{ "SchemaVersion": 2, "Trivy": { "Version": "0.70.0" }, "ReportID": "01a1b91c-589f-7768-aca1-01c95e16ea0f", "CreatedAt": "2026-11-08T04:03:25.087487019+01:00", "ArtifactID": "sha256:2f4e567386e4e05be7077ebd1758e8580b4b045c63431fcafa567db48e82277f", "ArtifactName": "supabase/gotrue:v2.189.0", "ArtifactType": "container_image", "Metadata": { "Size": 54216192, "OS": { "Family": "alpine", "Name": "3.23.4" }, "ImageID": "sha256:369913f15697d0b2f41fd556ce39f6f979512649f40c2e2e1abf4ed03b5591e7", "DiffIDs": [ "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1", "sha256:06bec9e0795a3bf0ac26437e2e0a29822cd373179bd6a0e4a040abc10b532415", "sha256:e168a8fad140204afa332a2d90eba58cb410097a1573a6f47d412600447f25cd", "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c", "sha256:7cbd0b348883ef7da898cae7655b96d8d39dfe743a2f6123d8419bd367bc84b7", "sha256:d663d9e81d9fb69b0ba24741029e00578ddbd8910aadcd5a91e3a4ee15322821" ], "RepoTags": [ "supabase/gotrue:v2.189.0" ], "RepoDigests": [ "supabase/gotrue@sha256:385184459f57569c54c25209f51f3b2be99ddd7c4ce9e3555b5d3eea8447b7cf" ], "Reference": "supabase/gotrue:v2.189.0", "ImageConfig": { "architecture": "amd64", "created": "2026-04-28T14:26:20.962170622Z", "history": [ { "created": "2026-04-15T20:01:40Z", "created_by": "ADD alpine-minirootfs-3.23.4-x86_64.tar.gz / # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-04-15T20:01:40Z", "created_by": "CMD [\"/bin/sh\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-04-16T15:24:14Z", "created_by": "RUN /bin/sh -c adduser -D -u 1000 supabase # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-04-16T15:24:14Z", "created_by": "RUN /bin/sh -c apk add --no-cache ca-certificates # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-04-28T14:26:20Z", "created_by": "COPY /go/src/github.com/supabase/auth/auth /usr/local/bin/auth # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-04-28T14:26:20Z", "created_by": "COPY /go/src/github.com/supabase/auth/migrations /usr/local/etc/auth/migrations/ # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-04-28T14:26:20Z", "created_by": "RUN /bin/sh -c ln -s /usr/local/bin/auth /usr/local/bin/gotrue # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-04-28T14:26:20Z", "created_by": "ENV GOTRUE_DB_MIGRATIONS_PATH=/usr/local/etc/auth/migrations", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-04-28T14:26:20Z", "created_by": "USER supabase", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-04-28T14:26:20Z", "created_by": "CMD [\"auth\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true } ], "os": "linux", "rootfs": { "type": "layers", "diff_ids": [ "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1", "sha256:06bec9e0795a3bf0ac26437e2e0a29822cd373179bd6a0e4a040abc10b532415", "sha256:e168a8fad140204afa332a2d90eba58cb410097a1573a6f47d412600447f25cd", "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c", "sha256:7cbd0b348883ef7da898cae7655b96d8d39dfe743a2f6123d8419bd367bc84b7", "sha256:d663d9e81d9fb69b0ba24741029e00578ddbd8910aadcd5a91e3a4ee15322821" ] }, "config": { "Cmd": [ "auth" ], "Env": [ "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GOTRUE_DB_MIGRATIONS_PATH=/usr/local/etc/auth/migrations" ], "User": "supabase", "WorkingDir": "/", "ArgsEscaped": true } }, "Layers": [ { "Size": 8732160, "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, { "Size": 10240, "DiffID": "sha256:06bec9e0795a3bf0ac26437e2e0a29822cd373179bd6a0e4a040abc10b532415" }, { "Size": 774656, "DiffID": "sha256:e168a8fad140204afa332a2d90eba58cb410097a1573a6f47d412600447f25cd" }, { "Size": 44579328, "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, { "Size": 116736, "DiffID": "sha256:7cbd0b348883ef7da898cae7655b96d8d39dfe743a2f6123d8419bd367bc84b7" }, { "Size": 3072, "DiffID": "sha256:d663d9e81d9fb69b0ba24741029e00578ddbd8910aadcd5a91e3a4ee15322821" } ] }, "Results": [ { "Target": "supabase/gotrue:v2.189.0 (alpine 3.23.4)", "Class": "os-pkgs", "Type": "alpine", "Packages": [ { "ID": "alpine-baselayout@3.7.2-r0", "Name": "alpine-baselayout", "Identifier": { "PURL": "pkg:apk/alpine/alpine-baselayout@3.7.2-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ff3090489ca40326" }, "Version": "3.7.2-r0", "Arch": "x86_64", "SrcName": "alpine-baselayout", "SrcVersion": "3.7.2-r0", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "alpine-baselayout-data@3.7.2-r0", "busybox-binsh@1.37.0-r30" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:545aa6f291209af89932b761d9e422c2778596cc", "InstalledFiles": [ "etc/motd", "etc/crontabs/root", "etc/modprobe.d/aliases.conf", "etc/modprobe.d/blacklist.conf", "etc/modprobe.d/i386.conf", "etc/profile.d/20locale.sh", "etc/profile.d/README", "etc/profile.d/color_prompt.sh.disabled", "usr/lib/sysctl.d/00-alpine.conf", "var/lock", "var/run", "var/spool/mail", "var/spool/cron/crontabs" ], "AnalyzedBy": "apk" }, { "ID": "alpine-baselayout-data@3.7.2-r0", "Name": "alpine-baselayout-data", "Identifier": { "PURL": "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r0?arch=x86_64\u0026distro=3.23.4", "UID": "78c0ed61d7df9a7e" }, "Version": "3.7.2-r0", "Arch": "x86_64", "SrcName": "alpine-baselayout", "SrcVersion": "3.7.2-r0", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:85816632dbce07ba7e9e7a629fa59eddbd1687fb", "InstalledFiles": [ "etc/fstab", "etc/group", "etc/hostname", "etc/hosts", "etc/inittab", "etc/modules", "etc/mtab", "etc/nsswitch.conf", "etc/passwd", "etc/profile", "etc/protocols", "etc/services", "etc/shadow", "etc/shells", "etc/sysctl.conf" ], "AnalyzedBy": "apk" }, { "ID": "alpine-keys@2.6-r0", "Name": "alpine-keys", "Identifier": { "PURL": "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "2c7cb90de388aa7d" }, "Version": "2.6-r0", "Arch": "x86_64", "SrcName": "alpine-keys", "SrcVersion": "2.6-r0", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:5c45a821cd6b84d543bbd7ff12a7de1855c5cd13", "InstalledFiles": [ "etc/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "etc/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", "etc/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", "usr/share/apk/keys/loongarch64/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", "usr/share/apk/keys/mips64/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub" ], "AnalyzedBy": "apk" }, { "ID": "alpine-release@3.23.4-r0", "Name": "alpine-release", "Identifier": { "PURL": "pkg:apk/alpine/alpine-release@3.23.4-r0?arch=x86_64\u0026distro=3.23.4", "UID": "114fb0bc8cc9ff31" }, "Version": "3.23.4-r0", "Arch": "x86_64", "SrcName": "alpine-base", "SrcVersion": "3.23.4-r0", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "alpine-keys@2.6-r0" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:7ff0b58e52211bb31a84e2afdbcbff0620df55a1", "InstalledFiles": [ "etc/alpine-release", "etc/issue", "etc/os-release", "etc/secfixes.d/alpine", "usr/lib/os-release" ], "AnalyzedBy": "apk" }, { "ID": "apk-tools@3.0.6-r0", "Name": "apk-tools", "Identifier": { "PURL": "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "760256a5bdd94a07" }, "Version": "3.0.6-r0", "Arch": "x86_64", "SrcName": "apk-tools", "SrcVersion": "3.0.6-r0", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "ca-certificates-bundle@20260413-r0", "libapk@3.0.6-r0", "libcrypto3@3.5.6-r0", "musl@1.2.5-r23", "zlib@1.3.2-r0" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:86f3b3ef94d1cb213a4ed1187b34a6bb9f593033", "InstalledFiles": [ "sbin/apk" ], "AnalyzedBy": "apk" }, { "ID": "busybox@1.37.0-r30", "Name": "busybox", "Identifier": { "PURL": "pkg:apk/alpine/busybox@1.37.0-r30?arch=x86_64\u0026distro=3.23.4", "UID": "9647681d0b54db77" }, "Version": "1.37.0-r30", "Arch": "x86_64", "SrcName": "busybox", "SrcVersion": "1.37.0-r30", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:f1347801bb96b1aa40d17f82237c3f4ff02a4725", "InstalledFiles": [ "bin/busybox", "etc/securetty", "etc/busybox-paths.d/busybox", "etc/logrotate.d/acpid", "etc/network/if-up.d/dad", "etc/udhcpc/udhcpc.conf", "usr/share/udhcpc/default.script" ], "AnalyzedBy": "apk" }, { "ID": "busybox-binsh@1.37.0-r30", "Name": "busybox-binsh", "Identifier": { "PURL": "pkg:apk/alpine/busybox-binsh@1.37.0-r30?arch=x86_64\u0026distro=3.23.4", "UID": "3e18d05d46a6f46f" }, "Version": "1.37.0-r30", "Arch": "x86_64", "SrcName": "busybox", "SrcVersion": "1.37.0-r30", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", "DependsOn": [ "busybox@1.37.0-r30" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:188d2d0110afa58e8a3e3e5fd424b2d996df7a09", "InstalledFiles": [ "bin/sh" ], "AnalyzedBy": "apk" }, { "ID": "ca-certificates@20260413-r0", "Name": "ca-certificates", "Identifier": { "PURL": "pkg:apk/alpine/ca-certificates@20260413-r0?arch=x86_64\u0026distro=3.23.4", "UID": "63ca5aff4886266d" }, "Version": "20260413-r0", "Arch": "x86_64", "SrcName": "ca-certificates", "SrcVersion": "20260413-r0", "Licenses": [ "MPL-2.0", "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "busybox-binsh@1.37.0-r30", "libcrypto3@3.5.6-r0", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:e168a8fad140204afa332a2d90eba58cb410097a1573a6f47d412600447f25cd" }, "Digest": "sha1:af25e0f0a0412b141942909ed199144cc46f5bbc", "InstalledFiles": [ "etc/ca-certificates.conf", "etc/apk/protected_paths.d/ca-certificates.list", "etc/ca-certificates/update.d/certhash", "usr/bin/c_rehash", "usr/sbin/update-ca-certificates", "usr/share/ca-certificates/mozilla/ACCVRAIZ1.crt", "usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM.crt", "usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM_SERVIDORES_SEGUROS.crt", "usr/share/ca-certificates/mozilla/ANF_Secure_Server_Root_CA.crt", "usr/share/ca-certificates/mozilla/Actalis_Authentication_Root_CA.crt", "usr/share/ca-certificates/mozilla/AffirmTrust_Commercial.crt", "usr/share/ca-certificates/mozilla/AffirmTrust_Networking.crt", "usr/share/ca-certificates/mozilla/AffirmTrust_Premium.crt", "usr/share/ca-certificates/mozilla/AffirmTrust_Premium_ECC.crt", "usr/share/ca-certificates/mozilla/Amazon_Root_CA_1.crt", "usr/share/ca-certificates/mozilla/Amazon_Root_CA_2.crt", "usr/share/ca-certificates/mozilla/Amazon_Root_CA_3.crt", "usr/share/ca-certificates/mozilla/Amazon_Root_CA_4.crt", "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_2011.crt", "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.crt", "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.crt", "usr/share/ca-certificates/mozilla/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.crt", "usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA1.crt", "usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA2.crt", "usr/share/ca-certificates/mozilla/Buypass_Class_2_Root_CA.crt", "usr/share/ca-certificates/mozilla/Buypass_Class_3_Root_CA.crt", "usr/share/ca-certificates/mozilla/CA_Disig_Root_R2.crt", "usr/share/ca-certificates/mozilla/CFCA_EV_ROOT.crt", "usr/share/ca-certificates/mozilla/COMODO_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/COMODO_ECC_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/COMODO_RSA_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Certainly_Root_E1.crt", "usr/share/ca-certificates/mozilla/Certainly_Root_R1.crt", "usr/share/ca-certificates/mozilla/Certigna.crt", "usr/share/ca-certificates/mozilla/Certigna_Root_CA.crt", "usr/share/ca-certificates/mozilla/Certum_EC-384_CA.crt", "usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA.crt", "usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA_2.crt", "usr/share/ca-certificates/mozilla/Certum_Trusted_Root_CA.crt", "usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_1_2020.crt", "usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_2_2023.crt", "usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt", "usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_2_2023.crt", "usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_2009.crt", "usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_EV_2009.crt", "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_CA.crt", "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G2.crt", "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G3.crt", "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_CA.crt", "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G2.crt", "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G3.crt", "usr/share/ca-certificates/mozilla/DigiCert_High_Assurance_EV_Root_CA.crt", "usr/share/ca-certificates/mozilla/DigiCert_TLS_ECC_P384_Root_G5.crt", "usr/share/ca-certificates/mozilla/DigiCert_TLS_RSA4096_Root_G5.crt", "usr/share/ca-certificates/mozilla/DigiCert_Trusted_Root_G4.crt", "usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_EC1.crt", "usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_G2.crt", "usr/share/ca-certificates/mozilla/FIRMAPROFESIONAL_CA_ROOT-A_WEB.crt", "usr/share/ca-certificates/mozilla/GDCA_TrustAUTH_R5_ROOT.crt", "usr/share/ca-certificates/mozilla/GLOBALTRUST_2020.crt", "usr/share/ca-certificates/mozilla/GTS_Root_R1.crt", "usr/share/ca-certificates/mozilla/GTS_Root_R2.crt", "usr/share/ca-certificates/mozilla/GTS_Root_R3.crt", "usr/share/ca-certificates/mozilla/GTS_Root_R4.crt", "usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R4.crt", "usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R5.crt", "usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R3.crt", "usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R6.crt", "usr/share/ca-certificates/mozilla/GlobalSign_Root_E46.crt", "usr/share/ca-certificates/mozilla/GlobalSign_Root_R46.crt", "usr/share/ca-certificates/mozilla/Go_Daddy_Root_Certificate_Authority_-_G2.crt", "usr/share/ca-certificates/mozilla/HARICA_TLS_ECC_Root_CA_2021.crt", "usr/share/ca-certificates/mozilla/HARICA_TLS_RSA_Root_CA_2021.crt", "usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.crt", "usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_RootCA_2015.crt", "usr/share/ca-certificates/mozilla/HiPKI_Root_CA_-_G1.crt", "usr/share/ca-certificates/mozilla/Hongkong_Post_Root_CA_3.crt", "usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt", "usr/share/ca-certificates/mozilla/ISRG_Root_X2.crt", "usr/share/ca-certificates/mozilla/IdenTrust_Commercial_Root_CA_1.crt", "usr/share/ca-certificates/mozilla/IdenTrust_Public_Sector_Root_CA_1.crt", "usr/share/ca-certificates/mozilla/Izenpe.com.crt", "usr/share/ca-certificates/mozilla/Microsec_e-Szigno_Root_CA_2009.crt", "usr/share/ca-certificates/mozilla/Microsoft_ECC_Root_Certificate_Authority_2017.crt", "usr/share/ca-certificates/mozilla/Microsoft_RSA_Root_Certificate_Authority_2017.crt", "usr/share/ca-certificates/mozilla/NAVER_Global_Root_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/NetLock_Arany_=Class_Gold=_Főtanúsítvány.crt", "usr/share/ca-certificates/mozilla/OISTE_Server_Root_ECC_G1.crt", "usr/share/ca-certificates/mozilla/OISTE_Server_Root_RSA_G1.crt", "usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GB_CA.crt", "usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GC_CA.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_1_G3.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2_G3.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3_G3.crt", "usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_ECC.crt", "usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_RSA_R2.crt", "usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_ECC.crt", "usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_RSA.crt", "usr/share/ca-certificates/mozilla/SSL.com_TLS_ECC_Root_CA_2022.crt", "usr/share/ca-certificates/mozilla/SSL.com_TLS_RSA_Root_CA_2022.crt", "usr/share/ca-certificates/mozilla/SZAFIR_ROOT_CA2.crt", "usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_E46.crt", "usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_R46.crt", "usr/share/ca-certificates/mozilla/SecureSign_Root_CA12.crt", "usr/share/ca-certificates/mozilla/SecureSign_Root_CA14.crt", "usr/share/ca-certificates/mozilla/SecureSign_Root_CA15.crt", "usr/share/ca-certificates/mozilla/SecureTrust_CA.crt", "usr/share/ca-certificates/mozilla/Secure_Global_CA.crt", "usr/share/ca-certificates/mozilla/Security_Communication_ECC_RootCA1.crt", "usr/share/ca-certificates/mozilla/Security_Communication_RootCA2.crt", "usr/share/ca-certificates/mozilla/Starfield_Root_Certificate_Authority_-_G2.crt", "usr/share/ca-certificates/mozilla/Starfield_Services_Root_Certificate_Authority_-_G2.crt", "usr/share/ca-certificates/mozilla/SwissSign_Gold_CA_-_G2.crt", "usr/share/ca-certificates/mozilla/SwissSign_RSA_TLS_Root_CA_2022_-_1.crt", "usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_2.crt", "usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_3.crt", "usr/share/ca-certificates/mozilla/TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi_-_Surum_1.crt", "usr/share/ca-certificates/mozilla/TWCA_CYBER_Root_CA.crt", "usr/share/ca-certificates/mozilla/TWCA_Global_Root_CA.crt", "usr/share/ca-certificates/mozilla/TWCA_Root_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Telekom_Security_TLS_ECC_Root_2020.crt", "usr/share/ca-certificates/mozilla/Telekom_Security_TLS_RSA_Root_2023.crt", "usr/share/ca-certificates/mozilla/TeliaSonera_Root_CA_v1.crt", "usr/share/ca-certificates/mozilla/Telia_Root_CA_v2.crt", "usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G3.crt", "usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G4.crt", "usr/share/ca-certificates/mozilla/TrustAsia_TLS_ECC_Root_CA.crt", "usr/share/ca-certificates/mozilla/TrustAsia_TLS_RSA_Root_CA.crt", "usr/share/ca-certificates/mozilla/Trustwave_Global_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Trustwave_Global_ECC_P256_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Trustwave_Global_ECC_P384_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/TunTrust_Root_CA.crt", "usr/share/ca-certificates/mozilla/UCA_Extended_Validation_Root.crt", "usr/share/ca-certificates/mozilla/UCA_Global_G2_Root.crt", "usr/share/ca-certificates/mozilla/USERTrust_ECC_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/USERTrust_RSA_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/certSIGN_ROOT_CA.crt", "usr/share/ca-certificates/mozilla/certSIGN_Root_CA_G2.crt", "usr/share/ca-certificates/mozilla/e-Szigno_Root_CA_2017.crt", "usr/share/ca-certificates/mozilla/e-Szigno_TLS_Root_CA_2023.crt", "usr/share/ca-certificates/mozilla/ePKI_Root_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_C3.crt", "usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt", "usr/share/ca-certificates/mozilla/emSign_Root_CA_-_C1.crt", "usr/share/ca-certificates/mozilla/emSign_Root_CA_-_G1.crt", "usr/share/ca-certificates/mozilla/vTrus_ECC_Root_CA.crt", "usr/share/ca-certificates/mozilla/vTrus_Root_CA.crt" ], "AnalyzedBy": "apk" }, { "ID": "ca-certificates-bundle@20260413-r0", "Name": "ca-certificates-bundle", "Identifier": { "PURL": "pkg:apk/alpine/ca-certificates-bundle@20260413-r0?arch=x86_64\u0026distro=3.23.4", "UID": "d9471547e8751507" }, "Version": "20260413-r0", "Arch": "x86_64", "SrcName": "ca-certificates", "SrcVersion": "20260413-r0", "Licenses": [ "MPL-2.0", "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:44c90827e10115cb6afec51081cb26785dc8f418", "InstalledFiles": [ "etc/ssl/cert.pem", "etc/ssl/certs/ca-certificates.crt", "etc/ssl1.1/cert.pem", "etc/ssl1.1/certs" ], "AnalyzedBy": "apk" }, { "ID": "libapk@3.0.6-r0", "Name": "libapk", "Identifier": { "PURL": "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "47dcfb9093b112c1" }, "Version": "3.0.6-r0", "Arch": "x86_64", "SrcName": "apk-tools", "SrcVersion": "3.0.6-r0", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libcrypto3@3.5.6-r0", "libssl3@3.5.6-r0", "musl@1.2.5-r23", "zlib@1.3.2-r0" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:f064c8318c4f7f17da6a490921ce0d5e709fc063", "InstalledFiles": [ "usr/lib/libapk.so.3.0.0" ], "AnalyzedBy": "apk" }, { "ID": "libcrypto3@3.5.6-r0", "Name": "libcrypto3", "Identifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.5.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "975680d851f10fda" }, "Version": "3.5.6-r0", "Arch": "x86_64", "SrcName": "openssl", "SrcVersion": "3.5.6-r0", "Licenses": [ "Apache-2.0" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:9e7a866d0d052d290d3f9d621a4c89214188acff", "InstalledFiles": [ "etc/ssl/ct_log_list.cnf", "etc/ssl/ct_log_list.cnf.dist", "etc/ssl/openssl.cnf", "etc/ssl/openssl.cnf.dist", "usr/lib/libcrypto.so.3", "usr/lib/engines-3/afalg.so", "usr/lib/engines-3/capi.so", "usr/lib/engines-3/loader_attic.so", "usr/lib/engines-3/padlock.so", "usr/lib/ossl-modules/legacy.so" ], "AnalyzedBy": "apk" }, { "ID": "libssl3@3.5.6-r0", "Name": "libssl3", "Identifier": { "PURL": "pkg:apk/alpine/libssl3@3.5.