ad575fd945ac8f6ec000118ae14ec5904ccba1a", "InstalledFiles": [ "usr/lib/liblzma.so.5", "usr/lib/liblzma.so.5.4.3" ], "AnalyzedBy": "apk" }, { "ID": "zfs@2.1.14-r0", "Name": "zfs", "Identifier": { "PURL": "pkg:apk/alpine/zfs@2.1.14-r0?arch=x86_64\u0026distro=3.18.6", "UID": "9db20337c7b0f9d8" }, "Version": "2.1.14-r0", "Arch": "x86_64", "SrcName": "zfs", "SrcVersion": "2.1.14-r0", "Licenses": [ "CDDL-1.0" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libblkid@2.38.1-r8", "libintl@0.21.1-r7", "libuuid@2.38.1-r8", "musl@1.2.4-r2", "zfs-libs@2.1.14-r0" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:365e4e37d186cb1ca6290ee6da5e52e5736e6755", "InstalledFiles": [ "etc/sudoers.d/zfs", "etc/zfs/vdev_id.conf.alias.example", "etc/zfs/vdev_id.conf.multipath.example", "etc/zfs/vdev_id.conf.sas_direct.example", "etc/zfs/vdev_id.conf.sas_switch.example", "etc/zfs/vdev_id.conf.scsi.example", "etc/zfs/zfs-functions", "etc/zfs/zed.d/all-syslog.sh", "etc/zfs/zed.d/data-notify.sh", "etc/zfs/zed.d/history_event-zfs-list-cacher.sh", "etc/zfs/zed.d/pool_import-led.sh", "etc/zfs/zed.d/resilver_finish-notify.sh", "etc/zfs/zed.d/resilver_finish-start-scrub.sh", "etc/zfs/zed.d/scrub_finish-notify.sh", "etc/zfs/zed.d/statechange-led.sh", "etc/zfs/zed.d/statechange-notify.sh", "etc/zfs/zed.d/statechange-slot_off.sh", "etc/zfs/zed.d/vdev_attach-led.sh", "etc/zfs/zed.d/vdev_clear-led.sh", "etc/zfs/zed.d/zed-functions.sh", "etc/zfs/zed.d/zed.rc", "etc/zfs/zpool.d/ata_err", "etc/zfs/zpool.d/cmd_to", "etc/zfs/zpool.d/defect", "etc/zfs/zpool.d/dm-deps", "etc/zfs/zpool.d/enc", "etc/zfs/zpool.d/encdev", "etc/zfs/zpool.d/fault_led", "etc/zfs/zpool.d/health", "etc/zfs/zpool.d/hours_on", "etc/zfs/zpool.d/iostat", "etc/zfs/zpool.d/iostat-10s", "etc/zfs/zpool.d/iostat-1s", "etc/zfs/zpool.d/label", "etc/zfs/zpool.d/locate_led", "etc/zfs/zpool.d/lsblk", "etc/zfs/zpool.d/media", "etc/zfs/zpool.d/model", "etc/zfs/zpool.d/nonmed", "etc/zfs/zpool.d/nvme_err", "etc/zfs/zpool.d/off_ucor", "etc/zfs/zpool.d/pend_sec", "etc/zfs/zpool.d/pwr_cyc", "etc/zfs/zpool.d/r_proc", "etc/zfs/zpool.d/r_ucor", "etc/zfs/zpool.d/realloc", "etc/zfs/zpool.d/rep_ucor", "etc/zfs/zpool.d/serial", "etc/zfs/zpool.d/ses", "etc/zfs/zpool.d/size", "etc/zfs/zpool.d/slot", "etc/zfs/zpool.d/smart", "etc/zfs/zpool.d/smart_test", "etc/zfs/zpool.d/smartx", "etc/zfs/zpool.d/temp", "etc/zfs/zpool.d/test_ended", "etc/zfs/zpool.d/test_progress", "etc/zfs/zpool.d/test_status", "etc/zfs/zpool.d/test_type", "etc/zfs/zpool.d/upath", "etc/zfs/zpool.d/vendor", "etc/zfs/zpool.d/w_proc", "etc/zfs/zpool.d/w_ucor", "sbin/mount.zfs", "usr/bin/raidz_test", "usr/bin/zvol_wait", "usr/libexec/zfs/zpool_influxdb", "usr/libexec/zfs/zed.d/all-debug.sh", "usr/libexec/zfs/zed.d/all-syslog.sh", "usr/libexec/zfs/zed.d/data-notify.sh", "usr/libexec/zfs/zed.d/generic-notify.sh", "usr/libexec/zfs/zed.d/history_event-zfs-list-cacher.sh", "usr/libexec/zfs/zed.d/pool_import-led.sh", "usr/libexec/zfs/zed.d/resilver_finish-notify.sh", "usr/libexec/zfs/zed.d/resilver_finish-start-scrub.sh", "usr/libexec/zfs/zed.d/scrub_finish-notify.sh", "usr/libexec/zfs/zed.d/statechange-led.sh", "usr/libexec/zfs/zed.d/statechange-notify.sh", "usr/libexec/zfs/zed.d/statechange-slot_off.sh", "usr/libexec/zfs/zed.d/trim_finish-notify.sh", "usr/libexec/zfs/zed.d/vdev_attach-led.sh", "usr/libexec/zfs/zed.d/vdev_clear-led.sh", "usr/libexec/zfs/zpool.d/ata_err", "usr/libexec/zfs/zpool.d/cmd_to", "usr/libexec/zfs/zpool.d/defect", "usr/libexec/zfs/zpool.d/dm-deps", "usr/libexec/zfs/zpool.d/enc", "usr/libexec/zfs/zpool.d/encdev", "usr/libexec/zfs/zpool.d/fault_led", "usr/libexec/zfs/zpool.d/health", "usr/libexec/zfs/zpool.d/hours_on", "usr/libexec/zfs/zpool.d/iostat", "usr/libexec/zfs/zpool.d/iostat-10s", "usr/libexec/zfs/zpool.d/iostat-1s", "usr/libexec/zfs/zpool.d/label", "usr/libexec/zfs/zpool.d/locate_led", "usr/libexec/zfs/zpool.d/lsblk", "usr/libexec/zfs/zpool.d/media", "usr/libexec/zfs/zpool.d/model", "usr/libexec/zfs/zpool.d/nonmed", "usr/libexec/zfs/zpool.d/nvme_err", "usr/libexec/zfs/zpool.d/off_ucor", "usr/libexec/zfs/zpool.d/pend_sec", "usr/libexec/zfs/zpool.d/pwr_cyc", "usr/libexec/zfs/zpool.d/r_proc", "usr/libexec/zfs/zpool.d/r_ucor", "usr/libexec/zfs/zpool.d/realloc", "usr/libexec/zfs/zpool.d/rep_ucor", "usr/libexec/zfs/zpool.d/serial", "usr/libexec/zfs/zpool.d/ses", "usr/libexec/zfs/zpool.d/size", "usr/libexec/zfs/zpool.d/slot", "usr/libexec/zfs/zpool.d/smart", "usr/libexec/zfs/zpool.d/smart_test", "usr/libexec/zfs/zpool.d/smartx", "usr/libexec/zfs/zpool.d/temp", "usr/libexec/zfs/zpool.d/test_ended", "usr/libexec/zfs/zpool.d/test_progress", "usr/libexec/zfs/zpool.d/test_status", "usr/libexec/zfs/zpool.d/test_type", "usr/libexec/zfs/zpool.d/upath", "usr/libexec/zfs/zpool.d/vendor", "usr/libexec/zfs/zpool.d/w_proc", "usr/libexec/zfs/zpool.d/w_ucor", "usr/sbin/fsck.zfs", "usr/sbin/zdb", "usr/sbin/zed", "usr/sbin/zfs", "usr/sbin/zfs_ids_to_path", "usr/sbin/zgenhostid", "usr/sbin/zhack", "usr/sbin/zinject", "usr/sbin/zpool", "usr/sbin/zstream", "usr/sbin/zstreamdump", "usr/sbin/ztest" ], "AnalyzedBy": "apk" }, { "ID": "zfs-libs@2.1.14-r0", "Name": "zfs-libs", "Identifier": { "PURL": "pkg:apk/alpine/zfs-libs@2.1.14-r0?arch=x86_64\u0026distro=3.18.6", "UID": "d7da941feae62913" }, "Version": "2.1.14-r0", "Arch": "x86_64", "SrcName": "zfs", "SrcVersion": "2.1.14-r0", "Licenses": [ "CDDL-1.0" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libblkid@2.38.1-r8", "libcrypto3@3.1.4-r5", "libintl@0.21.1-r7", "libtirpc@1.3.3-r2", "libuuid@2.38.1-r8", "musl@1.2.4-r2", "zlib@1.2.13-r1" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:ff8ca74e7deca119fea08b66eb657368495368ba", "InstalledFiles": [ "usr/lib/libnvpair.so.3", "usr/lib/libnvpair.so.3.0.0", "usr/lib/libuutil.so.3", "usr/lib/libuutil.so.3.0.0", "usr/lib/libzfs.so.4", "usr/lib/libzfs.so.4.1.0", "usr/lib/libzfs_core.so.3", "usr/lib/libzfs_core.so.3.0.0", "usr/lib/libzfsbootenv.so.1", "usr/lib/libzfsbootenv.so.1.0.0", "usr/lib/libzpool.so.5", "usr/lib/libzpool.so.5.0.0" ], "AnalyzedBy": "apk" }, { "ID": "zlib@1.2.13-r1", "Name": "zlib", "Identifier": { "PURL": "pkg:apk/alpine/zlib@1.2.13-r1?arch=x86_64\u0026distro=3.18.6", "UID": "596bb4af28208be4" }, "Version": "1.2.13-r1", "Arch": "x86_64", "SrcName": "zlib", "SrcVersion": "1.2.13-r1", "Licenses": [ "Zlib" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:aedc3bda2944bb9bcb6c3d475bee8b460db9a9b0f3e0b33a6ed2fd1ae0f1d445" }, "Digest": "sha1:2656e848992b378aa40dca24af8cde9e97161174", "InstalledFiles": [ "lib/libz.so.1", "lib/libz.so.1.2.13" ], "AnalyzedBy": "apk" }, { "ID": "zstd-libs@1.5.5-r4", "Name": "zstd-libs", "Identifier": { "PURL": "pkg:apk/alpine/zstd-libs@1.5.5-r4?arch=x86_64\u0026distro=3.18.6", "UID": "734edfdc4a601868" }, "Version": "1.5.5-r4", "Arch": "x86_64", "SrcName": "zstd", "SrcVersion": "1.5.5-r4", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later" ], "Maintainer": "psykose \u003calice@ayaya.dev\u003e", "DependsOn": [ "musl@1.2.4-r2" ], "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "Digest": "sha1:83d8ab27f4fd4725a147245f89d076aa96b52262", "InstalledFiles": [ "usr/lib/libzstd.so.1", "usr/lib/libzstd.so.1.5.5" ], "AnalyzedBy": "apk" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2024-37371", "PkgID": "krb5-libs@1.20.1-r1", "PkgName": "krb5-libs", "PkgIdentifier": { "PURL": "pkg:apk/alpine/krb5-libs@1.20.1-r1?arch=x86_64\u0026distro=3.18.6", "UID": "aab7b89b1d7ce6e" }, "InstalledVersion": "1.20.1-r1", "FixedVersion": "1.20.2-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-37371", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:e0cf962f432154a4f95da811b1c5f7d8131d1d9e166a5d1190ffe9fd73039da9", "Title": "krb5: GSS message token handling", "Description": "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.", "Severity": "CRITICAL", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 4, "cbl-mariner": 4, "julia": 4, "nvd": 4, "oracle-oval": 3, "photon": 4, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 9.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2025:1671", "https://access.redhat.com/security/cve/CVE-2024-37371", "https://bugzilla.redhat.com/2294581", "https://bugzilla.redhat.com/2294676", "https://bugzilla.redhat.com/2301888", "https://bugzilla.redhat.com/2318857", "https://bugzilla.redhat.com/2318858", "https://bugzilla.redhat.com/2318870", "https://bugzilla.redhat.com/2318873", "https://bugzilla.redhat.com/2318874", "https://bugzilla.redhat.com/2318876", "https://bugzilla.redhat.com/2318882", "https://bugzilla.redhat.com/2318883", "https://bugzilla.redhat.com/2318884", "https://bugzilla.redhat.com/2318885", "https://bugzilla.redhat.com/2318886", "https://bugzilla.redhat.com/2318897", "https://bugzilla.redhat.com/2318900", "https://bugzilla.redhat.com/2318905", "https://bugzilla.redhat.com/2318914", "https://bugzilla.redhat.com/2318922", "https://bugzilla.redhat.com/2318923", "https://bugzilla.redhat.com/2318925", "https://bugzilla.redhat.com/2318926", "https://bugzilla.redhat.com/2318927", "https://bugzilla.redhat.com/2331191", "https://bugzilla.redhat.com/2339218", "https://bugzilla.redhat.com/2339220", "https://bugzilla.redhat.com/2339221", "https://bugzilla.redhat.com/2339226", "https://bugzilla.redhat.com/2339231", "https://bugzilla.redhat.com/2339236", "https://bugzilla.redhat.com/2339238", "https://bugzilla.redhat.com/2339243", "https://bugzilla.redhat.com/2339247", "https://bugzilla.redhat.com/2339252", "https://bugzilla.redhat.com/2339259", "https://bugzilla.redhat.com/2339266", "https://bugzilla.redhat.com/2339270", "https://bugzilla.redhat.com/2339271", "https://bugzilla.redhat.com/2339275", "https://bugzilla.redhat.com/2339277", "https://bugzilla.redhat.com/2339281", "https://bugzilla.redhat.com/2339284", "https://bugzilla.redhat.com/2339291", "https://bugzilla.redhat.com/2339293", "https://bugzilla.redhat.com/2339295", "https://bugzilla.redhat.com/2339299", "https://bugzilla.redhat.com/2339300", "https://bugzilla.redhat.com/2339304", "https://bugzilla.redhat.com/2339305", "https://bugzilla.redhat.com/show_bug.cgi?id=2294581", "https://bugzilla.redhat.com/show_bug.cgi?id=2294676", "https://bugzilla.redhat.com/show_bug.cgi?id=2301888", "https://bugzilla.redhat.com/show_bug.cgi?id=2318857", "https://bugzilla.redhat.com/show_bug.cgi?id=2318858", "https://bugzilla.redhat.com/show_bug.cgi?id=2318870", "https://bugzilla.redhat.com/show_bug.cgi?id=2318873", "https://bugzilla.redhat.com/show_bug.cgi?id=2318874", "https://bugzilla.redhat.com/show_bug.cgi?id=2318876", "https://bugzilla.redhat.com/show_bug.cgi?id=2318882", "https://bugzilla.redhat.com/show_bug.cgi?id=2318883", "https://bugzilla.redhat.com/show_bug.cgi?id=2318884", "https://bugzilla.redhat.com/show_bug.cgi?id=2318885", "https://bugzilla.redhat.com/show_bug.cgi?id=2318886", "https://bugzilla.redhat.com/show_bug.cgi?id=2318897", "https://bugzilla.redhat.com/show_bug.cgi?id=2318900", "https://bugzilla.redhat.com/show_bug.cgi?id=2318905", "https://bugzilla.redhat.com/show_bug.cgi?id=2318914", "https://bugzilla.redhat.com/show_bug.cgi?id=2318922", "https://bugzilla.redhat.com/show_bug.cgi?id=2318923", "https://bugzilla.redhat.com/show_bug.cgi?id=2318925", "https://bugzilla.redhat.com/show_bug.cgi?id=2318926", "https://bugzilla.redhat.com/show_bug.cgi?id=2318927", "https://bugzilla.redhat.com/show_bug.cgi?id=2331191", "https://bugzilla.redhat.com/show_bug.cgi?id=2339218", "https://bugzilla.redhat.com/show_bug.cgi?id=2339220", "https://bugzilla.redhat.com/show_bug.cgi?id=2339221", "https://bugzilla.redhat.com/show_bug.cgi?id=2339226", "https://bugzilla.redhat.com/show_bug.cgi?id=2339231", "https://bugzilla.redhat.com/show_bug.cgi?id=2339236", "https://bugzilla.redhat.com/show_bug.cgi?id=2339238", "https://bugzilla.redhat.com/show_bug.cgi?id=2339243", "https://bugzilla.redhat.com/show_bug.cgi?id=2339247", "https://bugzilla.redhat.com/show_bug.cgi?id=2339252", "https://bugzilla.redhat.com/show_bug.cgi?id=2339259", "https://bugzilla.redhat.com/show_bug.cgi?id=2339266", "https://bugzilla.redhat.com/show_bug.cgi?id=2339270", "https://bugzilla.redhat.com/show_bug.cgi?id=2339271", "https://bugzilla.redhat.com/show_bug.cgi?id=2339275", "https://bugzilla.redhat.com/show_bug.cgi?id=2339277", "https://bugzilla.redhat.com/show_bug.cgi?id=2339281", "https://bugzilla.redhat.com/show_bug.cgi?id=2339284", "https://bugzilla.redhat.com/show_bug.cgi?id=2339291", "https://bugzilla.redhat.com/show_bug.cgi?id=2339293", "https://bugzilla.redhat.com/show_bug.cgi?id=2339295", "https://bugzilla.redhat.com/show_bug.cgi?id=2339299", "https://bugzilla.redhat.com/show_bug.cgi?id=2339300", "https://bugzilla.redhat.com/show_bug.cgi?id=2339304", "https://bugzilla.redhat.com/show_bug.cgi?id=2339305", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11053", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21193", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21194", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21196", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21197", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21198", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21199", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21201", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21203", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21212", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21213", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21218", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21230", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21231", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21236", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21238", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21239", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21241", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21247", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37371", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5535", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7264", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21490", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21491", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21494", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21497", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21500", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21501", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21503", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21505", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21518", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21519", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21520", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21521", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21522", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21523", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21525", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21529", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21531", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21534", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21536", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21540", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21543", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21546", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21555", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21559", "https://errata.almalinux.org/9/ALSA-2025-1671.html", "https://errata.rockylinux.org/RLSA-2025:1671", "https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef", "https://linux.oracle.com/cve/CVE-2024-37371.html", "https://linux.oracle.com/errata/ELSA-2025-1673.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-37371", "https://security.netapp.com/advisory/ntap-20241108-0009/", "https://security.netapp.com/advisory/ntap-20250124-0010/", "https://ubuntu.com/security/notices/USN-6947-1", "https://web.mit.edu/kerberos/www/advisories/", "https://web.mit.edu/kerberos/www/krb5-1.21/", "https://www.cve.org/CVERecord?id=CVE-2024-37371", "https://www.oracle.com/security-alerts/cpujan2025.html#AppendixMSQL" ], "PublishedDate": "2024-06-28T23:15:11.603Z", "LastModifiedDate": "2026-06-17T07:38:14.497Z" }, { "VulnerabilityID": "CVE-2024-37370", "PkgID": "krb5-libs@1.20.1-r1", "PkgName": "krb5-libs", "PkgIdentifier": { "PURL": "pkg:apk/alpine/krb5-libs@1.20.1-r1?arch=x86_64\u0026distro=3.18.6", "UID": "aab7b89b1d7ce6e" }, "InstalledVersion": "1.20.1-r1", "FixedVersion": "1.20.2-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-37370", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:23a60c075c069f3ec33afd5b235641b20c5388d3f9a85cfb00d17f5732a37395", "Title": "krb5: GSS message token handling", "Description": "In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.", "Severity": "HIGH", "CweIDs": [ "CWE-345" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 3, "cbl-mariner": 3, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2024:5312", "https://access.redhat.com/errata/RHSA-2024:6166", "https://access.redhat.com/security/cve/CVE-2024-37370", "https://bugzilla.redhat.com/2294676", "https://bugzilla.redhat.com/2294677", "https://bugzilla.redhat.com/show_bug.cgi?id=2294676", "https://bugzilla.redhat.com/show_bug.cgi?id=2294677", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37370", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37371", "https://errata.almalinux.org/9/ALSA-2024-6166.html", "https://errata.rockylinux.org/RLSA-2024:5312", "https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef", "https://linux.oracle.com/cve/CVE-2024-37370.html", "https://linux.oracle.com/errata/ELSA-2024-6166.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-37370", "https://security.netapp.com/advisory/ntap-20241108-0007/", "https://ubuntu.com/security/notices/USN-6947-1", "https://web.mit.edu/kerberos/www/advisories/", "https://web.mit.edu/kerberos/www/krb5-1.21/", "https://www.cve.org/CVERecord?id=CVE-2024-37370" ], "PublishedDate": "2024-06-28T22:15:02.293Z", "LastModifiedDate": "2026-06-17T07:38:14.32Z" }, { "VulnerabilityID": "CVE-2025-26519", "PkgID": "libc6-compat@1.2.4-r2", "PkgName": "libc6-compat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libc6-compat@1.2.4-r2?arch=x86_64\u0026distro=3.18.6", "UID": "14521b0ca0ff95dc" }, "InstalledVersion": "1.2.4-r2", "FixedVersion": "1.2.4-r3", "Status": "fixed", "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-26519", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:1e675c9aadb407ea923b2d78a637fee01a734f076943f6c966b868d8002205e9", "Title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ...", "Description": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2025/02/13/2", "http://www.openwall.com/lists/oss-security/2025/02/13/3", "http://www.openwall.com/lists/oss-security/2025/02/13/4", "http://www.openwall.com/lists/oss-security/2025/02/13/5", "http://www.openwall.com/lists/oss-security/2025/02/14/5", "http://www.openwall.com/lists/oss-security/2025/02/14/6", "https://git.musl-libc.org/cgit/musl/commit/?id=c47ad25ea3b484e10326f933e927c0bc8cded3da", "https://git.musl-libc.org/cgit/musl/commit/?id=e5adcd97b5196e29991b524237381a0202a60659", "https://www.openwall.com/lists/oss-security/2025/02/13/2" ], "PublishedDate": "2025-02-14T04:15:09.05Z", "LastModifiedDate": "2026-06-17T09:01:57.26Z" }, { "VulnerabilityID": "CVE-2024-6119", "PkgID": "libcrypto3@3.1.4-r5", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.1.4-r5?arch=x86_64\u0026distro=3.18.6", "UID": "8293acc3a9a93559" }, "InstalledVersion": "3.1.4-r5", "FixedVersion": "3.1.7-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:aedc3bda2944bb9bcb6c3d475bee8b460db9a9b0f3e0b33a6ed2fd1ae0f1d445" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-6119", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:e3eba3e5af95c393a9b0bf615fbfbeb002edd7f7c0382c5628d8ec9bc6670379", "Title": "openssl: Possible denial of service in X.509 name checks", "Description": "Issue summary: Applications performing certificate name checks (e.g., TLS\nclients checking server certificates) may attempt to read an invalid memory\naddress resulting in abnormal termination of the application process.\n\nImpact summary: Abnormal termination of an application can a cause a denial of\nservice.\n\nApplications performing certificate name checks (e.g., TLS clients checking\nserver certificates) may attempt to read an invalid memory address when\ncomparing the expected name with an `otherName` subject alternative name of an\nX.509 certificate. This may result in an exception that terminates the\napplication program.\n\nNote that basic certificate chain validation (signatures, dates, ...) is not\naffected, the denial of service can occur only when the application also\nspecifies an expected DNS name, Email address or IP address.\n\nTLS servers rarely solicit client certificates, and even when they do, they\ngenerally don't perform a name check against a reference identifier (expected\nidentity), but rather extract the presented identity after checking the\ncertificate chain. So TLS servers are generally not affected and the severity\nof the issue is Moderate.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.", "Severity": "HIGH", "CweIDs": [ "CWE-843" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 3, "cbl-mariner": 3, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2024/09/03/4", "https://access.redhat.com/errata/RHSA-2024:6783", "https://access.redhat.com/errata/RHSA-2024:8935", "https://access.redhat.com/security/cve/CVE-2024-6119", "https://bugzilla.redhat.com/2306158", "https://bugzilla.redhat.com/show_bug.cgi?id=2306158", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-613116.html", "https://cert-portal.siemens.com/productcert/html/ssa-769027.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6119", "https://errata.almalinux.org/9/ALSA-2024-8935.html", "https://errata.rockylinux.org/RLSA-2024:6783", "https://github.com/advisories/GHSA-7m4m-pwhv-49c5", "https://github.com/openssl/openssl/commit/05f360d9e849a1b277db628f1f13083a7f8dd04f", "https://github.com/openssl/openssl/commit/06d1dc3fa96a2ba5a3e22735a033012aadc9f0d6", "https://github.com/openssl/openssl/commit/621f3729831b05ee828a3203eddb621d014ff2b2", "https://github.com/openssl/openssl/commit/7dfcee2cd2a63b2c64b9b4b0850be64cb695b0a0", "https://github.com/openssl/openssl/security/advisories/GHSA-5qrj-vq78-58fj", "https://linux.oracle.com/cve/CVE-2024-6119.html", "https://linux.oracle.com/errata/ELSA-2024-8935.html", "https://lists.freebsd.org/archives/freebsd-security/2024-September/000303.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-6119", "https://openssl-library.org/news/secadv/20240903.txt", "https://security.netapp.com/advisory/ntap-20240912-0001", "https://security.netapp.com/advisory/ntap-20240912-0001/", "https://ubuntu.com/security/notices/USN-6986-1", "https://ubuntu.com/security/notices/USN-7894-1", "https://www.cve.org/CVERecord?id=CVE-2024-6119" ], "PublishedDate": "2024-09-03T16:15:07.177Z", "LastModifiedDate": "2026-06-17T08:17:19.693Z" }, { "VulnerabilityID": "CVE-2024-6119", "PkgID": "libssl3@3.1.4-r5", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.1.4-r5?arch=x86_64\u0026distro=3.18.6", "UID": "cb6143d4e3627ca9" }, "InstalledVersion": "3.1.4-r5", "FixedVersion": "3.1.7-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:aedc3bda2944bb9bcb6c3d475bee8b460db9a9b0f3e0b33a6ed2fd1ae0f1d445" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-6119", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:428e1ba81235b6ea1ef3b25db90daefd5f5101933e64a23970b220729aa0211a", "Title": "openssl: Possible denial of service in X.509 name checks", "Description": "Issue summary: Applications performing certificate name checks (e.g., TLS\nclients checking server certificates) may attempt to read an invalid memory\naddress resulting in abnormal termination of the application process.\n\nImpact summary: Abnormal termination of an application can a cause a denial of\nservice.\n\nApplications performing certificate name checks (e.g., TLS clients checking\nserver certificates) may attempt to read an invalid memory address when\ncomparing the expected name with an `otherName` subject alternative name of an\nX.509 certificate. This may result in an exception that terminates the\napplication program.\n\nNote that basic certificate chain validation (signatures, dates, ...) is not\naffected, the denial of service can occur only when the application also\nspecifies an expected DNS name, Email address or IP address.\n\nTLS servers rarely solicit client certificates, and even when they do, they\ngenerally don't perform a name check against a reference identifier (expected\nidentity), but rather extract the presented identity after checking the\ncertificate chain. So TLS servers are generally not affected and the severity\nof the issue is Moderate.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.", "Severity": "HIGH", "CweIDs": [ "CWE-843" ], "VendorSeverity": { "alma": 2, "amazon": 2, "azure": 3, "cbl-mariner": 3, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2024/09/03/4", "https://access.redhat.com/errata/RHSA-2024:6783", "https://access.redhat.com/errata/RHSA-2024:8935", "https://access.redhat.com/security/cve/CVE-2024-6119", "https://bugzilla.redhat.com/2306158", "https://bugzilla.redhat.com/show_bug.cgi?id=2306158", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-613116.html", "https://cert-portal.siemens.com/productcert/html/ssa-769027.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6119", "https://errata.almalinux.org/9/ALSA-2024-8935.html", "https://errata.rockylinux.org/RLSA-2024:6783", "https://github.com/advisories/GHSA-7m4m-pwhv-49c5", "https://github.com/openssl/openssl/commit/05f360d9e849a1b277db628f1f13083a7f8dd04f", "https://github.com/openssl/openssl/commit/06d1dc3fa96a2ba5a3e22735a033012aadc9f0d6", "https://github.com/openssl/openssl/commit/621f3729831b05ee828a3203eddb621d014ff2b2", "https://github.com/openssl/openssl/commit/7dfcee2cd2a63b2c64b9b4b0850be64cb695b0a0", "https://github.com/openssl/openssl/security/advisories/GHSA-5qrj-vq78-58fj", "https://linux.oracle.com/cve/CVE-2024-6119.html", "https://linux.oracle.com/errata/ELSA-2024-8935.html", "https://lists.freebsd.org/archives/freebsd-security/2024-September/000303.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-6119", "https://openssl-library.org/news/secadv/20240903.txt", "https://security.netapp.com/advisory/ntap-20240912-0001", "https://security.netapp.com/advisory/ntap-20240912-0001/", "https://ubuntu.com/security/notices/USN-6986-1", "https://ubuntu.com/security/notices/USN-7894-1", "https://www.cve.org/CVERecord?id=CVE-2024-6119" ], "PublishedDate": "2024-09-03T16:15:07.177Z", "LastModifiedDate": "2026-06-17T08:17:19.693Z" }, { "VulnerabilityID": "CVE-2025-26519", "PkgID": "musl@1.2.4-r2", "PkgName": "musl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/musl@1.2.4-r2?arch=x86_64\u0026distro=3.18.6", "UID": "ed590eea03f1e3ce" }, "InstalledVersion": "1.2.4-r2", "FixedVersion": "1.2.4-r3", "Status": "fixed", "Layer": { "DiffID": "sha256:aedc3bda2944bb9bcb6c3d475bee8b460db9a9b0f3e0b33a6ed2fd1ae0f1d445" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-26519", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:3528ee51f929a7c05028dd936ff5e17b294276c4105072a5840f34289f9dbea0", "Title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ...", "Description": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2025/02/13/2", "http://www.openwall.com/lists/oss-security/2025/02/13/3", "http://www.openwall.com/lists/oss-security/2025/02/13/4", "http://www.openwall.com/lists/oss-security/2025/02/13/5", "http://www.openwall.com/lists/oss-security/2025/02/14/5", "http://www.openwall.com/lists/oss-security/2025/02/14/6", "https://git.musl-libc.org/cgit/musl/commit/?id=c47ad25ea3b484e10326f933e927c0bc8cded3da", "https://git.musl-libc.org/cgit/musl/commit/?id=e5adcd97b5196e29991b524237381a0202a60659", "https://www.openwall.com/lists/oss-security/2025/02/13/2" ], "PublishedDate": "2025-02-14T04:15:09.05Z", "LastModifiedDate": "2026-06-17T09:01:57.26Z" }, { "VulnerabilityID": "CVE-2025-26519", "PkgID": "musl-utils@1.2.4-r2", "PkgName": "musl-utils", "PkgIdentifier": { "PURL": "pkg:apk/alpine/musl-utils@1.2.4-r2?arch=x86_64\u0026distro=3.18.6", "UID": "6d5f6f9a2f072221" }, "InstalledVersion": "1.2.4-r2", "FixedVersion": "1.2.4-r3", "Status": "fixed", "Layer": { "DiffID": "sha256:aedc3bda2944bb9bcb6c3d475bee8b460db9a9b0f3e0b33a6ed2fd1ae0f1d445" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-26519", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:e19af18aeec6acdcdc772e0fa33521dd348838af4c04b5c8b706d0975af84e9e", "Title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ...", "Description": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "nvd": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2025/02/13/2", "http://www.openwall.com/lists/oss-security/2025/02/13/3", "http://www.openwall.com/lists/oss-security/2025/02/13/4", "http://www.openwall.com/lists/oss-security/2025/02/13/5", "http://www.openwall.com/lists/oss-security/2025/02/14/5", "http://www.openwall.com/lists/oss-security/2025/02/14/6", "https://git.musl-libc.org/cgit/musl/commit/?id=c47ad25ea3b484e10326f933e927c0bc8cded3da", "https://git.musl-libc.org/cgit/musl/commit/?id=e5adcd97b5196e29991b524237381a0202a60659", "https://www.openwall.com/lists/oss-security/2025/02/13/2" ], "PublishedDate": "2025-02-14T04:15:09.05Z", "LastModifiedDate": "2026-06-17T09:01:57.26Z" }, { "VulnerabilityID": "CVE-2025-31115", "PkgID": "xz-libs@5.4.3-r0", "PkgName": "xz-libs", "PkgIdentifier": { "PURL": "pkg:apk/alpine/xz-libs@5.4.3-r0?arch=x86_64\u0026distro=3.18.6", "UID": "9121c02b4daea091" }, "InstalledVersion": "5.4.3-r0", "FixedVersion": "5.4.3-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:8587de382d4160935c77c5f81856965f03541168f438686cad56cd24212104ff" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-31115", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:0dbe2695f6afa8e1f6daa7e61ee4efa435d416d8266abae5821d1273fecc5504", "Title": "xz: XZ has a heap-use-after-free bug in threaded .xz decoder", "Description": "XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzma_stream_decoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases.", "Severity": "HIGH", "CweIDs": [ "CWE-366", "CWE-416", "CWE-476", "CWE-826" ], "VendorSeverity": { "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2025/04/03/1", "http://www.openwall.com/lists/oss-security/2025/04/03/2", "http://www.openwall.com/lists/oss-security/2025/04/03/3", "https://access.redhat.com/errata/RHSA-2025:7524", "https://access.redhat.com/security/cve/CVE-2025-31115", "https://bugzilla.redhat.com/show_bug.cgi?id=2357249", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31115", "https://errata.rockylinux.org/RLSA-2025:7524", "https://github.com/tukaani-project/xz/commit/d5a2ffe41bb77b918a8c96084885d4dbe4bf6480", "https://github.com/tukaani-project/xz/security/advisories/GHSA-6cc8-p5mm-29w2", "https://linux.oracle.com/cve/CVE-2025-31115.html", "https://linux.oracle.com/errata/ELSA-2025-7524.