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "aece396067dff154" }, "Version": "3.5.6-r0", "Arch": "x86_64", "SrcName": "openssl", "SrcVersion": "3.5.6-r0", "Licenses": [ "Apache-2.0" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libcrypto3@3.5.6-r0", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:5a2620d507434903b747470a76b47e24b222de5e", "InstalledFiles": [ "usr/lib/libssl.so.3" ], "AnalyzedBy": "apk" }, { "ID": "musl@1.2.5-r23", "Name": "musl", "Identifier": { "PURL": "pkg:apk/alpine/musl@1.2.5-r23?arch=x86_64\u0026distro=3.23.4", "UID": "dca30b3fd6708a32" }, "Version": "1.2.5-r23", "Arch": "x86_64", "SrcName": "musl", "SrcVersion": "1.2.5-r23", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:1b6c50426d3c0656e9c5a567a5a59601c7f4307a", "InstalledFiles": [ "lib/ld-musl-x86_64.so.1", "lib/libc.musl-x86_64.so.1" ], "AnalyzedBy": "apk" }, { "ID": "musl-utils@1.2.5-r23", "Name": "musl-utils", "Identifier": { "PURL": "pkg:apk/alpine/musl-utils@1.2.5-r23?arch=x86_64\u0026distro=3.23.4", "UID": "ffcf7198a9776c5f" }, "Version": "1.2.5-r23", "Arch": "x86_64", "SrcName": "musl", "SrcVersion": "1.2.5-r23", "Licenses": [ "MIT", "BSD-2-Clause", "GPL-2.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23", "scanelf@1.3.8-r2" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:92fdbe96d25f13fe3a3d297ada56e4fb907aacec", "InstalledFiles": [ "sbin/ldconfig", "usr/bin/getconf", "usr/bin/getent", "usr/bin/iconv", "usr/bin/ldd" ], "AnalyzedBy": "apk" }, { "ID": "scanelf@1.3.8-r2", "Name": "scanelf", "Identifier": { "PURL": "pkg:apk/alpine/scanelf@1.3.8-r2?arch=x86_64\u0026distro=3.23.4", "UID": "4efd612ed6f16dca" }, "Version": "1.3.8-r2", "Arch": "x86_64", "SrcName": "pax-utils", "SrcVersion": "1.3.8-r2", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:6ea36dd44ef9f6364f0cdfabe09ea15d2fdbe229", "InstalledFiles": [ "usr/bin/scanelf" ], "AnalyzedBy": "apk" }, { "ID": "ssl_client@1.37.0-r30", "Name": "ssl_client", "Identifier": { "PURL": "pkg:apk/alpine/ssl_client@1.37.0-r30?arch=x86_64\u0026distro=3.23.4", "UID": "f1acb8f2a8f94f51" }, "Version": "1.37.0-r30", "Arch": "x86_64", "SrcName": "busybox", "SrcVersion": "1.37.0-r30", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", "DependsOn": [ "libcrypto3@3.5.6-r0", "libssl3@3.5.6-r0", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:5b6ec0939cfc9be47d9677a3152c547cc18b5edd", "InstalledFiles": [ "usr/bin/ssl_client" ], "AnalyzedBy": "apk" }, { "ID": "zlib@1.3.2-r0", "Name": "zlib", "Identifier": { "PURL": "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64\u0026distro=3.23.4", "UID": "23a5a7d167a86311" }, "Version": "1.3.2-r0", "Arch": "x86_64", "SrcName": "zlib", "SrcVersion": "1.3.2-r0", "Licenses": [ "Zlib" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:68bb97ea5255e77aa974e65476d64832ad56288a", "InstalledFiles": [ "usr/lib/libz.so.1", "usr/lib/libz.so.1.3.2" ], "AnalyzedBy": "apk" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2026-14456", "PkgID": "libcrypto3@3.5.6-r0", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.5.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "975680d851f10fda" }, "InstalledVersion": "3.5.6-r0", "FixedVersion": "3.5.8-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-14456", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:e77e8171a8ff42f11d4c5465fefe87986e27fff65effb0137603ed33f2bb86b6", "Title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "Description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/13/4", "https://access.redhat.com/errata/RHSA-2026:67165", "https://access.redhat.com/security/cve/CVE-2026-14456", "https://bugzilla.redhat.com/2515348", "https://bugzilla.redhat.com/2517559", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2517561", "https://bugzilla.redhat.com/2517562", "https://bugzilla.redhat.com/2517564", "https://bugzilla.redhat.com/2517565", "https://bugzilla.redhat.com/2517566", "https://bugzilla.redhat.com/2517570", "https://bugzilla.redhat.com/show_bug.cgi?id=2515348", "https://bugzilla.redhat.com/show_bug.cgi?id=2517559", "https://bugzilla.redhat.com/show_bug.cgi?id=2517560", "https://bugzilla.redhat.com/show_bug.cgi?id=2517561", "https://bugzilla.redhat.com/show_bug.cgi?id=2517562", "https://bugzilla.redhat.com/show_bug.cgi?id=2517564", "https://bugzilla.redhat.com/show_bug.cgi?id=2517565", "https://bugzilla.redhat.com/show_bug.cgi?id=2517566", "https://bugzilla.redhat.com/show_bug.cgi?id=2517570", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14457", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18798", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54874", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63076", "https://errata.almalinux.org/9/ALSA-2026-67165.html", "https://errata.rockylinux.org/RLSA-2026:67165", "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9", "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b", "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139", "https://linux.oracle.com/cve/CVE-2026-14456.html", "https://linux.oracle.com/errata/ELSA-2026-67165-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-14456", "https://openssl-library.org/news/secadv/20260813.txt", "https://ubuntu.com/security/notices/USN-8678-1", "https://www.cve.org/CVERecord?id=CVE-2026-14456" ], "PublishedDate": "2026-08-13T15:19:31.82Z", "LastModifiedDate": "2026-11-06T20:26:36.04Z" }, { "VulnerabilityID": "CVE-2026-45447", "PkgID": "libcrypto3@3.5.6-r0", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.5.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "975680d851f10fda" }, "InstalledVersion": "3.5.6-r0", "FixedVersion": "3.5.7-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45447", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:e5841b3e857d7ebad857747aed912a2c05441f3637b76297b261b295d46c5d1c", "Title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "Description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "julia": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25237", "https://access.redhat.com/errata/RHSA-2026:25239", "https://access.redhat.com/errata/RHSA-2026:26275", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:34102", "https://access.redhat.com/errata/RHSA-2026:35869", "https://access.redhat.com/errata/RHSA-2026:36215", "https://access.redhat.com/errata/RHSA-2026:36217", "https://access.redhat.com/errata/RHSA-2026:39009", "https://access.redhat.com/errata/RHSA-2026:39012", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:44438", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:58563", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:66524", "https://access.redhat.com/security/cve/CVE-2026-45447", "https://bugzilla.redhat.com/2481898", "https://bugzilla.redhat.com/show_bug.cgi?id=2481879", "https://bugzilla.redhat.com/show_bug.cgi?id=2481880", "https://bugzilla.redhat.com/show_bug.cgi?id=2481881", "https://bugzilla.redhat.com/show_bug.cgi?id=2481882", "https://bugzilla.redhat.com/show_bug.cgi?id=2481884", "https://bugzilla.redhat.com/show_bug.cgi?id=2481885", "https://bugzilla.redhat.com/show_bug.cgi?id=2481887", "https://bugzilla.redhat.com/show_bug.cgi?id=2481890", "https://bugzilla.redhat.com/show_bug.cgi?id=2481891", "https://bugzilla.redhat.com/show_bug.cgi?id=2481892", "https://bugzilla.redhat.com/show_bug.cgi?id=2481893", "https://bugzilla.redhat.com/show_bug.cgi?id=2481894", "https://bugzilla.redhat.com/show_bug.cgi?id=2481896", "https://bugzilla.redhat.com/show_bug.cgi?id=2481897", "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076", "https://errata.almalinux.org/9/ALSA-2026-44438.html", "https://errata.rockylinux.org/RLSA-2026:25239", "https://github.com/advisories/GHSA-f684-cpcq-j565", "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://linux.oracle.com/cve/CVE-2026-45447.html", "https://linux.oracle.com/errata/ELSA-2026-50379.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45447", "https://openssl-library.org/news/secadv/20260609.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "https://ubuntu.com/security/notices/USN-8414-1", "https://ubuntu.com/security/notices/USN-8414-2", "https://www.cve.org/CVERecord?id=CVE-2026-45447" ], "PublishedDate": "2026-06-09T17:17:19.277Z", "LastModifiedDate": "2026-09-18T13:18:26.343Z" }, { "VulnerabilityID": "CVE-2026-14456", "PkgID": "libssl3@3.5.6-r0", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.5.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "aece396067dff154" }, "InstalledVersion": "3.5.6-r0", "FixedVersion": "3.5.8-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-14456", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:0629d82441007125a059b6cf95e2ca78827364db2bd13f40760f04704b6d85c5", "Title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "Description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/13/4", "https://access.redhat.com/errata/RHSA-2026:67165", "https://access.redhat.com/security/cve/CVE-2026-14456", "https://bugzilla.redhat.com/2515348", "https://bugzilla.redhat.com/2517559", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2517561", "https://bugzilla.redhat.com/2517562", "https://bugzilla.redhat.com/2517564", "https://bugzilla.redhat.com/2517565", "https://bugzilla.redhat.com/2517566", "https://bugzilla.redhat.com/2517570", "https://bugzilla.redhat.com/show_bug.cgi?id=2515348", "https://bugzilla.redhat.com/show_bug.cgi?id=2517559", "https://bugzilla.redhat.com/show_bug.cgi?id=2517560", "https://bugzilla.redhat.com/show_bug.cgi?id=2517561", "https://bugzilla.redhat.com/show_bug.cgi?id=2517562", "https://bugzilla.redhat.com/show_bug.cgi?id=2517564", "https://bugzilla.redhat.com/show_bug.cgi?id=2517565", "https://bugzilla.redhat.com/show_bug.cgi?id=2517566", "https://bugzilla.redhat.com/show_bug.cgi?id=2517570", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14457", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18798", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54874", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63076", "https://errata.almalinux.org/9/ALSA-2026-67165.html", "https://errata.rockylinux.org/RLSA-2026:67165", "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9", "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b", "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139", "https://linux.oracle.com/cve/CVE-2026-14456.html", "https://linux.oracle.com/errata/ELSA-2026-67165-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-14456", "https://openssl-library.org/news/secadv/20260813.txt", "https://ubuntu.com/security/notices/USN-8678-1", "https://www.cve.org/CVERecord?id=CVE-2026-14456" ], "PublishedDate": "2026-08-13T15:19:31.82Z", "LastModifiedDate": "2026-11-06T20:26:36.04Z" }, { "VulnerabilityID": "CVE-2026-45447", "PkgID": "libssl3@3.5.6-r0", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.5.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "aece396067dff154" }, "InstalledVersion": "3.5.6-r0", "FixedVersion": "3.5.7-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45447", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:7ba6d899236934468deaeb58f259764064f26bed022a25ec64796a1ab340d925", "Title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "Description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "julia": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25237", "https://access.redhat.com/errata/RHSA-2026:25239", "https://access.redhat.com/errata/RHSA-2026:26275", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:34102", "https://access.redhat.com/errata/RHSA-2026:35869", "https://access.redhat.com/errata/RHSA-2026:36215", "https://access.redhat.com/errata/RHSA-2026:36217", "https://access.redhat.com/errata/RHSA-2026:39009", "https://access.redhat.com/errata/RHSA-2026:39012", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:44438", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:58563", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:66524", "https://access.redhat.com/security/cve/CVE-2026-45447", "https://bugzilla.redhat.com/2481898", "https://bugzilla.redhat.com/show_bug.cgi?id=2481879", "https://bugzilla.redhat.com/show_bug.cgi?id=2481880", "https://bugzilla.redhat.com/show_bug.cgi?id=2481881", "https://bugzilla.redhat.com/show_bug.cgi?id=2481882", "https://bugzilla.redhat.com/show_bug.cgi?id=2481884", "https://bugzilla.redhat.com/show_bug.cgi?id=2481885", "https://bugzilla.redhat.com/show_bug.cgi?id=2481887", "https://bugzilla.redhat.com/show_bug.cgi?id=2481890", "https://bugzilla.redhat.com/show_bug.cgi?id=2481891", "https://bugzilla.redhat.com/show_bug.cgi?id=2481892", "https://bugzilla.redhat.com/show_bug.cgi?id=2481893", "https://bugzilla.redhat.com/show_bug.cgi?id=2481894", "https://bugzilla.redhat.com/show_bug.cgi?id=2481896", "https://bugzilla.redhat.com/show_bug.cgi?id=2481897", "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076", "https://errata.almalinux.org/9/ALSA-2026-44438.html", "https://errata.rockylinux.org/RLSA-2026:25239", "https://github.com/advisories/GHSA-f684-cpcq-j565", "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://linux.oracle.com/cve/CVE-2026-45447.html", "https://linux.oracle.com/errata/ELSA-2026-50379.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45447", "https://openssl-library.org/news/secadv/20260609.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "https://ubuntu.com/security/notices/USN-8414-1", "https://ubuntu.com/security/notices/USN-8414-2", "https://www.cve.org/CVERecord?id=CVE-2026-45447" ], "PublishedDate": "2026-06-09T17:17:19.277Z", "LastModifiedDate": "2026-09-18T13:18:26.343Z" }, { "VulnerabilityID": "CVE-2026-107891", "PkgID": "musl@1.2.5-r23", "PkgName": "musl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/musl@1.2.5-r23?arch=x86_64\u0026distro=3.23.4", "UID": "dca30b3fd6708a32" }, "InstalledVersion": "1.2.5-r23", "FixedVersion": "1.2.5-r24", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-107891", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:456d994fc9be0620435427b72a6ca3e776708bdc98ba03ad19de1ac80e94acbd", "Title": "musl: musl: Arbitrary code execution via integer overflow in regcomp", "Description": "musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/21/18", "https://access.redhat.com/security/cve/CVE-2026-107891", "https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941", "https://musl.libc.org", "https://nvd.nist.gov/vuln/detail/CVE-2026-107891", "https://www.cve.org/CVERecord?id=CVE-2026-107891", "https://www.openwall.com/lists/musl/2026/10/21/1" ], "PublishedDate": "2026-11-05T16:17:32.15Z", "LastModifiedDate": "2026-11-05T17:17:35.287Z" }, { "VulnerabilityID": "CVE-2026-107891", "PkgID": "musl-utils@1.2.5-r23", "PkgName": "musl-utils", "PkgIdentifier": { "PURL": "pkg:apk/alpine/musl-utils@1.2.5-r23?arch=x86_64\u0026distro=3.23.4", "UID": "ffcf7198a9776c5f" }, "InstalledVersion": "1.2.5-r23", "FixedVersion": "1.2.5-r24", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-107891", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:d4e382079e52c5e5cbf793579a1027eb112cdc8942562ada50c1913cc5cc7113", "Title": "musl: musl: Arbitrary code execution via integer overflow in regcomp", "Description": "musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/21/18", "https://access.redhat.com/security/cve/CVE-2026-107891", "https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941", "https://musl.libc.org", "https://nvd.nist.gov/vuln/detail/CVE-2026-107891", "https://www.cve.org/CVERecord?id=CVE-2026-107891", "https://www.openwall.com/lists/musl/2026/10/21/1" ], "PublishedDate": "2026-11-05T16:17:32.15Z", "LastModifiedDate": "2026-11-05T17:17:35.287Z" }, { "VulnerabilityID": "CVE-2026-85091", "PkgID": "zlib@1.3.2-r0", "PkgName": "zlib", "PkgIdentifier": { "PURL": "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64\u0026distro=3.23.4", "UID": "23a5a7d167a86311" }, "InstalledVersion": "1.3.2-r0", "FixedVersion": "1.3.2-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-85091", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:0879cbdcac36a27488cdbbdd979c2e8951d235fd1a93182b0e03b8c5b1ac68ad", "Title": "zlib: zlib: Heap buffer overflow in gz_vacate() allows arbitrary code execution", "Description": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-85091", "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "https://github.com/madler/zlib", "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393", "https://nvd.nist.gov/vuln/detail/CVE-2026-85091", "https://ubuntu.com/security/notices/USN-8954-1", "https://www.cve.org/CVERecord?id=CVE-2026-85091", "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" ], "PublishedDate": "2026-09-03T13:06:20.573Z", "LastModifiedDate": "2026-09-09T20:41:07.123Z" } ] }, { "Target": "usr/local/bin/auth", "Class": "lang-pkgs", "Type": "gobinary", "Packages": [ { "ID": "github.com/supabase/auth@v2.189.0", "Name": "github.com/supabase/auth", "Identifier": { "PURL": "pkg:golang/github.com/supabase/auth@v2.189.0", "UID": "4a17ea83bb4c2d94" }, "Version": "v2.189.0", "Relationship": "root", "DependsOn": [ "github.com/Masterminds/semver/v3@v3.1.1", "github.com/XSAM/otelsql@v0.26.0", "github.com/aaronarduino/goqrsvg@v0.0.0-20220419053939-17e843f1dd40", "github.com/ajstarks/svgo@v0.0.0-20211024235047-1546f124cd8b", "github.com/aymerick/douceur@v0.2.0", "github.com/badoux/checkmail@v0.0.0-20170203135005-d0a759655d62", "github.com/beevik/etree@v1.6.0", "github.com/beorn7/perks@v1.0.1", "github.com/bits-and-blooms/bitset@v1.20.0", "github.com/bits-and-blooms/bloom/v3@v3.6.0", "github.com/bombsimon/logrusr/v3@v3.0.0", "github.com/boombuler/barcode@v1.0.1-0.20190219062509-6c824513bacc", "github.com/btcsuite/btcutil@v1.0.2", "github.com/cenkalti/backoff/v4@v4.3.0", "github.com/cenkalti/backoff/v5@v5.0.3", "github.com/cespare/xxhash/v2@v2.3.0", "github.com/consensys/gnark-crypto@v0.18.1", "github.com/coreos/go-oidc/v3@v3.6.0", "github.com/crate-crypto/go-eth-kzg@v1.4.0", "github.com/crewjam/httperr@v0.2.0", "github.com/crewjam/saml@v0.4.14", "github.com/decred/dcrd/dcrec/secp256k1/v4@v4.3.0", "github.com/didip/tollbooth/v5@v5.1.1", "github.com/ethereum/go-ethereum@v1.17.0", "github.com/fatih/color@v1.16.0", "github.com/fatih/structs@v1.1.0", "github.com/felixge/httpsnoop@v1.0.4", "github.com/fsnotify/fsnotify@v1.7.0", "github.com/fxamacker/cbor/v2@v2.9.1", "github.com/go-chi/chi/v5@v5.2.4", "github.com/go-jose/go-jose/v3@v3.0.4", "github.com/go-logr/logr@v1.4.3", "github.com/go-logr/stdr@v1.2.2", "github.com/go-sql-driver/mysql@v1.7.0", "github.com/go-viper/mapstructure/v2@v2.5.0", "github.com/go-webauthn/webauthn@v0.16.5", "github.com/go-webauthn/x@v0.2.3", "github.com/gobuffalo/envy@v1.10.2", "github.com/gobuffalo/fizz@v1.14.4", "github.com/gobuffalo/flect@v1.0.2", "github.com/gobuffalo/github_flavored_markdown@v1.1.3", "github.com/gobuffalo/helpers@v0.6.7", "github.com/gobuffalo/nulls@v0.4.2", "github.com/gobuffalo/plush/v4@v4.1.18", "github.com/gobuffalo/pop/v6@v6.1.1", "github.com/gobuffalo/tags/v3@v3.1.4", "github.com/gobuffalo/validate/v3@v3.3.3", "github.com/gobwas/glob@v0.2.3", "github.com/gofrs/uuid@v4.3.1+incompatible", "github.com/golang-jwt/jwt/v4@v4.5.2", "github.com/golang-jwt/jwt/v5@v5.3.1", "github.com/google/go-tpm@v0.9.8", "github.com/google/uuid@v1.6.0", "github.com/gorilla/css@v1.0.0", "github.com/grpc-ecosystem/grpc-gateway/v2@v2.27.7", "github.com/holiman/uint256@v1.3.2", "github.com/jackc/chunkreader/v2@v2.0.1", "github.com/jackc/pgconn@v1.14.3", "github.com/jackc/pgerrcode@v0.0.0-20201024163028-a0d42d470451", "github.com/jackc/pgio@v1.0.0", "github.com/jackc/pgpassfile@v1.0.0", "github.com/jackc/pgproto3/v2@v2.3.3", "github.com/jackc/pgservicefile@v0.0.0-20221227161230-091c0ba34f0a", "github.com/jackc/pgtype@v1.14.0", "github.com/jackc/pgx/v4@v4.18.2", "github.com/jmoiron/sqlx@v1.3.5", "github.com/joho/godotenv@v1.5.1", "github.com/jonboulle/clockwork@v0.5.0", "github.com/kballard/go-shellquote@v0.0.0-20180428030007-95032a82bc51", "github.com/kelseyhightower/envconfig@v1.4.0", "github.com/lestrrat-go/blackmagic@v1.0.2", "github.com/lestrrat-go/httpcc@v1.0.1", "github.com/lestrrat-go/httprc@v1.0.5", "github.com/lestrrat-go/iter@v1.0.2", "github.com/lestrrat-go/jwx/v2@v2.1.0", "github.com/lestrrat-go/option@v1.0.1", "github.com/lib/pq@v1.10.7", "github.com/luna-duclos/instrumentedsql@v1.1.3", "github.com/mattermost/xml-roundtrip-validator@v0.1.0", "github.com/mattn/go-colorable@v0.1.13", "github.com/mattn/go-isatty@v0.0.20", "github.com/microcosm-cc/bluemonday@v1.0.26", "github.com/mitchellh/mapstructure@v1.5.0", "github.com/mrjones/oauth@v0.0.0-20190623134757-126b35219450", "github.com/patrickmn/go-cache@v2.1.0+incompatible", "github.com/philhofer/fwd@v1.2.0", "github.com/pkg/errors@v0.9.1", "github.com/pquerna/otp@v1.4.0", "github.com/prometheus