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-31115", "https://tukaani.org/xz/xz-cve-2025-31115.patch", "https://ubuntu.com/security/notices/USN-7414-1", "https://www.cve.org/CVERecord?id=CVE-2025-31115" ], "PublishedDate": "2025-04-03T17:15:30.54Z", "LastModifiedDate": "2026-06-17T09:09:52.91Z" } ] }, { "Target": "usr/bin/cadvisor", "Class": "lang-pkgs", "Type": "gobinary", "Packages": [ { "ID": "github.com/google/cadvisor/cmd@v0.49.1", "Name": "github.com/google/cadvisor/cmd", "Identifier": { "PURL": "pkg:golang/github.com/google/cadvisor/cmd@v0.49.1", "UID": "a6a3843b2a54923" }, "Version": "v0.49.1", "Relationship": "root", "DependsOn": [ "../", "cloud.google.com/go/compute/metadata@v0.2.3", "github.com/Rican7/retry@v0.3.1", "github.com/Shopify/sarama@v1.37.2", "github.com/abbot/go-http-auth@v0.4.0", "github.com/aws/aws-sdk-go@v1.35.24", "github.com/beorn7/perks@v1.0.1", "github.com/blang/semver/v4@v4.0.0", "github.com/cespare/xxhash/v2@v2.2.0", "github.com/checkpoint-restore/go-criu/v5@v5.3.0", "github.com/cilium/ebpf@v0.7.0", "github.com/containerd/console@v1.0.3", "github.com/containerd/ttrpc@v1.2.2", "github.com/coreos/go-systemd/v22@v22.3.3-0.20220203105225-a9a7ef127534", "github.com/cyphar/filepath-securejoin@v0.2.4", "github.com/davecgh/go-spew@v1.1.1", "github.com/docker/distribution@v2.8.2+incompatible", "github.com/docker/docker@v20.10.27+incompatible", "github.com/docker/go-connections@v0.4.0", "github.com/docker/go-units@v0.5.0", "github.com/eapache/go-resiliency@v1.3.0", "github.com/eapache/go-xerial-snappy@v0.0.0-20180814174437-776d5712da21", "github.com/eapache/queue@v1.1.0", "github.com/euank/go-kmsg-parser@v2.0.0+incompatible", "github.com/go-logr/logr@v1.2.3", "github.com/godbus/dbus/v5@v5.0.6", "github.com/gogo/protobuf@v1.3.2", "github.com/golang/groupcache@v0.0.0-20210331224755-41bb18bfe9da", "github.com/golang/protobuf@v1.5.3", "github.com/golang/snappy@v0.0.4", "github.com/gomodule/redigo@v1.8.9", "github.com/google/s2a-go@v0.1.4", "github.com/google/uuid@v1.3.0", "github.com/googleapis/enterprise-certificate-proxy@v0.2.3", "github.com/googleapis/gax-go/v2@v2.11.0", "github.com/hashicorp/errwrap@v1.0.0", "github.com/hashicorp/go-multierror@v1.1.1", "github.com/hashicorp/go-uuid@v1.0.3", "github.com/influxdb/influxdb@v0.9.6-0.20151125225445-9eab56311373", "github.com/jcmturner/aescts/v2@v2.0.0", "github.com/jcmturner/dnsutils/v2@v2.0.0", "github.com/jcmturner/gofork@v1.7.6", "github.com/jcmturner/gokrb5/v8@v8.4.3", "github.com/jcmturner/rpc/v2@v2.0.3", "github.com/jmespath/go-jmespath@v0.4.0", "github.com/karrick/godirwalk@v1.17.0", "github.com/klauspost/compress@v1.15.11", "github.com/matttproud/golang_protobuf_extensions@v1.0.2", "github.com/mesos/mesos-go@v0.0.11", "github.com/mistifyio/go-zfs@v2.1.2-0.20190413222219-f784269be439+incompatible", "github.com/moby/sys/mountinfo@v0.6.2", "github.com/mrunalp/fileutils@v0.5.1", "github.com/opencontainers/go-digest@v1.0.0", "github.com/opencontainers/image-spec@v1.0.2", "github.com/opencontainers/runc@v1.1.12", "github.com/opencontainers/runtime-spec@v1.0.3-0.20220909204839-494a5a6aca78", "github.com/opencontainers/selinux@v1.10.0", "github.com/pierrec/lz4/v4@v4.1.17", "github.com/pkg/errors@v0.9.1", "github.com/pquerna/ffjson@v0.0.0-20190930134022-aa0246cd15f7", "github.com/prometheus/client_golang@v1.14.0", "github.com/prometheus/client_model@v0.3.0", "github.com/prometheus/common@v0.37.0", "github.com/prometheus/procfs@v0.8.0", "github.com/rcrowley/go-metrics@v0.0.0-20201227073835-cf1acfcdf475", "github.com/sirupsen/logrus@v1.8.1", "github.com/syndtr/gocapability@v0.0.0-20200815063812-42c35b437635", "github.com/vishvananda/netlink@v1.1.0", "github.com/vishvananda/netns@v0.0.0-20191106174202-0a2b9b5464df", "go.opencensus.io@v0.24.0", "golang.org/x/crypto@v0.17.0", "golang.org/x/net@v0.19.0", "golang.org/x/oauth2@v0.10.0", "golang.org/x/sys@v0.15.0", "golang.org/x/text@v0.14.0", "google.golang.org/api@v0.126.0", "google.golang.org/appengine@v1.6.7", "google.golang.org/genproto/googleapis/rpc@v0.0.0-20230803162519-f966b187b2e5", "google.golang.org/grpc@v1.58.3", "google.golang.org/protobuf@v1.31.0", "gopkg.in/olivere/elastic.v2@v2.0.61", "k8s.io/klog/v2@v2.100.1", "k8s.io/utils@v0.0.0-20230406110748-d93618cff8a2", "stdlib@v1.22.0" ], "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "stdlib@v1.22.0", "Name": "stdlib", "Identifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "Version": "v1.22.0", "Relationship": "direct", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "../", "Name": "../", "Identifier": { "UID": "2754dbd13052319" }, "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "cloud.google.com/go/compute/metadata@v0.2.3", "Name": "cloud.google.com/go/compute/metadata", "Identifier": { "PURL": "pkg:golang/cloud.google.com/go/compute/metadata@v0.2.3", "UID": "e8dceb58569e6dc4" }, "Version": "v0.2.3", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Rican7/retry@v0.3.1", "Name": "github.com/Rican7/retry", "Identifier": { "PURL": "pkg:golang/github.com/rican7/retry@v0.3.1", "UID": "542deef38382071" }, "Version": "v0.3.1", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Shopify/sarama@v1.37.2", "Name": "github.com/Shopify/sarama", "Identifier": { "PURL": "pkg:golang/github.com/shopify/sarama@v1.37.2", "UID": "15eb4db55152ea4d" }, "Version": "v1.37.2", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/abbot/go-http-auth@v0.4.0", "Name": "github.com/abbot/go-http-auth", "Identifier": { "PURL": "pkg:golang/github.com/abbot/go-http-auth@v0.4.0", "UID": "4e7a8a2d094a56a1" }, "Version": "v0.4.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go@v1.35.24", "Name": "github.com/aws/aws-sdk-go", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go@v1.35.24", "UID": "3216f703ab95ed42" }, "Version": "v1.35.24", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/beorn7/perks@v1.0.1", "Name": "github.com/beorn7/perks", "Identifier": { "PURL": "pkg:golang/github.com/beorn7/perks@v1.0.1", "UID": "ddcccae4795fc6c3" }, "Version": "v1.0.1", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/blang/semver/v4@v4.0.0", "Name": "github.com/blang/semver/v4", "Identifier": { "PURL": "pkg:golang/github.com/blang/semver/v4@v4.0.0", "UID": "a50d07b0c92d004a" }, "Version": "v4.0.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cespare/xxhash/v2@v2.2.0", "Name": "github.com/cespare/xxhash/v2", "Identifier": { "PURL": "pkg:golang/github.com/cespare/xxhash/v2@v2.2.0", "UID": "17c7febe890e2c99" }, "Version": "v2.2.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/checkpoint-restore/go-criu/v5@v5.3.0", "Name": "github.com/checkpoint-restore/go-criu/v5", "Identifier": { "PURL": "pkg:golang/github.com/checkpoint-restore/go-criu/v5@v5.3.0", "UID": "963065901dae3a11" }, "Version": "v5.3.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cilium/ebpf@v0.7.0", "Name": "github.com/cilium/ebpf", "Identifier": { "PURL": "pkg:golang/github.com/cilium/ebpf@v0.7.0", "UID": "3d9d32c8b5c6c49d" }, "Version": "v0.7.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/containerd/console@v1.0.3", "Name": "github.com/containerd/console", "Identifier": { "PURL": "pkg:golang/github.com/containerd/console@v1.0.3", "UID": "3f6b508a7d5504f8" }, "Version": "v1.0.3", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/containerd/ttrpc@v1.2.2", "Name": "github.com/containerd/ttrpc", "Identifier": { "PURL": "pkg:golang/github.com/containerd/ttrpc@v1.2.2", "UID": "9062387b70da05f1" }, "Version": "v1.2.2", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/coreos/go-systemd/v22@v22.3.3-0.20220203105225-a9a7ef127534", "Name": "github.com/coreos/go-systemd/v22", "Identifier": { "PURL": "pkg:golang/github.com/coreos/go-systemd/v22@v22.3.3-0.20220203105225-a9a7ef127534", "UID": "f7f6547b8dcf2a94" }, "Version": "v22.3.3-0.20220203105225-a9a7ef127534", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cyphar/filepath-securejoin@v0.2.4", "Name": "github.com/cyphar/filepath-securejoin", "Identifier": { "PURL": "pkg:golang/github.com/cyphar/filepath-securejoin@v0.2.4", "UID": "6022d7f17d49cad5" }, "Version": "v0.2.4", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/davecgh/go-spew@v1.1.1", "Name": "github.com/davecgh/go-spew", "Identifier": { "PURL": "pkg:golang/github.com/davecgh/go-spew@v1.1.1", "UID": "2142efa852370a51" }, "Version": "v1.1.1", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/docker/distribution@v2.8.2+incompatible", "Name": "github.com/docker/distribution", "Identifier": { "PURL": "pkg:golang/github.com/docker/distribution@v2.8.2%2Bincompatible", "UID": "ec6a19661c4dd74e" }, "Version": "v2.8.2+incompatible", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/docker/docker@v20.10.27+incompatible", "Name": "github.com/docker/docker", "Identifier": { "PURL": "pkg:golang/github.com/docker/docker@v20.10.27%2Bincompatible", "UID": "2a211494dbbe3a50" }, "Version": "v20.10.27+incompatible", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/docker/go-connections@v0.4.0", "Name": "github.com/docker/go-connections", "Identifier": { "PURL": "pkg:golang/github.com/docker/go-connections@v0.4.0", "UID": "18030af0b1a05621" }, "Version": "v0.4.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/docker/go-units@v0.5.0", "Name": "github.com/docker/go-units", "Identifier": { "PURL": "pkg:golang/github.com/docker/go-units@v0.5.0", "UID": "fe45fa187545c0fc" }, "Version": "v0.5.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/eapache/go-resiliency@v1.3.0", "Name": "github.com/eapache/go-resiliency", "Identifier": { "PURL": "pkg:golang/github.com/eapache/go-resiliency@v1.3.0", "UID": "4f7d9c2fbcf35b4a" }, "Version": "v1.3.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/eapache/go-xerial-snappy@v0.0.0-20180814174437-776d5712da21", "Name": "github.com/eapache/go-xerial-snappy", "Identifier": { "PURL": "pkg:golang/github.com/eapache/go-xerial-snappy@v0.0.0-20180814174437-776d5712da21", "UID": "3bb69a4379c67c5b" }, "Version": "v0.0.0-20180814174437-776d5712da21", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/eapache/queue@v1.1.0", "Name": "github.com/eapache/queue", "Identifier": { "PURL": "pkg:golang/github.com/eapache/queue@v1.1.0", "UID": "481c526439442cf8" }, "Version": "v1.1.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/euank/go-kmsg-parser@v2.0.0+incompatible", "Name": "github.com/euank/go-kmsg-parser", "Identifier": { "PURL": "pkg:golang/github.com/euank/go-kmsg-parser@v2.0.0%2Bincompatible", "UID": "b28077c94c47cc7" }, "Version": "v2.0.0+incompatible", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-logr/logr@v1.2.3", "Name": "github.com/go-logr/logr", "Identifier": { "PURL": "pkg:golang/github.com/go-logr/logr@v1.2.3", "UID": "21e4590c285a49be" }, "Version": "v1.2.3", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/godbus/dbus/v5@v5.0.6", "Name": "github.com/godbus/dbus/v5", "Identifier": { "PURL": "pkg:golang/github.com/godbus/dbus/v5@v5.0.6", "UID": "bacff9aa1efce5b" }, "Version": "v5.0.6", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gogo/protobuf@v1.3.2", "Name": "github.com/gogo/protobuf", "Identifier": { "PURL": "pkg:golang/github.com/gogo/protobuf@v1.3.2", "UID": "a5778292b21eea87" }, "Version": "v1.3.2", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/golang/groupcache@v0.0.0-20210331224755-41bb18bfe9da", "Name": "github.com/golang/groupcache", "Identifier": { "PURL": "pkg:golang/github.com/golang/groupcache@v0.0.0-20210331224755-41bb18bfe9da", "UID": "7d42ef0e25940bd7" }, "Version": "v0.0.0-20210331224755-41bb18bfe9da", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/golang/protobuf@v1.5.3", "Name": "github.com/golang/protobuf", "Identifier": { "PURL": "pkg:golang/github.com/golang/protobuf@v1.5.3", "UID": "fb79802060577c29" }, "Version": "v1.5.3", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/golang/snappy@v0.0.4", "Name": "github.com/golang/snappy", "Identifier": { "PURL": "pkg:golang/github.com/golang/snappy@v0.0.4", "UID": "602d32031e002b2c" }, "Version": "v0.0.4", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gomodule/redigo@v1.8.9", "Name": "github.com/gomodule/redigo", "Identifier": { "PURL": "pkg:golang/github.com/gomodule/redigo@v1.8.9", "UID": "6b40b9f9e50abd18" }, "Version": "v1.8.9", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/s2a-go@v0.1.4", "Name": "github.com/google/s2a-go", "Identifier": { "PURL": "pkg:golang/github.com/google/s2a-go@v0.1.4", "UID": "951caf630db57993" }, "Version": "v0.1.4", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/uuid@v1.3.0", "Name": "github.com/google/uuid", "Identifier": { "PURL": "pkg:golang/github.com/google/uuid@v1.3.0", "UID": "8a3b675637217e0c" }, "Version": "v1.3.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/googleapis/enterprise-certificate-proxy@v0.2.3", "Name": "github.com/googleapis/enterprise-certificate-proxy", "Identifier": { "PURL": "pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.2.3", "UID": "44357da2d5ec0a69" }, "Version": "v0.2.3", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/googleapis/gax-go/v2@v2.11.0", "Name": "github.com/googleapis/gax-go/v2", "Identifier": { "PURL": "pkg:golang/github.com/googleapis/gax-go/v2@v2.11.0", "UID": "8613037e77daa70e" }, "Version": "v2.11.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/errwrap@v1.0.0", "Name": "github.com/hashicorp/errwrap", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/errwrap@v1.0.0", "UID": "9d409372656488e2" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/go-multierror@v1.1.1", "Name": "github.com/hashicorp/go-multierror", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/go-multierror@v1.1.1", "UID": "aa9b12f90d73d53" }, "Version": "v1.1.1", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/go-uuid@v1.0.3", "Name": "github.com/hashicorp/go-uuid", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/go-uuid@v1.0.3", "UID": "e401c875f67fb4ff" }, "Version": "v1.0.3", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/influxdb/influxdb@v0.9.6-0.20151125225445-9eab56311373", "Name": "github.com/influxdb/influxdb", "Identifier": { "PURL": "pkg:golang/github.com/influxdb/influxdb@v0.9.6-0.20151125225445-9eab56311373", "UID": "bbd0f3892fbac865" }, "Version": "v0.9.6-0.20151125225445-9eab56311373", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jcmturner/aescts/v2@v2.0.0", "Name": "github.com/jcmturner/aescts/v2", "Identifier": { "PURL": "pkg:golang/github.com/jcmturner/aescts/v2@v2.0.0", "UID": "e460589528c68e3f" }, "Version": "v2.0.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jcmturner/dnsutils/v2@v2.0.0", "Name": "github.com/jcmturner/dnsutils/v2", "Identifier": { "PURL": "pkg:golang/github.com/jcmturner/dnsutils/v2@v2.0.0", "UID": "cc68e37b2d984476" }, "Version": "v2.0.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jcmturner/gofork@v1.7.6", "Name": "github.com/jcmturner/gofork", "Identifier": { "PURL": "pkg:golang/github.com/jcmturner/gofork@v1.7.6", "UID": "92aa8c86d306538d" }, "Version": "v1.7.6", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jcmturner/gokrb5/v8@v8.4.3", "Name": "github.com/jcmturner/gokrb5/v8", "Identifier": { "PURL": "pkg:golang/github.com/jcmturner/gokrb5/v8@v8.4.3", "UID": "95558120d9c30dc0" }, "Version": "v8.4.3", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jcmturner/rpc/v2@v2.0.3", "Name": "github.com/jcmturner/rpc/v2", "Identifier": { "PURL": "pkg:golang/github.com/jcmturner/rpc/v2@v2.0.3", "UID": "ddfb02f7819dc5d" }, "Version": "v2.0.3", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jmespath/go-jmespath@v0.4.0", "Name": "github.com/jmespath/go-jmespath", "Identifier": { "PURL": "pkg:golang/github.com/jmespath/go-jmespath@v0.4.0", "UID": "6985610b2062692e" }, "Version": "v0.4.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/karrick/godirwalk@v1.17.0", "Name": "github.com/karrick/godirwalk", "Identifier": { "PURL": "pkg:golang/github.com/karrick/godirwalk@v1.17.0", "UID": "9b4970fce1186bdf" }, "Version": "v1.17.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/klauspost/compress@v1.15.11", "Name": "github.com/klauspost/compress", "Identifier": { "PURL": "pkg:golang/github.com/klauspost/compress@v1.15.11", "UID": "9ec5ec075738614" }, "Version": "v1.15.11", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/matttproud/golang_protobuf_extensions@v1.0.2", "Name": "github.com/matttproud/golang_protobuf_extensions", "Identifier": { "PURL": "pkg:golang/github.com/matttproud/golang_protobuf_extensions@v1.0.2", "UID": "69b233ac640e9266" }, "Version": "v1.0.2", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mesos/mesos-go@v0.0.11", "Name": "github.com/mesos/mesos-go", "Identifier": { "PURL": "pkg:golang/github.com/mesos/mesos-go@v0.0.11", "UID": "b6f63d10c66045d" }, "Version": "v0.0.11", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mistifyio/go-zfs@v2.1.2-0.20190413222219-f784269be439+incompatible", "Name": "github.com/mistifyio/go-zfs", "Identifier": { "PURL": "pkg:golang/github.com/mistifyio/go-zfs@v2.1.2-0.20190413222219-f784269be439%2Bincompatible", "UID": "3accb8cccd521789" }, "Version": "v2.1.2-0.20190413222219-f784269be439+incompatible", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/moby/sys/mountinfo@v0.6.2", "Name": "github.com/moby/sys/mountinfo", "Identifier": { "PURL": "pkg:golang/github.com/moby/sys/mountinfo@v0.6.2", "UID": "4cc57d1cc202a062" }, "Version": "v0.6.2", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mrunalp/fileutils@v0.5.1", "Name": "github.com/mrunalp/fileutils", "Identifier": { "PURL": "pkg:golang/github.com/mrunalp/fileutils@v0.5.1", "UID": "a54deefa4f170e5e" }, "Version": "v0.5.1", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/opencontainers/go-digest@v1.0.0", "Name": "github.com/opencontainers/go-digest", "Identifier": { "PURL": "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", "UID": "1121237a3bf187b7" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/opencontainers/image-spec@v1.0.2", "Name": "github.com/opencontainers/image-spec", "Identifier": { "PURL": "pkg:golang/github.com/opencontainers/image-spec@v1.0.2", "UID": "2618f6b28c04b117" }, "Version": "v1.0.2", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/opencontainers/runc@v1.1.12", "Name": "github.com/opencontainers/runc", "Identifier": { "PURL": "pkg:golang/github.com/opencontainers/runc@v1.1.12", "UID": "618dddcb4ee93d7c" }, "Version": "v1.1.12", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/opencontainers/runtime-spec@v1.0.3-0.20220909204839-494a5a6aca78", "Name": "github.com/opencontainers/runtime-spec", "Identifier": { "PURL": "pkg:golang/github.com/opencontainers/runtime-spec@v1.0.3-0.20220909204839-494a5a6aca78", "UID": "618525c745bbdd2" }, "Version": "v1.0.3-0.20220909204839-494a5a6aca78", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/opencontainers/selinux@v1.10.0", "Name": "github.com/opencontainers/selinux", "Identifier": { "PURL": "pkg:golang/github.com/opencontainers/selinux@v1.10.0", "UID": "ec03c84e469e4101" }, "Version": "v1.10.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/pierrec/lz4/v4@v4.1.17", "Name": "github.com/pierrec/lz4/v4", "Identifier": { "PURL": "pkg:golang/github.com/pierrec/lz4/v4@v4.1.17", "UID": "6d1888dcbec642a2" }, "Version": "v4.1.17", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/pkg/errors@v0.9.1", "Name": "github.com/pkg/errors", "Identifier": { "PURL": "pkg:golang/github.com/pkg/errors@v0.9.1", "UID": "ec8aa8a64ba2bf0d" }, "Version": "v0.9.1", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/pquerna/ffjson@v0.0.0-20190930134022-aa0246cd15f7", "Name": "github.com/pquerna/ffjson", "Identifier": { "PURL": "pkg:golang/github.com/pquerna/ffjson@v0.0.0-20190930134022-aa0246cd15f7", "UID": "966060911e5a6931" }, "Version": "v0.0.0-20190930134022-aa0246cd15f7", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/client_golang@v1.14.0", "Name": "github.com/prometheus/client_golang", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/client_golang@v1.14.0", "UID": "39360abcc947656f" }, "Version": "v1.14.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/client_model@v0.3.0", "Name": "github.com/prometheus/client_model", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/client_model@v0.3.0", "UID": "883218ce4651e7d0" }, "Version": "v0.3.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/common@v0.37.0", "Name": "github.com/prometheus/common", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/common@v0.37.0", "UID": "24d0473878b6358d" }, "Version": "v0.37.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/procfs@v0.8.0", "Name": "github.com/prometheus/procfs", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/procfs@v0.8.0", "UID": "5bf73646f2936f4f" }, "Version": "v0.8.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/rcrowley/go-metrics@v0.0.0-20201227073835-cf1acfcdf475", "Name": "github.com/rcrowley/go-metrics", "Identifier": { "PURL": "pkg:golang/github.com/rcrowley/go-metrics@v0.0.0-20201227073835-cf1acfcdf475", "UID": "a87c3ec5528e0925" }, "Version": "v0.0.0-20201227073835-cf1acfcdf475", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sirupsen/logrus@v1.8.1", "Name": "github.com/sirupsen/logrus", "Identifier": { "PURL": "pkg:golang/github.com/sirupsen/logrus@v1.8.1", "UID": "2dea3632c0028381" }, "Version": "v1.8.1", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/syndtr/gocapability@v0.0.0-20200815063812-42c35b437635", "Name": "github.com/syndtr/gocapability", "Identifier": { "PURL": "pkg:golang/github.com/syndtr/gocapability@v0.0.0-20200815063812-42c35b437635", "UID": "5e36655012f5789a" }, "Version": "v0.0.0-20200815063812-42c35b437635", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/vishvananda/netlink@v1.1.0", "Name": "github.com/vishvananda/netlink", "Identifier": { "PURL": "pkg:golang/github.com/vishvananda/netlink@v1.1.0", "UID": "2493106d844049c0" }, "Version": "v1.1.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/vishvananda/netns@v0.0.0-20191106174202-0a2b9b5464df", "Name": "github.com/vishvananda/netns", "Identifier": { "PURL": "pkg:golang/github.com/vishvananda/netns@v0.0.0-20191106174202-0a2b9b5464df", "UID": "a36aefdb1d5fc1ba" }, "Version": "v0.0.0-20191106174202-0a2b9b5464df", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opencensus.io@v0.24.0", "Name": "go.opencensus.io", "Identifier": { "PURL": "pkg:golang/go.opencensus.io@v0.24.0", "UID": "65ad640ee1f95601" }, "Version": "v0.24.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/crypto@v0.17.0", "Name": "golang.org/x/crypto", "Identifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.17.0", "UID": "49c4d27774de0dce" }, "Version": "v0.17.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/net@v0.19.0", "Name": "golang.org/x/net", "Identifier": { "PURL": "pkg:golang/golang.org/x/net@v0.19.0", "UID": "1ba10a08b5703a5c" }, "Version": "v0.19.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/oauth2@v0.10.0", "Name": "golang.org/x/oauth2", "Identifier": { "PURL": "pkg:golang/golang.org/x/oauth2@v0.10.0", "UID": "dc9284b1c8aa62c9" }, "Version": "v0.10.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/sys@v0.15.0", "Name": "golang.org/x/sys", "Identifier": { "PURL": "pkg:golang/golang.org/x/sys@v0.15.0", "UID": "2197ec67a9874781" }, "Version": "v0.15.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/text@v0.14.0", "Name": "golang.org/x/text", "Identifier": { "PURL": "pkg:golang/golang.org/x/text@v0.14.0", "UID": "3e75f675a5fc04c7" }, "Version": "v0.14.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/api@v0.126.0", "Name": "google.golang.org/api", "Identifier": { "PURL": "pkg:golang/google.golang.org/api@v0.126.0", "UID": "8ad0d598fd6fc589" }, "Version": "v0.126.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/appengine@v1.6.7", "Name": "google.golang.org/appengine", "Identifier": { "PURL": "pkg:golang/google.golang.org/appengine@v1.6.7", "UID": "1c815736a24eb86a" }, "Version": "v1.6.7", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/genproto/googleapis/rpc@v0.0.0-20230803162519-f966b187b2e5", "Name": "google.golang.org/genproto/googleapis/rpc", "Identifier": { "PURL": "pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20230803162519-f966b187b2e5", "UID": "e8bb0caf3e922e3a" }, "Version": "v0.0.0-20230803162519-f966b187b2e5", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/grpc@v1.58.3", "Name": "google.golang.org/grpc", "Identifier": { "PURL": "pkg:golang/google.golang.org/grpc@v1.58.3", "UID": "695dd48a89a4d663" }, "Version": "v1.58.3", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/protobuf@v1.31.0", "Name": "google.golang.org/protobuf", "Identifier": { "PURL": "pkg:golang/google.golang.org/protobuf@v1.31.0", "UID": "812df50c21e328ce" }, "Version": "v1.31.0", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "gopkg.in/olivere/elastic.v2@v2.0.61", "Name": "gopkg.in/olivere/elastic.v2", "Identifier": { "PURL": "pkg:golang/gopkg.in/olivere/elastic.v2@v2.0.61", "UID": "3ea2e9ebde8aff50" }, "Version": "v2.0.61", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "k8s.io/klog/v2@v2.100.1", "Name": "k8s.io/klog/v2", "Identifier": { "PURL": "pkg:golang/k8s.io/klog/v2@v2.100.1", "UID": "9145a813926f5581" }, "Version": "v2.100.1", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" }, { "ID": "k8s.io/utils@v0.0.0-20230406110748-d93618cff8a2", "Name": "k8s.io/utils", "Identifier": { "PURL": "pkg:golang/k8s.io/utils@v0.0.0-20230406110748-d93618cff8a2", "UID": "3b36a9c93329454d" }, "Version": "v0.0.0-20230406110748-d93618cff8a2", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "AnalyzedBy": "gobinary" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2024-41110", "VendorIDs": [ "GHSA-v23v-6jw2-98fq" ], "PkgID": "github.com/docker/docker@v20.10.27+incompatible", "PkgName": "github.com/docker/docker", "PkgIdentifier": { "PURL": "pkg:golang/github.com/docker/docker@v20.10.27%2Bincompatible", "UID": "2a211494dbbe3a50" }, "InstalledVersion": "v20.10.27+incompatible", "FixedVersion": "23.0.15, 26.1.5, 27.1.1, 25.0.6", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-41110", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:13c7f52ef62ff941a0a2bf976266c6b8012c107c7f4f94dacae1cf519a9c0f1c", "Title": "moby: Authz zero length regression", "Description": "Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is low.\n\nUsing a specially-crafted API request, an Engine API client could make the daemon forward the request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it.\n\nA security issue was discovered In 2018, where an attacker could bypass AuthZ plugins using a specially crafted API request. This could lead to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later major versions, resulting in a regression. Anyone who depends on authorization plugins that introspect the request and/or response body to make access control decisions is potentially impacted.\n\nDocker EE v19.03.x and all versions of Mirantis Container Runtime are not vulnerable.\n\ndocker-ce v27.1.1 containes patches to fix the vulnerability. Patches have also been merged into the master, 19.03, 20.0, 23.0, 24.0, 25.0, 26.0, and 26.1 release branches. If one is unable to upgrade immediately, avoid using AuthZ plugins and/or restrict access to the Docker API to trusted parties, following the principle of least privilege.", "Severity": "CRITICAL", "CweIDs": [ "CWE-187", "CWE-444", "CWE-863" ], "VendorSeverity": { "amazon": 3, "azure": 4, "bottlerocket": 3, "cbl-mariner": 4, "ghsa": 4, "photon": 4, "redhat": 4, "ubuntu": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "V3Score": 10, "V40Score": 9.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 9.9 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41110", "https://access.redhat.com/security/cve/CVE-2024-41110", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-2v9q-99m9-j8g2", "https://github.com/moby/moby", "https://github.com/moby/moby/commit/411e817ddf710ff8e08fa193da80cb78af708191", "https://github.com/moby/moby/commit/42f40b1d6dd7562342f832b9cd2adf9e668eeb76", "https://github.com/moby/moby/commit/65cc597cea28cdc25bea3b8a86384b4251872919", "https://github.com/moby/moby/commit/852759a7df454cbf88db4e954c919becd48faa9b", "https://github.com/moby/moby/commit/a31260625655cff9ae226b51757915e275e304b0", "https://github.com/moby/moby/commit/a79fabbfe84117696a19671f4aa88b82d0f64fc1", "https://github.com/moby/moby/commit/ae160b4edddb72ef4bd71f66b975a1a1cc434f00", "https://github.com/moby/moby/commit/ae2b3666c517c96cbc2adf1af5591a6b00d4ec0f", "https://github.com/moby/moby/commit/cc13f952511154a2866bddbb7dddebfe9e83b801", "https://github.com/moby/moby/commit/fc274cd2ff4cf3b48c91697fb327dd1fb95588fb", "https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq", "https://lists.debian.org/debian-lts-announce/2024/10/msg00009.