/client_golang@v1.19.0", "github.com/prometheus/client_model@v0.6.1", "github.com/prometheus/common@v0.48.0", "github.com/prometheus/procfs@v0.12.0", "github.com/rogpeppe/go-internal@v1.14.1", "github.com/rs/cors@v1.11.0", "github.com/russellhaering/goxmldsig@v1.6.0", "github.com/sebest/xff@v0.0.0-20160910043805-6c115e0ffa35", "github.com/sergi/go-diff@v1.2.0", "github.com/sethvargo/go-password@v0.2.0", "github.com/sirupsen/logrus@v1.9.3", "github.com/sourcegraph/annotate@v0.0.0-20160123013949-f4cad6c6324d", "github.com/sourcegraph/syntaxhighlight@v0.0.0-20170531221838-bd320f5d308e", "github.com/spf13/cobra@v1.8.1", "github.com/spf13/pflag@v1.0.6", "github.com/standard-webhooks/standard-webhooks/libraries@v0.0.0-20240303152453-e0e82adf1721", "github.com/supabase/hibp@v0.0.0-20231124125943-d225752ae869", "github.com/tinylib/msgp@v1.6.4", "github.com/x448/float16@v0.8.4", "github.com/xeipuuv/gojsonpointer@v0.0.0-20180127040702-4e3ac2762d5f", "github.com/xeipuuv/gojsonreference@v0.0.0-20180127040603-bd5ef7bd5415", "github.com/xeipuuv/gojsonschema@v1.2.0", "go.opentelemetry.io/auto/sdk@v1.2.1", "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.64.0", "go.opentelemetry.io/contrib/instrumentation/runtime@v0.45.0", "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc@v1.26.0", "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.26.0", "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.40.0", "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.40.0", "go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.40.0", "go.opentelemetry.io/otel/exporters/prometheus@v0.48.0", "go.opentelemetry.io/otel/metric@v1.40.0", "go.opentelemetry.io/otel/sdk/metric@v1.40.0", "go.opentelemetry.io/otel/sdk@v1.40.0", "go.opentelemetry.io/otel/trace@v1.40.0", "go.opentelemetry.io/otel@v1.40.0", "go.opentelemetry.io/proto/otlp@v1.9.0", "golang.org/x/crypto@v0.50.0", "golang.org/x/exp@v0.0.0-20230811145659-89c5cff77bcb", "golang.org/x/mod@v0.34.0", "golang.org/x/net@v0.52.0", "golang.org/x/oauth2@v0.34.0", "golang.org/x/sync@v0.20.0", "golang.org/x/sys@v0.43.0", "golang.org/x/text@v0.36.0", "golang.org/x/time@v0.9.0", "google.golang.org/genproto/googleapis/api@v0.0.0-20260128011058-8636f8732409", "google.golang.org/genproto/googleapis/rpc@v0.0.0-20260128011058-8636f8732409", "google.golang.org/grpc@v1.78.0", "google.golang.org/protobuf@v1.36.11", "gopkg.in/gomail.v2@v2.0.0-20160411212932-81ebce5c23df", "gopkg.in/yaml.v2@v2.4.0", "stdlib@v1.25.8" ], "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "stdlib@v1.25.8", "Name": "stdlib", "Identifier": { "PURL": "pkg:golang/stdlib@v1.25.8", "UID": "d0005ada20383185" }, "Version": "v1.25.8", "Relationship": "direct", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Masterminds/semver/v3@v3.1.1", "Name": "github.com/Masterminds/semver/v3", "Identifier": { "PURL": "pkg:golang/github.com/masterminds/semver/v3@v3.1.1", "UID": "2beb38a0d0d75e21" }, "Version": "v3.1.1", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/XSAM/otelsql@v0.26.0", "Name": "github.com/XSAM/otelsql", "Identifier": { "PURL": "pkg:golang/github.com/xsam/otelsql@v0.26.0", "UID": "18caa0f91126c6fb" }, "Version": "v0.26.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aaronarduino/goqrsvg@v0.0.0-20220419053939-17e843f1dd40", "Name": "github.com/aaronarduino/goqrsvg", "Identifier": { "PURL": "pkg:golang/github.com/aaronarduino/goqrsvg@v0.0.0-20220419053939-17e843f1dd40", "UID": "994317175057987a" }, "Version": "v0.0.0-20220419053939-17e843f1dd40", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/ajstarks/svgo@v0.0.0-20211024235047-1546f124cd8b", "Name": "github.com/ajstarks/svgo", "Identifier": { "PURL": "pkg:golang/github.com/ajstarks/svgo@v0.0.0-20211024235047-1546f124cd8b", "UID": "63c137f472852f61" }, "Version": "v0.0.0-20211024235047-1546f124cd8b", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aymerick/douceur@v0.2.0", "Name": "github.com/aymerick/douceur", "Identifier": { "PURL": "pkg:golang/github.com/aymerick/douceur@v0.2.0", "UID": "f69e29c22378d9cf" }, "Version": "v0.2.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/badoux/checkmail@v0.0.0-20170203135005-d0a759655d62", "Name": "github.com/badoux/checkmail", "Identifier": { "PURL": "pkg:golang/github.com/badoux/checkmail@v0.0.0-20170203135005-d0a759655d62", "UID": "e6b194287726a6f1" }, "Version": "v0.0.0-20170203135005-d0a759655d62", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/beevik/etree@v1.6.0", "Name": "github.com/beevik/etree", "Identifier": { "PURL": "pkg:golang/github.com/beevik/etree@v1.6.0", "UID": "fd2c73e6ade37a78" }, "Version": "v1.6.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/beorn7/perks@v1.0.1", "Name": "github.com/beorn7/perks", "Identifier": { "PURL": "pkg:golang/github.com/beorn7/perks@v1.0.1", "UID": "5e37a11f850d70a0" }, "Version": "v1.0.1", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/bits-and-blooms/bitset@v1.20.0", "Name": "github.com/bits-and-blooms/bitset", "Identifier": { "PURL": "pkg:golang/github.com/bits-and-blooms/bitset@v1.20.0", "UID": "287ad20d2da31df6" }, "Version": "v1.20.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/bits-and-blooms/bloom/v3@v3.6.0", "Name": "github.com/bits-and-blooms/bloom/v3", "Identifier": { "PURL": "pkg:golang/github.com/bits-and-blooms/bloom/v3@v3.6.0", "UID": "a0a0c0cddb2125d" }, "Version": "v3.6.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/bombsimon/logrusr/v3@v3.0.0", "Name": "github.com/bombsimon/logrusr/v3", "Identifier": { "PURL": "pkg:golang/github.com/bombsimon/logrusr/v3@v3.0.0", "UID": "b81d68623a8200d0" }, "Version": "v3.0.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/boombuler/barcode@v1.0.1-0.20190219062509-6c824513bacc", "Name": "github.com/boombuler/barcode", "Identifier": { "PURL": "pkg:golang/github.com/boombuler/barcode@v1.0.1-0.20190219062509-6c824513bacc", "UID": "430bb1704cb6cfb0" }, "Version": "v1.0.1-0.20190219062509-6c824513bacc", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/btcsuite/btcutil@v1.0.2", "Name": "github.com/btcsuite/btcutil", "Identifier": { "PURL": "pkg:golang/github.com/btcsuite/btcutil@v1.0.2", "UID": "dc41d61a49be0a2e" }, "Version": "v1.0.2", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cenkalti/backoff/v4@v4.3.0", "Name": "github.com/cenkalti/backoff/v4", "Identifier": { "PURL": "pkg:golang/github.com/cenkalti/backoff/v4@v4.3.0", "UID": "e6dac930aaf4135" }, "Version": "v4.3.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cenkalti/backoff/v5@v5.0.3", "Name": "github.com/cenkalti/backoff/v5", "Identifier": { "PURL": "pkg:golang/github.com/cenkalti/backoff/v5@v5.0.3", "UID": "762c88a4e72a7de7" }, "Version": "v5.0.3", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cespare/xxhash/v2@v2.3.0", "Name": "github.com/cespare/xxhash/v2", "Identifier": { "PURL": "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", "UID": "1a09e378bcf08c05" }, "Version": "v2.3.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/consensys/gnark-crypto@v0.18.1", "Name": "github.com/consensys/gnark-crypto", "Identifier": { "PURL": "pkg:golang/github.com/consensys/gnark-crypto@v0.18.1", "UID": "c93eaaccf4d6233d" }, "Version": "v0.18.1", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/coreos/go-oidc/v3@v3.6.0", "Name": "github.com/coreos/go-oidc/v3", "Identifier": { "PURL": "pkg:golang/github.com/coreos/go-oidc/v3@v3.6.0", "UID": "ec1ddf3206a96eb7" }, "Version": "v3.6.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/crate-crypto/go-eth-kzg@v1.4.0", "Name": "github.com/crate-crypto/go-eth-kzg", "Identifier": { "PURL": "pkg:golang/github.com/crate-crypto/go-eth-kzg@v1.4.0", "UID": "5aaf81f54e63b3a7" }, "Version": "v1.4.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/crewjam/httperr@v0.2.0", "Name": "github.com/crewjam/httperr", "Identifier": { "PURL": "pkg:golang/github.com/crewjam/httperr@v0.2.0", "UID": "ba7f6c0085d5de69" }, "Version": "v0.2.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/crewjam/saml@v0.4.14", "Name": "github.com/crewjam/saml", "Identifier": { "PURL": "pkg:golang/github.com/crewjam/saml@v0.4.14", "UID": "1bd9c1b74e04cff2" }, "Version": "v0.4.14", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/decred/dcrd/dcrec/secp256k1/v4@v4.3.0", "Name": "github.com/decred/dcrd/dcrec/secp256k1/v4", "Identifier": { "PURL": "pkg:golang/github.com/decred/dcrd/dcrec/secp256k1/v4@v4.3.0", "UID": "c1adfe52941812f0" }, "Version": "v4.3.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/didip/tollbooth/v5@v5.1.1", "Name": "github.com/didip/tollbooth/v5", "Identifier": { "PURL": "pkg:golang/github.com/didip/tollbooth/v5@v5.1.1", "UID": "eff3a3bab9597dbb" }, "Version": "v5.1.1", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/ethereum/go-ethereum@v1.17.0", "Name": "github.com/ethereum/go-ethereum", "Identifier": { "PURL": "pkg:golang/github.com/ethereum/go-ethereum@v1.17.0", "UID": "435ee5fcacb508f6" }, "Version": "v1.17.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/fatih/color@v1.16.0", "Name": "github.com/fatih/color", "Identifier": { "PURL": "pkg:golang/github.com/fatih/color@v1.16.0", "UID": "7a256a05d33efc66" }, "Version": "v1.16.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/fatih/structs@v1.1.0", "Name": "github.com/fatih/structs", "Identifier": { "PURL": "pkg:golang/github.com/fatih/structs@v1.1.0", "UID": "db7d248aab95a3c0" }, "Version": "v1.1.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/felixge/httpsnoop@v1.0.4", "Name": "github.com/felixge/httpsnoop", "Identifier": { "PURL": "pkg:golang/github.com/felixge/httpsnoop@v1.0.4", "UID": "6970c29f4833166b" }, "Version": "v1.0.4", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/fsnotify/fsnotify@v1.7.0", "Name": "github.com/fsnotify/fsnotify", "Identifier": { "PURL": "pkg:golang/github.com/fsnotify/fsnotify@v1.7.0", "UID": "eb4aa2581ab970eb" }, "Version": "v1.7.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/fxamacker/cbor/v2@v2.9.1", "Name": "github.com/fxamacker/cbor/v2", "Identifier": { "PURL": "pkg:golang/github.com/fxamacker/cbor/v2@v2.9.1", "UID": "6bf204ebc4f0a7e5" }, "Version": "v2.9.1", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-chi/chi/v5@v5.2.4", "Name": "github.com/go-chi/chi/v5", "Identifier": { "PURL": "pkg:golang/github.com/go-chi/chi/v5@v5.2.4", "UID": "2a79bb07bc749912" }, "Version": "v5.2.4", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-jose/go-jose/v3@v3.0.4", "Name": "github.com/go-jose/go-jose/v3", "Identifier": { "PURL": "pkg:golang/github.com/go-jose/go-jose/v3@v3.0.4", "UID": "7cd8c1ab3ce2b4eb" }, "Version": "v3.0.4", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-logr/logr@v1.4.3", "Name": "github.com/go-logr/logr", "Identifier": { "PURL": "pkg:golang/github.com/go-logr/logr@v1.4.3", "UID": "5b7d44c90303ea2f" }, "Version": "v1.4.3", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-logr/stdr@v1.2.2", "Name": "github.com/go-logr/stdr", "Identifier": { "PURL": "pkg:golang/github.com/go-logr/stdr@v1.2.2", "UID": "e0ff4328e9e423c8" }, "Version": "v1.2.2", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-sql-driver/mysql@v1.7.0", "Name": "github.com/go-sql-driver/mysql", "Identifier": { "PURL": "pkg:golang/github.com/go-sql-driver/mysql@v1.7.0", "UID": "605533d775a56a47" }, "Version": "v1.7.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-viper/mapstructure/v2@v2.5.0", "Name": "github.com/go-viper/mapstructure/v2", "Identifier": { "PURL": "pkg:golang/github.com/go-viper/mapstructure/v2@v2.5.0", "UID": "25879ad4e8f70bb1" }, "Version": "v2.5.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-webauthn/webauthn@v0.16.5", "Name": "github.com/go-webauthn/webauthn", "Identifier": { "PURL": "pkg:golang/github.com/go-webauthn/webauthn@v0.16.5", "UID": "5467eac6eb1d3d05" }, "Version": "v0.16.5", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-webauthn/x@v0.2.3", "Name": "github.com/go-webauthn/x", "Identifier": { "PURL": "pkg:golang/github.com/go-webauthn/x@v0.2.3", "UID": "ec2d0dd02348a41c" }, "Version": "v0.2.3", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gobuffalo/envy@v1.10.2", "Name": "github.com/gobuffalo/envy", "Identifier": { "PURL": "pkg:golang/github.com/gobuffalo/envy@v1.10.2", "UID": "b4779f35a1b1a4ec" }, "Version": "v1.10.2", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gobuffalo/fizz@v1.14.4", "Name": "github.com/gobuffalo/fizz", "Identifier": { "PURL": "pkg:golang/github.com/gobuffalo/fizz@v1.14.4", "UID": "8f418d54dc47f552" }, "Version": "v1.14.4", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gobuffalo/flect@v1.0.2", "Name": "github.com/gobuffalo/flect", "Identifier": { "PURL": "pkg:golang/github.com/gobuffalo/flect@v1.0.2", "UID": "4fbe088ae20182fc" }, "Version": "v1.0.2", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gobuffalo/github_flavored_markdown@v1.1.3", "Name": "github.com/gobuffalo/github_flavored_markdown", "Identifier": { "PURL": "pkg:golang/github.com/gobuffalo/github_flavored_markdown@v1.1.3", "UID": "dbbe71d58f44a4a0" }, "Version": "v1.1.3", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gobuffalo/helpers@v0.6.7", "Name": "github.com/gobuffalo/helpers", "Identifier": { "PURL": "pkg:golang/github.com/gobuffalo/helpers@v0.6.7", "UID": "c76e564060eb7304" }, "Version": "v0.6.7", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gobuffalo/nulls@v0.4.2", "Name": "github.com/gobuffalo/nulls", "Identifier": { "PURL": "pkg:golang/github.com/gobuffalo/nulls@v0.4.2", "UID": "4dfd1cc54c0d5bb2" }, "Version": "v0.4.2", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gobuffalo/plush/v4@v4.1.18", "Name": "github.com/gobuffalo/plush/v4", "Identifier": { "PURL": "pkg:golang/github.com/gobuffalo/plush/v4@v4.1.18", "UID": "d4ded931804ba877" }, "Version": "v4.1.18", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gobuffalo/pop/v6@v6.1.1", "Name": "github.com/gobuffalo/pop/v6", "Identifier": { "PURL": "pkg:golang/github.com/gobuffalo/pop/v6@v6.1.1", "UID": "263f1f9b323790ef" }, "Version": "v6.1.1", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gobuffalo/tags/v3@v3.1.4", "Name": "github.com/gobuffalo/tags/v3", "Identifier": { "PURL": "pkg:golang/github.com/gobuffalo/tags/v3@v3.1.4", "UID": "4c034872cd869b28" }, "Version": "v3.1.4", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gobuffalo/validate/v3@v3.3.3", "Name": "github.com/gobuffalo/validate/v3", "Identifier": { "PURL": "pkg:golang/github.com/gobuffalo/validate/v3@v3.3.3", "UID": "a6065dfffba9de23" }, "Version": "v3.3.3", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gobwas/glob@v0.2.3", "Name": "github.com/gobwas/glob", "Identifier": { "PURL": "pkg:golang/github.com/gobwas/glob@v0.2.3", "UID": "46141bdaaa8ce7e3" }, "Version": "v0.2.3", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gofrs/uuid@v4.3.1+incompatible", "Name": "github.com/gofrs/uuid", "Identifier": { "PURL": "pkg:golang/github.com/gofrs/uuid@v4.3.1%2Bincompatible", "UID": "c229ed577e6dbef2" }, "Version": "v4.3.1+incompatible", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/golang-jwt/jwt/v4@v4.5.2", "Name": "github.com/golang-jwt/jwt/v4", "Identifier": { "PURL": "pkg:golang/github.com/golang-jwt/jwt/v4@v4.5.2", "UID": "5168cf9b9f227a8e" }, "Version": "v4.5.2", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/golang-jwt/jwt/v5@v5.3.1", "Name": "github.com/golang-jwt/jwt/v5", "Identifier": { "PURL": "pkg:golang/github.com/golang-jwt/jwt/v5@v5.3.1", "UID": "4b7f8a1210af69a5" }, "Version": "v5.3.1", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/go-tpm@v0.9.8", "Name": "github.com/google/go-tpm", "Identifier": { "PURL": "pkg:golang/github.com/google/go-tpm@v0.9.8", "UID": "86ce0636486a0cb7" }, "Version": "v0.9.8", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/uuid@v1.6.0", "Name": "github.com/google/uuid", "Identifier": { "PURL": "pkg:golang/github.com/google/uuid@v1.6.0", "UID": "e67a6d0388ad0376" }, "Version": "v1.6.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gorilla/css@v1.0.0", "Name": "github.com/gorilla/css", "Identifier": { "PURL": "pkg:golang/github.com/gorilla/css@v1.0.0", "UID": "49fae05b40c8e34a" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grpc-ecosystem/grpc-gateway/v2@v2.27.7", "Name": "github.com/grpc-ecosystem/grpc-gateway/v2", "Identifier": { "PURL": "pkg:golang/github.com/grpc-ecosystem/grpc-gateway/v2@v2.27.7", "UID": "ac0b3a128390a42d" }, "Version": "v2.27.7", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/holiman/uint256@v1.3.2", "Name": "github.com/holiman/uint256", "Identifier": { "PURL": "pkg:golang/github.com/holiman/uint256@v1.3.2", "UID": "da483aae839c6f03" }, "Version": "v1.3.2", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jackc/chunkreader/v2@v2.0.1", "Name": "github.com/jackc/chunkreader/v2", "Identifier": { "PURL": "pkg:golang/github.com/jackc/chunkreader/v2@v2.0.1", "UID": "f108b858278fea7f" }, "Version": "v2.0.1", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jackc/pgconn@v1.14.3", "Name": "github.com/jackc/pgconn", "Identifier": { "PURL": "pkg:golang/github.com/jackc/pgconn@v1.14.3", "UID": "44357699ed466b13" }, "Version": "v1.14.3", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jackc/pgerrcode@v0.0.0-20201024163028-a0d42d470451", "Name": "github.com/jackc/pgerrcode", "Identifier": { "PURL": "pkg:golang/github.com/jackc/pgerrcode@v0.0.0-20201024163028-a0d42d470451", "UID": "c5f5fe315e90c0ad" }, "Version": "v0.0.0-20201024163028-a0d42d470451", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jackc/pgio@v1.0.0", "Name": "github.com/jackc/pgio", "Identifier": { "PURL": "pkg:golang/github.com/jackc/pgio@v1.0.0", "UID": "326ff09cac9d96b3" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jackc/pgpassfile@v1.0.0", "Name": "github.com/jackc/pgpassfile", "Identifier": { "PURL": "pkg:golang/github.com/jackc/pgpassfile@v1.0.0", "UID": "1952040e23c6fcf5" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jackc/pgproto3/v2@v2.3.3", "Name": "github.com/jackc/pgproto3/v2", "Identifier": { "PURL": "pkg:golang/github.com/jackc/pgproto3/v2@v2.3.3", "UID": "5d4f909e4ebb12f9" }, "Version": "v2.3.3", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jackc/pgservicefile@v0.0.0-20221227161230-091c0ba34f0a", "Name": "github.com/jackc/pgservicefile", "Identifier": { "PURL": "pkg:golang/github.com/jackc/pgservicefile@v0.0.0-20221227161230-091c0ba34f0a", "UID": "3b47b1ae172d9029" }, "Version": "v0.0.0-20221227161230-091c0ba34f0a", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jackc/pgtype@v1.14.0", "Name": "github.com/jackc/pgtype", "Identifier": { "PURL": "pkg:golang/github.com/jackc/pgtype@v1.14.0", "UID": "610594ebeacf1f7c" }, "Version": "v1.14.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jackc/pgx/v4@v4.18.2", "Name": "github.com/jackc/pgx/v4", "Identifier": { "PURL": "pkg:golang/github.com/jackc/pgx/v4@v4.18.2", "UID": "2448978a0e51757a" }, "Version": "v4.18.2", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jmoiron/sqlx@v1.3.5", "Name": "github.com/jmoiron/sqlx", "Identifier": { "PURL": "pkg:golang/github.com/jmoiron/sqlx@v1.3.5", "UID": "4c9309e961350595" }, "Version": "v1.3.5", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/joho/godotenv@v1.5.1", "Name": "github.com/joho/godotenv", "Identifier": { "PURL": "pkg:golang/github.com/joho/godotenv@v1.5.1", "UID": "ff4376299fb09d5f" }, "Version": "v1.5.1", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jonboulle/clockwork@v0.5.0", "Name": "github.com/jonboulle/clockwork", "Identifier": { "PURL": "pkg:golang/github.com/jonboulle/clockwork@v0.5.0", "UID": "c8d9a5fcc86756a9" }, "Version": "v0.5.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/kballard/go-shellquote@v0.0.0-20180428030007-95032a82bc51", "Name": "github.com/kballard/go-shellquote", "Identifier": { "PURL": "pkg:golang/github.com/kballard/go-shellquote@v0.0.0-20180428030007-95032a82bc51", "UID": "3c3305e9602612d2" }, "Version": "v0.0.0-20180428030007-95032a82bc51", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/kelseyhightower/envconfig@v1.4.0", "Name": "github.com/kelseyhightower/envconfig", "Identifier": { "PURL": "pkg:golang/github.com/kelseyhightower/envconfig@v1.4.0", "UID": "5cf1cbb5bf9ccc54" }, "Version": "v1.4.