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-41110", "https://security.netapp.com/advisory/ntap-20240802-0001/", "https://ubuntu.com/security/notices/USN-7161-1", "https://ubuntu.com/security/notices/USN-7161-2", "https://ubuntu.com/security/notices/USN-7161-3", "https://www.cve.org/CVERecord?id=CVE-2024-41110", "https://www.docker.com/blog/docker-security-advisory-docker-engine-authz-plugin", "https://www.docker.com/blog/docker-security-advisory-docker-engine-authz-plugin/" ], "PublishedDate": "2024-07-24T17:15:11.053Z", "LastModifiedDate": "2026-06-17T07:47:17.503Z" }, { "VulnerabilityID": "CVE-2026-41567", "VendorIDs": [ "GHSA-x86f-5xw2-fm2r" ], "PkgID": "github.com/docker/docker@v20.10.27+incompatible", "PkgName": "github.com/docker/docker", "PkgIdentifier": { "PURL": "pkg:golang/github.com/docker/docker@v20.10.27%2Bincompatible", "UID": "2a211494dbbe3a50" }, "InstalledVersion": "v20.10.27+incompatible", "Status": "affected", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-41567", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:5dfab58ab32b4f4bb6cb4cd04de54a18a273d8218e11987bc70c09d7b1e18af7", "Title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "Description": "Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images", "Severity": "HIGH", "CweIDs": [ "CWE-427" ], "VendorSeverity": { "amazon": 3, "ghsa": 3, "photon": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N", "V3Score": 7.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:51057", "https://access.redhat.com/security/cve/CVE-2026-41567", "https://bugzilla.redhat.com/show_bug.cgi?id=2485356", "https://github.com/moby/moby", "https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r", "https://nvd.nist.gov/vuln/detail/CVE-2026-41567", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41567.json", "https://www.cve.org/CVERecord?id=CVE-2026-41567" ], "PublishedDate": "2026-06-05T02:17:13.817Z", "LastModifiedDate": "2026-09-09T13:19:53.313Z" }, { "VulnerabilityID": "CVE-2026-42306", "VendorIDs": [ "GHSA-rg2x-37c3-w2rh" ], "PkgID": "github.com/docker/docker@v20.10.27+incompatible", "PkgName": "github.com/docker/docker", "PkgIdentifier": { "PURL": "pkg:golang/github.com/docker/docker@v20.10.27%2Bincompatible", "UID": "2a211494dbbe3a50" }, "InstalledVersion": "v20.10.27+incompatible", "Status": "affected", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42306", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:10cb226f375e7f183d2a14680c5419c268dc38940434646c41023ba5e03867a5", "Title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "Description": "Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.", "Severity": "HIGH", "CweIDs": [ "CWE-61", "CWE-367" ], "VendorSeverity": { "amazon": 3, "ghsa": 3, "nvd": 3, "photon": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.2 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-42306", "https://github.com/moby/moby", "https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh", "https://nvd.nist.gov/vuln/detail/CVE-2026-42306", "https://www.cve.org/CVERecord?id=CVE-2026-42306" ], "PublishedDate": "2026-06-12T19:16:27.49Z", "LastModifiedDate": "2026-06-17T10:47:39.96Z" }, { "VulnerabilityID": "CVE-2026-63209", "VendorIDs": [ "GHSA-259r-337f-4rfw" ], "PkgID": "github.com/klauspost/compress@v1.15.11", "PkgName": "github.com/klauspost/compress", "PkgIdentifier": { "PURL": "pkg:golang/github.com/klauspost/compress@v1.15.11", "UID": "9ec5ec075738614" }, "InstalledVersion": "v1.15.11", "FixedVersion": "1.18.7", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63209", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:612f9d049382b1e6eb1756be2dcb39d882fb65be09639e8b6fc32bb7cb1b62de", "Title": "github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing", "Description": "compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.", "Severity": "HIGH", "CweIDs": [ "CWE-190", "CWE-787" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63209", "https://github.com/klauspost/compress", "https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536", "https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa", "https://github.com/klauspost/compress/pull/1163", "https://github.com/klauspost/compress/releases/tag/v1.18.7", "https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw", "https://nvd.nist.gov/vuln/detail/CVE-2026-63209", "https://www.cve.org/CVERecord?id=CVE-2026-63209" ], "PublishedDate": "2026-09-29T15:17:27.13Z", "LastModifiedDate": "2026-09-30T19:57:08.043Z" }, { "VulnerabilityID": "CVE-2025-31133", "VendorIDs": [ "GHSA-9493-h29p-rfm2" ], "PkgID": "github.com/opencontainers/runc@v1.1.12", "PkgName": "github.com/opencontainers/runc", "PkgIdentifier": { "PURL": "pkg:golang/github.com/opencontainers/runc@v1.1.12", "UID": "618dddcb4ee93d7c" }, "InstalledVersion": "v1.1.12", "FixedVersion": "1.2.8, 1.3.3, 1.4.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-31133", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:a3317219d7a4da01aa621446ee03770c68e235d41d7e99416f3b9d1a431037a1", "Title": "runc: container escape via 'masked path' abuse due to mount race conditions", "Description": "runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack: an arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape, or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.", "Severity": "HIGH", "CweIDs": [ "CWE-61", "CWE-363" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "cbl-mariner": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "V40Score": 7.3 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 8.2 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31133", "https://access.redhat.com/errata/RHSA-2025:20957", "https://access.redhat.com/security/cve/CVE-2025-31133", "https://bugzilla.redhat.com/2404705", "https://bugzilla.redhat.com/2404708", "https://bugzilla.redhat.com/2404715", "https://bugzilla.redhat.com/show_bug.cgi?id=2404705", "https://bugzilla.redhat.com/show_bug.cgi?id=2404708", "https://bugzilla.redhat.com/show_bug.cgi?id=2404715", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52565", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52881", "https://errata.almalinux.org/9/ALSA-2025-20957.html", "https://errata.rockylinux.org/RLSA-2025:20957", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/10.9.0/BRSA-teob8iclrtit.toml", "https://github.com/opencontainers/runc", "https://github.com/opencontainers/runc/commit/1a30a8f3d921acbbb6a4bb7e99da2c05f8d48522", "https://github.com/opencontainers/runc/commit/5d7b2424072449872d1cd0c937f2ca25f418eb66", "https://github.com/opencontainers/runc/commit/8476df83b534a2522b878c0507b3491def48db9f", "https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64", "https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2", "https://linux.oracle.com/cve/CVE-2025-31133.html", "https://linux.oracle.com/errata/ELSA-2025-21232.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-31133", "https://ubuntu.com/security/notices/USN-7851-1", "https://www.cve.org/CVERecord?id=CVE-2025-31133" ], "PublishedDate": "2025-11-06T19:15:41.343Z", "LastModifiedDate": "2026-10-07T21:10:00.2Z" }, { "VulnerabilityID": "CVE-2025-52565", "VendorIDs": [ "GHSA-qw9x-cqr3-wc7r" ], "PkgID": "github.com/opencontainers/runc@v1.1.12", "PkgName": "github.com/opencontainers/runc", "PkgIdentifier": { "PURL": "pkg:golang/github.com/opencontainers/runc@v1.1.12", "UID": "618dddcb4ee93d7c" }, "InstalledVersion": "v1.1.12", "FixedVersion": "1.2.8, 1.3.3, 1.4.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-52565", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:cefb16178590dba162fe9e905bfed59ae3b2116181547926aa8c008cccf2ff99", "Title": "runc: container escape with malicious config due to /dev/console mount and related races", "Description": "runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers that allocate a console). This happens after `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively). This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.", "Severity": "HIGH", "CweIDs": [ "CWE-61", "CWE-363" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "cbl-mariner": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "V40Score": 7.3 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 8.2 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52565", "https://access.redhat.com/errata/RHSA-2025:20957", "https://access.redhat.com/security/cve/CVE-2025-52565", "https://bugzilla.redhat.com/2404705", "https://bugzilla.redhat.com/2404708", "https://bugzilla.redhat.com/2404715", "https://bugzilla.redhat.com/show_bug.cgi?id=2404705", "https://bugzilla.redhat.com/show_bug.cgi?id=2404708", "https://bugzilla.redhat.com/show_bug.cgi?id=2404715", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31133", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52565", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52881", "https://errata.almalinux.org/9/ALSA-2025-20957.html", "https://errata.rockylinux.org/RLSA-2025:20957", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/10.9.0/BRSA-kvjmd7tqofdu.toml", "https://github.com/opencontainers/runc", "https://github.com/opencontainers/runc/commit/01de9d65dc72f67b256ef03f9bfb795a2bf143b4", "https://github.com/opencontainers/runc/commit/398955bccb7f20565c224a3064d331c19e422398", "https://github.com/opencontainers/runc/commit/531ef794e4ecd628006a865ad334a048ee2b4b2e", "https://github.com/opencontainers/runc/commit/9be1dbf4ac67d9840a043ebd2df5c68f36705d1d", "https://github.com/opencontainers/runc/commit/aee7d3fe355dd02939d44155e308ea0052e0d53a", "https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64", "https://github.com/opencontainers/runc/commit/de87203e625cd7a27141fb5f2ad00a320c69c5e8", "https://github.com/opencontainers/runc/commit/ff94f9991bd32076c871ef0ad8bc1b763458e480", "https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r", "https://linux.oracle.com/cve/CVE-2025-52565.html", "https://linux.oracle.com/errata/ELSA-2025-21232.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-52565", "https://ubuntu.com/security/notices/USN-7851-1", "https://www.cve.org/CVERecord?id=CVE-2025-52565" ], "PublishedDate": "2025-11-06T20:15:49.24Z", "LastModifiedDate": "2026-06-17T09:36:41.353Z" }, { "VulnerabilityID": "CVE-2025-52881", "VendorIDs": [ "GHSA-cgrx-mc8f-2prm" ], "PkgID": "github.com/opencontainers/runc@v1.1.12", "PkgName": "github.com/opencontainers/runc", "PkgIdentifier": { "PURL": "pkg:golang/github.com/opencontainers/runc@v1.1.12", "UID": "618dddcb4ee93d7c" }, "InstalledVersion": "v1.1.12", "FixedVersion": "1.2.8, 1.3.3, 1.4.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-52881", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:eeee2043bfad7633ab9e6a18cb894e93c416a3ad997c7ca12ef4d2a166d36384", "Title": "runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects", "Description": "runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.", "Severity": "HIGH", "CweIDs": [ "CWE-61", "CWE-363" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bottlerocket": 3, "cbl-mariner": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "V40Score": 7.3 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 8.2 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52881", "http://github.com/opencontainers/runc/commit/a41366e74080fa9f26a2cd3544e2801449697322", "http://github.com/opencontainers/runc/commit/fdcc9d3cad2f85954a241ccb910a61aaa1ef47f3", "https://access.redhat.com/errata/RHSA-2025:22011", "https://access.redhat.com/security/cve/CVE-2025-52881", "https://bugzilla.redhat.com/2404715", "https://bugzilla.redhat.com/2407258", "https://bugzilla.redhat.com/show_bug.cgi?id=2404715", "https://bugzilla.redhat.com/show_bug.cgi?id=2407258", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52881", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58183", "https://errata.almalinux.org/9/ALSA-2025-22011.html", "https://errata.rockylinux.org/RLSA-2025:22011", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/10.9.0/BRSA-fokfzmhxepqx.toml", "https://github.com/opencontainers/runc", "https://github.com/opencontainers/runc/blob/v1.4.0-rc.2/RELEASES.md", "https://github.com/opencontainers/runc/commit/3f925525b44d247e390e529e772a0dc0c0bc3557", "https://github.com/opencontainers/runc/commit/435cc81be6b79cdec73b4002c0dae549b2f6ae6d", "https://github.com/opencontainers/runc/commit/44a0fcf685db051c80b8c269812bb177f5802c58", "https://github.com/opencontainers/runc/commit/4b37cd93f86e72feac866442988b549b5b7bf3e6", "https://github.com/opencontainers/runc/commit/6fc191449109ea14bb7d61238f24a33fe08c651f", "https://github.com/opencontainers/runc/commit/77889b56db939c323d29d1130f28f9aea2edb544", "https://github.com/opencontainers/runc/commit/77d217c7c3775d8ca5af89e477e81568ef4572db", "https://github.com/opencontainers/runc/commit/a41366e74080fa9f26a2cd3544e2801449697322", "https://github.com/opencontainers/runc/commit/b3dd1bc562ed9996d1a0f249e056c16624046d28", "https://github.com/opencontainers/runc/commit/d40b3439a9614a86e87b81a94c6811ec6fa2d7d2", "https://github.com/opencontainers/runc/commit/d61fd29d854b416feaaf128bf650325cd2182165", "https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64", "https://github.com/opencontainers/runc/commit/ed6b1693b8b3ae7eb0250a7e76fc888cdacf98c1", "https://github.com/opencontainers/runc/commit/fdcc9d3cad2f85954a241ccb910a61aaa1ef47f3", "https://github.com/opencontainers/runc/commit/ff6fe1324663538167eca8b3d3eec61e1bd4fa51", "https://github.com/opencontainers/runc/commit/ff94f9991bd32076c871ef0ad8bc1b763458e480", "https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2", "https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm", "https://github.com/opencontainers/runc/security/advisories/GHSA-fh74-hm69-rqjw", "https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r", "https://github.com/opencontainers/selinux/pull/237", "https://github.com/opencontainers/selinux/releases/tag/v1.13.0", "https://linux.oracle.com/cve/CVE-2025-52881.html", "https://linux.oracle.com/errata/ELSA-2025-23543.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-52881", "https://pkg.go.dev/github.com/cyphar/filepath-securejoin/pathrs-lite/procfs", "https://ubuntu.com/security/notices/USN-7851-1", "https://www.cve.org/CVERecord?id=CVE-2025-52881", "https://youtu.be/tGseJW_uBB8", "https://youtu.be/y1PaBzxwRWQ" ], "PublishedDate": "2025-11-06T21:15:42.817Z", "LastModifiedDate": "2026-10-07T21:10:00.2Z" }, { "VulnerabilityID": "CVE-2025-52881", "VendorIDs": [ "GHSA-cgrx-mc8f-2prm" ], "PkgID": "github.com/opencontainers/selinux@v1.10.0", "PkgName": "github.com/opencontainers/selinux", "PkgIdentifier": { "PURL": "pkg:golang/github.com/opencontainers/selinux@v1.10.0", "UID": "ec03c84e469e4101" }, "InstalledVersion": "v1.10.0", "FixedVersion": "1.13.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-52881", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:014b9ee2b8d85556b360454fd1415dcb3c6a34b6bf1607b3dd16811743160d55", "Title": "runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects", "Description": "runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.", "Severity": "HIGH", "CweIDs": [ "CWE-61", "CWE-363" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bottlerocket": 3, "cbl-mariner": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "V40Score": 7.3 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 8.2 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52881", "http://github.com/opencontainers/runc/commit/a41366e74080fa9f26a2cd3544e2801449697322", "http://github.com/opencontainers/runc/commit/fdcc9d3cad2f85954a241ccb910a61aaa1ef47f3", "https://access.redhat.com/errata/RHSA-2025:22011", "https://access.redhat.com/security/cve/CVE-2025-52881", "https://bugzilla.redhat.com/2404715", "https://bugzilla.redhat.com/2407258", "https://bugzilla.redhat.com/show_bug.cgi?id=2404715", "https://bugzilla.redhat.com/show_bug.cgi?id=2407258", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52881", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58183", "https://errata.almalinux.org/9/ALSA-2025-22011.html", "https://errata.rockylinux.org/RLSA-2025:22011", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/10.9.0/BRSA-fokfzmhxepqx.toml", "https://github.com/opencontainers/runc", "https://github.com/opencontainers/runc/blob/v1.4.0-rc.2/RELEASES.md", "https://github.com/opencontainers/runc/commit/3f925525b44d247e390e529e772a0dc0c0bc3557", "https://github.com/opencontainers/runc/commit/435cc81be6b79cdec73b4002c0dae549b2f6ae6d", "https://github.com/opencontainers/runc/commit/44a0fcf685db051c80b8c269812bb177f5802c58", "https://github.com/opencontainers/runc/commit/4b37cd93f86e72feac866442988b549b5b7bf3e6", "https://github.com/opencontainers/runc/commit/6fc191449109ea14bb7d61238f24a33fe08c651f", "https://github.com/opencontainers/runc/commit/77889b56db939c323d29d1130f28f9aea2edb544", "https://github.com/opencontainers/runc/commit/77d217c7c3775d8ca5af89e477e81568ef4572db", "https://github.com/opencontainers/runc/commit/a41366e74080fa9f26a2cd3544e2801449697322", "https://github.com/opencontainers/runc/commit/b3dd1bc562ed9996d1a0f249e056c16624046d28", "https://github.com/opencontainers/runc/commit/d40b3439a9614a86e87b81a94c6811ec6fa2d7d2", "https://github.com/opencontainers/runc/commit/d61fd29d854b416feaaf128bf650325cd2182165", "https://github.com/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64", "https://github.com/opencontainers/runc/commit/ed6b1693b8b3ae7eb0250a7e76fc888cdacf98c1", "https://github.com/opencontainers/runc/commit/fdcc9d3cad2f85954a241ccb910a61aaa1ef47f3", "https://github.com/opencontainers/runc/commit/ff6fe1324663538167eca8b3d3eec61e1bd4fa51", "https://github.com/opencontainers/runc/commit/ff94f9991bd32076c871ef0ad8bc1b763458e480", "https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2", "https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm", "https://github.com/opencontainers/runc/security/advisories/GHSA-fh74-hm69-rqjw", "https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r", "https://github.com/opencontainers/selinux/pull/237", "https://github.com/opencontainers/selinux/releases/tag/v1.13.0", "https://linux.oracle.com/cve/CVE-2025-52881.html", "https://linux.oracle.com/errata/ELSA-2025-23543.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-52881", "https://pkg.go.dev/github.com/cyphar/filepath-securejoin/pathrs-lite/procfs", "https://ubuntu.com/security/notices/USN-7851-1", "https://www.cve.org/CVERecord?id=CVE-2025-52881", "https://youtu.be/tGseJW_uBB8", "https://youtu.be/y1PaBzxwRWQ" ], "PublishedDate": "2025-11-06T21:15:42.817Z", "LastModifiedDate": "2026-10-07T21:10:00.2Z" }, { "VulnerabilityID": "CVE-2025-65637", "VendorIDs": [ "GHSA-4f99-4q7p-p3gh" ], "PkgID": "github.com/sirupsen/logrus@v1.8.1", "PkgName": "github.com/sirupsen/logrus", "PkgIdentifier": { "PURL": "pkg:golang/github.com/sirupsen/logrus@v1.8.1", "UID": "2dea3632c0028381" }, "InstalledVersion": "v1.8.1", "FixedVersion": "1.8.3, 1.9.1, 1.9.3", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-65637", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:c917deac97baf0c3e649b02773b2c6d7ddeb1d7ab2fc8f9592cd5b62812e53d8", "Title": "github.com/sirupsen/logrus: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload", "Description": "A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with \"token too long\" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions \u003c 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "cbl-mariner": 2, "ghsa": 3, "oracle-oval": 3, "redhat": 2, "rocky": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:3428", "https://access.redhat.com/security/cve/CVE-2025-65637", "https://bugzilla.redhat.com/2268022", "https://bugzilla.redhat.com/2418462", "https://bugzilla.redhat.com/2418900", "https://bugzilla.redhat.com/show_bug.cgi?id=2268022", "https://bugzilla.redhat.com/show_bug.cgi?id=2418462", "https://bugzilla.redhat.com/show_bug.cgi?id=2418900", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24785", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-65637", "https://errata.almalinux.org/8/ALSA-2026-3428.html", "https://errata.rockylinux.org/RLSA-2026:3428", "https://github.com/mjuanxd/logrus-dos-poc", "https://github.com/mjuanxd/logrus-dos-poc/blob/main/README.md", "https://github.com/sirupsen/logrus", "https://github.com/sirupsen/logrus/commit/6acd903758687c4a3db3c11701e6c414fcf1c1f7", "https://github.com/sirupsen/logrus/issues/1370", "https://github.com/sirupsen/logrus/pull/1376", "https://github.com/sirupsen/logrus/releases/tag/v1.8.3", "https://github.com/sirupsen/logrus/releases/tag/v1.9.1", "https://github.com/sirupsen/logrus/releases/tag/v1.9.3", "https://linux.oracle.com/cve/CVE-2025-65637.html", "https://linux.oracle.com/errata/ELSA-2026-3428.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-65637", "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSIRUPSENLOGRUS-5564391", "https://www.cve.org/CVERecord?id=CVE-2025-65637" ], "PublishedDate": "2025-12-04T19:16:05.223Z", "LastModifiedDate": "2026-11-04T22:10:00.21Z" }, { "VulnerabilityID": "CVE-2024-45337", "VendorIDs": [ "GHSA-v778-237x-gjrc", "GO-2024-3321" ], "PkgID": "golang.org/x/crypto@v0.17.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.17.0", "UID": "49c4d27774de0dce" }, "InstalledVersion": "v0.17.0", "FixedVersion": "0.31.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-45337", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:93d7d9df968ae3d9508b173d5604a284eea9564597dafde16e320913d383cc27", "Title": "golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto", "Description": "Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.", "Severity": "HIGH", "VendorSeverity": { "amazon": 3, "azure": 4, "cbl-mariner": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "V3Score": 8.2 } }, "References": [ "http://www.openwall.com/lists/oss-security/2024/12/11/2", "https://access.redhat.com/security/cve/CVE-2024-45337", "https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909", "https://go-review.googlesource.com/c/crypto/+/635315/", "https://go.dev/cl/635315", "https://go.dev/issue/70779", "https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ", "https://nvd.nist.gov/vuln/detail/CVE-2024-45337", "https://pkg.go.dev/vuln/GO-2024-3321", "https://security.netapp.com/advisory/ntap-20250131-0007/", "https://ubuntu.com/security/notices/USN-7839-1", "https://ubuntu.com/security/notices/USN-7839-2", "https://www.cve.org/CVERecord?id=CVE-2024-45337" ], "PublishedDate": "2024-12-12T02:02:07.97Z", "LastModifiedDate": "2026-06-17T07:54:03.36Z" }, { "VulnerabilityID": "CVE-2025-22869", "VendorIDs": [ "GO-2025-3487" ], "PkgID": "golang.org/x/crypto@v0.17.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.17.0", "UID": "49c4d27774de0dce" }, "InstalledVersion": "v0.17.0", "FixedVersion": "0.35.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-22869", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:20cfd859e5043245a1a9c3bbb6d51c0542c4ac0c37e567426e2ef1e4d4e09c4d", "Title": "golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh", "Description": "SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "cbl-mariner": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2025:3833", "https://access.redhat.com/errata/RHSA-2025:7416", "https://access.redhat.com/security/cve/CVE-2025-22869", "https://bugzilla.redhat.com/2348367", "https://bugzilla.redhat.com/show_bug.cgi?id=2348367", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22869", "https://errata.almalinux.org/9/ALSA-2025-3833.html", "https://errata.rockylinux.org/RLSA-2025:7416", "https://github.com/golang/go/issues/71931", "https://go-review.googlesource.com/c/crypto/+/652135", "https://go.dev/cl/652135", "https://go.dev/issue/71931", "https://linux.oracle.com/cve/CVE-2025-22869.html", "https://linux.oracle.com/errata/ELSA-2025-7484.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-22869", "https://pkg.go.dev/vuln/GO-2025-3487", "https://security.netapp.com/advisory/ntap-20250411-0010/", "https://ubuntu.com/security/notices/USN-8519-1", "https://www.cve.org/CVERecord?id=CVE-2025-22869" ], "PublishedDate": "2025-02-26T08:14:24.997Z", "LastModifiedDate": "2026-06-17T08:50:40.113Z" }, { "VulnerabilityID": "CVE-2025-47913", "VendorIDs": [ "GO-2025-4116" ], "PkgID": "golang.org/x/crypto@v0.17.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.17.0", "UID": "49c4d27774de0dce" }, "InstalledVersion": "v0.17.0", "FixedVersion": "0.43.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-47913", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:b42f1e46f87f0b65871535edbbf54c27c540954e136dc3ec68532f71a3068f3c", "Title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS", "Description": "SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.", "Severity": "HIGH", "CweIDs": [ "CWE-617" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "cbl-mariner": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:0470", "https://access.redhat.com/security/cve/CVE-2025-47913", "https://bugzilla.redhat.com/2414943", "https://bugzilla.redhat.com/show_bug.cgi?id=2414943", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47913", "https://errata.almalinux.org/9/ALSA-2026-0470.html", "https://errata.rockylinux.org/RLSA-2026:0470", "https://github.com/advisories/GHSA-56w8-48fp-6mgv", "https://github.com/advisories/GHSA-hcg3-q754-cr77", "https://go-review.googlesource.com/c/crypto/+/700295", "https://go.dev/cl/700295", "https://go.dev/issue/75178", "https://linux.oracle.com/cve/CVE-2025-47913.html", "https://linux.oracle.com/errata/ELSA-2026-0753.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-47913", "https://pkg.go.dev/vuln/GO-2025-4116", "https://ubuntu.com/security/notices/USN-8519-1", "https://www.cve.org/CVERecord?id=CVE-2025-47913" ], "PublishedDate": "2025-11-13T22:15:51.28Z", "LastModifiedDate": "2026-10-18T20:10:00.11Z" }, { "VulnerabilityID": "CVE-2026-39828", "VendorIDs": [ "GO-2026-5014" ], "PkgID": "golang.org/x/crypto@v0.17.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.17.0", "UID": "49c4d27774de0dce" }, "InstalledVersion": "v0.17.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39828", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:41f9b98bbbf0b5f9707f52a273402de1d74985371192f0c87ec3d66522573a0e", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions", "Description": "When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.", "Severity": "HIGH", "CweIDs": [ "CWE-295", "CWE-281" ], "VendorSeverity": { "amazon": 2, "azure": 2, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:36105", "https://access.redhat.com/errata/RHSA-2026:36167", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:37268", "https://access.redhat.com/errata/RHSA-2026:37271", "https://access.redhat.com/errata/RHSA-2026:37272", "https://access.redhat.com/errata/RHSA-2026:37278", "https://access.redhat.com/errata/RHSA-2026:37286", "https://access.redhat.com/errata/RHSA-2026:37296", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:40969", "https://access.redhat.com/errata/RHSA-2026:40972", "https://access.redhat.com/errata/RHSA-2026:40974", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:46903", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51038", "https://access.redhat.com/errata/RHSA-2026:52857", "https://access.redhat.com/errata/RHSA-2026:52910", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66521", "https://access.redhat.com/security/cve/CVE-2026-39828", "https://bugzilla.redhat.com/show_bug.cgi?id=2480687", "https://go.dev/cl/781621", "https://go.dev/issue/79562", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://nvd.nist.gov/vuln/detail/CVE-2026-39828", "https://pkg.go.dev/vuln/GO-2026-5014", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39828.json", "https://www.cve.org/CVERecord?id=CVE-2026-39828" ], "PublishedDate": "2026-05-22T04:16:22.19Z", "LastModifiedDate": "2026-09-11T13:17:51.26Z" }, { "VulnerabilityID": "CVE-2026-39829", "VendorIDs": [ "GO-2026-5018" ], "PkgID": "golang.org/x/crypto@v0.17.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.17.0", "UID": "49c4d27774de0dce" }, "InstalledVersion": "v0.17.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39829", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:dba98f4b24bdfe683d3c55357cb190c5b1dbbb7c84322874760c6419df1c958c", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters", "Description": "The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.", "Severity": "HIGH", "CweIDs": [ "CWE-347", "CWE-1284" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:35833", "https://access.redhat.com/errata/RHSA-2026:36199", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:36883", "https://access.redhat.com/errata/RHSA-2026:37072", "https://access.redhat.com/errata/RHSA-2026:37123", "https://access.redhat.com/errata/RHSA-2026:37268", "https://access.redhat.com/errata/RHSA-2026:37271", "https://access.redhat.com/errata/RHSA-2026:37272", "https://access.redhat.com/errata/RHSA-2026:37278", "https://access.redhat.com/errata/RHSA-2026:37286", "https://access.redhat.com/errata/RHSA-2026:37296", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:40969", "https://access.redhat.com/errata/RHSA-2026:40972", "https://access.redhat.com/errata/RHSA-2026:40974", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:46903", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47949", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:48693", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:52857", "https://access.redhat.com/errata/RHSA-2026:52910", "https://access.redhat.com/errata/RHSA-2026:54400", "https://access.redhat.com/errata/RHSA-2026:54432", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57365", "https://access.redhat.com/errata/RHSA-2026:57801", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:59593", "https://access.redhat.com/errata/RHSA-2026:60446", "https://access.redhat.com/errata/RHSA-2026:60454", "https://access.redhat.com/errata/RHSA-2026:60477", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65964", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:67450", "https://access.redhat.com/security/cve/CVE-2026-39829", "https://bugzilla.redhat.com/2480680", "https://bugzilla.redhat.com/2480681", "https://bugzilla.redhat.com/2480685", "https://bugzilla.redhat.com/2480688", "https://bugzilla.redhat.com/2480757", "https://bugzilla.redhat.com/2480761", "https://bugzilla.redhat.com/2493620", "https://bugzilla.redhat.com/show_bug.cgi?id=2480680", "https://bugzilla.redhat.com/show_bug.cgi?id=2480681", "https://bugzilla.redhat.com/show_bug.cgi?id=2480685", "https://bugzilla.redhat.com/show_bug.cgi?id=2480688", "https://bugzilla.redhat.com/show_bug.cgi?id=2480757", "https://bugzilla.redhat.com/show_bug.cgi?id=2480761", "https://bugzilla.redhat.com/show_bug.cgi?id=2493620", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39835", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57231", "https://errata.almalinux.org/9/ALSA-2026-37123.html", "https://errata.rockylinux.org/RLSA-2026:37123", "https://go.dev/cl/781641", "https://go.dev/cl/781661", "https://go.dev/issue/79565", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://linux.oracle.com/cve/CVE-2026-39829.html", "https://linux.oracle.com/errata/ELSA-2026-37123.