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/lestrrat-go/blackmagic@v1.0.2", "Name": "github.com/lestrrat-go/blackmagic", "Identifier": { "PURL": "pkg:golang/github.com/lestrrat-go/blackmagic@v1.0.2", "UID": "82f493dc6c2022b" }, "Version": "v1.0.2", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/lestrrat-go/httpcc@v1.0.1", "Name": "github.com/lestrrat-go/httpcc", "Identifier": { "PURL": "pkg:golang/github.com/lestrrat-go/httpcc@v1.0.1", "UID": "fc1582f5b2519520" }, "Version": "v1.0.1", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/lestrrat-go/httprc@v1.0.5", "Name": "github.com/lestrrat-go/httprc", "Identifier": { "PURL": "pkg:golang/github.com/lestrrat-go/httprc@v1.0.5", "UID": "7290c2be45b1f979" }, "Version": "v1.0.5", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/lestrrat-go/iter@v1.0.2", "Name": "github.com/lestrrat-go/iter", "Identifier": { "PURL": "pkg:golang/github.com/lestrrat-go/iter@v1.0.2", "UID": "d74fe38b50490e88" }, "Version": "v1.0.2", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/lestrrat-go/jwx/v2@v2.1.0", "Name": "github.com/lestrrat-go/jwx/v2", "Identifier": { "PURL": "pkg:golang/github.com/lestrrat-go/jwx/v2@v2.1.0", "UID": "ec3d0508c5f45578" }, "Version": "v2.1.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/lestrrat-go/option@v1.0.1", "Name": "github.com/lestrrat-go/option", "Identifier": { "PURL": "pkg:golang/github.com/lestrrat-go/option@v1.0.1", "UID": "b8ffcb24c7d60b47" }, "Version": "v1.0.1", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/lib/pq@v1.10.7", "Name": "github.com/lib/pq", "Identifier": { "PURL": "pkg:golang/github.com/lib/pq@v1.10.7", "UID": "1dcf11f80e6e1928" }, "Version": "v1.10.7", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/luna-duclos/instrumentedsql@v1.1.3", "Name": "github.com/luna-duclos/instrumentedsql", "Identifier": { "PURL": "pkg:golang/github.com/luna-duclos/instrumentedsql@v1.1.3", "UID": "ac240060a16451b5" }, "Version": "v1.1.3", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mattermost/xml-roundtrip-validator@v0.1.0", "Name": "github.com/mattermost/xml-roundtrip-validator", "Identifier": { "PURL": "pkg:golang/github.com/mattermost/xml-roundtrip-validator@v0.1.0", "UID": "f1d153de9ebd1e95" }, "Version": "v0.1.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mattn/go-colorable@v0.1.13", "Name": "github.com/mattn/go-colorable", "Identifier": { "PURL": "pkg:golang/github.com/mattn/go-colorable@v0.1.13", "UID": "7424f73b02560236" }, "Version": "v0.1.13", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mattn/go-isatty@v0.0.20", "Name": "github.com/mattn/go-isatty", "Identifier": { "PURL": "pkg:golang/github.com/mattn/go-isatty@v0.0.20", "UID": "378b4bdb69974e27" }, "Version": "v0.0.20", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/microcosm-cc/bluemonday@v1.0.26", "Name": "github.com/microcosm-cc/bluemonday", "Identifier": { "PURL": "pkg:golang/github.com/microcosm-cc/bluemonday@v1.0.26", "UID": "6bd9d3abe1850ce5" }, "Version": "v1.0.26", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mitchellh/mapstructure@v1.5.0", "Name": "github.com/mitchellh/mapstructure", "Identifier": { "PURL": "pkg:golang/github.com/mitchellh/mapstructure@v1.5.0", "UID": "987125d57d3d15d6" }, "Version": "v1.5.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mrjones/oauth@v0.0.0-20190623134757-126b35219450", "Name": "github.com/mrjones/oauth", "Identifier": { "PURL": "pkg:golang/github.com/mrjones/oauth@v0.0.0-20190623134757-126b35219450", "UID": "6b5b2ecb5d77922c" }, "Version": "v0.0.0-20190623134757-126b35219450", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/patrickmn/go-cache@v2.1.0+incompatible", "Name": "github.com/patrickmn/go-cache", "Identifier": { "PURL": "pkg:golang/github.com/patrickmn/go-cache@v2.1.0%2Bincompatible", "UID": "e22a7a6f5f6a38fa" }, "Version": "v2.1.0+incompatible", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/philhofer/fwd@v1.2.0", "Name": "github.com/philhofer/fwd", "Identifier": { "PURL": "pkg:golang/github.com/philhofer/fwd@v1.2.0", "UID": "cbae1639d0b254bd" }, "Version": "v1.2.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/pkg/errors@v0.9.1", "Name": "github.com/pkg/errors", "Identifier": { "PURL": "pkg:golang/github.com/pkg/errors@v0.9.1", "UID": "4a2d53650e475b1a" }, "Version": "v0.9.1", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/pquerna/otp@v1.4.0", "Name": "github.com/pquerna/otp", "Identifier": { "PURL": "pkg:golang/github.com/pquerna/otp@v1.4.0", "UID": "d39f91363868a68" }, "Version": "v1.4.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/client_golang@v1.19.0", "Name": "github.com/prometheus/client_golang", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/client_golang@v1.19.0", "UID": "410a578f930230fe" }, "Version": "v1.19.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/client_model@v0.6.1", "Name": "github.com/prometheus/client_model", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/client_model@v0.6.1", "UID": "37d1e02503b525fa" }, "Version": "v0.6.1", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/common@v0.48.0", "Name": "github.com/prometheus/common", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/common@v0.48.0", "UID": "3a35a82f6ec079b1" }, "Version": "v0.48.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/procfs@v0.12.0", "Name": "github.com/prometheus/procfs", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/procfs@v0.12.0", "UID": "c86aadc8ece424fb" }, "Version": "v0.12.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/rogpeppe/go-internal@v1.14.1", "Name": "github.com/rogpeppe/go-internal", "Identifier": { "PURL": "pkg:golang/github.com/rogpeppe/go-internal@v1.14.1", "UID": "7f418134a20adda9" }, "Version": "v1.14.1", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/rs/cors@v1.11.0", "Name": "github.com/rs/cors", "Identifier": { "PURL": "pkg:golang/github.com/rs/cors@v1.11.0", "UID": "efeaf881395f502d" }, "Version": "v1.11.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/russellhaering/goxmldsig@v1.6.0", "Name": "github.com/russellhaering/goxmldsig", "Identifier": { "PURL": "pkg:golang/github.com/russellhaering/goxmldsig@v1.6.0", "UID": "d2b98431b5e4f1a4" }, "Version": "v1.6.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sebest/xff@v0.0.0-20160910043805-6c115e0ffa35", "Name": "github.com/sebest/xff", "Identifier": { "PURL": "pkg:golang/github.com/sebest/xff@v0.0.0-20160910043805-6c115e0ffa35", "UID": "bfb162eaef62c60f" }, "Version": "v0.0.0-20160910043805-6c115e0ffa35", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sergi/go-diff@v1.2.0", "Name": "github.com/sergi/go-diff", "Identifier": { "PURL": "pkg:golang/github.com/sergi/go-diff@v1.2.0", "UID": "5f91be40c7200167" }, "Version": "v1.2.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sethvargo/go-password@v0.2.0", "Name": "github.com/sethvargo/go-password", "Identifier": { "PURL": "pkg:golang/github.com/sethvargo/go-password@v0.2.0", "UID": "7dd89347c8e9a9c1" }, "Version": "v0.2.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sirupsen/logrus@v1.9.3", "Name": "github.com/sirupsen/logrus", "Identifier": { "PURL": "pkg:golang/github.com/sirupsen/logrus@v1.9.3", "UID": "108539794e3eba90" }, "Version": "v1.9.3", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sourcegraph/annotate@v0.0.0-20160123013949-f4cad6c6324d", "Name": "github.com/sourcegraph/annotate", "Identifier": { "PURL": "pkg:golang/github.com/sourcegraph/annotate@v0.0.0-20160123013949-f4cad6c6324d", "UID": "250eac5bfc3cb5c3" }, "Version": "v0.0.0-20160123013949-f4cad6c6324d", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sourcegraph/syntaxhighlight@v0.0.0-20170531221838-bd320f5d308e", "Name": "github.com/sourcegraph/syntaxhighlight", "Identifier": { "PURL": "pkg:golang/github.com/sourcegraph/syntaxhighlight@v0.0.0-20170531221838-bd320f5d308e", "UID": "1eb14bfd75353e24" }, "Version": "v0.0.0-20170531221838-bd320f5d308e", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/spf13/cobra@v1.8.1", "Name": "github.com/spf13/cobra", "Identifier": { "PURL": "pkg:golang/github.com/spf13/cobra@v1.8.1", "UID": "2c032d5f5a9ac4dd" }, "Version": "v1.8.1", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/spf13/pflag@v1.0.6", "Name": "github.com/spf13/pflag", "Identifier": { "PURL": "pkg:golang/github.com/spf13/pflag@v1.0.6", "UID": "9a6a71ecc820b0e" }, "Version": "v1.0.6", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/standard-webhooks/standard-webhooks/libraries@v0.0.0-20240303152453-e0e82adf1721", "Name": "github.com/standard-webhooks/standard-webhooks/libraries", "Identifier": { "PURL": "pkg:golang/github.com/standard-webhooks/standard-webhooks/libraries@v0.0.0-20240303152453-e0e82adf1721", "UID": "ea646a3fa33977be" }, "Version": "v0.0.0-20240303152453-e0e82adf1721", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/supabase/hibp@v0.0.0-20231124125943-d225752ae869", "Name": "github.com/supabase/hibp", "Identifier": { "PURL": "pkg:golang/github.com/supabase/hibp@v0.0.0-20231124125943-d225752ae869", "UID": "a531fc44d1f932bc" }, "Version": "v0.0.0-20231124125943-d225752ae869", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/tinylib/msgp@v1.6.4", "Name": "github.com/tinylib/msgp", "Identifier": { "PURL": "pkg:golang/github.com/tinylib/msgp@v1.6.4", "UID": "a361793d059e68e8" }, "Version": "v1.6.4", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/x448/float16@v0.8.4", "Name": "github.com/x448/float16", "Identifier": { "PURL": "pkg:golang/github.com/x448/float16@v0.8.4", "UID": "9595d907fda882" }, "Version": "v0.8.4", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/xeipuuv/gojsonpointer@v0.0.0-20180127040702-4e3ac2762d5f", "Name": "github.com/xeipuuv/gojsonpointer", "Identifier": { "PURL": "pkg:golang/github.com/xeipuuv/gojsonpointer@v0.0.0-20180127040702-4e3ac2762d5f", "UID": "156f1e800fd58f90" }, "Version": "v0.0.0-20180127040702-4e3ac2762d5f", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/xeipuuv/gojsonreference@v0.0.0-20180127040603-bd5ef7bd5415", "Name": "github.com/xeipuuv/gojsonreference", "Identifier": { "PURL": "pkg:golang/github.com/xeipuuv/gojsonreference@v0.0.0-20180127040603-bd5ef7bd5415", "UID": "bb2ac67266ef57fb" }, "Version": "v0.0.0-20180127040603-bd5ef7bd5415", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/xeipuuv/gojsonschema@v1.2.0", "Name": "github.com/xeipuuv/gojsonschema", "Identifier": { "PURL": "pkg:golang/github.com/xeipuuv/gojsonschema@v1.2.0", "UID": "6ddb8e6ff1b2330" }, "Version": "v1.2.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/auto/sdk@v1.2.1", "Name": "go.opentelemetry.io/auto/sdk", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", "UID": "74eafb501d791904" }, "Version": "v1.2.1", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.64.0", "Name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.64.0", "UID": "9b31b4fca1e7ae9d" }, "Version": "v0.64.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/contrib/instrumentation/runtime@v0.45.0", "Name": "go.opentelemetry.io/contrib/instrumentation/runtime", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/runtime@v0.45.0", "UID": "33ce81852e2ee5e3" }, "Version": "v0.45.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel@v1.40.0", "Name": "go.opentelemetry.io/otel", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel@v1.40.0", "UID": "e712c274aa2b94fc" }, "Version": "v1.40.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc@v1.26.0", "Name": "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc@v1.26.0", "UID": "71198b5cc811cfd6" }, "Version": "v1.26.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.26.0", "Name": "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.26.0", "UID": "91802109b360e8bb" }, "Version": "v1.26.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.40.0", "Name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.40.0", "UID": "b3685e5d54a67d6b" }, "Version": "v1.40.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.40.0", "Name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.40.0", "UID": "6d1e453e37388dbf" }, "Version": "v1.40.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.40.0", "Name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.40.0", "UID": "ae16bd0d9dc43c54" }, "Version": "v1.40.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/exporters/prometheus@v0.48.0", "Name": "go.opentelemetry.io/otel/exporters/prometheus", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/exporters/prometheus@v0.48.0", "UID": "6fd2641834ad7869" }, "Version": "v0.48.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/metric@v1.40.0", "Name": "go.opentelemetry.io/otel/metric", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/metric@v1.40.0", "UID": "6b75e8d0d4e84ce8" }, "Version": "v1.40.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/sdk@v1.40.0", "Name": "go.opentelemetry.io/otel/sdk", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/sdk@v1.40.0", "UID": "e6f4b59255844f2f" }, "Version": "v1.40.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/sdk/metric@v1.40.0", "Name": "go.opentelemetry.io/otel/sdk/metric", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/sdk/metric@v1.40.0", "UID": "b18c339c27d2e19f" }, "Version": "v1.40.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/trace@v1.40.0", "Name": "go.opentelemetry.io/otel/trace", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/trace@v1.40.0", "UID": "47bbadcef76c6470" }, "Version": "v1.40.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/proto/otlp@v1.9.0", "Name": "go.opentelemetry.io/proto/otlp", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/proto/otlp@v1.9.0", "UID": "b08cefebed9761c0" }, "Version": "v1.9.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/crypto@v0.50.0", "Name": "golang.org/x/crypto", "Identifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.50.0", "UID": "830563ac48045270" }, "Version": "v0.50.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/exp@v0.0.0-20230811145659-89c5cff77bcb", "Name": "golang.org/x/exp", "Identifier": { "PURL": "pkg:golang/golang.org/x/exp@v0.0.0-20230811145659-89c5cff77bcb", "UID": "e08c16b17f858b4c" }, "Version": "v0.0.0-20230811145659-89c5cff77bcb", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/mod@v0.34.0", "Name": "golang.org/x/mod", "Identifier": { "PURL": "pkg:golang/golang.org/x/mod@v0.34.0", "UID": "8ca97aa0a2215ca6" }, "Version": "v0.34.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/net@v0.52.0", "Name": "golang.org/x/net", "Identifier": { "PURL": "pkg:golang/golang.org/x/net@v0.52.0", "UID": "95b58d1978f45fad" }, "Version": "v0.52.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/oauth2@v0.34.0", "Name": "golang.org/x/oauth2", "Identifier": { "PURL": "pkg:golang/golang.org/x/oauth2@v0.34.0", "UID": "661ce24defae1109" }, "Version": "v0.34.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/sync@v0.20.0", "Name": "golang.org/x/sync", "Identifier": { "PURL": "pkg:golang/golang.org/x/sync@v0.20.0", "UID": "697de9e7b3a659e8" }, "Version": "v0.20.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/sys@v0.43.0", "Name": "golang.org/x/sys", "Identifier": { "PURL": "pkg:golang/golang.org/x/sys@v0.43.0", "UID": "2d219fd227d253ae" }, "Version": "v0.43.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/text@v0.36.0", "Name": "golang.org/x/text", "Identifier": { "PURL": "pkg:golang/golang.org/x/text@v0.36.0", "UID": "411c2d918b792182" }, "Version": "v0.36.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/time@v0.9.0", "Name": "golang.org/x/time", "Identifier": { "PURL": "pkg:golang/golang.org/x/time@v0.9.0", "UID": "834f3503c6d90efe" }, "Version": "v0.9.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/genproto/googleapis/api@v0.0.0-20260128011058-8636f8732409", "Name": "google.golang.org/genproto/googleapis/api", "Identifier": { "PURL": "pkg:golang/google.golang.org/genproto/googleapis/api@v0.0.0-20260128011058-8636f8732409", "UID": "b937671ed895fde4" }, "Version": "v0.0.0-20260128011058-8636f8732409", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/genproto/googleapis/rpc@v0.0.0-20260128011058-8636f8732409", "Name": "google.golang.org/genproto/googleapis/rpc", "Identifier": { "PURL": "pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20260128011058-8636f8732409", "UID": "162d0b9839d7dee6" }, "Version": "v0.0.0-20260128011058-8636f8732409", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/grpc@v1.78.0", "Name": "google.golang.org/grpc", "Identifier": { "PURL": "pkg:golang/google.golang.org/grpc@v1.78.0", "UID": "19710d7bc0aab5e1" }, "Version": "v1.78.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/protobuf@v1.36.11", "Name": "google.golang.org/protobuf", "Identifier": { "PURL": "pkg:golang/google.golang.org/protobuf@v1.36.11", "UID": "6e4405f83f2d6a40" }, "Version": "v1.36.11", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "gopkg.in/gomail.v2@v2.0.0-20160411212932-81ebce5c23df", "Name": "gopkg.in/gomail.v2", "Identifier": { "PURL": "pkg:golang/gopkg.in/gomail.v2@v2.0.0-20160411212932-81ebce5c23df", "UID": "f5067545a7e4283" }, "Version": "v2.0.0-20160411212932-81ebce5c23df", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" }, { "ID": "gopkg.in/yaml.v2@v2.4.0", "Name": "gopkg.in/yaml.v2", "Identifier": { "PURL": "pkg:golang/gopkg.in/yaml.v2@v2.4.0", "UID": "ff40796a9f18ea44" }, "Version": "v2.4.0", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "AnalyzedBy": "gobinary" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2026-116587", "VendorIDs": [ "GHSA-mgcc-cww5-fp2q" ], "PkgID": "github.com/go-jose/go-jose/v3@v3.0.4", "PkgName": "github.com/go-jose/go-jose/v3", "PkgIdentifier": { "PURL": "pkg:golang/github.com/go-jose/go-jose/v3@v3.0.4", "UID": "7cd8c1ab3ce2b4eb" }, "InstalledVersion": "v3.0.4", "Status": "affected", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-116587", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:982fc555f6db18ccb37b834219571c8fedc0c5998537c8fcd52a54083c09a01a", "Title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "Description": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from JWKs without enforcing size and consistency bounds before passing them to crypto/rsa.PrivateKey.Validate. On Go 1.24 and later, crafted large or degenerate RSA parameters can make that validation consume cubic CPU time, allowing remote denial of service in applications that parse JWKs from untrusted sources. This issue is fixed in version 4.1.6.", "Severity": "HIGH", "CweIDs": [ "CWE-407", "CWE-770" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-116587", "https://github.com/go-jose/go-jose", "https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230", "https://github.com/go-jose/go-jose/releases/tag/v4.1.6", "https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q", "https://nvd.nist.gov/vuln/detail/CVE-2026-116587", "https://www.cve.org/CVERecord?id=CVE-2026-116587" ], "PublishedDate": "2026-10-26T22:16:55.193Z", "LastModifiedDate": "2026-10-27T15:16:40.99Z" }, { "VulnerabilityID": "CVE-2026-34986", "VendorIDs": [ "GHSA-78h2-9frx-2jm8" ], "PkgID": "github.com/go-jose/go-jose/v3@v3.0.4", "PkgName": "github.com/go-jose/go-jose/v3", "PkgIdentifier": { "PURL": "pkg:golang/github.com/go-jose/go-jose/v3@v3.0.4", "UID": "7cd8c1ab3ce2b4eb" }, "InstalledVersion": "v3.0.4", "FixedVersion": "3.0.5", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-34986", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:d36e39ebbc33f06d0899c4bc7b7b3be87712e9276ef28ccf0f46781bc05fba15", "Title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object", "Description": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed in 4.1.4 and 3.0.5.", "Severity": "HIGH", "CweIDs": [ "CWE-248", "CWE-131" ], "VendorSeverity": { "alma": 3, "amazon": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10125", "https://access.redhat.com/errata/RHSA-2026:10130", "https://access.redhat.com/errata/RHSA-2026:10135", "https://access.redhat.com/errata/RHSA-2026:10175", "https://access.redhat.com/errata/RHSA-2026:11070", "https://access.redhat.com/errata/RHSA-2026:11217", "https://access.redhat.com/errata/RHSA-2026:11512", "https://access.redhat.com/errata/RHSA-2026:11688", "https://access.redhat.com/errata/RHSA-2026:11856", "https://access.redhat.com/errata/RHSA-2026:11916", "https://access.redhat.com/errata/RHSA-2026:11996", "https://access.redhat.com/errata/RHSA-2026:12116", "https://access.redhat.com/errata/RHSA-2026:12277", "https://access.redhat.com/errata/RHSA-2026:12279", "https://access.redhat.com/errata/RHSA-2026:13791", "https://access.redhat.com/errata/RHSA-2026:13829", "https://access.redhat.com/errata/RHSA-2026:16696", "https://access.redhat.com/errata/RHSA-2026:17040", "https://access.redhat.com/errata/RHSA-2026:17121", "https://access.redhat.com/errata/RHSA-2026:17123", "https://access.redhat.com/errata/RHSA-2026:17287", "https://access.redhat.com/errata/RHSA-2026:17448", "https://access.redhat.com/errata/RHSA-2026:17458", "https://access.redhat.com/errata/RHSA-2026:17459", "https://access.redhat.com/errata/RHSA-2026:17468", "https://access.redhat.com/errata/RHSA-2026:17474", "https://access.redhat.com/errata/RHSA-2026:17547", "https://access.redhat.com/errata/RHSA-2026:17550", "https://access.redhat.com/errata/RHSA-2026:17598", "https://access.redhat.com/errata/RHSA-2026:17789", "https://access.redhat.com/errata/RHSA-2026:18584", "https://access.redhat.com/errata/RHSA-2026:18585", "https://access.redhat.com/errata/RHSA-2026:19017", "https://access.redhat.com/errata/RHSA-2026:19099", "https://access.redhat.com/errata/RHSA-2026:19108", "https://access.redhat.com/errata/RHSA-2026:19135", "https://access.redhat.com/errata/RHSA-2026:19173", "https://access.redhat.com/errata/RHSA-2026:19186", "https://access.redhat.com/errata/RHSA-2026:19353", "https://access.redhat.com/errata/RHSA-2026:19375", "https://access.redhat.com/errata/RHSA-2026:19712", "https://access.redhat.com/errata/RHSA-2026:19719", "https://access.redhat.com/errata/RHSA-2026:19720", "https://access.redhat.com/errata/RHSA-2026:19721", "https://access.redhat.com/errata/RHSA-2026:20034", "https://access.redhat.com/errata/RHSA-2026:20041", "https://access.redhat.com/errata/RHSA-2026:20569", "https://access.redhat.com/errata/RHSA-2026:20607", "https://access.redhat.com/errata/RHSA-2026:20609", "https://access.redhat.com/errata/RHSA-2026:20946", "https://access.redhat.com/errata/RHSA-2026:21017", "https://access.redhat.com/errata/RHSA-2026:21703", "https://access.redhat.com/errata/RHSA-2026:21709", "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:21931", "https://access.redhat.com/errata/RHSA-2026:21932", "https://access.redhat.com/errata/RHSA-2026:22258", "https://access.redhat.com/errata/RHSA-2026:22260", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:22423", "https://access.redhat.com/errata/RHSA-2026:22450", "https://access.redhat.com/errata/RHSA-2026:22465", "https://access.redhat.com/errata/RHSA-2026:22629", "https://access.redhat.com/errata/RHSA-2026:22714", "https://access.redhat.com/errata/RHSA-2026:22840", "https://access.redhat.com/errata/RHSA-2026:22937", "https://access.redhat.com/errata/RHSA-2026:23228", "https://access.redhat.com/errata/RHSA-2026:23241", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/errata/RHSA-2026:23361", "https://access.redhat.com/errata/RHSA-2026:24471", "https://access.redhat.com/errata/RHSA-2026:24475", "https://access.redhat.com/errata/RHSA-2026:24477", "https://access.redhat.com/errata/RHSA-2026:24479", "https://access.redhat.com/errata/RHSA-2026:24482", "https://access.redhat.com/errata/RHSA-2026:24484", "https://access.redhat.com/errata/RHSA-2026:24853", "https://access.redhat.com/errata/RHSA-2026:24977", "https://access.redhat.com/errata/RHSA-2026:25127", "https://access.redhat.com/errata/RHSA-2026:25187", "https://access.redhat.com/errata/RHSA-2026:25194", "https://access.redhat.com/errata/RHSA-2026:25206", "https://access.redhat.com/errata/RHSA-2026:25248", "https://access.redhat.com/errata/RHSA-2026:25250", "https://access.redhat.com/errata/RHSA-2026:25252", "https://access.redhat.com/errata/RHSA-2026:26054", "https://access.redhat.com/errata/RHSA-2026:26568", "https://access.redhat.com/errata/RHSA-2026:26585", "https://access.redhat.com/errata/RHSA-2026:26636", "https://access.redhat.com/errata/RHSA-2026:27001", "https://access.redhat.com/errata/RHSA-2026:27004", "https://access.redhat.com/errata/RHSA-2026:27044", "https://access.redhat.com/errata/RHSA-2026:27063", "https://access.redhat.com/errata/RHSA-2026:27856", "https://access.redhat.com/errata/RHSA-2026:28198", "https://access.redhat.com/errata/RHSA-2026:29854", "https://access.redhat.com/errata/RHSA-2026:30650", "https://access.redhat.com/errata/RHSA-2026:32991", "https://access.redhat.com/errata/RHSA-2026:33722", "https://access.redhat.com/errata/RHSA-2026:34099", "https://access.redhat.com/errata/RHSA-2026:34192", "https://access.redhat.com/errata/RHSA-2026:34196", "https://access.redhat.com/errata/RHSA-2026:34197", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:34794", "https://access.redhat.com/errata/RHSA-2026:35833", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:40984", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:41941", "https://access.redhat.com/errata/RHSA-2026:41944", "https://access.redhat.com/errata/RHSA-2026:44267", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:48085", "https://access.redhat.com/errata/RHSA-2026:48676", "https://access.redhat.com/errata/RHSA-2026:48790", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:56366", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:56968", "https://access.redhat.com/errata/RHSA-2026:57013", "https://access.redhat.com/errata/RHSA-2026:57408", "https://access.redhat.com/errata/RHSA-2026:57487", "https://access.redhat.com/errata/RHSA-2026:57590", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60444", "https://access.redhat.com/errata/RHSA-2026:60449", "https://access.redhat.com/errata/RHSA-2026:60452", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:62548", "https://access.redhat.com/errata/RHSA-2026:62550", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65906", "https://access.redhat.com/errata/RHSA-2026:66385", "https://access.redhat.com/errata/RHSA-2026:8490", "https://access.redhat.com/errata/RHSA-2026:8491", "https://access.redhat.com/errata/RHSA-2026:8493", "https://access.redhat.com/errata/RHSA-2026:9385", "https://access.redhat.com/errata/RHSA-2026:9388", "https://access.redhat.com/errata/RHSA-2026:9448", "https://access.redhat.com/errata/RHSA-2026:9453", "https://access.redhat.com/security/cve/CVE-2026-34986", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/2449833", "https://bugzilla.redhat.com/2455470", "https://bugzilla.redhat.com/2456333", "https://bugzilla.redhat.com/2456335", "https://bugzilla.redhat.com/2456336", "https://bugzilla.redhat.com/2456338", "https://bugzilla.redhat.com/2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2434432", "https://bugzilla.redhat.com/show_bug.cgi?id=2437111", "https://bugzilla.redhat.com/show_bug.cgi?id=2445345", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2449833", "https://bugzilla.redhat.com/show_bug.cgi?id=2455470", "https://bugzilla.redhat.com/show_bug.cgi?id=2456336", "https://bugzilla.redhat.com/show_bug.cgi?id=2456338", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27137", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33186", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34986", "https://errata.almalinux.org/9/ALSA-2026-19353.html", "https://errata.rockylinux.org/RLSA-2026:23228", "https://github.com/go-jose/go-jose", "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8", "https://linux.oracle.com/cve/CVE-2026-34986.html", "https://linux.oracle.com/errata/ELSA-2026-48790.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-34986", "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34986.json", "https://www.cve.org/CVERecord?id=CVE-2026-34986" ], "PublishedDate": "2026-04-06T17:17:11.87Z", "LastModifiedDate": "2026-10-23T23:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-32286", "VendorIDs": [ "GHSA-jqcq-xjh3-6g23" ], "PkgID": "github.com/jackc/pgproto3/v2@v2.3.3", "PkgName": "github.com/jackc/pgproto3/v2", "PkgIdentifier": { "PURL": "pkg:golang/github.com/jackc/pgproto3/v2@v2.3.3", "UID": "5d4f909e4ebb12f9" }, "InstalledVersion": "v2.3.3", "Status": "affected", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32286", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:d5152f669e81b997625f73a9179b3d3c078d8732d0c4c47584886905dc9a9444", "Title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server", "Description": "The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.", "Severity": "HIGH", "CweIDs": [ "CWE-129", "CWE-1285" ], "VendorSeverity": { "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:11070", "https://access.redhat.com/errata/RHSA-2026:11217", "https://access.redhat.com/errata/RHSA-2026:11856", "https://access.redhat.com/errata/RHSA-2026:11916", "https://access.redhat.com/errata/RHSA-2026:11996", "https://access.redhat.com/errata/RHSA-2026:19375", "https://access.redhat.com/errata/RHSA-2026:21017", "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:22423", "https://access.redhat.com/errata/RHSA-2026:22450", "https://access.redhat.com/errata/RHSA-2026:22465", "https://access.redhat.com/errata/RHSA-2026:22714", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/errata/RHSA-2026:24853", "https://access.redhat.com/security/cve/CVE-2026-32286", "https://bugzilla.redhat.com/show_bug.cgi?id=2434431", "https://bugzilla.redhat.com/show_bug.cgi?id=2434432", "https://bugzilla.redhat.com/show_bug.cgi?id=2437111", "https://bugzilla.redhat.com/show_bug.cgi?id=2445345", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2448626", "https://bugzilla.redhat.com/show_bug.cgi?id=2449833", "https://bugzilla.redhat.com/show_bug.cgi?id=2451847", "https://bugzilla.redhat.com/show_bug.cgi?id=2455470", "https://bugzilla.redhat.com/show_bug.cgi?id=2456336", "https://bugzilla.redhat.com/show_bug.cgi?id=2456338", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61728", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27137", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32286", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33186", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34986", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4427", "https://errata.rockylinux.org/RLSA-2026:22714", "https://github.com/advisories/GHSA-jqcq-xjh3-6g23", "https://github.com/golang/vulndb/issues/4518", "https://github.com/jackc/pgproto3", "https://github.com/jackc/pgx/issues/2507", "https://linux.oracle.com/cve/CVE-2026-32286.html", "https://linux.oracle.com/errata/ELSA-2026-22714.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-32286", "https://pkg.go.dev/vuln/GO-2026-4518", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32286.json", "https://securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx", "https://www.cve.org/CVERecord?id=CVE-2026-32286" ], "PublishedDate": "2026-03-26T20:16:12.303Z", "LastModifiedDate": "2026-09-10T13:18:08.907Z" }, { "VulnerabilityID": "CVE-2026-29181", "VendorIDs": [ "GHSA-mh2q-q3fh-2475" ], "PkgID": "go.opentelemetry.io/otel@v1.40.0", "PkgName": "go.opentelemetry.io/otel", "PkgIdentifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel@v1.40.0", "UID": "e712c274aa2b94fc" }, "InstalledVersion": "v1.40.0", "FixedVersion": "1.41.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-29181", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:b1103c61f114d746732e1b9acb35130b8ecd23417a39da8bf479d91c4507af8d", "Title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Denial of Service via crafted multi-value baggage headers", "Description": "OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. This allows an attacker to amplify cpu and allocations by sending many baggage: header lines, even when each individual value is within the 8192-byte per-value parse limit. This vulnerability is fixed in 1.41.0.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "azure": 2, "ghsa": 3, "photon": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25271", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:63140", "https://access.redhat.com/errata/RHSA-2026:66521", "https://access.redhat.com/security/cve/CVE-2026-29181", "https://bugzilla.redhat.com/show_bug.cgi?id=2456252", "https://github.com/open-telemetry/opentelemetry-go", "https://github.com/open-telemetry/opentelemetry-go/commit/aa1894e09e3fe66860c7885cb40f98901b35277f", "https://github.com/open-telemetry/opentelemetry-go/pull/7880", "https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.41.0", "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475", "https://nvd.nist.gov/vuln/detail/CVE-2026-29181", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29181.json", "https://www.cve.org/CVERecord?id=CVE-2026-29181" ], "PublishedDate": "2026-04-07T21:17:16.003Z", "LastModifiedDate": "2026-09-11T13:17:25.487Z" }, { "VulnerabilityID": "CVE-2026-39883", "VendorIDs": [ "GHSA-hfvc-g4fc-pqhx" ], "PkgID": "go.opentelemetry.io/otel/sdk@v1.40.0", "PkgName": "go.opentelemetry.io/otel/sdk", "PkgIdentifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/sdk@v1.40.0", "UID": "e6f4b59255844f2f" }, "InstalledVersion": "v1.40.0", "FixedVersion": "1.43.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39883", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:4a42f594c7625b6537070395e445ad930d09acfb176910a05f3bf01ab851e1bc", "Title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Arbitrary code execution via PATH hijacking on BSD/Solaris", "Description": "OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. This vulnerability is fixed in 1.43.0.", "Severity": "HIGH", "CweIDs": [ "CWE-426" ], "VendorSeverity": { "ghsa": 3, "nvd": 3, "photon": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.3 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "http://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0", "https://access.redhat.com/errata/RHSA-2026:26254", "https://access.redhat.com/errata/RHSA-2026:26257", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:63140", "https://access.redhat.com/security/cve/CVE-2026-39883", "https://bugzilla.redhat.com/show_bug.cgi?id=2456718", "https://github.com/open-telemetry/opentelemetry-go", "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hfvc-g4fc-pqhx", "https://nvd.nist.gov/vuln/detail/CVE-2026-39883", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39883.json", "https://www.cve.org/CVERecord?id=CVE-2026-39883" ], "PublishedDate": "2026-04-08T21:17:00.697Z", "LastModifiedDate": "2026-09-09T13:19:48.837Z" }, { "VulnerabilityID": "CVE-2026-39828", "VendorIDs": [ "GO-2026-5014" ], "PkgID": "golang.org/x/crypto@v0.50.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.50.0", "UID": "830563ac48045270" }, "InstalledVersion": "v0.50.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39828", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:a23066c699887d5bdbd5088dbf64ac0d9f3706601528f0de963e6f841a1a00bb", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions", "Description": "When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.", "Severity": "HIGH", "CweIDs": [ "CWE-295", "CWE-281" ], "VendorSeverity": { "amazon": 2, "azure": 2, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:36105", "https://access.redhat.com/errata/RHSA-2026:36167", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:37268", "https://access.redhat.com/errata/RHSA-2026:37271", "https://access.redhat.com/errata/RHSA-2026:37272", "https://access.redhat.com/errata/RHSA-2026:37278", "https://access.redhat.com/errata/RHSA-2026:37286", "https://access.redhat.com/errata/RHSA-2026:37296", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:40969", "https://access.redhat.com/errata/RHSA-2026:40972", "https://access.redhat.com/errata/RHSA-2026:40974", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:46903", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51038", "https://access.redhat.com/errata/RHSA-2026:52857", "https://access.redhat.com/errata/RHSA-2026:52910", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66521", "https://access.redhat.com/security/cve/CVE-2026-39828", "https://bugzilla.redhat.com/show_bug.cgi?id=2480687", "https://go.dev/cl/781621", "https://go.dev/issue/79562", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://nvd.nist.gov/vuln/detail/CVE-2026-39828", "https://pkg.go.dev/vuln/GO-2026-5014", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39828.json", "https://www.cve.org/CVERecord?id=CVE-2026-39828" ], "PublishedDate": "2026-05-22T04:16:22.19Z", "LastModifiedDate": "2026-09-11T13:17:51.26Z" }, { "VulnerabilityID": "CVE-2026-39829", "VendorIDs": [ "GO-2026-5018" ], "PkgID": "golang.org/x/crypto@v0.50.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.50.0", "UID": "830563ac48045270" }, "InstalledVersion": "v0.50.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39829", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:7986bd974683699e8bfa16108d53a24ea0d825d4fe7f2a676758fae1b5a7d83c", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters", "Description": "The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.", "Severity": "HIGH", "CweIDs": [ "CWE-347", "CWE-1284" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:35833", "https://access.redhat.com/errata/RHSA-2026:36199", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:36883", "https://access.redhat.com/errata/RHSA-2026:37072", "https://access.redhat.com/errata/RHSA-2026:37123", "https://access.redhat.com/errata/RHSA-2026:37268", "https://access.redhat.com/errata/RHSA-2026:37271", "https://access.redhat.com/errata/RHSA-2026:37272", "https://access.redhat.com/errata/RHSA-2026:37278", "https://access.redhat.com/errata/RHSA-2026:37286", "https://access.redhat.com/errata/RHSA-2026:37296", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:40969", "https://access.redhat.com/errata/RHSA-2026:40972", "https://access.redhat.com/errata/RHSA-2026:40974", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:46903", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47949", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:48693", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:52857", "https://access.redhat.com/errata/RHSA-2026:52910", "https://access.redhat.com/errata/RHSA-2026:54400", "https://access.redhat.com/errata/RHSA-2026:54432", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57365", "https://access.redhat.com/errata/RHSA-2026:57801", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:59593", "https://access.redhat.com/errata/RHSA-2026:60446", "https://access.redhat.com/errata/RHSA-2026:60454", "https://access.redhat.com/errata/RHSA-2026:60477", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65964", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:67450", "https://access.redhat.com/security/cve/CVE-2026-39829", "https://bugzilla.redhat.com/2480680", "https://bugzilla.redhat.com/2480681", "https://bugzilla.redhat.com/2480685", "https://bugzilla.redhat.com/2480688", "https://bugzilla.redhat.com/2480757", "https://bugzilla.redhat.com/2480761", "https://bugzilla.redhat.com/2493620", "https://bugzilla.redhat.com/show_bug.cgi?id=2480680", "https://bugzilla.redhat.com/show_bug.cgi?id=2480681", "https://bugzilla.redhat.com/show_bug.cgi?id=2480685", "https://bugzilla.redhat.com/show_bug.cgi?id=2480688", "https://bugzilla.redhat.com/show_bug.cgi?id=2480757", "https://bugzilla.redhat.com/show_bug.cgi?id=2480761", "https://bugzilla.redhat.com/show_bug.cgi?id=2493620", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39835", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57231", "https://errata.almalinux.org/9/ALSA-2026-37123.html", "https://errata.rockylinux.org/RLSA-2026:37123", "https://go.dev/cl/781641", "https://go.dev/cl/781661", "https://go.dev/issue/79565", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://linux.oracle.com/cve/CVE-2026-39829.html", "https://linux.oracle.com/errata/ELSA-2026-37123.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39829", "https://pkg.go.dev/vuln/GO-2026-5018", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39829.json", "https://www.cve.org/CVERecord?id=CVE-2026-39829" ], "PublishedDate": "2026-05-22T04:16:22.31Z", "LastModifiedDate": "2026-09-16T13:17:52.28Z" }, { "VulnerabilityID": "CVE-2026-39830", "VendorIDs": [ "GO-2026-5017" ], "PkgID": "golang.org/x/crypto@v0.50.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.50.0", "UID": "830563ac48045270" }, "InstalledVersion": "v0.50.