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39829", "https://pkg.go.dev/vuln/GO-2026-5018", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39829.json", "https://www.cve.org/CVERecord?id=CVE-2026-39829" ], "PublishedDate": "2026-05-22T04:16:22.31Z", "LastModifiedDate": "2026-09-16T13:17:52.28Z" }, { "VulnerabilityID": "CVE-2026-39830", "VendorIDs": [ "GO-2026-5017" ], "PkgID": "golang.org/x/crypto@v0.17.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.17.0", "UID": "49c4d27774de0dce" }, "InstalledVersion": "v0.17.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39830", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:52c9ec2e72323eae57336e1b65b8120701e283f3c1a5fba98ae02b0b29d15b0d", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses", "Description": "A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.", "Severity": "HIGH", "CweIDs": [ "CWE-119", "CWE-772" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:35833", "https://access.redhat.com/errata/RHSA-2026:36199", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:37072", "https://access.redhat.com/errata/RHSA-2026:37268", "https://access.redhat.com/errata/RHSA-2026:37271", "https://access.redhat.com/errata/RHSA-2026:37272", "https://access.redhat.com/errata/RHSA-2026:37275", "https://access.redhat.com/errata/RHSA-2026:37278", "https://access.redhat.com/errata/RHSA-2026:37286", "https://access.redhat.com/errata/RHSA-2026:37296", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:40969", "https://access.redhat.com/errata/RHSA-2026:40972", "https://access.redhat.com/errata/RHSA-2026:40974", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:52857", "https://access.redhat.com/errata/RHSA-2026:52910", "https://access.redhat.com/errata/RHSA-2026:54400", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57801", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:65964", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66521", "https://access.redhat.com/errata/RHSA-2026:67450", "https://access.redhat.com/errata/RHSA-2026:69961", "https://access.redhat.com/security/cve/CVE-2026-39830", "https://bugzilla.redhat.com/2480684", "https://bugzilla.redhat.com/2508234", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2480684", "https://bugzilla.redhat.com/show_bug.cgi?id=2508234", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2518147", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17106", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19730", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39830", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-69961.html", "https://errata.rockylinux.org/RLSA-2026:69961", "https://github.com/golang/crypto/commit/4e7a7384ecbc8d519f6f4c11b36fa9d761fc8946", "https://go.dev/cl/781640", "https://go.dev/cl/781664", "https://go.dev/issue/79564", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://linux.oracle.com/cve/CVE-2026-39830.html", "https://linux.oracle.com/errata/ELSA-2026-69961.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39830", "https://pkg.go.dev/vuln/GO-2026-5017", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json", "https://ubuntu.com/security/notices/USN-8447-1", "https://ubuntu.com/security/notices/USN-8447-2", "https://ubuntu.com/security/notices/USN-8447-3", "https://www.cve.org/CVERecord?id=CVE-2026-39830" ], "PublishedDate": "2026-05-22T04:16:22.44Z", "LastModifiedDate": "2026-09-16T13:17:53.697Z" }, { "VulnerabilityID": "CVE-2026-39831", "VendorIDs": [ "GO-2026-5019" ], "PkgID": "golang.org/x/crypto@v0.17.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.17.0", "UID": "49c4d27774de0dce" }, "InstalledVersion": "v0.17.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39831", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:04e022dbe5feabbcd4c00f6399fb1e2ad62c235f60c063c652050b574b3812b9", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check", "Description": "The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.", "Severity": "HIGH", "CweIDs": [ "CWE-862" ], "VendorSeverity": { "amazon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-39831", "https://github.com/golang/crypto/commit/b61cf853a89d82cad68da5e12a6beca2116f8456", "https://go.dev/cl/781662", "https://go.dev/issue/79566", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://nvd.nist.gov/vuln/detail/CVE-2026-39831", "https://pkg.go.dev/vuln/GO-2026-5019", "https://ubuntu.com/security/notices/USN-8447-1", "https://ubuntu.com/security/notices/USN-8447-3", "https://www.cve.org/CVERecord?id=CVE-2026-39831" ], "PublishedDate": "2026-05-22T04:16:22.553Z", "LastModifiedDate": "2026-07-23T16:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-39832", "VendorIDs": [ "GHSA-f5wc-c3c7-36mc", "GO-2026-5006" ], "PkgID": "golang.org/x/crypto@v0.17.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.17.0", "UID": "49c4d27774de0dce" }, "InstalledVersion": "v0.17.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39832", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:08148778ced0a7d945fa623a8b07cd507b6b29fb0db27dbfeef8c8316e334477", "Title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions", "Description": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.", "Severity": "HIGH", "CweIDs": [ "CWE-502", "CWE-281" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "V3Score": 8.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:35833", "https://access.redhat.com/errata/RHSA-2026:36199", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:37072", "https://access.redhat.com/errata/RHSA-2026:37123", "https://access.redhat.com/errata/RHSA-2026:37271", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:37410", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:40972", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:52857", "https://access.redhat.com/errata/RHSA-2026:52910", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:59579", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:66521", "https://access.redhat.com/errata/RHSA-2026:67450", "https://access.redhat.com/security/cve/CVE-2026-39832", "https://bugzilla.redhat.com/2480680", "https://bugzilla.redhat.com/2480685", "https://bugzilla.redhat.com/show_bug.cgi?id=2480680", "https://bugzilla.redhat.com/show_bug.cgi?id=2480685", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39835", "https://errata.almalinux.org/9/ALSA-2026-37410.html", "https://errata.rockylinux.org/RLSA-2026:37410", "https://github.com/golang/crypto/commit/e3d1254f1e7e60baa086142c46174bf6d8d0fe50", "https://go.dev/cl/778640", "https://go.dev/cl/778641", "https://go.dev/cl/778642", "https://go.dev/issue/79435", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://linux.oracle.com/cve/CVE-2026-39832.html", "https://linux.oracle.com/errata/ELSA-2026-37410.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39832", "https://pkg.go.dev/vuln/GO-2026-5006", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39832.json", "https://ubuntu.com/security/notices/USN-8447-1", "https://www.cve.org/CVERecord?id=CVE-2026-39832" ], "PublishedDate": "2026-05-22T04:16:22.663Z", "LastModifiedDate": "2026-09-15T12:17:40.787Z" }, { "VulnerabilityID": "CVE-2026-39835", "VendorIDs": [ "GO-2026-5015" ], "PkgID": "golang.org/x/crypto@v0.17.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.17.0", "UID": "49c4d27774de0dce" }, "InstalledVersion": "v0.17.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39835", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:e4acf57bc3a6f90ab524ad28f734f6d5081f4c0c5df10257efe7dcff25fdf275", "Title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate", "Description": "SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.", "Severity": "HIGH", "CweIDs": [ "CWE-295", "CWE-476" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:36199", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:37072", "https://access.redhat.com/errata/RHSA-2026:37123", "https://access.redhat.com/errata/RHSA-2026:37268", "https://access.redhat.com/errata/RHSA-2026:37271", "https://access.redhat.com/errata/RHSA-2026:37272", "https://access.redhat.com/errata/RHSA-2026:37286", "https://access.redhat.com/errata/RHSA-2026:37296", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:37410", "https://access.redhat.com/errata/RHSA-2026:38504", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:40969", "https://access.redhat.com/errata/RHSA-2026:40972", "https://access.redhat.com/errata/RHSA-2026:40974", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47949", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51036", "https://access.redhat.com/errata/RHSA-2026:51038", "https://access.redhat.com/errata/RHSA-2026:52857", "https://access.redhat.com/errata/RHSA-2026:52910", "https://access.redhat.com/errata/RHSA-2026:54525", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59593", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66521", "https://access.redhat.com/security/cve/CVE-2026-39835", "https://bugzilla.redhat.com/2480680", "https://bugzilla.redhat.com/2480685", "https://bugzilla.redhat.com/show_bug.cgi?id=2480680", "https://bugzilla.redhat.com/show_bug.cgi?id=2480685", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39835", "https://errata.almalinux.org/9/ALSA-2026-37410.html", "https://errata.rockylinux.org/RLSA-2026:37410", "https://go.dev/cl/781660", "https://go.dev/issue/79563", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://linux.oracle.com/cve/CVE-2026-39835.html", "https://linux.oracle.com/errata/ELSA-2026-38504.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39835", "https://pkg.go.dev/vuln/GO-2026-5015", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39835.json", "https://www.cve.org/CVERecord?id=CVE-2026-39835" ], "PublishedDate": "2026-05-22T04:16:24.53Z", "LastModifiedDate": "2026-09-18T13:18:12.74Z" }, { "VulnerabilityID": "CVE-2026-42508", "VendorIDs": [ "GHSA-5cgq-3rg8-m6cv", "GO-2026-5021" ], "PkgID": "golang.org/x/crypto@v0.17.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.17.0", "UID": "49c4d27774de0dce" }, "InstalledVersion": "v0.17.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42508", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:b7bee7f0ff55ede2f2c4552f49e379ef939c395fb5309f16306be369a4e64167", "Title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey", "Description": "Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:35833", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:37072", "https://access.redhat.com/errata/RHSA-2026:37123", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41064", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:52857", "https://access.redhat.com/errata/RHSA-2026:52910", "https://access.redhat.com/errata/RHSA-2026:54400", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66521", "https://access.redhat.com/errata/RHSA-2026:67450", "https://access.redhat.com/security/cve/CVE-2026-42508", "https://bugzilla.redhat.com/2480680", "https://bugzilla.redhat.com/2480681", "https://bugzilla.redhat.com/2480685", "https://bugzilla.redhat.com/2480688", "https://bugzilla.redhat.com/2480757", "https://bugzilla.redhat.com/2480761", "https://bugzilla.redhat.com/2493620", "https://bugzilla.redhat.com/show_bug.cgi?id=2480680", "https://bugzilla.redhat.com/show_bug.cgi?id=2480681", "https://bugzilla.redhat.com/show_bug.cgi?id=2480685", "https://bugzilla.redhat.com/show_bug.cgi?id=2480688", "https://bugzilla.redhat.com/show_bug.cgi?id=2480757", "https://bugzilla.redhat.com/show_bug.cgi?id=2480761", "https://bugzilla.redhat.com/show_bug.cgi?id=2493620", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39835", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57231", "https://errata.almalinux.org/9/ALSA-2026-37123.html", "https://errata.rockylinux.org/RLSA-2026:37123", "https://github.com/golang/crypto/commit/f717e29698a271c548239ed56bf5dd9516d6f7e8", "https://go.dev/cl/781220", "https://go.dev/issue/79568", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://linux.oracle.com/cve/CVE-2026-42508.html", "https://linux.oracle.com/errata/ELSA-2026-37123.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42508", "https://pkg.go.dev/vuln/GO-2026-5021", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42508.json", "https://ubuntu.com/security/notices/USN-8447-1", "https://ubuntu.com/security/notices/USN-8447-2", "https://www.cve.org/CVERecord?id=CVE-2026-42508" ], "PublishedDate": "2026-05-22T04:16:25.44Z", "LastModifiedDate": "2026-09-15T12:17:45.777Z" }, { "VulnerabilityID": "CVE-2026-46595", "VendorIDs": [ "GO-2026-5023" ], "PkgID": "golang.org/x/crypto@v0.17.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.17.0", "UID": "49c4d27774de0dce" }, "InstalledVersion": "v0.17.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46595", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:9f3de71a0b2d06a13bd93eff1562cce944b219e6fb818f73b86fa3aebf1464be", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation", "Description": "Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.", "Severity": "HIGH", "CweIDs": [ "CWE-863", "CWE-303" ], "VendorSeverity": { "amazon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:30650", "https://access.redhat.com/errata/RHSA-2026:30651", "https://access.redhat.com/errata/RHSA-2026:33524", "https://access.redhat.com/errata/RHSA-2026:33531", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:37275", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59558", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66521", "https://access.redhat.com/security/cve/CVE-2026-46595", "https://bugzilla.redhat.com/show_bug.cgi?id=2480689", "https://github.com/golang/crypto/commit/533fb3f7e4a5ae23f69d1837cd851d35ff5b76ce", "https://go.dev/cl/781642", "https://go.dev/issue/79570", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://nvd.nist.gov/vuln/detail/CVE-2026-46595", "https://pkg.go.dev/vuln/GO-2026-5023", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46595.json", "https://ubuntu.com/security/notices/USN-8447-1", "https://ubuntu.com/security/notices/USN-8447-3", "https://www.cve.org/CVERecord?id=CVE-2026-46595" ], "PublishedDate": "2026-05-22T04:16:25.55Z", "LastModifiedDate": "2026-09-11T13:18:12.367Z" }, { "VulnerabilityID": "CVE-2026-46597", "VendorIDs": [ "GO-2026-5013" ], "PkgID": "golang.org/x/crypto@v0.17.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.17.0", "UID": "49c4d27774de0dce" }, "InstalledVersion": "v0.17.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46597", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:f1c449f2725eae6d765352b4e31bf6b72419649ccede8163d48735d8f8978541", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs", "Description": "An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.", "Severity": "HIGH", "CweIDs": [ "CWE-704" ], "VendorSeverity": { "amazon": 2, "azure": 3, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46597", "https://go.dev/cl/781620", "https://go.dev/issue/79561", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://nvd.nist.gov/vuln/detail/CVE-2026-46597", "https://pkg.go.dev/vuln/GO-2026-5013", "https://www.cve.org/CVERecord?id=CVE-2026-46597" ], "PublishedDate": "2026-05-22T04:16:26.003Z", "LastModifiedDate": "2026-07-23T16:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-56854", "VendorIDs": [ "GO-2026-6303" ], "PkgID": "golang.org/x/crypto@v0.17.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.17.0", "UID": "49c4d27774de0dce" }, "InstalledVersion": "v0.17.0", "FixedVersion": "0.55.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56854", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:a9868b191ea3b81628e2c3fb6edf1b123fd6629a469a4c964417d4df49c398d9", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions", "Description": "The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.", "Severity": "HIGH", "CweIDs": [ "CWE-863" ], "VendorSeverity": { "amazon": 3, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56854", "https://go.dev/cl/797040", "https://go.dev/issue/80213", "https://nvd.nist.gov/vuln/detail/CVE-2026-56854", "https://pkg.go.dev/vuln/GO-2026-6303", "https://www.cve.org/CVERecord?id=CVE-2026-56854" ], "PublishedDate": "2026-08-28T16:18:17.607Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2023-45288", "VendorIDs": [ "GHSA-4v7x-pqxf-cx7m", "GO-2024-2687" ], "PkgID": "golang.org/x/net@v0.19.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.19.0", "UID": "1ba10a08b5703a5c" }, "InstalledVersion": "v0.19.0", "FixedVersion": "0.23.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45288", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:8c4e4e688c9b23f301106917384aec2215fcd8e9be60362c17c72ca5000dd96b", "Title": "golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS", "Description": "An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "bottlerocket": 2, "cbl-mariner": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45288", "http://www.openwall.com/lists/oss-security/2024/04/03/16", "http://www.openwall.com/lists/oss-security/2024/04/05/4", "https://access.redhat.com/errata/RHSA-2024:2724", "https://access.redhat.com/security/cve/CVE-2023-45288", "https://bugzilla.redhat.com/2268017", "https://bugzilla.redhat.com/2268018", "https://bugzilla.redhat.com/2268019", "https://bugzilla.redhat.com/2268273", "https://bugzilla.redhat.com/show_bug.cgi?id=2268017", "https://bugzilla.redhat.com/show_bug.cgi?id=2268018", "https://bugzilla.redhat.com/show_bug.cgi?id=2268019", "https://bugzilla.redhat.com/show_bug.cgi?id=2268273", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45288", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45289", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45290", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24783", "https://errata.almalinux.org/9/ALSA-2024-2724.html", "https://errata.rockylinux.org/RLSA-2024:2724", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-c9wf-j9h6-m2r9", "https://go.dev/cl/576155", "https://go.dev/issue/65051", "https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M", "https://kb.cert.org/vuls/id/421644", "https://linux.oracle.com/cve/CVE-2023-45288.html", "https://linux.oracle.com/errata/ELSA-2024-3346.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/", "https://nowotarski.info/http2-continuation-flood/", "https://nvd.nist.gov/vuln/detail/CVE-2023-45288", "https://pkg.go.dev/vuln/GO-2024-2687", "https://security.netapp.com/advisory/ntap-20240419-0009/", "https://ubuntu.com/security/notices/USN-6886-1", "https://ubuntu.com/security/notices/USN-7109-1", "https://ubuntu.com/security/notices/USN-7111-1", "https://www.cve.org/CVERecord?id=CVE-2023-45288", "https://www.kb.cert.org/vuls/id/421644" ], "PublishedDate": "2024-04-04T21:15:16.113Z", "LastModifiedDate": "2026-06-17T06:28:35.58Z" }, { "VulnerabilityID": "CVE-2024-45338", "VendorIDs": [ "GHSA-w32m-9786-jp63", "GO-2024-3333" ], "PkgID": "golang.org/x/net@v0.19.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.19.0", "UID": "1ba10a08b5703a5c" }, "InstalledVersion": "v0.19.0", "FixedVersion": "0.33.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-45338", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:2f305f6a146127abe021db9805b8afb1eb4125d72d469b48a44a2e8dd68bd661", "Title": "golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html", "Description": "An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.", "Severity": "HIGH", "CweIDs": [ "CWE-1333" ], "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 2, "cbl-mariner": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45338", "https://access.redhat.com/security/cve/CVE-2024-45338", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/8.2.0/BRSA-newyz3jucdu5.toml", "https://go-review.googlesource.com/c/net/+/637536", "https://go.dev/cl/637536", "https://go.dev/issue/70906", "https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ", "https://nvd.nist.gov/vuln/detail/CVE-2024-45338", "https://pkg.go.dev/vuln/GO-2024-3333", "https://security.netapp.com/advisory/ntap-20250221-0001/", "https://ubuntu.com/security/notices/USN-7197-1", "https://ubuntu.com/security/notices/USN-8900-1", "https://www.cve.org/CVERecord?id=CVE-2024-45338" ], "PublishedDate": "2024-12-18T21:15:08.173Z", "LastModifiedDate": "2026-06-17T07:54:03.51Z" }, { "VulnerabilityID": "CVE-2026-25681", "VendorIDs": [ "GO-2026-5029" ], "PkgID": "golang.org/x/net@v0.19.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.19.0", "UID": "1ba10a08b5703a5c" }, "InstalledVersion": "v0.19.0", "FixedVersion": "0.55.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-25681", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:2ed006345e5106c60e465df283fd93d283ce45f70139e8a574e350c65932b4f2", "Title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting", "Description": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "Severity": "HIGH", "CweIDs": [ "CWE-1021" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69293", "https://access.redhat.com/security/cve/CVE-2026-25681", "https://bugzilla.redhat.com/2480757", "https://bugzilla.redhat.com/2480761", "https://bugzilla.redhat.com/2480762", "https://bugzilla.redhat.com/2484830", "https://bugzilla.redhat.com/2493622", "https://bugzilla.redhat.com/show_bug.cgi?id=2480757", "https://bugzilla.redhat.com/show_bug.cgi?id=2480761", "https://bugzilla.redhat.com/show_bug.cgi?id=2480762", "https://bugzilla.redhat.com/show_bug.cgi?id=2484830", "https://bugzilla.redhat.com/show_bug.cgi?id=2493622", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41178", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42502", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55677", "https://errata.almalinux.org/9/ALSA-2026-69293.html", "https://errata.rockylinux.org/RLSA-2026:69293", "https://go.dev/cl/781703", "https://go.dev/issue/79574", "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "https://linux.oracle.com/cve/CVE-2026-25681.html", "https://linux.oracle.com/errata/ELSA-2026-69293.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-25681", "https://pkg.go.dev/vuln/GO-2026-5029", "https://www.cve.org/CVERecord?id=CVE-2026-25681" ], "PublishedDate": "2026-05-22T16:16:19.863Z", "LastModifiedDate": "2026-07-23T16:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-27136", "VendorIDs": [ "GO-2026-5030" ], "PkgID": "golang.org/x/net@v0.19.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.19.0", "UID": "1ba10a08b5703a5c" }, "InstalledVersion": "v0.19.0", "FixedVersion": "0.55.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27136", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:f3a76be3d8269049fc8d174eb609bd1e4f09b6f9a3fd32f7a2a3215ea4d192ca", "Title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass", "Description": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "Severity": "HIGH", "CweIDs": [ "CWE-1021" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69293", "https://access.redhat.com/security/cve/CVE-2026-27136", "https://bugzilla.redhat.com/2480757", "https://bugzilla.redhat.com/2480761", "https://bugzilla.redhat.com/2480762", "https://bugzilla.redhat.com/2484830", "https://bugzilla.redhat.com/2493622", "https://bugzilla.redhat.com/show_bug.cgi?id=2480757", "https://bugzilla.redhat.com/show_bug.cgi?id=2480761", "https://bugzilla.redhat.com/show_bug.cgi?id=2480762", "https://bugzilla.redhat.com/show_bug.cgi?id=2484830", "https://bugzilla.redhat.com/show_bug.cgi?id=2493622", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41178", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42502", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55677", "https://errata.almalinux.org/9/ALSA-2026-69293.html", "https://errata.rockylinux.org/RLSA-2026:69293", "https://go.dev/cl/781685", "https://go.dev/issue/79575", "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "https://linux.oracle.com/cve/CVE-2026-27136.html", "https://linux.oracle.com/errata/ELSA-2026-69293.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-27136", "https://pkg.go.dev/vuln/GO-2026-5030", "https://www.cve.org/CVERecord?id=CVE-2026-27136" ], "PublishedDate": "2026-05-22T16:16:20.087Z", "LastModifiedDate": "2026-07-23T16:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-33814", "VendorIDs": [ "GO-2026-4918" ], "PkgID": "golang.org/x/net@v0.19.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.19.0", "UID": "1ba10a08b5703a5c" }, "InstalledVersion": "v0.19.0", "FixedVersion": "0.53.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33814", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:e60e28c306c24c3f17a4eeeff276aefe10ada959220bc89e9f182c8b04b8e9b2", "Title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame", "Description": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.", "Severity": "HIGH", "CweIDs": [ "CWE-835", "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57365", "https://access.redhat.com/errata/RHSA-2026:57367", "https://access.redhat.com/errata/RHSA-2026:57408", "https://access.redhat.com/errata/RHSA-2026:57545", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60441", "https://access.redhat.com/errata/RHSA-2026:60442", "https://access.redhat.com/errata/RHSA-2026:60446", "https://access.redhat.com/errata/RHSA-2026:60447", "https://access.redhat.com/errata/RHSA-2026:60454", "https://access.redhat.com/errata/RHSA-2026:60477", "https://access.redhat.com/errata/RHSA-2026:60478", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:60668", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62410", "https://access.redhat.com/errata/RHSA-2026:62550", "https://access.redhat.com/errata/RHSA-2026:62551", "https://access.redhat.com/errata/RHSA-2026:63046", "https://access.redhat.com/errata/RHSA-2026:63047", "https://access.redhat.com/errata/RHSA-2026:63048", "https://access.redhat.com/errata/RHSA-2026:63050", "https://access.redhat.com/errata/RHSA-2026:63091", "https://access.redhat.com/errata/RHSA-2026:63096", "https://access.redhat.com/errata/RHSA-2026:63097", "https://access.redhat.com/errata/RHSA-2026:63103", "https://access.redhat.com/errata/RHSA-2026:63104", "https://access.redhat.com/errata/RHSA-2026:63636", "https://access.redhat.com/errata/RHSA-2026:63637", "https://access.redhat.com/errata/RHSA-2026:63639", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/security/cve/CVE-2026-33814", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467810", "https://bugzilla.redhat.com/show_bug.cgi?id=2467811", "https://bugzilla.redhat.com/show_bug.cgi?id=2467813", "https://bugzilla.redhat.com/show_bug.cgi?id=2467815", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467823", "https://bugzilla.redhat.com/show_bug.cgi?id=2467825", "https://bugzilla.redhat.com/show_bug.cgi?id=2467826", "https://bugzilla.redhat.com/show_bug.cgi?id=2467827", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501", "https://errata.almalinux.org/9/ALSA-2026-22121.html", "https://errata.rockylinux.org/RLSA-2026:22121", "https://github.com/golang/go/issues/78476", "https://go-review.googlesource.com/c/go/+/761581", "https://go-review.googlesource.com/c/net/+/761640", "https://go.dev/cl/761581", "https://go.dev/cl/761640", "https://go.dev/issue/78476", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-33814.html", "https://linux.oracle.com/errata/ELSA-2026-22121.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33814", "https://pkg.go.dev/vuln/GO-2026-4918", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json", "https://ubuntu.com/security/notices/USN-8430-1", "https://ubuntu.com/security/notices/USN-8471-1", "https://ubuntu.com/security/notices/USN-8472-1", "https://ubuntu.com/security/notices/USN-8473-1", "https://www.cve.org/CVERecord?id=CVE-2026-33814" ], "PublishedDate": "2026-05-07T20:16:42.88Z", "LastModifiedDate": "2026-10-26T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-39821", "VendorIDs": [ "GO-2026-5026" ], "PkgID": "golang.org/x/net@v0.19.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.19.0", "UID": "1ba10a08b5703a5c" }, "InstalledVersion": "v0.19.0", "FixedVersion": "0.55.