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39830", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:9c13eb5362ab5c9e3623f30626858875afb7ac1ec04721210ee8c5b8caaddb93", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses", "Description": "A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.", "Severity": "HIGH", "CweIDs": [ "CWE-119", "CWE-772" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:35833", "https://access.redhat.com/errata/RHSA-2026:36199", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:37072", "https://access.redhat.com/errata/RHSA-2026:37268", "https://access.redhat.com/errata/RHSA-2026:37271", "https://access.redhat.com/errata/RHSA-2026:37272", "https://access.redhat.com/errata/RHSA-2026:37275", "https://access.redhat.com/errata/RHSA-2026:37278", "https://access.redhat.com/errata/RHSA-2026:37286", "https://access.redhat.com/errata/RHSA-2026:37296", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:40969", "https://access.redhat.com/errata/RHSA-2026:40972", "https://access.redhat.com/errata/RHSA-2026:40974", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:52857", "https://access.redhat.com/errata/RHSA-2026:52910", "https://access.redhat.com/errata/RHSA-2026:54400", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57801", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:65964", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66521", "https://access.redhat.com/errata/RHSA-2026:67450", "https://access.redhat.com/errata/RHSA-2026:69961", "https://access.redhat.com/security/cve/CVE-2026-39830", "https://bugzilla.redhat.com/2480684", "https://bugzilla.redhat.com/2508234", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2480684", "https://bugzilla.redhat.com/show_bug.cgi?id=2508234", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2518147", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17106", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19730", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39830", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-69961.html", "https://errata.rockylinux.org/RLSA-2026:69961", "https://github.com/golang/crypto/commit/4e7a7384ecbc8d519f6f4c11b36fa9d761fc8946", "https://go.dev/cl/781640", "https://go.dev/cl/781664", "https://go.dev/issue/79564", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://linux.oracle.com/cve/CVE-2026-39830.html", "https://linux.oracle.com/errata/ELSA-2026-69961.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39830", "https://pkg.go.dev/vuln/GO-2026-5017", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json", "https://ubuntu.com/security/notices/USN-8447-1", "https://ubuntu.com/security/notices/USN-8447-2", "https://ubuntu.com/security/notices/USN-8447-3", "https://www.cve.org/CVERecord?id=CVE-2026-39830" ], "PublishedDate": "2026-05-22T04:16:22.44Z", "LastModifiedDate": "2026-09-16T13:17:53.697Z" }, { "VulnerabilityID": "CVE-2026-39831", "VendorIDs": [ "GO-2026-5019" ], "PkgID": "golang.org/x/crypto@v0.50.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.50.0", "UID": "830563ac48045270" }, "InstalledVersion": "v0.50.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39831", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:4bef49bcb7d264145ca9cde14160232c5416d7e9013b5c12ebf87e0603d02d65", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check", "Description": "The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.", "Severity": "HIGH", "CweIDs": [ "CWE-862" ], "VendorSeverity": { "amazon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-39831", "https://github.com/golang/crypto/commit/b61cf853a89d82cad68da5e12a6beca2116f8456", "https://go.dev/cl/781662", "https://go.dev/issue/79566", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://nvd.nist.gov/vuln/detail/CVE-2026-39831", "https://pkg.go.dev/vuln/GO-2026-5019", "https://ubuntu.com/security/notices/USN-8447-1", "https://ubuntu.com/security/notices/USN-8447-3", "https://www.cve.org/CVERecord?id=CVE-2026-39831" ], "PublishedDate": "2026-05-22T04:16:22.553Z", "LastModifiedDate": "2026-07-23T16:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-39832", "VendorIDs": [ "GHSA-f5wc-c3c7-36mc", "GO-2026-5006" ], "PkgID": "golang.org/x/crypto@v0.50.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.50.0", "UID": "830563ac48045270" }, "InstalledVersion": "v0.50.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39832", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:26b7d45647f27f1de4d1274b53b674b314bd87e968eccef408b669765ef4c8b6", "Title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions", "Description": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.", "Severity": "HIGH", "CweIDs": [ "CWE-502", "CWE-281" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "V3Score": 8.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:35833", "https://access.redhat.com/errata/RHSA-2026:36199", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:37072", "https://access.redhat.com/errata/RHSA-2026:37123", "https://access.redhat.com/errata/RHSA-2026:37271", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:37410", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:40972", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:52857", "https://access.redhat.com/errata/RHSA-2026:52910", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:59579", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:66521", "https://access.redhat.com/errata/RHSA-2026:67450", "https://access.redhat.com/security/cve/CVE-2026-39832", "https://bugzilla.redhat.com/2480680", "https://bugzilla.redhat.com/2480685", "https://bugzilla.redhat.com/show_bug.cgi?id=2480680", "https://bugzilla.redhat.com/show_bug.cgi?id=2480685", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39835", "https://errata.almalinux.org/9/ALSA-2026-37410.html", "https://errata.rockylinux.org/RLSA-2026:37410", "https://github.com/golang/crypto/commit/e3d1254f1e7e60baa086142c46174bf6d8d0fe50", "https://go.dev/cl/778640", "https://go.dev/cl/778641", "https://go.dev/cl/778642", "https://go.dev/issue/79435", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://linux.oracle.com/cve/CVE-2026-39832.html", "https://linux.oracle.com/errata/ELSA-2026-37410.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39832", "https://pkg.go.dev/vuln/GO-2026-5006", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39832.json", "https://ubuntu.com/security/notices/USN-8447-1", "https://www.cve.org/CVERecord?id=CVE-2026-39832" ], "PublishedDate": "2026-05-22T04:16:22.663Z", "LastModifiedDate": "2026-09-15T12:17:40.787Z" }, { "VulnerabilityID": "CVE-2026-39835", "VendorIDs": [ "GO-2026-5015" ], "PkgID": "golang.org/x/crypto@v0.50.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.50.0", "UID": "830563ac48045270" }, "InstalledVersion": "v0.50.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39835", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:436705a3511016a2bf646f71022ab268c03302a4b76da7264d811dd924e94af0", "Title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate", "Description": "SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.", "Severity": "HIGH", "CweIDs": [ "CWE-295", "CWE-476" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:36199", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:37072", "https://access.redhat.com/errata/RHSA-2026:37123", "https://access.redhat.com/errata/RHSA-2026:37268", "https://access.redhat.com/errata/RHSA-2026:37271", "https://access.redhat.com/errata/RHSA-2026:37272", "https://access.redhat.com/errata/RHSA-2026:37286", "https://access.redhat.com/errata/RHSA-2026:37296", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:37410", "https://access.redhat.com/errata/RHSA-2026:38504", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:40969", "https://access.redhat.com/errata/RHSA-2026:40972", "https://access.redhat.com/errata/RHSA-2026:40974", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47949", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51036", "https://access.redhat.com/errata/RHSA-2026:51038", "https://access.redhat.com/errata/RHSA-2026:52857", "https://access.redhat.com/errata/RHSA-2026:52910", "https://access.redhat.com/errata/RHSA-2026:54525", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59593", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66521", "https://access.redhat.com/security/cve/CVE-2026-39835", "https://bugzilla.redhat.com/2480680", "https://bugzilla.redhat.com/2480685", "https://bugzilla.redhat.com/show_bug.cgi?id=2480680", "https://bugzilla.redhat.com/show_bug.cgi?id=2480685", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39835", "https://errata.almalinux.org/9/ALSA-2026-37410.html", "https://errata.rockylinux.org/RLSA-2026:37410", "https://go.dev/cl/781660", "https://go.dev/issue/79563", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://linux.oracle.com/cve/CVE-2026-39835.html", "https://linux.oracle.com/errata/ELSA-2026-38504.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39835", "https://pkg.go.dev/vuln/GO-2026-5015", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39835.json", "https://www.cve.org/CVERecord?id=CVE-2026-39835" ], "PublishedDate": "2026-05-22T04:16:24.53Z", "LastModifiedDate": "2026-09-18T13:18:12.74Z" }, { "VulnerabilityID": "CVE-2026-42508", "VendorIDs": [ "GHSA-5cgq-3rg8-m6cv", "GO-2026-5021" ], "PkgID": "golang.org/x/crypto@v0.50.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.50.0", "UID": "830563ac48045270" }, "InstalledVersion": "v0.50.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42508", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:c3091e181712434d50c5e51fd9e66d74e5e07979b43d0135712eeb49d9ea7e60", "Title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey", "Description": "Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:35833", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:37072", "https://access.redhat.com/errata/RHSA-2026:37123", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41064", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:52857", "https://access.redhat.com/errata/RHSA-2026:52910", "https://access.redhat.com/errata/RHSA-2026:54400", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66521", "https://access.redhat.com/errata/RHSA-2026:67450", "https://access.redhat.com/security/cve/CVE-2026-42508", "https://bugzilla.redhat.com/2480680", "https://bugzilla.redhat.com/2480681", "https://bugzilla.redhat.com/2480685", "https://bugzilla.redhat.com/2480688", "https://bugzilla.redhat.com/2480757", "https://bugzilla.redhat.com/2480761", "https://bugzilla.redhat.com/2493620", "https://bugzilla.redhat.com/show_bug.cgi?id=2480680", "https://bugzilla.redhat.com/show_bug.cgi?id=2480681", "https://bugzilla.redhat.com/show_bug.cgi?id=2480685", "https://bugzilla.redhat.com/show_bug.cgi?id=2480688", "https://bugzilla.redhat.com/show_bug.cgi?id=2480757", "https://bugzilla.redhat.com/show_bug.cgi?id=2480761", "https://bugzilla.redhat.com/show_bug.cgi?id=2493620", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39835", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57231", "https://errata.almalinux.org/9/ALSA-2026-37123.html", "https://errata.rockylinux.org/RLSA-2026:37123", "https://github.com/golang/crypto/commit/f717e29698a271c548239ed56bf5dd9516d6f7e8", "https://go.dev/cl/781220", "https://go.dev/issue/79568", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://linux.oracle.com/cve/CVE-2026-42508.html", "https://linux.oracle.com/errata/ELSA-2026-37123.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42508", "https://pkg.go.dev/vuln/GO-2026-5021", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42508.json", "https://ubuntu.com/security/notices/USN-8447-1", "https://ubuntu.com/security/notices/USN-8447-2", "https://www.cve.org/CVERecord?id=CVE-2026-42508" ], "PublishedDate": "2026-05-22T04:16:25.44Z", "LastModifiedDate": "2026-09-15T12:17:45.777Z" }, { "VulnerabilityID": "CVE-2026-46595", "VendorIDs": [ "GO-2026-5023" ], "PkgID": "golang.org/x/crypto@v0.50.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.50.0", "UID": "830563ac48045270" }, "InstalledVersion": "v0.50.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46595", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:4923705c31cdb1ab346a935d1237864ca177819e4945fed83ac2f76962d9e063", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation", "Description": "Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.", "Severity": "HIGH", "CweIDs": [ "CWE-863", "CWE-303" ], "VendorSeverity": { "amazon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:30650", "https://access.redhat.com/errata/RHSA-2026:30651", "https://access.redhat.com/errata/RHSA-2026:33524", "https://access.redhat.com/errata/RHSA-2026:33531", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:37275", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59558", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66521", "https://access.redhat.com/security/cve/CVE-2026-46595", "https://bugzilla.redhat.com/show_bug.cgi?id=2480689", "https://github.com/golang/crypto/commit/533fb3f7e4a5ae23f69d1837cd851d35ff5b76ce", "https://go.dev/cl/781642", "https://go.dev/issue/79570", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://nvd.nist.gov/vuln/detail/CVE-2026-46595", "https://pkg.go.dev/vuln/GO-2026-5023", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46595.json", "https://ubuntu.com/security/notices/USN-8447-1", "https://ubuntu.com/security/notices/USN-8447-3", "https://www.cve.org/CVERecord?id=CVE-2026-46595" ], "PublishedDate": "2026-05-22T04:16:25.55Z", "LastModifiedDate": "2026-09-11T13:18:12.367Z" }, { "VulnerabilityID": "CVE-2026-46597", "VendorIDs": [ "GO-2026-5013" ], "PkgID": "golang.org/x/crypto@v0.50.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.50.0", "UID": "830563ac48045270" }, "InstalledVersion": "v0.50.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46597", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:fabfb5262c4d0a14bf387dbc65f55aa2fac044892159f21b4cd752a5b4249940", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs", "Description": "An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.", "Severity": "HIGH", "CweIDs": [ "CWE-704" ], "VendorSeverity": { "amazon": 2, "azure": 3, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46597", "https://go.dev/cl/781620", "https://go.dev/issue/79561", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://nvd.nist.gov/vuln/detail/CVE-2026-46597", "https://pkg.go.dev/vuln/GO-2026-5013", "https://www.cve.org/CVERecord?id=CVE-2026-46597" ], "PublishedDate": "2026-05-22T04:16:26.003Z", "LastModifiedDate": "2026-07-23T16:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-56854", "VendorIDs": [ "GO-2026-6303" ], "PkgID": "golang.org/x/crypto@v0.50.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.50.0", "UID": "830563ac48045270" }, "InstalledVersion": "v0.50.0", "FixedVersion": "0.55.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56854", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:666de7d1d58b282aa0bdfc95b5c8e59822e7a51016ec31ffb3be484e1235cd32", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions", "Description": "The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.", "Severity": "HIGH", "CweIDs": [ "CWE-863" ], "VendorSeverity": { "amazon": 3, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56854", "https://go.dev/cl/797040", "https://go.dev/issue/80213", "https://nvd.nist.gov/vuln/detail/CVE-2026-56854", "https://pkg.go.dev/vuln/GO-2026-6303", "https://www.cve.org/CVERecord?id=CVE-2026-56854" ], "PublishedDate": "2026-08-28T16:18:17.607Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56864", "VendorIDs": [ "GO-2026-6180" ], "PkgID": "golang.org/x/mod@v0.34.0", "PkgName": "golang.org/x/mod", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/mod@v0.34.0", "UID": "8ca97aa0a2215ca6" }, "InstalledVersion": "v0.34.0", "FixedVersion": "0.40.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56864", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:8aeb67e43fdfdaa250a3cc461174794b2540ab57fdb1e0b893dbc0591936f023", "Title": "golang.org/x/mod/sumdb: golang.org/x/mod/sumdb: Integrity bypass via malicious GOSUMDB", "Description": "A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy", "Severity": "HIGH", "CweIDs": [ "CWE-347" ], "VendorSeverity": { "amazon": 3, "bitnami": 3, "photon": 3, "redhat": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56864", "https://go.dev/cl/815000", "https://go.dev/cl/815020", "https://go.dev/issue/80745", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://nvd.nist.gov/vuln/detail/CVE-2026-56864", "https://pkg.go.dev/vuln/GO-2026-6180", "https://www.cve.org/CVERecord?id=CVE-2026-56864" ], "PublishedDate": "2026-08-13T22:17:22.677Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56865", "VendorIDs": [ "GO-2026-6179" ], "PkgID": "golang.org/x/mod@v0.34.0", "PkgName": "golang.org/x/mod", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/mod@v0.34.0", "UID": "8ca97aa0a2215ca6" }, "InstalledVersion": "v0.34.0", "FixedVersion": "0.40.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56865", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:bea3813503fc76bf34110e7e530194be72af7c5f8e5bc723503ad8a6facc50f0", "Title": "golang.org/x/mod/sumdb/tlog: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass", "Description": "A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy", "Severity": "HIGH", "CweIDs": [ "CWE-347" ], "VendorSeverity": { "amazon": 3, "azure": 3, "bitnami": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56865", "https://github.com/golang/go/issues/80744", "https://go.dev/cl/814960", "https://go.dev/cl/815020", "https://go.dev/issue/80744", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://nvd.nist.gov/vuln/detail/CVE-2026-56865", "https://pkg.go.dev/vuln/GO-2026-6179", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-56865" ], "PublishedDate": "2026-08-13T22:17:22.797Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-25681", "VendorIDs": [ "GO-2026-5029" ], "PkgID": "golang.org/x/net@v0.52.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.52.0", "UID": "95b58d1978f45fad" }, "InstalledVersion": "v0.52.0", "FixedVersion": "0.55.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-25681", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:809e212b195d230e5805c23f9d4fb9922ff9f164ffe1daa8a8ef807436a211ae", "Title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting", "Description": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "Severity": "HIGH", "CweIDs": [ "CWE-1021" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69293", "https://access.redhat.com/security/cve/CVE-2026-25681", "https://bugzilla.redhat.com/2480757", "https://bugzilla.redhat.com/2480761", "https://bugzilla.redhat.com/2480762", "https://bugzilla.redhat.com/2484830", "https://bugzilla.redhat.com/2493622", "https://bugzilla.redhat.com/show_bug.cgi?id=2480757", "https://bugzilla.redhat.com/show_bug.cgi?id=2480761", "https://bugzilla.redhat.com/show_bug.cgi?id=2480762", "https://bugzilla.redhat.com/show_bug.cgi?id=2484830", "https://bugzilla.redhat.com/show_bug.cgi?id=2493622", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41178", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42502", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55677", "https://errata.almalinux.org/9/ALSA-2026-69293.html", "https://errata.rockylinux.org/RLSA-2026:69293", "https://go.dev/cl/781703", "https://go.dev/issue/79574", "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "https://linux.oracle.com/cve/CVE-2026-25681.html", "https://linux.oracle.com/errata/ELSA-2026-69293.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-25681", "https://pkg.go.dev/vuln/GO-2026-5029", "https://www.cve.org/CVERecord?id=CVE-2026-25681" ], "PublishedDate": "2026-05-22T16:16:19.863Z", "LastModifiedDate": "2026-07-23T16:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-27136", "VendorIDs": [ "GO-2026-5030" ], "PkgID": "golang.org/x/net@v0.52.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.52.0", "UID": "95b58d1978f45fad" }, "InstalledVersion": "v0.52.0", "FixedVersion": "0.55.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27136", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:6d6f9beb39da1e3bdfbf136fd130fc418e3a948672a18620ec576deae32a4f34", "Title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass", "Description": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "Severity": "HIGH", "CweIDs": [ "CWE-1021" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69293", "https://access.redhat.com/security/cve/CVE-2026-27136", "https://bugzilla.redhat.com/2480757", "https://bugzilla.redhat.com/2480761", "https://bugzilla.redhat.com/2480762", "https://bugzilla.redhat.com/2484830", "https://bugzilla.redhat.com/2493622", "https://bugzilla.redhat.com/show_bug.cgi?id=2480757", "https://bugzilla.redhat.com/show_bug.cgi?id=2480761", "https://bugzilla.redhat.com/show_bug.cgi?id=2480762", "https://bugzilla.redhat.com/show_bug.cgi?id=2484830", "https://bugzilla.redhat.com/show_bug.cgi?id=2493622", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41178", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42502", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55677", "https://errata.almalinux.org/9/ALSA-2026-69293.html", "https://errata.rockylinux.org/RLSA-2026:69293", "https://go.dev/cl/781685", "https://go.dev/issue/79575", "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "https://linux.oracle.com/cve/CVE-2026-27136.html", "https://linux.oracle.com/errata/ELSA-2026-69293.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-27136", "https://pkg.go.dev/vuln/GO-2026-5030", "https://www.cve.org/CVERecord?id=CVE-2026-27136" ], "PublishedDate": "2026-05-22T16:16:20.087Z", "LastModifiedDate": "2026-07-23T16:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-33814", "VendorIDs": [ "GO-2026-4918" ], "PkgID": "golang.org/x/net@v0.52.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.52.0", "UID": "95b58d1978f45fad" }, "InstalledVersion": "v0.52.0", "FixedVersion": "0.53.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33814", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:d777be23ff8aae36d22be03c160b1e16f3a50ba6e2621da2b8fc15949d6aa5e7", "Title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame", "Description": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.", "Severity": "HIGH", "CweIDs": [ "CWE-835", "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57365", "https://access.redhat.com/errata/RHSA-2026:57367", "https://access.redhat.com/errata/RHSA-2026:57408", "https://access.redhat.com/errata/RHSA-2026:57545", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60441", "https://access.redhat.com/errata/RHSA-2026:60442", "https://access.redhat.com/errata/RHSA-2026:60446", "https://access.redhat.com/errata/RHSA-2026:60447", "https://access.redhat.com/errata/RHSA-2026:60454", "https://access.redhat.com/errata/RHSA-2026:60477", "https://access.redhat.com/errata/RHSA-2026:60478", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:60668", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62410", "https://access.redhat.com/errata/RHSA-2026:62550", "https://access.redhat.com/errata/RHSA-2026:62551", "https://access.redhat.com/errata/RHSA-2026:63046", "https://access.redhat.com/errata/RHSA-2026:63047", "https://access.redhat.com/errata/RHSA-2026:63048", "https://access.redhat.com/errata/RHSA-2026:63050", "https://access.redhat.com/errata/RHSA-2026:63091", "https://access.redhat.com/errata/RHSA-2026:63096", "https://access.redhat.com/errata/RHSA-2026:63097", "https://access.redhat.com/errata/RHSA-2026:63103", "https://access.redhat.com/errata/RHSA-2026:63104", "https://access.redhat.com/errata/RHSA-2026:63636", "https://access.redhat.com/errata/RHSA-2026:63637", "https://access.redhat.com/errata/RHSA-2026:63639", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/security/cve/CVE-2026-33814", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467810", "https://bugzilla.redhat.com/show_bug.cgi?id=2467811", "https://bugzilla.redhat.com/show_bug.cgi?id=2467813", "https://bugzilla.redhat.com/show_bug.cgi?id=2467815", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467823", "https://bugzilla.redhat.com/show_bug.cgi?id=2467825", "https://bugzilla.redhat.com/show_bug.cgi?id=2467826", "https://bugzilla.redhat.com/show_bug.cgi?id=2467827", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501", "https://errata.almalinux.org/9/ALSA-2026-22121.html", "https://errata.rockylinux.org/RLSA-2026:22121", "https://github.com/golang/go/issues/78476", "https://go-review.googlesource.com/c/go/+/761581", "https://go-review.googlesource.com/c/net/+/761640", "https://go.dev/cl/761581", "https://go.dev/cl/761640", "https://go.dev/issue/78476", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-33814.html", "https://linux.oracle.com/errata/ELSA-2026-22121.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33814", "https://pkg.go.dev/vuln/GO-2026-4918", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json", "https://ubuntu.com/security/notices/USN-8430-1", "https://ubuntu.com/security/notices/USN-8471-1", "https://ubuntu.com/security/notices/USN-8472-1", "https://ubuntu.com/security/notices/USN-8473-1", "https://www.cve.org/CVERecord?id=CVE-2026-33814" ], "PublishedDate": "2026-05-07T20:16:42.88Z", "LastModifiedDate": "2026-10-26T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-39821", "VendorIDs": [ "GO-2026-5026" ], "PkgID": "golang.org/x/net@v0.52.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.52.0", "UID": "95b58d1978f45fad" }, "InstalledVersion": "v0.52.0", "FixedVersion": "0.55.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39821", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:291113d453ae515bbd8861d323613669c96d27617c0d3967ffb0ec76f20ea04c", "Title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing", "Description": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".", "Severity": "HIGH", "CweIDs": [ "CWE-1289" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:30650", "https://access.redhat.com/errata/RHSA-2026:30651", "https://access.redhat.com/errata/RHSA-2026:30853", "https://access.redhat.com/errata/RHSA-2026:30854", "https://access.redhat.com/errata/RHSA-2026:30855", "https://access.redhat.com/errata/RHSA-2026:33155", "https://access.redhat.com/errata/RHSA-2026:33160", "https://access.redhat.com/errata/RHSA-2026:33163", "https://access.redhat.com/errata/RHSA-2026:33173", "https://access.redhat.com/errata/RHSA-2026:33183", "https://access.redhat.com/errata/RHSA-2026:33524", "https://access.redhat.com/errata/RHSA-2026:33531", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:34789", "https://access.redhat.com/errata/RHSA-2026:35826", "https://access.redhat.com/errata/RHSA-2026:35827", "https://access.redhat.com/errata/RHSA-2026:35828", "https://access.redhat.com/errata/RHSA-2026:35829", "https://access.redhat.com/errata/RHSA-2026:35830", "https://access.redhat.com/errata/RHSA-2026:35831", "https://access.redhat.com/errata/RHSA-2026:35993", "https://access.redhat.com/errata/RHSA-2026:35994", "https://access.redhat.com/errata/RHSA-2026:36105", "https://access.redhat.com/errata/RHSA-2026:36167", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:36883", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:37435", "https://access.redhat.com/errata/RHSA-2026:37436", "https://access.redhat.com/errata/RHSA-2026:38995", "https://access.redhat.com/errata/RHSA-2026:39005", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39879", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:41930", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42048", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42080", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:44624", "https://access.redhat.com/errata/RHSA-2026:46395", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51341", "https://access.redhat.com/errata/RHSA-2026:52826", "https://access.redhat.com/errata/RHSA-2026:53374", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54395", "https://access.redhat.com/errata/RHSA-2026:54401", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54580", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56143", "https://access.redhat.com/errata/RHSA-2026:56223", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57541", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59546", "https://access.redhat.com/errata/RHSA-2026:59549", "https://access.redhat.com/errata/RHSA-2026:59562", "https://access.redhat.com/errata/RHSA-2026:60315", "https://access.redhat.com/errata/RHSA-2026:60354", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61245", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62549", "https://access.redhat.com/errata/RHSA-2026:63134", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65359", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65851", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/errata/RHSA-2026:66432", "https://access.redhat.com/errata/RHSA-2026:67149", "https://access.redhat.com/errata/RHSA-2026:67159", "https://access.redhat.com/errata/RHSA-2026:67160", "https://access.redhat.com/errata/RHSA-2026:67287", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/security/cve/CVE-2026-39821", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/767220", "https://go.dev/issue/78760", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "https://linux.oracle.com/cve/CVE-2026-39821.html", "https://linux.oracle.com/errata/ELSA-2026-66432-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39821", "https://pkg.go.dev/vuln/GO-2026-5026", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json", "https://ubuntu.com/security/notices/USN-8416-1", "https://ubuntu.com/security/notices/USN-8883-1", "https://ubuntu.com/security/notices/USN-8883-2", "https://ubuntu.com/security/notices/USN-8900-1", "https://ubuntu.com/security/notices/USN-8914-1", "https://www.cve.org/CVERecord?id=CVE-2026-39821" ], "PublishedDate": "2026-05-22T16:16:20.41Z", "LastModifiedDate": "2026-09-17T12:18:05.767Z" }, { "VulnerabilityID": "CVE-2026-46600", "VendorIDs": [ "GO-2026-5942" ], "PkgID": "golang.org/x/net@v0.52.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.52.0", "UID": "95b58d1978f45fad" }, "InstalledVersion": "v0.52.0", "FixedVersion": "0.56.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46600", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:513e4f72998e922b0f70535572d47aaea4d44558e28ab98f6b9690dffcdd9d3f", "Title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing", "Description": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "bitnami": 3, "redhat": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46600", "https://go.dev/cl/786345", "https://go.dev/issue/79795", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://nvd.nist.gov/vuln/detail/CVE-2026-46600", "https://pkg.go.dev/vuln/GO-2026-5942", "https://www.cve.org/CVERecord?id=CVE-2026-46600" ], "PublishedDate": "2026-07-21T20:17:01.213Z", "LastModifiedDate": "2026-10-24T19:10:00.127Z" }, { "VulnerabilityID": "CVE-2026-78661", "VendorIDs": [ "GO-2026-6860" ], "PkgID": "golang.org/x/net@v0.52.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.52.0", "UID": "95b58d1978f45fad" }, "InstalledVersion": "v0.52.0", "FixedVersion": "0.62.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78661", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:25fc7be6245185406dae56dcd8f5e4cfe22931a73b0794c4d85ab6538b61215a", "Title": "golang.org/x/net/html: golang.org/x/net/html: Denial of Service via crafted HTML input", "Description": "When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a\u003c/x\u003e\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-78661", "https://go.dev/cl/849365", "https://go.dev/issue/82224", "https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs", "https://nvd.nist.gov/vuln/detail/CVE-2026-78661", "https://pkg.go.dev/vuln/GO-2026-6860", "https://www.cve.org/CVERecord?id=CVE-2026-78661" ], "PublishedDate": "2026-10-27T22:18:05.93Z", "LastModifiedDate": "2026-11-04T17:17:37.673Z" }, { "VulnerabilityID": "CVE-2026-78669", "VendorIDs": [ "GO-2026-6611" ], "PkgID": "golang.org/x/net@v0.52.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.52.0", "UID": "95b58d1978f45fad" }, "InstalledVersion": "v0.52.0", "FixedVersion": "0.60.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78669", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:36128af27ea2fb0c4c6f4b3129412cd885fe9920be0b4d82d80805203e9b9617", "Title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "Description": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78669", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81742", "https://go.dev/cl/847186", "https://go.dev/cl/847308", "https://go.dev/issue/81742", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs", "https://linux.oracle.com/cve/CVE-2026-78669.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78669", "https://pkg.go.dev/vuln/GO-2026-6611", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78669", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:04.01Z", "LastModifiedDate": "2026-10-09T17:16:49.857Z" }, { "VulnerabilityID": "CVE-2026-56851", "VendorIDs": [ "GO-2026-6629" ], "PkgID": "golang.org/x/text@v0.36.0", "PkgName": "golang.org/x/text", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/text@v0.36.0", "UID": "411c2d918b792182" }, "InstalledVersion": "v0.36.0", "FixedVersion": "0.41.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56851", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:2c3b9f8741f90160ee1b449614e5dac3875b36a50dfa5374b0993bc7808bf37a", "Title": "golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile", "Description": "The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 3, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56851", "https://go.dev/cl/793360", "https://go.dev/issue/80112", "https://nvd.nist.gov/vuln/detail/CVE-2026-56851", "https://pkg.go.dev/vuln/GO-2026-6629", "https://www.cve.org/CVERecord?id=CVE-2026-56851" ], "PublishedDate": "2026-10-07T18:17:20.903Z", "LastModifiedDate": "2026-10-08T21:35:53.89Z" }, { "VulnerabilityID": "CVE-2026-56852", "VendorIDs": [ "GO-2026-5970" ], "PkgID": "golang.org/x/text@v0.36.0", "PkgName": "golang.org/x/text", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/text@v0.36.0", "UID": "411c2d918b792182" }, "InstalledVersion": "v0.36.0", "FixedVersion": "0.39.0", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56852", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:ce29b4b887bcd0aa0bfbcb25b6e7e1eccac716104be287afbeb24fb1962c3e61", "Title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input", "Description": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70201", "https://access.redhat.com/security/cve/CVE-2026-56852", "https://bugzilla.redhat.com/2456335", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2504233", "https://bugzilla.redhat.com/2508234", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456335", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2504233", "https://bugzilla.redhat.com/show_bug.cgi?id=2508234", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2518147", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17106", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19730", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33810", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56852", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/10/ALSA-2026-70201.html", "https://errata.rockylinux.org/RLSA-2026:70201", "https://go.dev/cl/794100", "https://go.dev/issue/80142", "https://linux.oracle.com/cve/CVE-2026-56852.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56852", "https://pkg.go.dev/vuln/GO-2026-5970", "https://www.cve.org/CVERecord?id=CVE-2026-56852" ], "PublishedDate": "2026-07-21T20:17:02.867Z", "LastModifiedDate": "2026-10-24T19:10:00.127Z" }, { "VulnerabilityID": "CVE-2026-33186", "VendorIDs": [ "GHSA-p77j-4mvh-x3m3" ], "PkgID": "google.golang.org/grpc@v1.78.0", "PkgName": "google.golang.org/grpc", "PkgIdentifier": { "PURL": "pkg:golang/google.golang.org/grpc@v1.78.0", "UID": "19710d7bc0aab5e1" }, "InstalledVersion": "v1.78.0", "FixedVersion": "1.79.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33186", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:d40d31334abedba06c6cca1d1fe29a39222fc252bd011cb5c6433b77e988166d", "Title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation", "Description": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.", "Severity": "CRITICAL", "CweIDs": [ "CWE-285", "CWE-551" ], "VendorSeverity": { "alma": 3, "amazon": 3, "ghsa": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10093", "https://access.redhat.com/errata/RHSA-2026:10094", "https://access.redhat.com/errata/RHSA-2026:10105", "https://access.redhat.com/errata/RHSA-2026:10107", "https://access.redhat.com/errata/RHSA-2026:10125", "https://access.redhat.com/errata/RHSA-2026:10126", "https://access.redhat.com/errata/RHSA-2026:10130", "https://access.redhat.com/errata/RHSA-2026:10131", "https://access.redhat.com/errata/RHSA-2026:10153", "https://access.redhat.com/errata/RHSA-2026:10155", "https://access.redhat.com/errata/RHSA-2026:10158", "https://access.redhat.com/errata/RHSA-2026:10172", "https://access.redhat.com/errata/RHSA-2026:10175", "https://access.redhat.com/errata/RHSA-2026:10698", "https://access.redhat.com/errata/RHSA-2026:10705", "https://access.redhat.com/errata/RHSA-2026:10706", "https://access.redhat.com/errata/RHSA-2026:11070", "https://access.redhat.com/errata/RHSA-2026:11408", "https://access.redhat.com/errata/RHSA-2026:11803", "https://access.redhat.com/errata/RHSA-2026:11856", "https://access.redhat.com/errata/RHSA-2026:11916", "https://access.redhat.com/errata/RHSA-2026:11996", "https://access.redhat.com/errata/RHSA-2026:12116", "https://access.redhat.com/errata/RHSA-2026:12118", "https://access.redhat.com/errata/RHSA-2026:12119", "https://access.redhat.com/errata/RHSA-2026:12277", "https://access.redhat.com/errata/RHSA-2026:12279", "https://access.redhat.com/errata/RHSA-2026:12283", "https://access.redhat.com/errata/RHSA-2026:12337", "https://access.redhat.com/errata/RHSA-2026:13548", "https://access.redhat.com/errata/RHSA-2026:13791", "https://access.redhat.com/errata/RHSA-2026:13829", "https://access.redhat.com/errata/RHSA-2026:14775", "https://access.redhat.com/errata/RHSA-2026:15092", "https://access.redhat.com/errata/RHSA-2026:17123", "https://access.redhat.com/errata/RHSA-2026:17448", "https://access.redhat.com/errata/RHSA-2026:17459", "https://access.redhat.com/errata/RHSA-2026:17468", "https://access.redhat.com/errata/RHSA-2026:17474", "https://access.redhat.com/errata/RHSA-2026:17475", "https://access.redhat.com/errata/RHSA-2026:17598", "https://access.redhat.com/errata/RHSA-2026:17599", "https://access.redhat.com/errata/RHSA-2026:17789", "https://access.redhat.com/errata/RHSA-2026:18068", "https://access.redhat.com/errata/RHSA-2026:18585", "https://access.redhat.com/errata/RHSA-2026:19099", "https://access.redhat.com/errata/RHSA-2026:19108", "https://access.redhat.com/errata/RHSA-2026:19109", "https://access.redhat.com/errata/RHSA-2026:19135", "https://access.redhat.com/errata/RHSA-2026:19207", "https://access.redhat.com/errata/RHSA-2026:19353", "https://access.redhat.com/errata/RHSA-2026:19375", "https://access.redhat.com/errata/RHSA-2026:19712", "https://access.redhat.com/errata/RHSA-2026:19719", "https://access.redhat.com/errata/RHSA-2026:19720", "https://access.redhat.com/errata/RHSA-2026:19721", "https://access.redhat.com/errata/RHSA-2026:20034", "https://access.redhat.com/errata/RHSA-2026:20035", "https://access.redhat.com/errata/RHSA-2026:20041", "https://access.redhat.com/errata/RHSA-2026:20042", "https://access.redhat.com/errata/RHSA-2026:20088", "https://access.redhat.com/errata/RHSA-2026:20089", "https://access.redhat.com/errata/RHSA-2026:20322", "https://access.redhat.com/errata/RHSA-2026:20436", "https://access.redhat.com/errata/RHSA-2026:20943", "https://access.redhat.com/errata/RHSA-2026:20946", "https://access.redhat.com/errata/RHSA-2026:21017", "https://access.redhat.com/errata/RHSA-2026:21657", "https://access.redhat.com/errata/RHSA-2026:21658", "https://access.redhat.com/errata/RHSA-2026:21691", "https://access.redhat.com/errata/RHSA-2026:21692", "https://access.redhat.com/errata/RHSA-2026:21696", "https://access.redhat.com/errata/RHSA-2026:21697", "https://access.redhat.com/errata/RHSA-2026:21703", "https://access.redhat.com/errata/RHSA-2026:21704", "https://access.redhat.com/errata/RHSA-2026:21709", "https://access.redhat.com/errata/RHSA-2026:21710", "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:21931", "https://access.redhat.com/errata/RHSA-2026:21932", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:22423", "https://access.redhat.com/errata/RHSA-2026:22450", "https://access.redhat.com/errata/RHSA-2026:22465", "https://access.redhat.com/errata/RHSA-2026:22485", "https://access.redhat.com/errata/RHSA-2026:22645", "https://access.redhat.com/errata/RHSA-2026:22689", "https://access.redhat.com/errata/RHSA-2026:22714", "https://access.redhat.com/errata/RHSA-2026:22800", "https://access.redhat.com/errata/RHSA-2026:22937", "https://access.redhat.com/errata/RHSA-2026:22959", "https://access.redhat.com/errata/RHSA-2026:22961", "https://access.redhat.com/errata/RHSA-2026:23228", "https://access.redhat.com/errata/RHSA-2026:23234", "https://access.redhat.com/errata/RHSA-2026:23235", "https://access.redhat.com/errata/RHSA-2026:23241", "https://access.redhat.com/errata/RHSA-2026:23246", "https://access.redhat.com/errata/RHSA-2026:23247", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/errata/RHSA-2026:24484", "https://access.redhat.com/errata/RHSA-2026:24506", "https://access.redhat.com/errata/RHSA-2026:24535", "https://access.redhat.com/errata/RHSA-2026:24536", "https://access.redhat.com/errata/RHSA-2026:24759", "https://access.redhat.com/errata/RHSA-2026:24853", "https://access.redhat.com/errata/RHSA-2026:24977", "https://access.redhat.com/errata/RHSA-2026:25009", "https://access.redhat.com/errata/RHSA-2026:25045", "https://access.redhat.com/errata/RHSA-2026:25127", "https://access.redhat.com/errata/RHSA-2026:25182", "https://access.redhat.com/errata/RHSA-2026:25183", "https://access.redhat.com/errata/RHSA-2026:25187", "https://access.redhat