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39821", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:40088e32780d12c4adf1c252462c7ac448bd67acf3d42086576909aa6c287971", "Title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing", "Description": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".", "Severity": "HIGH", "CweIDs": [ "CWE-1289" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:30650", "https://access.redhat.com/errata/RHSA-2026:30651", "https://access.redhat.com/errata/RHSA-2026:30853", "https://access.redhat.com/errata/RHSA-2026:30854", "https://access.redhat.com/errata/RHSA-2026:30855", "https://access.redhat.com/errata/RHSA-2026:33155", "https://access.redhat.com/errata/RHSA-2026:33160", "https://access.redhat.com/errata/RHSA-2026:33163", "https://access.redhat.com/errata/RHSA-2026:33173", "https://access.redhat.com/errata/RHSA-2026:33183", "https://access.redhat.com/errata/RHSA-2026:33524", "https://access.redhat.com/errata/RHSA-2026:33531", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:34789", "https://access.redhat.com/errata/RHSA-2026:35826", "https://access.redhat.com/errata/RHSA-2026:35827", "https://access.redhat.com/errata/RHSA-2026:35828", "https://access.redhat.com/errata/RHSA-2026:35829", "https://access.redhat.com/errata/RHSA-2026:35830", "https://access.redhat.com/errata/RHSA-2026:35831", "https://access.redhat.com/errata/RHSA-2026:35993", "https://access.redhat.com/errata/RHSA-2026:35994", "https://access.redhat.com/errata/RHSA-2026:36105", "https://access.redhat.com/errata/RHSA-2026:36167", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:36883", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:37435", "https://access.redhat.com/errata/RHSA-2026:37436", "https://access.redhat.com/errata/RHSA-2026:38995", "https://access.redhat.com/errata/RHSA-2026:39005", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39879", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:41930", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42048", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42080", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:44624", "https://access.redhat.com/errata/RHSA-2026:46395", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51341", "https://access.redhat.com/errata/RHSA-2026:52826", "https://access.redhat.com/errata/RHSA-2026:53374", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54395", "https://access.redhat.com/errata/RHSA-2026:54401", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54580", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56143", "https://access.redhat.com/errata/RHSA-2026:56223", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57541", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59546", "https://access.redhat.com/errata/RHSA-2026:59549", "https://access.redhat.com/errata/RHSA-2026:59562", "https://access.redhat.com/errata/RHSA-2026:60315", "https://access.redhat.com/errata/RHSA-2026:60354", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61245", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62549", "https://access.redhat.com/errata/RHSA-2026:63134", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65359", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65851", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/errata/RHSA-2026:66432", "https://access.redhat.com/errata/RHSA-2026:67149", "https://access.redhat.com/errata/RHSA-2026:67159", "https://access.redhat.com/errata/RHSA-2026:67160", "https://access.redhat.com/errata/RHSA-2026:67287", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/security/cve/CVE-2026-39821", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/767220", "https://go.dev/issue/78760", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "https://linux.oracle.com/cve/CVE-2026-39821.html", "https://linux.oracle.com/errata/ELSA-2026-66432-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39821", "https://pkg.go.dev/vuln/GO-2026-5026", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json", "https://ubuntu.com/security/notices/USN-8416-1", "https://ubuntu.com/security/notices/USN-8883-1", "https://ubuntu.com/security/notices/USN-8883-2", "https://ubuntu.com/security/notices/USN-8900-1", "https://ubuntu.com/security/notices/USN-8914-1", "https://www.cve.org/CVERecord?id=CVE-2026-39821" ], "PublishedDate": "2026-05-22T16:16:20.41Z", "LastModifiedDate": "2026-09-17T12:18:05.767Z" }, { "VulnerabilityID": "CVE-2026-46600", "VendorIDs": [ "GO-2026-5942" ], "PkgID": "golang.org/x/net@v0.19.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.19.0", "UID": "1ba10a08b5703a5c" }, "InstalledVersion": "v0.19.0", "FixedVersion": "0.56.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46600", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:d1bc9324550d6fcb8763fc91fff7aebbcafb2997a2ffe178469ce6e3e0c83e7f", "Title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing", "Description": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "bitnami": 3, "redhat": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46600", "https://go.dev/cl/786345", "https://go.dev/issue/79795", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://nvd.nist.gov/vuln/detail/CVE-2026-46600", "https://pkg.go.dev/vuln/GO-2026-5942", "https://www.cve.org/CVERecord?id=CVE-2026-46600" ], "PublishedDate": "2026-07-21T20:17:01.213Z", "LastModifiedDate": "2026-10-24T19:10:00.127Z" }, { "VulnerabilityID": "CVE-2026-78661", "VendorIDs": [ "GO-2026-6860" ], "PkgID": "golang.org/x/net@v0.19.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.19.0", "UID": "1ba10a08b5703a5c" }, "InstalledVersion": "v0.19.0", "FixedVersion": "0.62.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78661", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:a741241d9c25fca05f6ff9419f78cd47107fdf5e31a18974ea4f46b2a41eb02d", "Title": "golang.org/x/net/html: golang.org/x/net/html: Denial of Service via crafted HTML input", "Description": "When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a\u003c/x\u003e\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-78661", "https://go.dev/cl/849365", "https://go.dev/issue/82224", "https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs", "https://nvd.nist.gov/vuln/detail/CVE-2026-78661", "https://pkg.go.dev/vuln/GO-2026-6860", "https://www.cve.org/CVERecord?id=CVE-2026-78661" ], "PublishedDate": "2026-10-27T22:18:05.93Z", "LastModifiedDate": "2026-11-04T17:17:37.673Z" }, { "VulnerabilityID": "CVE-2026-78669", "VendorIDs": [ "GO-2026-6611" ], "PkgID": "golang.org/x/net@v0.19.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.19.0", "UID": "1ba10a08b5703a5c" }, "InstalledVersion": "v0.19.0", "FixedVersion": "0.60.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78669", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:f5ebc910fd202779eab94316f80c4454309d61a9e9a60471b90e1a43ec400f86", "Title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "Description": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78669", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81742", "https://go.dev/cl/847186", "https://go.dev/cl/847308", "https://go.dev/issue/81742", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs", "https://linux.oracle.com/cve/CVE-2026-78669.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78669", "https://pkg.go.dev/vuln/GO-2026-6611", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78669", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:04.01Z", "LastModifiedDate": "2026-10-09T17:16:49.857Z" }, { "VulnerabilityID": "CVE-2025-22868", "VendorIDs": [ "GO-2025-3488" ], "PkgID": "golang.org/x/oauth2@v0.10.0", "PkgName": "golang.org/x/oauth2", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/oauth2@v0.10.0", "UID": "dc9284b1c8aa62c9" }, "InstalledVersion": "v0.10.0", "FixedVersion": "0.27.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-22868", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:05694aaa7ea645a9af7eb3076949c54fd4ef54b0c6c71826741be0519d2bc608", "Title": "golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws", "Description": "An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.", "Severity": "HIGH", "CweIDs": [ "CWE-1286" ], "VendorSeverity": { "amazon": 3, "azure": 3, "cbl-mariner": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2025:7479", "https://access.redhat.com/security/cve/CVE-2025-22868", "https://bugzilla.redhat.com/show_bug.cgi?id=2347423", "https://bugzilla.redhat.com/show_bug.cgi?id=2348366", "https://bugzilla.redhat.com/show_bug.cgi?id=2352914", "https://bugzilla.redhat.com/show_bug.cgi?id=2354195", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22868", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27144", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-29786", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30204", "https://errata.rockylinux.org/RLSA-2025:7479", "https://go.dev/cl/652155", "https://go.dev/issue/71490", "https://nvd.nist.gov/vuln/detail/CVE-2025-22868", "https://pkg.go.dev/vuln/GO-2025-3488", "https://www.cve.org/CVERecord?id=CVE-2025-22868" ], "PublishedDate": "2025-02-26T08:14:24.897Z", "LastModifiedDate": "2026-06-17T08:50:39.59Z" }, { "VulnerabilityID": "CVE-2026-56851", "VendorIDs": [ "GO-2026-6629" ], "PkgID": "golang.org/x/text@v0.14.0", "PkgName": "golang.org/x/text", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/text@v0.14.0", "UID": "3e75f675a5fc04c7" }, "InstalledVersion": "v0.14.0", "FixedVersion": "0.41.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56851", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:245541d264e224c4203de61cb72be27686d5b94a93bc47aed33af30d8324f5ca", "Title": "golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile", "Description": "The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 3, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56851", "https://go.dev/cl/793360", "https://go.dev/issue/80112", "https://nvd.nist.gov/vuln/detail/CVE-2026-56851", "https://pkg.go.dev/vuln/GO-2026-6629", "https://www.cve.org/CVERecord?id=CVE-2026-56851" ], "PublishedDate": "2026-10-07T18:17:20.903Z", "LastModifiedDate": "2026-10-08T21:35:53.89Z" }, { "VulnerabilityID": "CVE-2026-56852", "VendorIDs": [ "GO-2026-5970" ], "PkgID": "golang.org/x/text@v0.14.0", "PkgName": "golang.org/x/text", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/text@v0.14.0", "UID": "3e75f675a5fc04c7" }, "InstalledVersion": "v0.14.0", "FixedVersion": "0.39.0", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56852", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:acc52e60a9742f23959d649b3b6096da93c456b150f13e0d0e88194995077352", "Title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input", "Description": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70201", "https://access.redhat.com/security/cve/CVE-2026-56852", "https://bugzilla.redhat.com/2456335", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2504233", "https://bugzilla.redhat.com/2508234", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456335", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2504233", "https://bugzilla.redhat.com/show_bug.cgi?id=2508234", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2518147", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17106", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19730", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33810", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56852", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/10/ALSA-2026-70201.html", "https://errata.rockylinux.org/RLSA-2026:70201", "https://go.dev/cl/794100", "https://go.dev/issue/80142", "https://linux.oracle.com/cve/CVE-2026-56852.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56852", "https://pkg.go.dev/vuln/GO-2026-5970", "https://www.cve.org/CVERecord?id=CVE-2026-56852" ], "PublishedDate": "2026-07-21T20:17:02.867Z", "LastModifiedDate": "2026-10-24T19:10:00.127Z" }, { "VulnerabilityID": "CVE-2026-33186", "VendorIDs": [ "GHSA-p77j-4mvh-x3m3" ], "PkgID": "google.golang.org/grpc@v1.58.3", "PkgName": "google.golang.org/grpc", "PkgIdentifier": { "PURL": "pkg:golang/google.golang.org/grpc@v1.58.3", "UID": "695dd48a89a4d663" }, "InstalledVersion": "v1.58.3", "FixedVersion": "1.79.3", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33186", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:36ce4cccbf5419a9f55d8e491715acbd2e205df19a9439123583f5c1c89fc75d", "Title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation", "Description": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.", "Severity": "CRITICAL", "CweIDs": [ "CWE-285", "CWE-551" ], "VendorSeverity": { "alma": 3, "amazon": 3, "ghsa": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10093", "https://access.redhat.com/errata/RHSA-2026:10094", "https://access.redhat.com/errata/RHSA-2026:10105", "https://access.redhat.com/errata/RHSA-2026:10107", "https://access.redhat.com/errata/RHSA-2026:10125", "https://access.redhat.com/errata/RHSA-2026:10126", "https://access.redhat.com/errata/RHSA-2026:10130", "https://access.redhat.com/errata/RHSA-2026:10131", "https://access.redhat.com/errata/RHSA-2026:10153", "https://access.redhat.com/errata/RHSA-2026:10155", "https://access.redhat.com/errata/RHSA-2026:10158", "https://access.redhat.com/errata/RHSA-2026:10172", "https://access.redhat.com/errata/RHSA-2026:10175", "https://access.redhat.com/errata/RHSA-2026:10698", "https://access.redhat.com/errata/RHSA-2026:10705", "https://access.redhat.com/errata/RHSA-2026:10706", "https://access.redhat.com/errata/RHSA-2026:11070", "https://access.redhat.com/errata/RHSA-2026:11408", "https://access.redhat.com/errata/RHSA-2026:11803", "https://access.redhat.com/errata/RHSA-2026:11856", "https://access.redhat.com/errata/RHSA-2026:11916", "https://access.redhat.com/errata/RHSA-2026:11996", "https://access.redhat.com/errata/RHSA-2026:12116", "https://access.redhat.com/errata/RHSA-2026:12118", "https://access.redhat.com/errata/RHSA-2026:12119", "https://access.redhat.com/errata/RHSA-2026:12277", "https://access.redhat.com/errata/RHSA-2026:12279", "https://access.redhat.com/errata/RHSA-2026:12283", "https://access.redhat.com/errata/RHSA-2026:12337", "https://access.redhat.com/errata/RHSA-2026:13548", "https://access.redhat.com/errata/RHSA-2026:13791", "https://access.redhat.com/errata/RHSA-2026:13829", "https://access.redhat.com/errata/RHSA-2026:14775", "https://access.redhat.com/errata/RHSA-2026:15092", "https://access.redhat.com/errata/RHSA-2026:17123", "https://access.redhat.com/errata/RHSA-2026:17448", "https://access.redhat.com/errata/RHSA-2026:17459", "https://access.redhat.com/errata/RHSA-2026:17468", "https://access.redhat.com/errata/RHSA-2026:17474", "https://access.redhat.com/errata/RHSA-2026:17475", "https://access.redhat.com/errata/RHSA-2026:17598", "https://access.redhat.com/errata/RHSA-2026:17599", "https://access.redhat.com/errata/RHSA-2026:17789", "https://access.redhat.com/errata/RHSA-2026:18068", "https://access.redhat.com/errata/RHSA-2026:18585", "https://access.redhat.com/errata/RHSA-2026:19099", "https://access.redhat.com/errata/RHSA-2026:19108", "https://access.redhat.com/errata/RHSA-2026:19109", "https://access.redhat.com/errata/RHSA-2026:19135", "https://access.redhat.com/errata/RHSA-2026:19207", "https://access.redhat.com/errata/RHSA-2026:19353", "https://access.redhat.com/errata/RHSA-2026:19375", "https://access.redhat.com/errata/RHSA-2026:19712", "https://access.redhat.com/errata/RHSA-2026:19719", "https://access.redhat.com/errata/RHSA-2026:19720", "https://access.redhat.com/errata/RHSA-2026:19721", "https://access.redhat.com/errata/RHSA-2026:20034", "https://access.redhat.com/errata/RHSA-2026:20035", "https://access.redhat.com/errata/RHSA-2026:20041", "https://access.redhat.com/errata/RHSA-2026:20042", "https://access.redhat.com/errata/RHSA-2026:20088", "https://access.redhat.com/errata/RHSA-2026:20089", "https://access.redhat.com/errata/RHSA-2026:20322", "https://access.redhat.com/errata/RHSA-2026:20436", "https://access.redhat.com/errata/RHSA-2026:20943", "https://access.redhat.com/errata/RHSA-2026:20946", "https://access.redhat.com/errata/RHSA-2026:21017", "https://access.redhat.com/errata/RHSA-2026:21657", "https://access.redhat.com/errata/RHSA-2026:21658", "https://access.redhat.com/errata/RHSA-2026:21691", "https://access.redhat.com/errata/RHSA-2026:21692", "https://access.redhat.com/errata/RHSA-2026:21696", "https://access.redhat.com/errata/RHSA-2026:21697", "https://access.redhat.com/errata/RHSA-2026:21703", "https://access.redhat.com/errata/RHSA-2026:21704", "https://access.redhat.com/errata/RHSA-2026:21709", "https://access.redhat.com/errata/RHSA-2026:21710", "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:21931", "https://access.redhat.com/errata/RHSA-2026:21932", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:22423", "https://access.redhat.com/errata/RHSA-2026:22450", "https://access.redhat.com/errata/RHSA-2026:22465", "https://access.redhat.com/errata/RHSA-2026:22485", "https://access.redhat.com/errata/RHSA-2026:22645", "https://access.redhat.com/errata/RHSA-2026:22689", "https://access.redhat.com/errata/RHSA-2026:22714", "https://access.redhat.com/errata/RHSA-2026:22800", "https://access.redhat.com/errata/RHSA-2026:22937", "https://access.redhat.com/errata/RHSA-2026:22959", "https://access.redhat.com/errata/RHSA-2026:22961", "https://access.redhat.com/errata/RHSA-2026:23228", "https://access.redhat.com/errata/RHSA-2026:23234", "https://access.redhat.com/errata/RHSA-2026:23235", "https://access.redhat.com/errata/RHSA-2026:23241", "https://access.redhat.com/errata/RHSA-2026:23246", "https://access.redhat.com/errata/RHSA-2026:23247", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/errata/RHSA-2026:24484", "https://access.redhat.com/errata/RHSA-2026:24506", "https://access.redhat.com/errata/RHSA-2026:24535", "https://access.redhat.com/errata/RHSA-2026:24536", "https://access.redhat.com/errata/RHSA-2026:24759", "https://access.redhat.com/errata/RHSA-2026:24853", "https://access.redhat.com/errata/RHSA-2026:24977", "https://access.redhat.com/errata/RHSA-2026:25009", "https://access.redhat.com/errata/RHSA-2026:25045", "https://access.redhat.com/errata/RHSA-2026:25127", "https://access.redhat.com/errata/RHSA-2026:25182", "https://access.redhat.com/errata/RHSA-2026:25183", "https://access.redhat.com/errata/RHSA-2026:25187", "https://access.redhat.com/errata/RHSA-2026:25194", "https://access.redhat.com/errata/RHSA-2026:25195", "https://access.redhat.com/errata/RHSA-2026:25201", "https://access.redhat.com/errata/RHSA-2026:26412", "https://access.redhat.com/errata/RHSA-2026:26413", "https://access.redhat.com/errata/RHSA-2026:26416", "https://access.redhat.com/errata/RHSA-2026:26420", "https://access.redhat.com/errata/RHSA-2026:26519", "https://access.redhat.com/errata/RHSA-2026:26568", "https://access.redhat.com/errata/RHSA-2026:26997", "https://access.redhat.com/errata/RHSA-2026:26999", "https://access.redhat.com/errata/RHSA-2026:27001", "https://access.redhat.com/errata/RHSA-2026:27004", "https://access.redhat.com/errata/RHSA-2026:27063", "https://access.redhat.com/errata/RHSA-2026:27076", "https://access.redhat.com/errata/RHSA-2026:27712", "https://access.redhat.com/errata/RHSA-2026:27856", "https://access.redhat.com/errata/RHSA-2026:27892", "https://access.redhat.com/errata/RHSA-2026:27893", "https://access.redhat.com/errata/RHSA-2026:27901", "https://access.redhat.com/errata/RHSA-2026:27957", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:28893", "https://access.redhat.com/errata/RHSA-2026:28964", "https://access.redhat.com/errata/RHSA-2026:29079", "https://access.redhat.com/errata/RHSA-2026:29082", "https://access.redhat.com/errata/RHSA-2026:29854", "https://access.redhat.com/errata/RHSA-2026:34049", "https://access.redhat.com/errata/RHSA-2026:34097", "https://access.redhat.com/errata/RHSA-2026:34099", "https://access.redhat.com/errata/RHSA-2026:34100", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:34769", "https://access.redhat.com/errata/RHSA-2026:34794", "https://access.redhat.com/errata/RHSA-2026:34795", "https://access.redhat.com/errata/RHSA-2026:36611", "https://access.redhat.com/errata/RHSA-2026:36621", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36882", "https://access.redhat.com/errata/RHSA-2026:37192", "https://access.redhat.com/errata/RHSA-2026:37275", "https://access.redhat.com/errata/RHSA-2026:37580", "https://access.redhat.com/errata/RHSA-2026:37585", "https://access.redhat.com/errata/RHSA-2026:40022", "https://access.redhat.com/errata/RHSA-2026:40030", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40792", "https://access.redhat.com/errata/RHSA-2026:40795", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:40984", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:41941", "https://access.redhat.com/errata/RHSA-2026:41944", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:43225", "https://access.redhat.com/errata/RHSA-2026:43227", "https://access.redhat.com/errata/RHSA-2026:43253", "https://access.redhat.com/errata/RHSA-2026:43331", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44233", "https://access.redhat.com/errata/RHSA-2026:44235", "https://access.redhat.com/errata/RHSA-2026:47728", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:48699", "https://access.redhat.com/errata/RHSA-2026:48790", "https://access.redhat.com/errata/RHSA-2026:50758", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:53728", "https://access.redhat.com/errata/RHSA-2026:53763", "https://access.redhat.com/errata/RHSA-2026:53773", "https://access.redhat.com/errata/RHSA-2026:53804", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56366", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:56959", "https://access.redhat.com/errata/RHSA-2026:57013", "https://access.redhat.com/errata/RHSA-2026:57365", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60146", "https://access.redhat.com/errata/RHSA-2026:61245", "https://access.redhat.com/errata/RHSA-2026:6174", "https://access.redhat.com/errata/RHSA-2026:6428", "https://access.redhat.com/errata/RHSA-2026:6564", "https://access.redhat.com/errata/RHSA-2026:6802", "https://access.redhat.com/errata/RHSA-2026:7110", "https://access.redhat.com/errata/RHSA-2026:7128", "https://access.redhat.com/errata/RHSA-2026:7245", "https://access.redhat.com/errata/RHSA-2026:8151", "https://access.redhat.com/errata/RHSA-2026:8338", "https://access.redhat.com/errata/RHSA-2026:8433", "https://access.redhat.com/errata/RHSA-2026:8449", "https://access.redhat.com/errata/RHSA-2026:8483", "https://access.redhat.com/errata/RHSA-2026:8484", "https://access.redhat.com/errata/RHSA-2026:8490", "https://access.redhat.com/errata/RHSA-2026:8491", "https://access.redhat.com/errata/RHSA-2026:8493", "https://access.redhat.com/errata/RHSA-2026:9385", "https://access.redhat.com/errata/RHSA-2026:9388", "https://access.redhat.com/errata/RHSA-2026:9440", "https://access.redhat.com/errata/RHSA-2026:9448", "https://access.redhat.com/errata/RHSA-2026:9453", "https://access.redhat.com/errata/RHSA-2026:9872", "https://access.redhat.com/security/cve/CVE-2026-33186", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/2449833", "https://bugzilla.redhat.com/2455470", "https://bugzilla.redhat.com/2456333", "https://bugzilla.redhat.com/2456335", "https://bugzilla.redhat.com/2456336", "https://bugzilla.redhat.com/2456338", "https://bugzilla.redhat.com/2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2434432", "https://bugzilla.redhat.com/show_bug.cgi?id=2437111", "https://bugzilla.redhat.com/show_bug.cgi?id=2445345", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2449833", "https://bugzilla.redhat.com/show_bug.cgi?id=2455470", "https://bugzilla.redhat.com/show_bug.cgi?id=2456336", "https://bugzilla.redhat.com/show_bug.cgi?id=2456338", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27137", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33186", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34986", "https://errata.almalinux.org/9/ALSA-2026-19353.html", "https://errata.rockylinux.org/RLSA-2026:23228", "https://github.com/grpc/grpc-go", "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3", "https://linux.oracle.com/cve/CVE-2026-33186.html", "https://linux.oracle.com/errata/ELSA-2026-48790.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33186", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33186.json", "https://www.cve.org/CVERecord?id=CVE-2026-33186" ], "PublishedDate": "2026-03-20T23:16:45.18Z", "LastModifiedDate": "2026-09-18T13:17:50.363Z" }, { "VulnerabilityID": "CVE-2026-84304", "VendorIDs": [ "GHSA-vp52-pcj8-j9qc" ], "PkgID": "google.golang.org/grpc@v1.58.3", "PkgName": "google.golang.org/grpc", "PkgIdentifier": { "PURL": "pkg:golang/google.golang.org/grpc@v1.58.3", "UID": "695dd48a89a4d663" }, "InstalledVersion": "v1.58.3", "FixedVersion": "1.83.1", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84304", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:4de7c6c5a55d3b35e2a805ba5ab935b01fd2b20fabac8c7cb46a41382fecdddd", "Title": "google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation", "Description": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "azure": 3, "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-84304", "https://github.com/grpc/grpc-go", "https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176", "https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77", "https://github.com/grpc/grpc-go/pull/9331", "https://github.com/grpc/grpc-go/pull/9333", "https://github.com/grpc/grpc-go/releases/tag/v1.83.1", "https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc", "https://nvd.nist.gov/vuln/detail/CVE-2026-84304", "https://www.cve.org/CVERecord?id=CVE-2026-84304" ], "PublishedDate": "2026-09-01T19:17:30.743Z", "LastModifiedDate": "2026-09-09T21:09:13.08Z" }, { "VulnerabilityID": "CVE-2026-84445", "VendorIDs": [ "GHSA-2v4p-qf9q-27wj" ], "PkgID": "google.golang.org/grpc@v1.58.3", "PkgName": "google.golang.org/grpc", "PkgIdentifier": { "PURL": "pkg:golang/google.golang.org/grpc@v1.58.3", "UID": "695dd48a89a4d663" }, "InstalledVersion": "v1.58.3", "FixedVersion": "1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84445", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:2c67ce997f2f97dc647828d6e790234d0e5e7aa576f6fea611ef4d39c14699d8", "Title": "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests", "Description": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.", "Severity": "HIGH", "CweIDs": [ "CWE-129", "CWE-248" ], "VendorSeverity": { "alma": 3, "azure": 3, "ghsa": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:76744", "https://access.redhat.com/errata/RHSA-2026:95272", "https://access.redhat.com/security/cve/CVE-2026-84445", "https://bugzilla.redhat.com/2533175", "https://bugzilla.redhat.com/show_bug.cgi?id=2533175", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84445", "https://errata.almalinux.org/9/ALSA-2026-76744.html", "https://errata.rockylinux.org/RLSA-2026:95272", "https://github.com/grpc/grpc-go", "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7", "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4", "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f", "https://github.com/grpc/grpc-go/issues/9354", "https://github.com/grpc/grpc-go/pull/9365", "https://github.com/grpc/grpc-go/pull/9366", "https://github.com/grpc/grpc-go/pull/9367", "https://github.com/grpc/grpc-go/releases/tag/v1.82.2", "https://github.com/grpc/grpc-go/releases/tag/v1.83.2", "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj", "https://nvd.nist.gov/vuln/detail/CVE-2026-84445", "https://www.cve.org/CVERecord?id=CVE-2026-84445" ], "PublishedDate": "2026-09-14T17:17:51.743Z", "LastModifiedDate": "2026-09-25T14:10:13.927Z" }, { "VulnerabilityID": "GHSA-hrxh-6v49-42gf", "PkgID": "google.golang.org/grpc@v1.58.3", "PkgName": "google.golang.org/grpc", "PkgIdentifier": { "PURL": "pkg:golang/google.golang.org/grpc@v1.58.3", "UID": "695dd48a89a4d663" }, "InstalledVersion": "v1.58.3", "FixedVersion": "1.82.1", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-hrxh-6v49-42gf", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:a66f91a8aec41e2bce1247c54a2edd4c9f0920e07cc22a66c2aab6fb70c812ea", "Title": "gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities", "Description": "Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization engine (internal/xds/rbac) and the HTTP/2 transport server implementation (internal/transport). These vulnerabilities could result in:\n\n- Authorization Bypass (Fail-Open) when translating xDS RBAC policies containing `Metadata` or `RequestedServerName` fields.\n- Denial of Service (High CPU Consumption) due to an HTTP/2 Rapid Reset mitigation bypass during client-initiated stream resets.\n- Denial of Service (Server Panic) when parsing crafted xDS RBAC policies containing `NOT` rules around unsupported fields.\n\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\n#### xDS RBAC Authorization Bypass via `Metadata` \u0026 `RequestedServerName` matchers\n\n- Affected Component: xDS RBAC \n- Impact: When building policy matchers for gRPC RBAC from xDS configurations, unsupported `permission` and `principal` rules (specifically `Metadata` and `RequestedServerName`) were silently ignored and treated as no-ops.\n - If an authorization policy relied purely on these matchers for access control, treating those rules as no-ops effectively removed the restrictions.\n- If these unsupported rules were nested inside logical `NOT` rules (`Permission_NotRule` / `Principal_NotId`) or multi-condition `OR/AND` rules, silently dropping them changed the boolean logic flow of the authorization engine.\n\nAs a result, policy evaluation decisions could fail open, allowing unauthorized clients to access protected gRPC services or resources.\n\n#### HTTP/2 Rapid Reset Mitigation Bypass / Denial of Service via Stream Aborts\n\n- Affected Component: HTTP/2 transport\n- Impact: Earlier mitigations in grpc-go for HTTP/2 Rapid Reset only applied threshold checks to items that directly resulted in control frames being written back to the wire, such as `SETTINGS` ACKs or server-initiated `RST_STREAM`s.\n\nWhen a client initiated a rapid flood of stream creation (`HEADERS`) immediately followed by stream termination `RST_STREAM`, items queued up in the control buffer without counting against the transport response frame threshold. An attacker can repeatedly trigger this flood sequence to bypass reader blocking, resulting in high CPU usage, and Denial of Service (DoS).\n\n#### Denial of Service (Panic) in xDS RBAC Engine via Unsupported Fields inside NOT Rules\n\n- Affected Component: xDS RBAC \n- Impact: The xDS RBAC policy translators recursively generate matchers for nested rules. When a `NOT` rule wrapped an unsupported or unhandled field (such as `SourcedMetadata`), the recursive step returned an empty matcher. This could result in a runtime panic when the RBAC engine attempts to authorize an incoming request.\n\nAn attacker or misconfigured/malicious xDS management server delivering an LDS/RDS update containing a `NOT` rule around an unhandled field causes the gRPC server process to crash immediately (CWE-248 / Denial of Service).\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nAll three issues have been fixed in `master` and will be released in 1.82.1 shortly.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nIf upgrading grpc-go immediately is not possible, apply the following workarounds based on your deployment architecture:\n\n* For xDS RBAC Vulnerabilities \u0026 Panics: Ensure that upstream xDS management servers do not push RBAC policies containing `Metadata`, `RequestedServerName`, or `NOT` rules wrapping unsupported fields (such as `SourcedMetadata`) to grpc-go servers.\n* For HTTP/2 Rapid Reset DOS: Configure upstream reverse proxies or load balancers (such as Envoy) with strict HTTP/2 `max_concurrent_streams` limits and active rate limiting on `RST_STREAM` frequency per connection.\n\n### Severity\n\n | Vulnerability | Qualitative Severity | Approximate CVSS v3.1 Score | Primary Impact |\n | :--- | :--- | :--- | :--- |\n | **xDS RBAC Authorization Bypass** | **High** | `8.2` | Unauthorized Access / Fail-Open |\n | **HTTP/2 Rapid Reset DOS Bypass** | **High** | `7.5` | High CPU Consumption / Denial of Service |\n | **xDS RBAC Engine Server Panic** | **Medium** | `5.9` | Process Crash / Denial of Service |", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.8 } }, "References": [ "https://github.com/grpc/grpc-go", "https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935", "https://github.com/grpc/grpc-go/pull/9236", "https://github.com/grpc/grpc-go/releases/tag/v1.82.1", "https://github.com/grpc/grpc-go/security/advisories/GHSA-hrxh-6v49-42gf" ], "PublishedDate": "2026-07-21T22:03:55Z", "LastModifiedDate": "2026-07-21T22:03:56Z" }, { "VulnerabilityID": "CVE-2024-24790", "VendorIDs": [ "GO-2024-2887" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.21.11, 1.22.4", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-24790", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:2cb87751fafe08cfdba8bc0f9dc0e5429c25167a6a0ae9be208fb9de4e712f93", "Title": "golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses", "Description": "The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.", "Severity": "CRITICAL", "VendorSeverity": { "alma": 2, "amazon": 3, "bitnami": 4, "bottlerocket": 2, "cbl-mariner": 4, "nvd": 4, "oracle-oval": 2, "photon": 4, "redhat": 2, "rocky": 2, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 6.7 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24790", "http://www.openwall.com/lists/oss-security/2024/06/04/1", "https://access.redhat.com/errata/RHSA-2025:7256", "https://access.redhat.com/security/cve/CVE-2024-24790", "https://bugzilla.redhat.com/2237777", "https://bugzilla.redhat.com/2237778", "https://bugzilla.redhat.com/2279814", "https://bugzilla.redhat.com/2292787", "https://bugzilla.redhat.com/2295310", "https://bugzilla.redhat.com/2315719", "https://bugzilla.redhat.com/show_bug.cgi?id=2237777", "https://bugzilla.redhat.com/show_bug.cgi?id=2237778", "https://bugzilla.redhat.com/show_bug.cgi?id=2279814", "https://bugzilla.redhat.com/show_bug.cgi?id=2292787", "https://bugzilla.redhat.com/show_bug.cgi?id=2295310", "https://bugzilla.redhat.com/show_bug.cgi?id=2315719", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39321", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39322", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24788", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24790", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24791", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9355", "https://errata.almalinux.org/9/ALSA-2025-7256.html", "https://errata.rockylinux.org/RLSA-2025:7256", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/2.9.0/BRSA-glvb5gspjgq6.toml", "https://github.com/golang/go/commit/051bdf3fd12a40307606ff9381138039c5f452f0%20%281.21%29", "https://github.com/golang/go/commit/12d5810cdb1f73cf23d7a86462143e9463317fca%20%281.22%29", "https://github.com/golang/go/issues/67680", "https://go.dev/cl/590316", "https://go.dev/issue/67680", "https://groups.google.com/g/golang-announce/c/XbxouI9gY7k", "https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ", "https://linux.oracle.com/cve/CVE-2024-24790.html", "https://linux.oracle.com/errata/ELSA-2025-7256.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-24790", "https://pkg.go.dev/vuln/GO-2024-2887", "https://security.netapp.com/advisory/ntap-20240905-0002/", "https://ubuntu.com/security/notices/USN-6886-1", "https://ubuntu.com/security/notices/USN-7109-1", "https://www.cve.org/CVERecord?id=CVE-2024-24790" ], "PublishedDate": "2024-06-05T16:15:10.56Z", "LastModifiedDate": "2026-06-17T07:14:52.097Z" }, { "VulnerabilityID": "CVE-2025-68121", "VendorIDs": [ "GO-2026-4337" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.24.13, 1.25.7, 1.26.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-68121", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:8c9e0fa0832324e1813c656cb860efa38acdba6ccdb57c2c4a933603fb6c54e4", "Title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "Description": "During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.", "Severity": "CRITICAL", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "bitnami": 4, "cbl-mariner": 2, "nvd": 4, "oracle-oval": 3, "photon": 4, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "V3Score": 10 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:4177", "https://access.redhat.com/security/cve/CVE-2025-68121", "https://bugzilla.redhat.com/2434432", "https://bugzilla.redhat.com/2437111", "https://bugzilla.redhat.com/show_bug.cgi?id=2434432", "https://bugzilla.redhat.com/show_bug.cgi?id=2437111", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121", "https://errata.almalinux.org/9/ALSA-2026-4177.html", "https://errata.rockylinux.org/RLSA-2026:4177", "https://github.com/golang/go/issues/77113", "https://go.dev/cl/737700", "https://go.dev/issue/77217", "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk", "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc", "https://linux.oracle.com/cve/CVE-2025-68121.html", "https://linux.oracle.com/errata/ELSA-2026-5146.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-68121", "https://pkg.go.dev/vuln/GO-2026-4337", "https://www.cve.org/CVERecord?id=CVE-2025-68121" ], "PublishedDate": "2026-02-05T18:16:10.857Z", "LastModifiedDate": "2026-06-17T09:58:33.833Z" }, { "VulnerabilityID": "CVE-2023-45288", "VendorIDs": [ "GHSA-4v7x-pqxf-cx7m", "GO-2024-2687" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.21.9, 1.22.2", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45288", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:3b1151befb9adaafe53162a0f05b6b1362e7d5e88e0531da0cd2aaa36a72a252", "Title": "golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS", "Description": "An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "bottlerocket": 2, "cbl-mariner": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45288", "http://www.openwall.com/lists/oss-security/2024/04/03/16", "http://www.openwall.com/lists/oss-security/2024/04/05/4", "https://access.redhat.com/errata/RHSA-2024:2724", "https://access.redhat.com/security/cve/CVE-2023-45288", "https://bugzilla.redhat.com/2268017", "https://bugzilla.redhat.com/2268018", "https://bugzilla.redhat.com/2268019", "https://bugzilla.redhat.com/2268273", "https://bugzilla.redhat.com/show_bug.cgi?id=2268017", "https://bugzilla.redhat.com/show_bug.cgi?id=2268018", "https://bugzilla.redhat.com/show_bug.cgi?id=2268019", "https://bugzilla.redhat.com/show_bug.cgi?id=2268273", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45288", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45289", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45290", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24783", "https://errata.almalinux.org/9/ALSA-2024-2724.html", "https://errata.rockylinux.org/RLSA-2024:2724", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-c9wf-j9h6-m2r9", "https://go.dev/cl/576155", "https://go.dev/issue/65051", "https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M", "https://kb.cert.org/vuls/id/421644", "https://linux.oracle.com/cve/CVE-2023-45288.html", "https://linux.oracle.com/errata/ELSA-2024-3346.html", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/", "https://nowotarski.info/http2-continuation-flood/", "https://nvd.nist.gov/vuln/detail/CVE-2023-45288", "https://pkg.go.dev/vuln/GO-2024-2687", "https://security.netapp.com/advisory/ntap-20240419-0009/", "https://ubuntu.com/security/notices/USN-6886-1", "https://ubuntu.com/security/notices/USN-7109-1", "https://ubuntu.com/security/notices/USN-7111-1", "https://www.cve.org/CVERecord?id=CVE-2023-45288", "https://www.kb.cert.org/vuls/id/421644" ], "PublishedDate": "2024-04-04T21:15:16.113Z", "LastModifiedDate": "2026-06-17T06:28:35.58Z" }, { "VulnerabilityID": "CVE-2024-34156", "VendorIDs": [ "GO-2024-3106" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.22.7, 1.23.1", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-34156", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:f817ffdd5fa93cfc50bfd285b4ee75e2e5064e55efae47d452bebb9b515ab40d", "Title": "encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion", "Description": "Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.", "Severity": "HIGH", "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2025:3773", "https://access.redhat.com/security/cve/CVE-2024-34156", "https://bugzilla.redhat.com/2310528", "https://bugzilla.redhat.com/show_bug.cgi?id=2310528", "https://bugzilla.redhat.com/show_bug.cgi?id=2341750", "https://bugzilla.redhat.com/show_bug.cgi?id=2341751", "https://bugzilla.redhat.com/show_bug.cgi?id=2344219", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45336", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45341", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22866", "https://errata.almalinux.org/9/ALSA-2025-3773.html", "https://errata.rockylinux.org/RLSA-2025:3773", "https://github.com/golang/go/commit/2092294f2b097c5828f4eace6c98a322c1510b01%20%28go1.22.7%29", "https://github.com/golang/go/commit/fa8ff1a46deb6c816304441ec6740ec112e19012%20%28go1.23.1%29", "https://go.dev/cl/611239", "https://go.dev/issue/69139", "https://groups.google.com/g/golang-announce/c/K-cEzDeCtpc", "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk", "https://linux.oracle.com/cve/CVE-2024-34156.html", "https://linux.oracle.com/errata/ELSA-2025-3773.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-34156", "https://pkg.go.dev/vuln/GO-2024-3106", "https://security.netapp.com/advisory/ntap-20240926-0004/", "https://ubuntu.com/security/notices/USN-7081-1", "https://ubuntu.com/security/notices/USN-7109-1", "https://ubuntu.com/security/notices/USN-7111-1", "https://www.cve.org/CVERecord?id=CVE-2024-34156" ], "PublishedDate": "2024-09-06T21:15:12.02Z", "LastModifiedDate": "2026-06-17T07:33:00.72Z" }, { "VulnerabilityID": "CVE-2025-61726", "VendorIDs": [ "GO-2026-4341" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.24.12, 1.25.6", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-61726", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:c4da61b4450d762c4280d31ff84c921b81cad0dfabf962dad3bbfa81c72393bd", "Title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url", "Description": "The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bitnami": 3, "cbl-mariner": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10096", "https://access.redhat.com/errata/RHSA-2026:10104", "https://access.redhat.com/errata/RHSA-2026:10184", "https://access.redhat.com/errata/RHSA-2026:10225", "https://access.redhat.com/errata/RHSA-2026:10250", "https://access.redhat.com/errata/RHSA-2026:11408", "https://access.redhat.com/errata/RHSA-2026:11414", "https://access.redhat.com/errata/RHSA-2026:11747", "https://access.redhat.com/errata/RHSA-2026:11749", "https://access.redhat.com/errata/RHSA-2026:12028", "https://access.redhat.com/errata/RHSA-2026:12029", "https://access.redhat.com/errata/RHSA-2026:12030", "https://access.redhat.com/errata/RHSA-2026:12031", "https://access.redhat.com/errata/RHSA-2026:12032", "https://access.redhat.com/errata/RHSA-2026:12033", "https://access.redhat.com/errata/RHSA-2026:12279", "https://access.redhat.com/errata/RHSA-2026:12282", "https://access.redhat.com/errata/RHSA-2026:13542", "https://access.redhat.com/errata/RHSA-2026:13548", "https://access.redhat.com/errata/RHSA-2026:13571", "https://access.redhat.com/errata/RHSA-2026:14100", "https://access.redhat.com/errata/RHSA-2026:14774", "https://access.redhat.com/errata/RHSA-2026:14868", "https://access.redhat.com/errata/RHSA-2026:14879", "https://access.redhat.com/errata/RHSA-2026:15091", "https://access.redhat.com/errata/RHSA-2026:15984", "https://access.redhat.com/errata/RHSA-2026:16102", "https://access.redhat.com/errata/RHSA-2026:16696", "https://access.redhat.com/errata/RHSA-2026:17040", "https://access.redhat.com/errata/RHSA-2026:17084", "https://access.redhat.com/errata/RHSA-2026:17446", "https://access.redhat.com/errata/RHSA-2026:17460", "https://access.redhat.com/errata/RHSA-2026:17463", "https://access.redhat.com/errata/RHSA-2026:17468", "https://access.redhat.com/errata/RHSA-2026:17595", "https://access.redhat.com/errata/RHSA-2026:17598", "https://access.redhat.com/errata/RHSA-2026:18913", "https://access.redhat.com/errata/RHSA-2026:19013", "https://access.redhat.com/errata/RHSA-2026:19132", "https://access.redhat.com/errata/RHSA-2026:19375", "https://access.redhat.com/errata/RHSA-2026:19634", "https://access.redhat.com/errata/RHSA-2026:19712", "https://access.redhat.com/errata/RHSA-2026:20041", "https://access.redhat.com/errata/RHSA-2026:21017", "https://access.redhat.com/errata/RHSA-2026:21657", "https://access.redhat.com/errata/RHSA-2026:21691", "https://access.redhat.com/errata/RHSA-2026:22450", "https://access.redhat.com/errata/RHSA-2026:22627", "https://access.redhat.com/errata/RHSA-2026:22714", "https://access.redhat.com/errata/RHSA-2026:22937", "https://access.redhat.com/errata/RHSA-2026:23228", "https://access.redhat.com/errata/RHSA-2026:23361", "https://access.redhat.com/errata/RHSA-2026:24977", "https://access.redhat.com/errata/RHSA-2026:25089", "https://access.redhat.com/errata/RHSA-2026:25127", "https://access.redhat.com/errata/RHSA-2026:25248", "https://access.redhat.com/errata/RHSA-2026:25250", "https://access.redhat.com/errata/RHSA-2026:25251", "https://access.redhat.com/errata/RHSA-2026:25252", "https://access.redhat.com/errata/RHSA-2026:25253", "https://access.redhat.com/errata/RHSA-2026:26420", "https://access.redhat.com/errata/RHSA-2026:26527", "https://access.redhat.com/errata/RHSA-2026:26541", "https://access.redhat.com/errata/RHSA-2026:26636", "https://access.redhat.com/errata/RHSA-2026:2681", "https://access.redhat.com/errata/RHSA-2026:2706", "https://access.redhat.com/errata/RHSA-2026:2708", "https://access.redhat.com/errata/RHSA-2026:2709", "https://access.redhat.com/errata/RHSA-2026:2754", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:2844", "https://access.redhat.com/errata/RHSA-2026:28441", "https://access.redhat.com/errata/RHSA-2026:28886", "https://access.redhat.com/errata/RHSA-2026:28961", "https://access.redhat.com/errata/RHSA-2026:2914", "https://access.redhat.com/errata/RHSA-2026:2920", "https://access.redhat.com/errata/RHSA-2026:3035", "https://access.redhat.com/errata/RHSA-2026:3040", "https://access.redhat.com/errata/RHSA-2026:3089", "https://access.redhat.com/errata/RHSA-2026:3092", "https://access.redhat.com/errata/RHSA-2026:3184", "https://access.redhat.com/errata/RHSA-2026:3186", "https://access.redhat.com/errata/RHSA-2026:3187", "https://access.redhat.com/errata/RHSA-2026:3188", "https://access.redhat.com/errata/RHSA-2026:3192", "https://access.redhat.com/errata/RHSA-2026:3193", "https://access.redhat.com/errata/RHSA-2026:3291", "https://access.redhat.com/errata/RHSA-2026:3296", "https://access.redhat.com/errata/RHSA-2026:3297", "https://access.redhat.com/errata/RHSA-2026:3298", "https://access.redhat.com/errata/RHSA-2026:3336", "https://access.redhat.com/errata/RHSA-2026:3337", "https://access.redhat.com/errata/RHSA-2026:3340", "https://access.redhat.com/errata/RHSA-2026:3341", "https://access.redhat.com/errata/RHSA-2026:3343", "https://access.redhat.com/errata/RHSA-2026:3391", "https://access.redhat.com/errata/RHSA-2026:3416", "https://access.redhat.com/errata/RHSA-2026:3427", "https://access.redhat.com/errata/RHSA-2026:3459", "https://access.redhat.com/errata/RHSA-2026:3468", "https://access.redhat.com/errata/RHSA-2026:3469", "https://access.redhat.com/errata/RHSA-2026:3470", "https://access.redhat.com/errata/RHSA-2026:3471", "https://access.redhat.com/errata/RHSA-2026:3472", "https://access.redhat.com/errata/RHSA-2026:3473", "https://access.redhat.com/errata/RHSA-2026:3489", "https://access.redhat.com/errata/RHSA-2026:3506", "https://access.redhat.com/errata/RHSA-2026:3556", "https://access.redhat.com/errata/RHSA-2026:3559", "https://access.redhat.com/errata/RHSA-2026:3668", "https://access.redhat.com/errata/RHSA-2026:3669", "https://access.redhat.com/errata/RHSA-2026:36873", "https://access.redhat.com/errata/RHSA-2026:36882", "https://access.redhat.com/errata/RHSA-2026:3699", "https://access.redhat.com/errata/RHSA-2026:3713", "https://access.redhat.com/errata/RHSA-2026:37275", "https://access.redhat.com/errata/RHSA-2026:3752", "https://access.redhat.com/errata/RHSA-2026:3753", "https://access.redhat.com/errata/RHSA-2026:3782", "https://access.redhat.com/errata/RHSA-2026:3812", "https://access.redhat.com/errata/RHSA-2026:3813", "https://access.redhat.com/errata/RHSA-2026:3814", "https://access.redhat.com/errata/RHSA-2026:3815", "https://access.redhat.com/errata/RHSA-2026:3816", "https://access.redhat.com/errata/RHSA-2026:3817", "https://access.redhat.com/errata/RHSA-2026:3818", "https://access.redhat.com/errata/RHSA-2026:3820", "https://access.redhat.com/errata/RHSA-2026:3821", "https://access.redhat.com/errata/RHSA-2026:3822", "https://access.redhat.com/errata/RHSA-2026:3831", "https://access.redhat.com/errata/RHSA-2026:3833", "https://access.redhat.com/errata/RHSA-2026:3835", "https://access.redhat.com/errata/RHSA-2026:3836", "https://access.redhat.com/errata/RHSA-2026:3838", "https://access.redhat.com/errata/RHSA-2026:3839", "https://access.redhat.com/errata/RHSA-2026:3840", "https://access.redhat.com/errata/RHSA-2026:3841", "https://access.redhat.com/errata/RHSA-2026:3843", "https://access.redhat.com/errata/RHSA-2026:3854", "https://access.redhat.com/errata/RHSA-2026:3855", "https://access.redhat.com/errata/RHSA-2026:3856", "https://access.redhat.com/errata/RHSA-2026:3864", "https://access.redhat.com/errata/RHSA-2026:3869", "https://access.redhat.com/errata/RHSA-2026:3874", "https://access.redhat.com/errata/RHSA-2026:3875", "https://access.redhat.com/errata/RHSA-2026:3879", "https://access.redhat.com/errata/RHSA-2026:3880", "https://access.redhat.com/errata/RHSA-2026:3884", "https://access.redhat.com/errata/RHSA-2026:3898", "https://access.redhat.com/errata/RHSA-2026:3905", "https://access.redhat.com/errata/RHSA-2026:3906", "https://access.redhat.com/errata/RHSA-2026:3928", "https://access.redhat.com/errata/RHSA-2026:3929", "https://access.redhat.com/errata/RHSA-2026:3930", "https://access.redhat.com/errata/RHSA-2026:3931", "https://access.redhat.com/errata/RHSA-2026:3932", "https://access.redhat.com/errata/RHSA-2026:3958", "https://access.redhat.com/errata/RHSA-2026:3959", "https://access.redhat.com/errata/RHSA-2026:3960", "https://access.redhat.com/errata/RHSA-2026:3970", "https://access.redhat.com/errata/RHSA-2026:3971", "https://access.redhat.com/errata/RHSA-2026:3972", "https://access.redhat.com/errata/RHSA-2026:3973", "https://access.redhat.com/errata/RHSA-2026:3974", "https://access.redhat.com/errata/RHSA-2026:3977", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:3985", "https://access.redhat.com/errata/RHSA-2026:40924", "https://access.redhat.com/errata/RHSA-2026:4164", "https://access.redhat.com/errata/RHSA-2026:4166", "https://access.redhat.com/errata/RHSA-2026:4170", "https://access.redhat.com/errata/RHSA-2026:4174", "https://access.redhat.com/errata/RHSA-2026:4177", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:41941", "https://access.redhat.com/errata/RHSA-2026:4211", "https://access.redhat.com/errata/RHSA-2026:4220", "https://access.redhat.com/errata/RHSA-2026:4256", "https://access.redhat.com/errata/RHSA-2026:4264", "https://access.redhat.com/errata/RHSA-2026:4267", "https://access.redhat.com/errata/RHSA-2026:4270", "https://access.redhat.com/errata/RHSA-2026:4276", "https://access.redhat.com/errata/RHSA-2026:4434", "https://access.redhat.com/errata/RHSA-2026:4435", "https://access.redhat.com/errata/RHSA-2026:4460", "https://access.redhat.com/errata/RHSA-2026:4466", "https://access.redhat.com/errata/RHSA-2026:4467", "https://access.redhat.com/errata/RHSA-2026:4498", "https://access.redhat.com/errata/RHSA-2026:4500", "https://access.redhat.com/errata/RHSA-2026:4510", "https://access.redhat.com/errata/RHSA-2026:4511", "https://access.redhat.com/errata/RHSA-2026:4672", "https://access.redhat.com/errata/RHSA-2026:46903", "https://access.redhat.com/errata/RHSA-2026:4753", "https://access.redhat.com/errata/RHSA-2026:4892", "https://access.redhat.com/errata/RHSA-2026:4901", "https://access.redhat.com/errata/RHSA-2026:4907", "https://access.redhat.com/errata/RHSA-2026:4939", "https://access.redhat.com/errata/RHSA-2026:4942", "https://access.redhat.com/errata/RHSA-2026:4943", "https://access.redhat.com/errata/RHSA-2026:4952", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:5022", "https://access.redhat.com/errata/RHSA-2026:5030", "https://access.redhat.com/errata/RHSA-2026:5031", "https://access.redhat.com/errata/RHSA-2026:5076", "https://access.redhat.com/errata/RHSA-2026:5077", "https://access.redhat.com/errata/RHSA-2026:5078", "https://access.redhat.com/errata/RHSA-2026:5079", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:5110", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:5129", "https://access.redhat.com/errata/RHSA-2026:5130", "https://access.redhat.com/errata/RHSA-2026:5131", "https://access.redhat.com/errata/RHSA-2026:5132", "https://access.redhat.com/errata/RHSA-2026:5145", "https://access.redhat.com/errata/RHSA-2026:5146", "https://access.redhat.com/errata/RHSA-2026:5168", "https://access.redhat.com/errata/RHSA-2026:5327", "https://access.redhat.com/errata/RHSA-2026:5394", "https://access.redhat.com/errata/RHSA-2026:5439", "https://access.redhat.com/errata/RHSA-2026:5444", "https://access.redhat.com/errata/RHSA-2026:5447", "https://access.redhat.com/errata/RHSA-2026:5452", "https://access.redhat.com/errata/RHSA-2026:5461", "https://access.redhat.com/errata/RHSA-2026:5463", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:5533", "https://access.redhat.com/errata/RHSA-2026:5544", "https://access.redhat.com/errata/RHSA-2026:5549", "https://access.redhat.com/errata/RHSA-2026:5636", "https://access.redhat.com/errata/RHSA-2026:56366", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:5645", "https://access.redhat.com/errata/RHSA-2026:5649", "https://access.redhat.com/errata/RHSA-2026:5665", "https://access.redhat.com/errata/RHSA-2026:57013", "https://access.redhat.com/errata/RHSA-2026:5807", "https://access.redhat.com/errata/RHSA-2026:5851", "https://access.redhat.com/errata/RHSA-2026:5852", "https://access.redhat.com/errata/RHSA-2026:5853", "https://access.redhat.com/errata/RHSA-2026:5948", "https://access.redhat.com/errata/RHSA-2026:5950", "https://access.redhat.com/errata/RHSA-2026:5952", "https://access.redhat.com/errata/RHSA-2026:5968", "https://access.redhat.com/errata/RHSA-2026:6184", "https://access.redhat.com/errata/RHSA-2026:6192", "https://access.redhat.com/errata/RHSA-2026:6226", "https://access.redhat.com/errata/RHSA-2026:6251", "https://access.redhat.com/errata/RHSA-2026:6277", "https://access.redhat.com/errata/RHSA-2026:6278", "https://access.redhat.com/errata/RHSA-2026:6428", "https://access.redhat.com/errata/RHSA-2026:6429", "https://access.redhat.com/errata/RHSA-2026:6497", "https://access.redhat.com/errata/RHSA-2026:6554", "https://access.redhat.com/errata/RHSA-2026:6564", "https://access.redhat.com/errata/RHSA-2026:6567", "https://access.redhat.com/errata/RHSA-2026:6568", "https://access.redhat.com/errata/RHSA-2026:66401", "https://access.redhat.com/errata/RHSA-2026:7052", "https://access.redhat.com/errata/RHSA-2026:7249", "https://access.redhat.com/errata/RHSA-2026:7291", "https://access.redhat.com/errata/RHSA-2026:7385", "https://access.redhat.com/errata/RHSA-2026:7676", "https://access.redhat.com/errata/RHSA-2026:7854", "https://access.redhat.com/errata/RHSA-2026:7942", "https://access.redhat.com/errata/RHSA-2026:8151", "https://access.redhat.com/errata/RHSA-2026:8167", "https://access.redhat.com/errata/RHSA-2026:8218", "https://access.redhat.com/errata/RHSA-2026:8229", "https://access.redhat.com/errata/RHSA-2026:8337", "https://access.redhat.com/errata/RHSA-2026:8338", "https://access.redhat.com/errata/RHSA-2026:8431", "https://access.redhat.com/errata/RHSA-2026:8433", "https://access.redhat.com/errata/RHSA-2026:8483", "https://access.redhat.com/errata/RHSA-2026:9097", "https://access.redhat.com/errata/RHSA-2026:9098", "https://access.redhat.com/errata/RHSA-2026:9108", "https://access.redhat.com/errata/RHSA-2026:9109", "https://access.redhat.com/errata/RHSA-2026:9848", "https://access.redhat.com/security/cve/CVE-2025-61726", "https://bugzilla.redhat.com/2434432", "https://bugzilla.redhat.com/2437111", "https://bugzilla.redhat.com/show_bug.cgi?id=2434432", "https://bugzilla.redhat.com/show_bug.cgi?id=2437111", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121", "https://errata.almalinux.org/9/ALSA-2026-4177.html", "https://errata.rockylinux.org/RLSA-2026:4177", "https://go.dev/cl/736712", "https://go.dev/issue/77101", "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc", "https://linux.oracle.com/cve/CVE-2025-61726.html", "https://linux.oracle.com/errata/ELSA-2026-5146.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-61726", "https://pkg.go.dev/vuln/GO-2026-4341", "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61726.json", "https://www.cve.org/CVERecord?id=CVE-2025-61726" ], "PublishedDate": "2026-01-28T20:16:09.713Z", "LastModifiedDate": "2026-09-17T12:17:11.443Z" }, { "VulnerabilityID": "CVE-2025-61729", "VendorIDs": [ "GO-2025-4155" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.24.11, 1.25.5", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-61729", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:438cc2d4ba86de5803d37648495f70d73078c150f31139b91fb44eb25ae9cf7e", "Title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate", "Description": "Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "cbl-mariner": 1, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:3928", "https://access.redhat.com/security/cve/CVE-2025-61729", "https://bugzilla.redhat.com/2418462", "https://bugzilla.redhat.com/2434432", "https://bugzilla.redhat.com/2437111", "https://bugzilla.redhat.com/show_bug.cgi?id=2418462", "https://bugzilla.redhat.com/show_bug.cgi?id=2434432", "https://bugzilla.redhat.com/show_bug.cgi?id=2437111", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121", "https://errata.almalinux.org/9/ALSA-2026-3928.html", "https://errata.rockylinux.org/RLSA-2026:3928", "https://go.dev/cl/725920", "https://go.dev/issue/76445", "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4", "https://linux.oracle.com/cve/CVE-2025-61729.html", "https://linux.oracle.com/errata/ELSA-2026-5146.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-61729", "https://pkg.go.dev/vuln/GO-2025-4155", "https://www.cve.org/CVERecord?id=CVE-2025-61729" ], "PublishedDate": "2025-12-02T19:15:51.447Z", "LastModifiedDate": "2026-10-18T18:10:00.1Z" }, { "VulnerabilityID": "CVE-2026-111943", "VendorIDs": [ "GO-2026-6809" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.26.10, 1.27.3", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-111943", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:4a3cd310ecadbd5c8c1bace09b8f21043d8e293a44f48f3d9dfbf854e04c52d2", "Title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "Description": "On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.", "Severity": "HIGH", "CweIDs": [ "CWE-299" ], "VendorSeverity": { "alma": 3, "amazon": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 6.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/20/29", "https://access.redhat.com/errata/RHSA-2026:95518", "https://access.redhat.com/security/cve/CVE-2026-111943", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-95518.html", "https://errata.rockylinux.org/RLSA-2026:95518", "https://github.com/golang/go/issues/82345", "https://go.dev/cl/851047", "https://go.dev/issue/82345", "https://groups.google.com/g/golang-announce/c/66pojueaQek", "https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU", "https://linux.oracle.com/cve/CVE-2026-111943.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-111943", "https://pkg.go.dev/vuln/GO-2026-6809", "https://www.cve.org/CVERecord?id=CVE-2026-111943" ], "PublishedDate": "2026-10-21T01:17:20.797Z", "LastModifiedDate": "2026-10-30T13:18:28.74Z" }, { "VulnerabilityID": "CVE-2026-25679", "VendorIDs": [ "GO-2026-4601" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.25.8, 1.26.1", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-25679", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:bf383da4ddb75883494397d17db1e72dc6fdf6867844c73121951582ad4ec4de", "Title": "net/url: Incorrect parsing of IPv6 host literals in net/url", "Description": "url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.", "Severity": "HIGH", "CweIDs": [ "CWE-425", "CWE-1286" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10065", "https://access.redhat.com/errata/RHSA-2026:10125", "https://access.redhat.com/errata/RHSA-2026:10133", "https://access.redhat.com/errata/RHSA-2026:10140", "https://access.redhat.com/errata/RHSA-2026:10141", "https://access.redhat.com/errata/RHSA-2026:10158", "https://access.redhat.com/errata/RHSA-2026:10169", "https://access.redhat.com/errata/RHSA-2026:10175", "https://access.redhat.com/errata/RHSA-2026:10184", "https://access.redhat.com/errata/RHSA-2026:10225", "https://access.redhat.com/errata/RHSA-2026:10250", "https://access.redhat.com/errata/RHSA-2026:10701", "https://access.redhat.com/errata/RHSA-2026:10712", "https://access.redhat.com/errata/RHSA-2026:10929", "https://access.redhat.com/errata/RHSA-2026:11217", "https://access.redhat.com/errata/RHSA-2026:11375", "https://access.redhat.com/errata/RHSA-2026:11412", "https://access.redhat.com/errata/RHSA-2026:11413", "https://access.redhat.com/errata/RHSA-2026:11686", "https://access.redhat.com/errata/RHSA-2026:11688", "https://access.redhat.com/errata/RHSA-2026:11747", "https://access.redhat.com/errata/RHSA-2026:11749", "https://access.redhat.com/errata/RHSA-2026:11768", "https://access.redhat.com/errata/RHSA-2026:11800", "https://access.redhat.com/errata/RHSA-2026:11856", "https://access.redhat.com/errata/RHSA-2026:11916", "https://access.redhat.com/errata/RHSA-2026:11996", "https://access.redhat.com/errata/RHSA-2026:12028", "https://access.redhat.com/errata/RHSA-2026:12029", "https://access.redhat.com/errata/RHSA-2026:12030", "https://access.redhat.com/errata/RHSA-2026:12031", "https://access.redhat.com/errata/RHSA-2026:12032", "https://access.redhat.com/errata/RHSA-2026:12033", "https://access.redhat.com/errata/RHSA-2026:12282", "https://access.redhat.com/errata/RHSA-2026:13508", "https://access.redhat.com/errata/RHSA-2026:13512", "https://access.redhat.com/errata/RHSA-2026:13545", "https://access.redhat.com/errata/RHSA-2026:13642", "https://access.redhat.com/errata/RHSA-2026:13643", "https://access.redhat.com/errata/RHSA-2026:13671", "https://access.redhat.com/errata/RHSA-2026:13791", "https://access.redhat.com/errata/RHSA-2026:13829", "https://access.redhat.com/errata/RHSA-2026:14020", "https://access.redhat.com/errata/RHSA-2026:14100", "https://access.redhat.com/errata/RHSA-2026:14774", "https://access.redhat.com/errata/RHSA-2026:14868", "https://access.redhat.com/errata/RHSA-2026:14879", "https://access.redhat.com/errata/RHSA-2026:15091", "https://access.redhat.com/errata/RHSA-2026:16102", "https://access.redhat.com/errata/RHSA-2026:16696", "https://access.redhat.com/errata/RHSA-2026:16874", "https://access.redhat.com/errata/RHSA-2026:16875", "https://access.redhat.com/errata/RHSA-2026:17040", "https://access.redhat.com/errata/RHSA-2026:17084", "https://access.redhat.com/errata/RHSA-2026:17287", "https://access.redhat.com/errata/RHSA-2026:17598", "https://access.redhat.com/errata/RHSA-2026:19017", "https://access.redhat.com/errata/RHSA-2026:19022", "https://access.redhat.com/errata/RHSA-2026:19026", "https://access.redhat.com/errata/RHSA-2026:19027", "https://access.redhat.com/errata/RHSA-2026:19031", "https://access.redhat.com/errata/RHSA-2026:19032", "https://access.redhat.com/errata/RHSA-2026:19049", "https://access.redhat.com/errata/RHSA-2026:19055", "https://access.redhat.com/errata/RHSA-2026:19126", "https://access.redhat.com/errata/RHSA-2026:19128", "https://access.redhat.com/errata/RHSA-2026:19132", "https://access.redhat.com/errata/RHSA-2026:19133", "https://access.redhat.com/errata/RHSA-2026:19135", "https://access.redhat.com/errata/RHSA-2026:19181", "https://access.redhat.com/errata/RHSA-2026:19184", "https://access.redhat.com/errata/RHSA-2026:19185", "https://access.redhat.com/errata/RHSA-2026:19207", "https://access.redhat.com/errata/RHSA-2026:19350", "https://access.redhat.com/errata/RHSA-2026:19353", "https://access.redhat.com/errata/RHSA-2026:19375", "https://access.redhat.com/errata/RHSA-2026:19475", "https://access.redhat.com/errata/RHSA-2026:19634", "https://access.redhat.com/errata/RHSA-2026:19719", "https://access.redhat.com/errata/RHSA-2026:19720", "https://access.redhat.com/errata/RHSA-2026:19721", "https://access.redhat.com/errata/RHSA-2026:19750", "https://access.redhat.com/errata/RHSA-2026:20041", "https://access.redhat.com/errata/RHSA-2026:20088", "https://access.redhat.com/errata/RHSA-2026:20581", "https://access.redhat.com/errata/RHSA-2026:20582", "https://access.redhat.com/errata/RHSA-2026:20584", "https://access.redhat.com/errata/RHSA-2026:20889", "https://access.redhat.com/errata/RHSA-2026:21017", "https://access.redhat.com/errata/RHSA-2026:21655", "https://access.redhat.com/errata/RHSA-2026:21657", "https://access.redhat.com/errata/RHSA-2026:21691", "https://access.redhat.com/errata/RHSA-2026:21696", "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:22423", "https://access.redhat.com/errata/RHSA-2026:22450", "https://access.redhat.com/errata/RHSA-2026:22627", "https://access.redhat.com/errata/RHSA-2026:22714", "https://access.redhat.com/errata/RHSA-2026:22733", "https://access.redhat.com/errata/RHSA-2026:22862", "https://access.redhat.com/errata/RHSA-2026:22937", "https://access.redhat.com/errata/RHSA-2026:23228", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/errata/RHSA-2026:24386", "https://access.redhat.com/errata/RHSA-2026:24853", "https://access.redhat.com/errata/RHSA-2026:25043", "https://access.redhat.com/errata/RHSA-2026:25127", "https://access.redhat.com/errata/RHSA-2026:25180", "https://access.redhat.com/errata/RHSA-2026:25248", "https://access.redhat.com/errata/RHSA-2026:25250", "https://access.redhat.com/errata/RHSA-2026:25251", "https://access.redhat.com/errata/RHSA-2026:25252", "https://access.redhat.com/errata/RHSA-2026:25253", "https://access.redhat.com/errata/RHSA-2026:26445", "https://access.redhat.com/errata/RHSA-2026:26527", "https://access.redhat.com/errata/RHSA-2026:26541", "https://access.redhat.com/errata/RHSA-2026:26568", "https://access.redhat.com/errata/RHSA-2026:26585", "https://access.redhat.com/errata/RHSA-2026:26636", "https://access.redhat.com/errata/RHSA-2026:27076", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:28441", "https://access.redhat.com/errata/RHSA-2026:28886", "https://access.redhat.com/errata/RHSA-2026:28893", "https://access.redhat.com/errata/RHSA-2026:28961", "https://access.redhat.com/errata/RHSA-2026:29035", "https://access.redhat.com/errata/RHSA-2026:29195", "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:29702", "https://access.redhat.com/errata/RHSA-2026:29703", "https://access.redhat.com/errata/RHSA-2026:29854", "https://access.redhat.com/errata/RHSA-2026:33722", "https://access.redhat.com/errata/RHSA-2026:34097", "https://access.redhat.com/errata/RHSA-2026:34365", "https://access.redhat.com/errata/RHSA-2026:36317", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:48036", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:5110", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:52389", "https://access.redhat.com/errata/RHSA-2026:52390", "https://access.redhat.com/errata/RHSA-2026:52391", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:5549", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:5941", "https://access.redhat.com/errata/RHSA-2026:5942", "https://access.redhat.com/errata/RHSA-2026:5943", "https://access.redhat.com/errata/RHSA-2026:5944", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:6341", "https://access.redhat.com/errata/RHSA-2026:6344", "https://access.redhat.com/errata/RHSA-2026:6382", "https://access.redhat.com/errata/RHSA-2026:6383", "https://access.redhat.com/errata/RHSA-2026:6388", "https://access.redhat.com/errata/RHSA-2026:6564", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:66401", "https://access.redhat.com/errata/RHSA-2026:6720", "https://access.redhat.com/errata/RHSA-2026:6802", "https://access.redhat.com/errata/RHSA-2026:6949", "https://access.redhat.com/errata/RHSA-2026:7005", "https://access.redhat.com/errata/RHSA-2026:7009", "https://access.redhat.com/errata/RHSA-2026:7011", "https://access.redhat.com/errata/RHSA-2026:7259", "https://access.redhat.com/errata/RHSA-2026:7291", "https://access.redhat.com/errata/RHSA-2026:7315", "https://access.redhat.com/errata/RHSA-2026:7328", "https://access.redhat.com/errata/RHSA-2026:7385", "https://access.redhat.com/errata/RHSA-2026:7665", "https://access.redhat.com/errata/RHSA-2026:7669", "https://access.redhat.com/errata/RHSA-2026:7674", "https://access.redhat.com/errata/RHSA-2026:7833", "https://access.redhat.com/errata/RHSA-2026:7834", "https://access.redhat.com/errata/RHSA-2026:7876", "https://access.redhat.com/errata/RHSA-2026:7877", "https://access.redhat.com/errata/RHSA-2026:7878", "https://access.redhat.com/errata/RHSA-2026:7879", "https://access.redhat.com/errata/RHSA-2026:7883", "https://access.redhat.com/errata/RHSA-2026:7992", "https://access.redhat.com/errata/RHSA-2026:8151", "https://access.redhat.com/errata/RHSA-2026:8167", "https://access.redhat.com/errata/RHSA-2026:8314", "https://access.redhat.com/errata/RHSA-2026:8322", "https://access.redhat.com/errata/RHSA-2026:8324", "https://access.redhat.com/errata/RHSA-2026:8337", "https://access.redhat.com/errata/RHSA-2026:8338", "https://access.redhat.com/errata/RHSA-2026:8433", "https://access.redhat.com/errata/RHSA-2026:8434", "https://access.redhat.com/errata/RHSA-2026:8456", "https://access.redhat.com/errata/RHSA-2026:8483", "https://access.redhat.com/errata/RHSA-2026:8484", "https://access.redhat.com/errata/RHSA-2026:8490", "https://access.redhat.com/errata/RHSA-2026:8491", "https://access.redhat.com/errata/RHSA-2026:8493", "https://access.redhat.com/errata/RHSA-2026:8840", "https://access.redhat.com/errata/RHSA-2026:8841", "https://access.redhat.com/errata/RHSA-2026:8842", "https://access.redhat.com/errata/RHSA-2026:8845", "https://access.redhat.com/errata/RHSA-2026:8847", "https://access.redhat.com/errata/RHSA-2026:8848", "https://access.redhat.com/errata/RHSA-2026:8849", "https://access.redhat.com/errata/RHSA-2026:8851", "https://access.redhat.com/errata/RHSA-2026:8852", "https://access.redhat.com/errata/RHSA-2026:8853", "https://access.redhat.com/errata/RHSA-2026:8855", "https://access.redhat.com/errata/RHSA-2026:8856", "https://access.redhat.com/errata/RHSA-2026:8860", "https://access.redhat.com/errata/RHSA-2026:8877", "https://access.redhat.com/errata/RHSA-2026:8878", "https://access.redhat.com/errata/RHSA-2026:8879", "https://access.redhat.com/errata/RHSA-2026:8881", "https://access.redhat.com/errata/RHSA-2026:8882", "https://access.redhat.com/errata/RHSA-2026:8930", "https://access.redhat.com/errata/RHSA-2026:8931", "https://access.redhat.com/errata/RHSA-2026:8949", "https://access.redhat.com/errata/RHSA-2026:9043", "https://access.redhat.com/errata/RHSA-2026:9044", "https://access.redhat.com/errata/RHSA-2026:9052", "https://access.redhat.com/errata/RHSA-2026:9090", "https://access.redhat.com/errata/RHSA-2026:9093", "https://access.redhat.com/errata/RHSA-2026:9094", "https://access.redhat.com/errata/RHSA-2026:9097", "https://access.redhat.com/errata/RHSA-2026:9098", "https://access.redhat.com/errata/RHSA-2026:9108", "https://access.redhat.com/errata/RHSA-2026:9109", "https://access.redhat.com/errata/RHSA-2026:9385", "https://access.redhat.com/errata/RHSA-2026:9434", "https://access.redhat.com/errata/RHSA-2026:9435", "https://access.redhat.com/errata/RHSA-2026:9436", "https://access.redhat.com/errata/RHSA-2026:9439", "https://access.redhat.com/errata/RHSA-2026:9440", "https://access.redhat.com/errata/RHSA-2026:9448", "https://access.redhat.com/errata/RHSA-2026:9453", "https://access.redhat.com/errata/RHSA-2026:9461", "https://access.redhat.com/errata/RHSA-2026:9695", "https://access.redhat.com/errata/RHSA-2026:9742", "https://access.redhat.com/errata/RHSA-2026:9872", "https://access.redhat.com/security/cve/CVE-2026-25679", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://errata.almalinux.org/9/ALSA-2026-9044.html", "https://errata.rockylinux.org/RLSA-2026:9044", "https://go.dev/cl/752180", "https://go.dev/issue/77578", "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk", "https://linux.oracle.com/cve/CVE-2026-25679.html", "https://linux.oracle.com/errata/ELSA-2026-9044.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-25679", "https://pkg.go.dev/vuln/GO-2026-4601", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25679.json", "https://www.cve.org/CVERecord?id=CVE-2026-25679" ], "PublishedDate": "2026-03-06T22:16:00.72Z", "LastModifiedDate": "2026-09-18T13:17:30.067Z" }, { "VulnerabilityID": "CVE-2026-27145", "VendorIDs": [ "GO-2026-5037" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.25.11, 1.26.4", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27145", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:c805860e2984baa49156178f93b1381b3a1b79959ff4ac96c47667f1234f16a1", "Title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries", "Description": "(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.", "Severity": "HIGH", "CweIDs": [ "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:29980", "https://access.redhat.com/errata/RHSA-2026:29981", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:35832", "https://access.redhat.com/errata/RHSA-2026:36317", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:38995", "https://access.redhat.com/errata/RHSA-2026:39005", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39879", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41930", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42080", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42946", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:46394", "https://access.redhat.com/errata/RHSA-2026:46395", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49703", "https://access.redhat.com/errata/RHSA-2026:49705", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:49729", "https://access.redhat.com/errata/RHSA-2026:49744", "https://access.redhat.com/errata/RHSA-2026:49765", "https://access.redhat.com/errata/RHSA-2026:49770", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:51057", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:52946", "https://access.redhat.com/errata/RHSA-2026:53374", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53416", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54168", "https://access.redhat.com/errata/RHSA-2026:54401", "https://access.redhat.com/errata/RHSA-2026:54427", "https://access.redhat.com/errata/RHSA-2026:54432", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54500", "https://access.redhat.com/errata/RHSA-2026:54525", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:55899", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:59556", "https://access.redhat.com/errata/RHSA-2026:59557", "https://access.redhat.com/errata/RHSA-2026:59558", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:59579", "https://access.redhat.com/errata/RHSA-2026:59593", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60315", "https://access.redhat.com/errata/RHSA-2026:60354", "https://access.redhat.com/errata/RHSA-2026:60386", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60388", "https://access.redhat.com/errata/RHSA-2026:60390", "https://access.redhat.com/errata/RHSA-2026:60391", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:63016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68335", "https://access.redhat.com/security/cve/CVE-2026-27145", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/2484207", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2484207", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27145", "https://errata.almalinux.org/9/ALSA-2026-36317.html", "https://errata.rockylinux.org/RLSA-2026:36317", "https://go.dev/cl/783621", "https://go.dev/issue/79694", "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw", "https://linux.oracle.com/cve/CVE-2026-27145.html", "https://linux.oracle.com/errata/ELSA-2026-53416.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-27145", "https://pkg.go.dev/vuln/GO-2026-5037", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27145.json", "https://www.cve.org/CVERecord?id=CVE-2026-27145" ], "PublishedDate": "2026-06-02T23:16:35.57Z", "LastModifiedDate": "2026-09-18T13:17:43.283Z" }, { "VulnerabilityID": "CVE-2026-32280", "VendorIDs": [ "GO-2026-4947" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.25.9, 1.26.2", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32280", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:d792532e8df7de0aca9290f912429710b7c6cab03ece2c95868b83179aacf984", "Title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building", "Description": "During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10217", "https://access.redhat.com/errata/RHSA-2026:10219", "https://access.redhat.com/errata/RHSA-2026:10704", "https://access.redhat.com/errata/RHSA-2026:11507", "https://access.redhat.com/errata/RHSA-2026:11514", "https://access.redhat.com/errata/RHSA-2026:11688", "https://access.redhat.com/errata/RHSA-2026:13545", "https://access.redhat.com/errata/RHSA-2026:13791", "https://access.redhat.com/errata/RHSA-2026:13826", "https://access.redhat.com/errata/RHSA-2026:13829", "https://access.redhat.com/errata/RHSA-2026:14020", "https://access.redhat.com/errata/RHSA-2026:14162", "https://access.redhat.com/errata/RHSA-2026:14200", "https://access.redhat.com/errata/RHSA-2026:14391", "https://access.redhat.com/errata/RHSA-2026:15980", "https://access.redhat.com/errata/RHSA-2026:16021", "https://access.redhat.com/errata/RHSA-2026:16024", "https://access.redhat.com/errata/RHSA-2026:16101", "https://access.redhat.com/errata/RHSA-2026:16476", "https://access.redhat.com/errata/RHSA-2026:16477", "https://access.redhat.com/errata/RHSA-2026:16505", "https://access.redhat.com/errata/RHSA-2026:16508", "https://access.redhat.com/errata/RHSA-2026:16532", "https://access.redhat.com/errata/RHSA-2026:16534", "https://access.redhat.com/errata/RHSA-2026:16535", "https://access.redhat.com/errata/RHSA-2026:16537", "https://access.redhat.com/errata/RHSA-2026:16542", "https://access.redhat.com/errata/RHSA-2026:16874", "https://access.redhat.com/errata/RHSA-2026:16875", "https://access.redhat.com/errata/RHSA-2026:17084", "https://access.redhat.com/errata/RHSA-2026:17287", "https://access.redhat.com/errata/RHSA-2026:18027", "https://access.redhat.com/errata/RHSA-2026:18032", "https://access.redhat.com/errata/RHSA-2026:19133", "https://access.redhat.com/errata/RHSA-2026:19135", "https://access.redhat.com/errata/RHSA-2026:19144", "https://access.redhat.com/errata/RHSA-2026:19350", "https://access.redhat.com/errata/RHSA-2026:19353", "https://access.redhat.com/errata/RHSA-2026:19375", "https://access.redhat.com/errata/RHSA-2026:19450", "https://access.redhat.com/errata/RHSA-2026:19550", "https://access.redhat.com/errata/RHSA-2026:19634", "https://access.redhat.com/errata/RHSA-2026:19714", "https://access.redhat.com/errata/RHSA-2026:19715", "https://access.redhat.com/errata/RHSA-2026:19719", "https://access.redhat.com/errata/RHSA-2026:19720", "https://access.redhat.com/errata/RHSA-2026:19721", "https://access.redhat.com/errata/RHSA-2026:19722", "https://access.redhat.com/errata/RHSA-2026:19750", "https://access.redhat.com/errata/RHSA-2026:19839", "https://access.redhat.com/errata/RHSA-2026:20556", "https://access.redhat.com/errata/RHSA-2026:20569", "https://access.redhat.com/errata/RHSA-2026:20570", "https://access.redhat.com/errata/RHSA-2026:20571", "https://access.redhat.com/errata/RHSA-2026:20607", "https://access.redhat.com/errata/RHSA-2026:20608", "https://access.redhat.com/errata/RHSA-2026:20609", "https://access.redhat.com/errata/RHSA-2026:20889", "https://access.redhat.com/errata/RHSA-2026:21017", "https://access.redhat.com/errata/RHSA-2026:21338", "https://access.redhat.com/errata/RHSA-2026:21655", "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:21772", "https://access.redhat.com/errata/RHSA-2026:22130", "https://access.redhat.com/errata/RHSA-2026:22141", "https://access.redhat.com/errata/RHSA-2026:22258", "https://access.redhat.com/errata/RHSA-2026:22260", "https://access.redhat.com/errata/RHSA-2026:22268", "https://access.redhat.com/errata/RHSA-2026:22309", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:22415", "https://access.redhat.com/errata/RHSA-2026:22422", "https://access.redhat.com/errata/RHSA-2026:22465", "https://access.redhat.com/errata/RHSA-2026:22485", "https://access.redhat.com/errata/RHSA-2026:22709", "https://access.redhat.com/errata/RHSA-2026:22713", "https://access.redhat.com/errata/RHSA-2026:22840", "https://access.redhat.com/errata/RHSA-2026:22862", "https://access.redhat.com/errata/RHSA-2026:22958", "https://access.redhat.com/errata/RHSA-2026:22959", "https://access.redhat.com/errata/RHSA-2026:22960", "https://access.redhat.com/errata/RHSA-2026:22961", "https://access.redhat.com/errata/RHSA-2026:22962", "https://access.redhat.com/errata/RHSA-2026:23102", "https://access.redhat.com/errata/RHSA-2026:23103", "https://access.redhat.com/errata/RHSA-2026:23244", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/errata/RHSA-2026:23361", "https://access.redhat.com/errata/RHSA-2026:24337", "https://access.redhat.com/errata/RHSA-2026:24359", "https://access.redhat.com/errata/RHSA-2026:24470", "https://access.redhat.com/errata/RHSA-2026:24478", "https://access.redhat.com/errata/RHSA-2026:24716", "https://access.redhat.com/errata/RHSA-2026:24761", "https://access.redhat.com/errata/RHSA-2026:24762", "https://access.redhat.com/errata/RHSA-2026:24853", "https://access.redhat.com/errata/RHSA-2026:24977", "https://access.redhat.com/errata/RHSA-2026:25089", "https://access.redhat.com/errata/RHSA-2026:25127", "https://access.redhat.com/errata/RHSA-2026:25180", "https://access.redhat.com/errata/RHSA-2026:25248", "https://access.redhat.com/errata/RHSA-2026:25250", "https://access.redhat.com/errata/RHSA-2026:25251", "https://access.redhat.com/errata/RHSA-2026:25252", "https://access.redhat.com/errata/RHSA-2026:25253", "https://access.redhat.com/errata/RHSA-2026:26447", "https://access.redhat.com/errata/RHSA-2026:26568", "https://access.redhat.com/errata/RHSA-2026:26571", "https://access.redhat.com/errata/RHSA-2026:26585", "https://access.redhat.com/errata/RHSA-2026:26636", "https://access.redhat.com/errata/RHSA-2026:27076", "https://access.redhat.com/errata/RHSA-2026:28038", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:28074", "https://access.redhat.com/errata/RHSA-2026:28196", "https://access.redhat.com/errata/RHSA-2026:28198", "https://access.redhat.com/errata/RHSA-2026:28441", "https://access.redhat.com/errata/RHSA-2026:28886", "https://access.redhat.com/errata/RHSA-2026:28961", "https://access.redhat.com/errata/RHSA-2026:29035", "https://access.redhat.com/errata/RHSA-2026:29195", "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:29702", "https://access.redhat.com/errata/RHSA-2026:29703", "https://access.redhat.com/errata/RHSA-2026:29854", "https://access.redhat.com/errata/RHSA-2026:33722", "https://access.redhat.com/errata/RHSA-2026:34097", "https://access.redhat.com/errata/RHSA-2026:34192", "https://access.redhat.com/errata/RHSA-2026:34196", "https://access.redhat.com/errata/RHSA-2026:34197", "https://access.redhat.com/errata/RHSA-2026:34365", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:39894", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:47712", "https://access.redhat.com/errata/RHSA-2026:47714", "https://access.redhat.com/errata/RHSA-2026:47716", "https://access.redhat.com/errata/RHSA-2026:47719", "https://access.redhat.com/errata/RHSA-2026:47721", "https://access.redhat.com/errata/RHSA-2026:47722", "https://access.redhat.com/errata/RHSA-2026:47910", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:48036", "https://access.redhat.com/errata/RHSA-2026:48790", "https://access.redhat.com/errata/RHSA-2026:49509", "https://access.redhat.com/errata/RHSA-2026:49526", "https://access.redhat.com/errata/RHSA-2026:49600", "https://access.redhat.com/errata/RHSA-2026:49838", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56855", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:56913", "https://access.redhat.com/errata/RHSA-2026:57409", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:59834", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61685", "https://access.redhat.com/errata/RHSA-2026:61906", "https://access.redhat.com/errata/RHSA-2026:61907", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66401", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:9385", "https://access.redhat.com/security/cve/CVE-2026-32280", "https://bugzilla.redhat.com/2456333", "https://bugzilla.redhat.com/2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-49838.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/758320", "https://go.dev/issue/78282", "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "https://linux.oracle.com/cve/CVE-2026-32280.html", "https://linux.oracle.com/errata/ELSA-2026-65886-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-32280", "https://pkg.go.dev/vuln/GO-2026-4947", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32280.json", "https://www.cve.org/CVERecord?id=CVE-2026-32280" ], "PublishedDate": "2026-04-08T02:16:03.247Z", "LastModifiedDate": "2026-09-18T13:17:45.92Z" }, { "VulnerabilityID": "CVE-2026-32281", "VendorIDs": [ "GO-2026-4946" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.25.9, 1.26.2", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32281", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:305a889b3c0a6ee0ef9fab3190f3f6dda740a0e001477cd8e27801e5d37e053b", "Title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation", "Description": "Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:49838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/security/cve/CVE-2026-32281", "https://bugzilla.redhat.com/2456333", "https://bugzilla.redhat.com/2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-49838.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/758061", "https://go.dev/issue/78281", "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "https://linux.oracle.com/cve/CVE-2026-32281.html", "https://linux.oracle.com/errata/ELSA-2026-67148-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-32281", "https://pkg.go.dev/vuln/GO-2026-4946", "https://www.cve.org/CVERecord?id=CVE-2026-32281" ], "PublishedDate": "2026-04-08T02:16:03.35Z", "LastModifiedDate": "2026-07-25T10:10:00.167Z" }, { "VulnerabilityID": "CVE-2026-32283", "VendorIDs": [ "GO-2026-4870" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.25.9, 1.26.2", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32283", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:3bd9c89c97df56d7958caef4e5d2aebad2f766f832da1783c5c582a713a048d7", "Title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages", "Description": "If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.", "Severity": "HIGH", "CweIDs": [ "CWE-770", "CWE-764" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10217", "https://access.redhat.com/errata/RHSA-2026:10219", "https://access.redhat.com/errata/RHSA-2026:10704", "https://access.redhat.com/errata/RHSA-2026:11507", "https://access.redhat.com/errata/RHSA-2026:11514", "https://access.redhat.com/errata/RHSA-2026:11704", "https://access.redhat.com/errata/RHSA-2026:11711", "https://access.redhat.com/errata/RHSA-2026:11712", "https://access.redhat.com/errata/RHSA-2026:11863", "https://access.redhat.com/errata/RHSA-2026:11881", "https://access.redhat.com/errata/RHSA-2026:14162", "https://access.redhat.com/errata/RHSA-2026:14200", "https://access.redhat.com/errata/RHSA-2026:14391", "https://access.redhat.com/errata/RHSA-2026:15980", "https://access.redhat.com/errata/RHSA-2026:16021", "https://access.redhat.com/errata/RHSA-2026:16024", "https://access.redhat.com/errata/RHSA-2026:16101", "https://access.redhat.com/errata/RHSA-2026:16102", "https://access.redhat.com/errata/RHSA-2026:16875", "https://access.redhat.com/errata/RHSA-2026:17075", "https://access.redhat.com/errata/RHSA-2026:17084", "https://access.redhat.com/errata/RHSA-2026:17287", "https://access.redhat.com/errata/RHSA-2026:18027", "https://access.redhat.com/errata/RHSA-2026:18032", "https://access.redhat.com/errata/RHSA-2026:19126", "https://access.redhat.com/errata/RHSA-2026:19132", "https://access.redhat.com/errata/RHSA-2026:19133", "https://access.redhat.com/errata/RHSA-2026:19134", "https://access.redhat.com/errata/RHSA-2026:19135", "https://access.redhat.com/errata/RHSA-2026:19136", "https://access.redhat.com/errata/RHSA-2026:19137", "https://access.redhat.com/errata/RHSA-2026:19139", "https://access.redhat.com/errata/RHSA-2026:19144", "https://access.redhat.com/errata/RHSA-2026:19156", "https://access.redhat.com/errata/RHSA-2026:19350", "https://access.redhat.com/errata/RHSA-2026:19351", "https://access.redhat.com/errata/RHSA-2026:19352", "https://access.redhat.com/errata/RHSA-2026:19353", "https://access.redhat.com/errata/RHSA-2026:19369", "https://access.redhat.com/errata/RHSA-2026:19450", "https://access.redhat.com/errata/RHSA-2026:19550", "https://access.redhat.com/errata/RHSA-2026:19634", "https://access.redhat.com/errata/RHSA-2026:19714", "https://access.redhat.com/errata/RHSA-2026:19715", "https://access.redhat.com/errata/RHSA-2026:19719", "https://access.redhat.com/errata/RHSA-2026:19720", "https://access.redhat.com/errata/RHSA-2026:19721", "https://access.redhat.com/errata/RHSA-2026:19722", "https://access.redhat.com/errata/RHSA-2026:19750", "https://access.redhat.com/errata/RHSA-2026:19839", "https://access.redhat.com/errata/RHSA-2026:20556", "https://access.redhat.com/errata/RHSA-2026:20569", "https://access.redhat.com/errata/RHSA-2026:20570", "https://access.redhat.com/errata/RHSA-2026:20571", "https://access.redhat.com/errata/RHSA-2026:20607", "https://access.redhat.com/errata/RHSA-2026:20608", "https://access.redhat.com/errata/RHSA-2026:20609", "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:22423", "https://access.redhat.com/errata/RHSA-2026:22450", "https://access.redhat.com/errata/RHSA-2026:22485", "https://access.redhat.com/errata/RHSA-2026:22709", "https://access.redhat.com/errata/RHSA-2026:22713", "https://access.redhat.com/errata/RHSA-2026:22714", "https://access.redhat.com/errata/RHSA-2026:22937", "https://access.redhat.com/errata/RHSA-2026:23102", "https://access.redhat.com/errata/RHSA-2026:23103", "https://access.redhat.com/errata/RHSA-2026:23228", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/errata/RHSA-2026:24337", "https://access.redhat.com/errata/RHSA-2026:24470", "https://access.redhat.com/errata/RHSA-2026:24761", "https://access.redhat.com/errata/RHSA-2026:24762", "https://access.redhat.com/errata/RHSA-2026:25248", "https://access.redhat.com/errata/RHSA-2026:25250", "https://access.redhat.com/errata/RHSA-2026:25251", "https://access.redhat.com/errata/RHSA-2026:25252", "https://access.redhat.com/errata/RHSA-2026:26447", "https://access.redhat.com/errata/RHSA-2026:26571", "https://access.redhat.com/errata/RHSA-2026:26636", "https://access.redhat.com/errata/RHSA-2026:27076", "https://access.redhat.com/errata/RHSA-2026:28038", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:28074", "https://access.redhat.com/errata/RHSA-2026:29035", "https://access.redhat.com/errata/RHSA-2026:29195", "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:29703", "https://access.redhat.com/errata/RHSA-2026:33722", "https://access.redhat.com/errata/RHSA-2026:34192", "https://access.redhat.com/errata/RHSA-2026:34196", "https://access.redhat.com/errata/RHSA-2026:34197", "https://access.redhat.com/errata/RHSA-2026:34365", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:47712", "https://access.redhat.com/errata/RHSA-2026:47714", "https://access.redhat.com/errata/RHSA-2026:47716", "https://access.redhat.com/errata/RHSA-2026:47719", "https://access.redhat.com/errata/RHSA-2026:47721", "https://access.redhat.com/errata/RHSA-2026:47722", "https://access.redhat.com/errata/RHSA-2026:47910", "https://access.redhat.com/errata/RHSA-2026:48036", "https://access.redhat.com/errata/RHSA-2026:48790", "https://access.redhat.com/errata/RHSA-2026:49509", "https://access.redhat.com/errata/RHSA-2026:49600", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:55898", "https://access.redhat.com/errata/RHSA-2026:55900", "https://access.redhat.com/errata/RHSA-2026:55901", "https://access.redhat.com/errata/RHSA-2026:55902", "https://access.redhat.com/errata/RHSA-2026:55903", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:57409", "https://access.redhat.com/errata/RHSA-2026:57801", "https://access.redhat.com/errata/RHSA-2026:57802", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65343", "https://access.redhat.com/errata/RHSA-2026:65514", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66084", "https://access.redhat.com/errata/RHSA-2026:66401", "https://access.redhat.com/errata/RHSA-2026:66523", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:7291", "https://access.redhat.com/errata/RHSA-2026:7385", "https://access.redhat.com/security/cve/CVE-2026-32283", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/2456333", "https://bugzilla.redhat.com/2456338", "https://bugzilla.redhat.com/2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456338", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283", "https://errata.almalinux.org/9/ALSA-2026-29703.html", "https://errata.rockylinux.org/RLSA-2026:29703", "https://go.dev/cl/763767", "https://go.dev/issue/78334", "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "https://linux.oracle.com/cve/CVE-2026-32283.html", "https://linux.oracle.com/errata/ELSA-2026-48790.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-32283", "https://pkg.go.dev/vuln/GO-2026-4870", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32283.json", "https://www.cve.org/CVERecord?id=CVE-2026-32283" ], "PublishedDate": "2026-04-08T02:16:03.58Z", "LastModifiedDate": "2026-09-18T13:17:48.437Z" }, { "VulnerabilityID": "CVE-2026-33811", "VendorIDs": [ "GO-2026-4981" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33811", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:c8372422efd7b10469060ef9f6bafd93940af796c7610b801398ca5c40326638", "Title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME", "Description": "When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.", "Severity": "HIGH", "CweIDs": [ "CWE-415", "CWE-1341" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:35832", "https://access.redhat.com/errata/RHSA-2026:35993", "https://access.redhat.com/errata/RHSA-2026:35994", "https://access.redhat.com/errata/RHSA-2026:35995", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36617", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36776", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:38504", "https://access.redhat.com/errata/RHSA-2026:39266", "https://access.redhat.com/errata/RHSA-2026:39272", "https://access.redhat.com/errata/RHSA-2026:39319", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40119", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42048", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:42946", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49703", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51057", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51341", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54168", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54500", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54556", "https://access.redhat.com/errata/RHSA-2026:54584", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56790", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56855", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:56913", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60302", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:61313", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:67149", "https://access.redhat.com/errata/RHSA-2026:67287", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/security/cve/CVE-2026-33811", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-39319.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/767860", "https://go.dev/issue/78803", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-33811.html", "https://linux.oracle.com/errata/ELSA-2026-65886-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33811", "https://pkg.go.dev/vuln/GO-2026-4981", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33811.json", "https://www.cve.org/CVERecord?id=CVE-2026-33811" ], "PublishedDate": "2026-05-07T20:16:42.77Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-33814", "VendorIDs": [ "GO-2026-4918" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33814", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:de33ee0a5b5d9441a30b92702fc30e8da03b41073faba17fd3313561ab306a4d", "Title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame", "Description": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.", "Severity": "HIGH", "CweIDs": [ "CWE-835", "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57365", "https://access.redhat.com/errata/RHSA-2026:57367", "https://access.redhat.com/errata/RHSA-2026:57408", "https://access.redhat.com/errata/RHSA-2026:57545", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60441", "https://access.redhat.com/errata/RHSA-2026:60442", "https://access.redhat.com/errata/RHSA-2026:60446", "https://access.redhat.com/errata/RHSA-2026:60447", "https://access.redhat.com/errata/RHSA-2026:60454", "https://access.redhat.com/errata/RHSA-2026:60477", "https://access.redhat.com/errata/RHSA-2026:60478", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:60668", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62410", "https://access.redhat.com/errata/RHSA-2026:62550", "https://access.redhat.com/errata/RHSA-2026:62551", "https://access.redhat.com/errata/RHSA-2026:63046", "https://access.redhat.com/errata/RHSA-2026:63047", "https://access.redhat.com/errata/RHSA-2026:63048", "https://access.redhat.com/errata/RHSA-2026:63050", "https://access.redhat.com/errata/RHSA-2026:63091", "https://access.redhat.com/errata/RHSA-2026:63096", "https://access.redhat.com/errata/RHSA-2026:63097", "https://access.redhat.com/errata/RHSA-2026:63103", "https://access.redhat.com/errata/RHSA-2026:63104", "https://access.redhat.com/errata/RHSA-2026:63636", "https://access.redhat.com/errata/RHSA-2026:63637", "https://access.redhat.com/errata/RHSA-2026:63639", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/security/cve/CVE-2026-33814", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467810", "https://bugzilla.redhat.com/show_bug.cgi?id=2467811", "https://bugzilla.redhat.com/show_bug.cgi?id=2467813", "https://bugzilla.redhat.com/show_bug.cgi?id=2467815", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467823", "https://bugzilla.redhat.com/show_bug.cgi?id=2467825", "https://bugzilla.redhat.com/show_bug.cgi?id=2467826", "https://bugzilla.redhat.com/show_bug.cgi?id=2467827", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501", "https://errata.almalinux.org/9/ALSA-2026-22121.html", "https://errata.rockylinux.org/RLSA-2026:22121", "https://github.com/golang/go/issues/78476", "https://go-review.googlesource.com/c/go/+/761581", "https://go-review.googlesource.com/c/net/+/761640", "https://go.dev/cl/761581", "https://go.dev/cl/761640", "https://go.dev/issue/78476", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-33814.html", "https://linux.oracle.com/errata/ELSA-2026-22121.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33814", "https://pkg.go.dev/vuln/GO-2026-4918", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json", "https://ubuntu.com/security/notices/USN-8430-1", "https://ubuntu.com/security/notices/USN-8471-1", "https://ubuntu.com/security/notices/USN-8472-1", "https://ubuntu.com/security/notices/USN-8473-1", "https://www.cve.org/CVERecord?id=CVE-2026-33814" ], "PublishedDate": "2026-05-07T20:16:42.88Z", "LastModifiedDate": "2026-10-26T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-33818", "VendorIDs": [ "GO-2026-5972" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33818", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:4c4fc7303ed277f788edab9d57d0a1218fef4fd0c66e709bae698da61df31acd", "Title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal", "Description": "Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-33818", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://github.com/golang/go/issues/80405", "https://go.dev/cl/814980", "https://go.dev/issue/80405", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-33818.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33818", "https://pkg.go.dev/vuln/GO-2026-5972", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-33818" ], "PublishedDate": "2026-08-13T22:17:19.84Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-39820", "VendorIDs": [ "GO-2026-4986" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39820", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:3e1df5172971de81378816f3698b36c050ead089e941192b1b3fa5f90dcd6165", "Title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs", "Description": "Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.", "Severity": "HIGH", "CweIDs": [ "CWE-770", "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36754", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54555", "https://access.redhat.com/errata/RHSA-2026:54583", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:54883", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57401", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57487", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:57914", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:62406", "https://access.redhat.com/errata/RHSA-2026:62407", "https://access.redhat.com/errata/RHSA-2026:62753", "https://access.redhat.com/errata/RHSA-2026:62754", "https://access.redhat.com/errata/RHSA-2026:62803", "https://access.redhat.com/errata/RHSA-2026:63022", "https://access.redhat.com/errata/RHSA-2026:65116", "https://access.redhat.com/errata/RHSA-2026:65117", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65335", "https://access.redhat.com/errata/RHSA-2026:65336", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:65895", "https://access.redhat.com/errata/RHSA-2026:66016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66327", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:67974", "https://access.redhat.com/errata/RHSA-2026:67975", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:68527", "https://access.redhat.com/security/cve/CVE-2026-39820", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/759940", "https://go.dev/issue/78566", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-39820.html", "https://linux.oracle.com/errata/ELSA-2026-65895-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39820", "https://pkg.go.dev/vuln/GO-2026-4986", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39820.json", "https://www.cve.org/CVERecord?id=CVE-2026-39820" ], "PublishedDate": "2026-05-07T20:16:43.187Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-39821", "VendorIDs": [ "GO-2026-5026" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39821", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:6209f400eaea2fe4a124feb0b1a2454bedcc22b9b6e3ebbcc4c5209149958381", "Title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing", "Description": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".", "Severity": "HIGH", "CweIDs": [ "CWE-1289" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:30650", "https://access.redhat.com/errata/RHSA-2026:30651", "https://access.redhat.com/errata/RHSA-2026:30853", "https://access.redhat.com/errata/RHSA-2026:30854", "https://access.redhat.com/errata/RHSA-2026:30855", "https://access.redhat.com/errata/RHSA-2026:33155", "https://access.redhat.com/errata/RHSA-2026:33160", "https://access.redhat.com/errata/RHSA-2026:33163", "https://access.redhat.com/errata/RHSA-2026:33173", "https://access.redhat.com/errata/RHSA-2026:33183", "https://access.redhat.com/errata/RHSA-2026:33524", "https://access.redhat.com/errata/RHSA-2026:33531", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:34789", "https://access.redhat.com/errata/RHSA-2026:35826", "https://access.redhat.com/errata/RHSA-2026:35827", "https://access.redhat.com/errata/RHSA-2026:35828", "https://access.redhat.com/errata/RHSA-2026:35829", "https://access.redhat.com/errata/RHSA-2026:35830", "https://access.redhat.com/errata/RHSA-2026:35831", "https://access.redhat.com/errata/RHSA-2026:35993", "https://access.redhat.com/errata/RHSA-2026:35994", "https://access.redhat.com/errata/RHSA-2026:36105", "https://access.redhat.com/errata/RHSA-2026:36167", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:36883", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:37435", "https://access.redhat.com/errata/RHSA-2026:37436", "https://access.redhat.com/errata/RHSA-2026:38995", "https://access.redhat.com/errata/RHSA-2026:39005", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39879", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:41930", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42048", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42080", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:44624", "https://access.redhat.com/errata/RHSA-2026:46395", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51341", "https://access.redhat.com/errata/RHSA-2026:52826", "https://access.redhat.com/errata/RHSA-2026:53374", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54395", "https://access.redhat.com/errata/RHSA-2026:54401", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54580", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56143", "https://access.redhat.com/errata/RHSA-2026:56223", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57541", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59546", "https://access.redhat.com/errata/RHSA-2026:59549", "https://access.redhat.com/errata/RHSA-2026:59562", "https://access.redhat.com/errata/RHSA-2026:60315", "https://access.redhat.com/errata/RHSA-2026:60354", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61245", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62549", "https://access.redhat.com/errata/RHSA-2026:63134", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65359", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65851", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/errata/RHSA-2026:66432", "https://access.redhat.com/errata/RHSA-2026:67149", "https://access.redhat.com/errata/RHSA-2026:67159", "https://access.redhat.com/errata/RHSA-2026:67160", "https://access.redhat.com/errata/RHSA-2026:67287", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/security/cve/CVE-2026-39821", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/767220", "https://go.dev/issue/78760", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "https://linux.oracle.com/cve/CVE-2026-39821.html", "https://linux.oracle.com/errata/ELSA-2026-66432-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39821", "https://pkg.go.dev/vuln/GO-2026-5026", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json", "https://ubuntu.com/security/notices/USN-8416-1", "https://ubuntu.com/security/notices/USN-8883-1", "https://ubuntu.com/security/notices/USN-8883-2", "https://ubuntu.com/security/notices/USN-8900-1", "https://ubuntu.com/security/notices/USN-8914-1", "https://www.cve.org/CVERecord?id=CVE-2026-39821" ], "PublishedDate": "2026-05-22T16:16:20.41Z", "LastModifiedDate": "2026-09-17T12:18:05.767Z" }, { "VulnerabilityID": "CVE-2026-39822", "VendorIDs": [ "GO-2026-4970" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.25.12, 1.26.5, 1.27.0-rc.2", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39822", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:47aefc78cd065906a556bfbde1f4ad28271d033b05ab5d9e92dfe6fe52cb20d6", "Title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal", "Description": "On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root.", "Severity": "HIGH", "CweIDs": [ "CWE-61" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:38878", "https://access.redhat.com/security/cve/CVE-2026-39822", "https://bugzilla.redhat.com/2498152", "https://bugzilla.redhat.com/show_bug.cgi?id=2498152", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39822", "https://errata.almalinux.org/9/ALSA-2026-38878.html", "https://errata.rockylinux.org/RLSA-2026:38878", "https://github.com/golang/go/issues/79005", "https://go.dev/cl/797880", "https://go.dev/issue/79005", "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc", "https://linux.oracle.com/cve/CVE-2026-39822.html", "https://linux.oracle.com/errata/ELSA-2026-38995.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39822", "https://pkg.go.dev/vuln/GO-2026-4970", "https://www.cve.org/CVERecord?id=CVE-2026-39822" ], "PublishedDate": "2026-07-08T17:17:21.31Z", "LastModifiedDate": "2026-10-25T17:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-39836", "VendorIDs": [ "GO-2026-4971" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39836", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:6e0c0689a5a9cdcc56015f8ff26b6ab0ae4362aa1d1ca492747b896bfce272fb", "Title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows", "Description": "The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/security/cve/CVE-2026-39836", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467810", "https://bugzilla.redhat.com/show_bug.cgi?id=2467811", "https://bugzilla.redhat.com/show_bug.cgi?id=2467813", "https://bugzilla.redhat.com/show_bug.cgi?id=2467815", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467823", "https://bugzilla.redhat.com/show_bug.cgi?id=2467825", "https://bugzilla.redhat.com/show_bug.cgi?id=2467826", "https://bugzilla.redhat.com/show_bug.cgi?id=2467827", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501", "https://errata.almalinux.org/9/ALSA-2026-22121.html", "https://errata.rockylinux.org/RLSA-2026:22121", "https://go.dev/cl/775320", "https://go.dev/issue/79006", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-39836.html", "https://linux.oracle.com/errata/ELSA-2026-22121.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39836", "https://pkg.go.dev/vuln/GO-2026-4971", "https://www.cve.org/CVERecord?id=CVE-2026-39836" ], "PublishedDate": "2026-05-07T20:16:43.593Z", "LastModifiedDate": "2026-10-26T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-42499", "VendorIDs": [ "GO-2026-4977" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42499", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:068e0fa6e53c6ab8a0fcc275ed545971141fcea9a940a6c35d0f96718d490bab", "Title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing", "Description": "Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.", "Severity": "HIGH", "CweIDs": [ "CWE-1046" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:17713", "https://access.redhat.com/errata/RHSA-2026:17714", "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36754", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54555", "https://access.redhat.com/errata/RHSA-2026:54583", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57487", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:57914", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:62406", "https://access.redhat.com/errata/RHSA-2026:62407", "https://access.redhat.com/errata/RHSA-2026:62753", "https://access.redhat.com/errata/RHSA-2026:62754", "https://access.redhat.com/errata/RHSA-2026:62803", "https://access.redhat.com/errata/RHSA-2026:63022", "https://access.redhat.com/errata/RHSA-2026:63163", "https://access.redhat.com/errata/RHSA-2026:63332", "https://access.redhat.com/errata/RHSA-2026:63636", "https://access.redhat.com/errata/RHSA-2026:64818", "https://access.redhat.com/errata/RHSA-2026:65116", "https://access.redhat.com/errata/RHSA-2026:65117", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65335", "https://access.redhat.com/errata/RHSA-2026:65336", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:65895", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66327", "https://access.redhat.com/errata/RHSA-2026:67148", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:67974", "https://access.redhat.com/errata/RHSA-2026:67975", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:68527", "https://access.redhat.com/security/cve/CVE-2026-42499", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/771520", "https://go.dev/issue/78987", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-42499.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42499", "https://pkg.go.dev/vuln/GO-2026-4977", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42499.json", "https://www.cve.org/CVERecord?id=CVE-2026-42499" ], "PublishedDate": "2026-05-07T20:16:44.54Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-42504", "VendorIDs": [ "GO-2026-5038" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.25.11, 1.26.4", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42504", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:6914683eaca195610d703bdab71ef52b2ccd7c5575ef51e77a8a9663235cf604", "Title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header", "Description": "Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/security/cve/CVE-2026-42504", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/774481", "https://go.dev/issue/79217", "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw", "https://linux.oracle.com/cve/CVE-2026-42504.html", "https://linux.oracle.com/errata/ELSA-2026-69308.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42504", "https://pkg.go.dev/vuln/GO-2026-5038", "https://www.cve.org/CVERecord?id=CVE-2026-42504" ], "PublishedDate": "2026-06-02T23:16:37.927Z", "LastModifiedDate": "2026-07-22T19:10:00.12Z" }, { "VulnerabilityID": "CVE-2026-56853", "VendorIDs": [ "GO-2026-6089" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56853", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:db233cd1491b5c585943d90b9cc805f072adfb9853acfe3c64587eacb2b43466", "Title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service", "Description": "When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56853", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/795540", "https://go.dev/issue/80205", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56853.html", "https://linux.oracle.com/errata/ELSA-2026-89752.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56853", "https://pkg.go.dev/vuln/GO-2026-6089", "https://www.cve.org/CVERecord?id=CVE-2026-56853" ], "PublishedDate": "2026-08-13T22:17:22.093Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56858", "VendorIDs": [ "GO-2026-6091" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56858", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:883a55046be41b02ecd5646744e4d189942269a0ae06e21d69133f142a22a079", "Title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input", "Description": "Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.", "Severity": "HIGH", "CweIDs": [ "CWE-79" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "V3Score": 6.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56858", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/807100", "https://go.dev/issue/80435", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56858.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56858", "https://pkg.go.dev/vuln/GO-2026-6091", "https://www.cve.org/CVERecord?id=CVE-2026-56858" ], "PublishedDate": "2026-08-13T22:17:22.207Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56859", "VendorIDs": [ "GO-2026-6088" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56859", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:bd0ff4f7c9f70a4ad579da4b8ee1284cc7770359c6d9a67b2f1ba9f32f372722", "Title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue", "Description": "Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69961", "https://access.redhat.com/security/cve/CVE-2026-56859", "https://bugzilla.redhat.com/2480684", "https://bugzilla.redhat.com/2508234", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2480684", "https://bugzilla.redhat.com/show_bug.cgi?id=2508234", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2518147", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17106", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19730", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39830", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-69961.html", "https://errata.rockylinux.org/RLSA-2026:69961", "https://github.com/golang/go/issues/80481", "https://go.dev/cl/803320", "https://go.dev/issue/80481", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56859.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56859", "https://pkg.go.dev/vuln/GO-2026-6088", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-56859" ], "PublishedDate": "2026-08-13T22:17:22.32Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56860", "VendorIDs": [ "GO-2026-6218" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56860", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:64d1d41e827887ef712669e5e4f1ff88935286d6343dce3073dc2e3ef0f28ee6", "Title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution", "Description": "Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56860", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/803681", "https://go.dev/issue/80494", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56860.html", "https://linux.oracle.com/errata/ELSA-2026-71619.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56860", "https://pkg.go.dev/vuln/GO-2026-6218", "https://www.cve.org/CVERecord?id=CVE-2026-56860" ], "PublishedDate": "2026-08-13T22:17:22.44Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56862", "VendorIDs": [ "GO-2026-6090" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56862", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:ef90270e3c92dfb03b797c1f739745e7fa2ec299420ad5adf32f91658dcb6edb", "Title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages", "Description": "Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56862", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://github.com/golang/go/issues/80528", "https://go.dev/cl/804261", "https://go.dev/issue/80528", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56862.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56862", "https://pkg.go.dev/vuln/GO-2026-6090", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-56862" ], "PublishedDate": "2026-08-13T22:17:22.55Z", "LastModifiedDate": "2026-10-24T16:10:00.153Z" }, { "VulnerabilityID": "CVE-2026-78667", "VendorIDs": [ "GO-2026-6609" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78667", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:33ea173d1c70739f77194d59f9595fe83043a14a2da6a1671391cdddea6091d8", "Title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers", "Description": "When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78667", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81858", "https://go.dev/cl/847309", "https://go.dev/issue/81858", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://linux.oracle.com/cve/CVE-2026-78667.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78667", "https://pkg.go.dev/vuln/GO-2026-6609", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78667", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:03.88Z", "LastModifiedDate": "2026-10-09T17:16:49.69Z" }, { "VulnerabilityID": "CVE-2026-78669", "VendorIDs": [ "GO-2026-6611" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78669", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:2d2da34bd3718a6ca56c09a78d58e4c7d8e1ef55caf8d1c5e7b5fd6be509ed64", "Title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "Description": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78669", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81742", "https://go.dev/cl/847186", "https://go.dev/cl/847308", "https://go.dev/issue/81742", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs", "https://linux.oracle.com/cve/CVE-2026-78669.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78669", "https://pkg.go.dev/vuln/GO-2026-6611", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78669", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:04.01Z", "LastModifiedDate": "2026-10-09T17:16:49.857Z" }, { "VulnerabilityID": "CVE-2026-97031", "VendorIDs": [ "GO-2026-6607" ], "PkgID": "stdlib@v1.22.0", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.22.0", "UID": "7a0506c8c0fa53a1" }, "InstalledVersion": "v1.22.0", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:a0f239f102b3fab28c4f60424b0239de0e37b965269cf5c280da2c5cfb6faf46" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-97031", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:191e4f68e0cba17d30a22c9ecfdfccf7e97a4df17d16b9a5ac9ab4f537932970", "Title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references", "Description": "Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:95518", "https://access.redhat.com/security/cve/CVE-2026-97031", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-95518.html", "https://errata.rockylinux.org/RLSA-2026:95518", "https://go.dev/cl/847312", "https://go.dev/issue/81855", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://linux.oracle.com/cve/CVE-2026-97031.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-97031", "https://pkg.go.dev/vuln/GO-2026-6607", "https://www.cve.org/CVERecord?id=CVE-2026-97031" ], "PublishedDate": "2026-10-08T23:17:06.037Z", "LastModifiedDate": "2026-10-09T16:35:35.9Z" } ] } ] }