.com/errata/RHSA-2026:25194", "https://access.redhat.com/errata/RHSA-2026:25195", "https://access.redhat.com/errata/RHSA-2026:25201", "https://access.redhat.com/errata/RHSA-2026:26412", "https://access.redhat.com/errata/RHSA-2026:26413", "https://access.redhat.com/errata/RHSA-2026:26416", "https://access.redhat.com/errata/RHSA-2026:26420", "https://access.redhat.com/errata/RHSA-2026:26519", "https://access.redhat.com/errata/RHSA-2026:26568", "https://access.redhat.com/errata/RHSA-2026:26997", "https://access.redhat.com/errata/RHSA-2026:26999", "https://access.redhat.com/errata/RHSA-2026:27001", "https://access.redhat.com/errata/RHSA-2026:27004", "https://access.redhat.com/errata/RHSA-2026:27063", "https://access.redhat.com/errata/RHSA-2026:27076", "https://access.redhat.com/errata/RHSA-2026:27712", "https://access.redhat.com/errata/RHSA-2026:27856", "https://access.redhat.com/errata/RHSA-2026:27892", "https://access.redhat.com/errata/RHSA-2026:27893", "https://access.redhat.com/errata/RHSA-2026:27901", "https://access.redhat.com/errata/RHSA-2026:27957", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:28893", "https://access.redhat.com/errata/RHSA-2026:28964", "https://access.redhat.com/errata/RHSA-2026:29079", "https://access.redhat.com/errata/RHSA-2026:29082", "https://access.redhat.com/errata/RHSA-2026:29854", "https://access.redhat.com/errata/RHSA-2026:34049", "https://access.redhat.com/errata/RHSA-2026:34097", "https://access.redhat.com/errata/RHSA-2026:34099", "https://access.redhat.com/errata/RHSA-2026:34100", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:34769", "https://access.redhat.com/errata/RHSA-2026:34794", "https://access.redhat.com/errata/RHSA-2026:34795", "https://access.redhat.com/errata/RHSA-2026:36611", "https://access.redhat.com/errata/RHSA-2026:36621", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36882", "https://access.redhat.com/errata/RHSA-2026:37192", "https://access.redhat.com/errata/RHSA-2026:37275", "https://access.redhat.com/errata/RHSA-2026:37580", "https://access.redhat.com/errata/RHSA-2026:37585", "https://access.redhat.com/errata/RHSA-2026:40022", "https://access.redhat.com/errata/RHSA-2026:40030", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40792", "https://access.redhat.com/errata/RHSA-2026:40795", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:40984", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:41941", "https://access.redhat.com/errata/RHSA-2026:41944", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:43225", "https://access.redhat.com/errata/RHSA-2026:43227", "https://access.redhat.com/errata/RHSA-2026:43253", "https://access.redhat.com/errata/RHSA-2026:43331", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44233", "https://access.redhat.com/errata/RHSA-2026:44235", "https://access.redhat.com/errata/RHSA-2026:47728", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:48699", "https://access.redhat.com/errata/RHSA-2026:48790", "https://access.redhat.com/errata/RHSA-2026:50758", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:53728", "https://access.redhat.com/errata/RHSA-2026:53763", "https://access.redhat.com/errata/RHSA-2026:53773", "https://access.redhat.com/errata/RHSA-2026:53804", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56366", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:56959", "https://access.redhat.com/errata/RHSA-2026:57013", "https://access.redhat.com/errata/RHSA-2026:57365", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60146", "https://access.redhat.com/errata/RHSA-2026:61245", "https://access.redhat.com/errata/RHSA-2026:6174", "https://access.redhat.com/errata/RHSA-2026:6428", "https://access.redhat.com/errata/RHSA-2026:6564", "https://access.redhat.com/errata/RHSA-2026:6802", "https://access.redhat.com/errata/RHSA-2026:7110", "https://access.redhat.com/errata/RHSA-2026:7128", "https://access.redhat.com/errata/RHSA-2026:7245", "https://access.redhat.com/errata/RHSA-2026:8151", "https://access.redhat.com/errata/RHSA-2026:8338", "https://access.redhat.com/errata/RHSA-2026:8433", "https://access.redhat.com/errata/RHSA-2026:8449", "https://access.redhat.com/errata/RHSA-2026:8483", "https://access.redhat.com/errata/RHSA-2026:8484", "https://access.redhat.com/errata/RHSA-2026:8490", "https://access.redhat.com/errata/RHSA-2026:8491", "https://access.redhat.com/errata/RHSA-2026:8493", "https://access.redhat.com/errata/RHSA-2026:9385", "https://access.redhat.com/errata/RHSA-2026:9388", "https://access.redhat.com/errata/RHSA-2026:9440", "https://access.redhat.com/errata/RHSA-2026:9448", "https://access.redhat.com/errata/RHSA-2026:9453", "https://access.redhat.com/errata/RHSA-2026:9872", "https://access.redhat.com/security/cve/CVE-2026-33186", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/2449833", "https://bugzilla.redhat.com/2455470", "https://bugzilla.redhat.com/2456333", "https://bugzilla.redhat.com/2456335", "https://bugzilla.redhat.com/2456336", "https://bugzilla.redhat.com/2456338", "https://bugzilla.redhat.com/2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2434432", "https://bugzilla.redhat.com/show_bug.cgi?id=2437111", "https://bugzilla.redhat.com/show_bug.cgi?id=2445345", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2449833", "https://bugzilla.redhat.com/show_bug.cgi?id=2455470", "https://bugzilla.redhat.com/show_bug.cgi?id=2456336", "https://bugzilla.redhat.com/show_bug.cgi?id=2456338", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27137", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33186", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34986", "https://errata.almalinux.org/9/ALSA-2026-19353.html", "https://errata.rockylinux.org/RLSA-2026:23228", "https://github.com/grpc/grpc-go", "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3", "https://linux.oracle.com/cve/CVE-2026-33186.html", "https://linux.oracle.com/errata/ELSA-2026-48790.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33186", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33186.json", "https://www.cve.org/CVERecord?id=CVE-2026-33186" ], "PublishedDate": "2026-03-20T23:16:45.18Z", "LastModifiedDate": "2026-09-18T13:17:50.363Z" }, { "VulnerabilityID": "CVE-2026-84304", "VendorIDs": [ "GHSA-vp52-pcj8-j9qc" ], "PkgID": "google.golang.org/grpc@v1.78.0", "PkgName": "google.golang.org/grpc", "PkgIdentifier": { "PURL": "pkg:golang/google.golang.org/grpc@v1.78.0", "UID": "19710d7bc0aab5e1" }, "InstalledVersion": "v1.78.0", "FixedVersion": "1.83.1", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84304", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:02bebf262a49c9a3a4f6e7be28e7d8a82c39a17aaad72a7ab7883900e16874bb", "Title": "google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation", "Description": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "azure": 3, "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-84304", "https://github.com/grpc/grpc-go", "https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176", "https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77", "https://github.com/grpc/grpc-go/pull/9331", "https://github.com/grpc/grpc-go/pull/9333", "https://github.com/grpc/grpc-go/releases/tag/v1.83.1", "https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc", "https://nvd.nist.gov/vuln/detail/CVE-2026-84304", "https://www.cve.org/CVERecord?id=CVE-2026-84304" ], "PublishedDate": "2026-09-01T19:17:30.743Z", "LastModifiedDate": "2026-09-09T21:09:13.08Z" }, { "VulnerabilityID": "CVE-2026-84445", "VendorIDs": [ "GHSA-2v4p-qf9q-27wj" ], "PkgID": "google.golang.org/grpc@v1.78.0", "PkgName": "google.golang.org/grpc", "PkgIdentifier": { "PURL": "pkg:golang/google.golang.org/grpc@v1.78.0", "UID": "19710d7bc0aab5e1" }, "InstalledVersion": "v1.78.0", "FixedVersion": "1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84445", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:2420df11425a662d9bfb55edbd1d1da90c726a3c310ce598434d47f6994ea6a5", "Title": "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests", "Description": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.", "Severity": "HIGH", "CweIDs": [ "CWE-129", "CWE-248" ], "VendorSeverity": { "alma": 3, "azure": 3, "ghsa": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:76744", "https://access.redhat.com/errata/RHSA-2026:95272", "https://access.redhat.com/security/cve/CVE-2026-84445", "https://bugzilla.redhat.com/2533175", "https://bugzilla.redhat.com/show_bug.cgi?id=2533175", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84445", "https://errata.almalinux.org/9/ALSA-2026-76744.html", "https://errata.rockylinux.org/RLSA-2026:95272", "https://github.com/grpc/grpc-go", "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7", "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4", "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f", "https://github.com/grpc/grpc-go/issues/9354", "https://github.com/grpc/grpc-go/pull/9365", "https://github.com/grpc/grpc-go/pull/9366", "https://github.com/grpc/grpc-go/pull/9367", "https://github.com/grpc/grpc-go/releases/tag/v1.82.2", "https://github.com/grpc/grpc-go/releases/tag/v1.83.2", "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj", "https://nvd.nist.gov/vuln/detail/CVE-2026-84445", "https://www.cve.org/CVERecord?id=CVE-2026-84445" ], "PublishedDate": "2026-09-14T17:17:51.743Z", "LastModifiedDate": "2026-09-25T14:10:13.927Z" }, { "VulnerabilityID": "GHSA-hrxh-6v49-42gf", "PkgID": "google.golang.org/grpc@v1.78.0", "PkgName": "google.golang.org/grpc", "PkgIdentifier": { "PURL": "pkg:golang/google.golang.org/grpc@v1.78.0", "UID": "19710d7bc0aab5e1" }, "InstalledVersion": "v1.78.0", "FixedVersion": "1.82.1", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-hrxh-6v49-42gf", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:ceebf7784fb9e59254ec4bd4fca17d232d2329603c23d50958ebf2fd1efb4945", "Title": "gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities", "Description": "Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization engine (internal/xds/rbac) and the HTTP/2 transport server implementation (internal/transport). These vulnerabilities could result in:\n\n- Authorization Bypass (Fail-Open) when translating xDS RBAC policies containing `Metadata` or `RequestedServerName` fields.\n- Denial of Service (High CPU Consumption) due to an HTTP/2 Rapid Reset mitigation bypass during client-initiated stream resets.\n- Denial of Service (Server Panic) when parsing crafted xDS RBAC policies containing `NOT` rules around unsupported fields.\n\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\n#### xDS RBAC Authorization Bypass via `Metadata` \u0026 `RequestedServerName` matchers\n\n- Affected Component: xDS RBAC \n- Impact: When building policy matchers for gRPC RBAC from xDS configurations, unsupported `permission` and `principal` rules (specifically `Metadata` and `RequestedServerName`) were silently ignored and treated as no-ops.\n - If an authorization policy relied purely on these matchers for access control, treating those rules as no-ops effectively removed the restrictions.\n- If these unsupported rules were nested inside logical `NOT` rules (`Permission_NotRule` / `Principal_NotId`) or multi-condition `OR/AND` rules, silently dropping them changed the boolean logic flow of the authorization engine.\n\nAs a result, policy evaluation decisions could fail open, allowing unauthorized clients to access protected gRPC services or resources.\n\n#### HTTP/2 Rapid Reset Mitigation Bypass / Denial of Service via Stream Aborts\n\n- Affected Component: HTTP/2 transport\n- Impact: Earlier mitigations in grpc-go for HTTP/2 Rapid Reset only applied threshold checks to items that directly resulted in control frames being written back to the wire, such as `SETTINGS` ACKs or server-initiated `RST_STREAM`s.\n\nWhen a client initiated a rapid flood of stream creation (`HEADERS`) immediately followed by stream termination `RST_STREAM`, items queued up in the control buffer without counting against the transport response frame threshold. An attacker can repeatedly trigger this flood sequence to bypass reader blocking, resulting in high CPU usage, and Denial of Service (DoS).\n\n#### Denial of Service (Panic) in xDS RBAC Engine via Unsupported Fields inside NOT Rules\n\n- Affected Component: xDS RBAC \n- Impact: The xDS RBAC policy translators recursively generate matchers for nested rules. When a `NOT` rule wrapped an unsupported or unhandled field (such as `SourcedMetadata`), the recursive step returned an empty matcher. This could result in a runtime panic when the RBAC engine attempts to authorize an incoming request.\n\nAn attacker or misconfigured/malicious xDS management server delivering an LDS/RDS update containing a `NOT` rule around an unhandled field causes the gRPC server process to crash immediately (CWE-248 / Denial of Service).\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nAll three issues have been fixed in `master` and will be released in 1.82.1 shortly.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nIf upgrading grpc-go immediately is not possible, apply the following workarounds based on your deployment architecture:\n\n* For xDS RBAC Vulnerabilities \u0026 Panics: Ensure that upstream xDS management servers do not push RBAC policies containing `Metadata`, `RequestedServerName`, or `NOT` rules wrapping unsupported fields (such as `SourcedMetadata`) to grpc-go servers.\n* For HTTP/2 Rapid Reset DOS: Configure upstream reverse proxies or load balancers (such as Envoy) with strict HTTP/2 `max_concurrent_streams` limits and active rate limiting on `RST_STREAM` frequency per connection.\n\n### Severity\n\n | Vulnerability | Qualitative Severity | Approximate CVSS v3.1 Score | Primary Impact |\n | :--- | :--- | :--- | :--- |\n | **xDS RBAC Authorization Bypass** | **High** | `8.2` | Unauthorized Access / Fail-Open |\n | **HTTP/2 Rapid Reset DOS Bypass** | **High** | `7.5` | High CPU Consumption / Denial of Service |\n | **xDS RBAC Engine Server Panic** | **Medium** | `5.9` | Process Crash / Denial of Service |", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.8 } }, "References": [ "https://github.com/grpc/grpc-go", "https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935", "https://github.com/grpc/grpc-go/pull/9236", "https://github.com/grpc/grpc-go/releases/tag/v1.82.1", "https://github.com/grpc/grpc-go/security/advisories/GHSA-hrxh-6v49-42gf" ], "PublishedDate": "2026-07-21T22:03:55Z", "LastModifiedDate": "2026-07-21T22:03:56Z" }, { "VulnerabilityID": "CVE-2026-111943", "VendorIDs": [ "GO-2026-6809" ], "PkgID": "stdlib@v1.25.8", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.8", "UID": "d0005ada20383185" }, "InstalledVersion": "v1.25.8", "FixedVersion": "1.26.10, 1.27.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-111943", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:23a0d070049af7a9383e4a3729bd9140e9c4430fcb9ca54ad1091a37e792bb6f", "Title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "Description": "On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.", "Severity": "HIGH", "CweIDs": [ "CWE-299" ], "VendorSeverity": { "alma": 3, "amazon": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 6.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/20/29", "https://access.redhat.com/errata/RHSA-2026:95518", "https://access.redhat.com/security/cve/CVE-2026-111943", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-95518.html", "https://errata.rockylinux.org/RLSA-2026:95518", "https://github.com/golang/go/issues/82345", "https://go.dev/cl/851047", "https://go.dev/issue/82345", "https://groups.google.com/g/golang-announce/c/66pojueaQek", "https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU", "https://linux.oracle.com/cve/CVE-2026-111943.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-111943", "https://pkg.go.dev/vuln/GO-2026-6809", "https://www.cve.org/CVERecord?id=CVE-2026-111943" ], "PublishedDate": "2026-10-21T01:17:20.797Z", "LastModifiedDate": "2026-10-30T13:18:28.74Z" }, { "VulnerabilityID": "CVE-2026-27145", "VendorIDs": [ "GO-2026-5037" ], "PkgID": "stdlib@v1.25.8", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.8", "UID": "d0005ada20383185" }, "InstalledVersion": "v1.25.8", "FixedVersion": "1.25.11, 1.26.4", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27145", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:6f8612c90d942badf8a0964f3f3ecd6fe64c8095298c972c1f0f7503af302603", "Title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries", "Description": "(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.", "Severity": "HIGH", "CweIDs": [ "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:29980", "https://access.redhat.com/errata/RHSA-2026:29981", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:35832", "https://access.redhat.com/errata/RHSA-2026:36317", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:38995", "https://access.redhat.com/errata/RHSA-2026:39005", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39879", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41930", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42080", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42946", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:46394", "https://access.redhat.com/errata/RHSA-2026:46395", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49703", "https://access.redhat.com/errata/RHSA-2026:49705", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:49729", "https://access.redhat.com/errata/RHSA-2026:49744", "https://access.redhat.com/errata/RHSA-2026:49765", "https://access.redhat.com/errata/RHSA-2026:49770", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:51057", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:52946", "https://access.redhat.com/errata/RHSA-2026:53374", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53416", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54168", "https://access.redhat.com/errata/RHSA-2026:54401", "https://access.redhat.com/errata/RHSA-2026:54427", "https://access.redhat.com/errata/RHSA-2026:54432", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54500", "https://access.redhat.com/errata/RHSA-2026:54525", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:55899", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:59556", "https://access.redhat.com/errata/RHSA-2026:59557", "https://access.redhat.com/errata/RHSA-2026:59558", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:59579", "https://access.redhat.com/errata/RHSA-2026:59593", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60315", "https://access.redhat.com/errata/RHSA-2026:60354", "https://access.redhat.com/errata/RHSA-2026:60386", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60388", "https://access.redhat.com/errata/RHSA-2026:60390", "https://access.redhat.com/errata/RHSA-2026:60391", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:63016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68335", "https://access.redhat.com/security/cve/CVE-2026-27145", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/2484207", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2484207", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27145", "https://errata.almalinux.org/9/ALSA-2026-36317.html", "https://errata.rockylinux.org/RLSA-2026:36317", "https://go.dev/cl/783621", "https://go.dev/issue/79694", "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw", "https://linux.oracle.com/cve/CVE-2026-27145.html", "https://linux.oracle.com/errata/ELSA-2026-53416.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-27145", "https://pkg.go.dev/vuln/GO-2026-5037", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27145.json", "https://www.cve.org/CVERecord?id=CVE-2026-27145" ], "PublishedDate": "2026-06-02T23:16:35.57Z", "LastModifiedDate": "2026-09-18T13:17:43.283Z" }, { "VulnerabilityID": "CVE-2026-32280", "VendorIDs": [ "GO-2026-4947" ], "PkgID": "stdlib@v1.25.8", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.8", "UID": "d0005ada20383185" }, "InstalledVersion": "v1.25.8", "FixedVersion": "1.25.9, 1.26.2", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32280", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:20a929affe8c4a24e4c6c5ca18739a3452ee9fdee1ec3867d79000298bb4e2e4", "Title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building", "Description": "During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10217", "https://access.redhat.com/errata/RHSA-2026:10219", "https://access.redhat.com/errata/RHSA-2026:10704", "https://access.redhat.com/errata/RHSA-2026:11507", "https://access.redhat.com/errata/RHSA-2026:11514", "https://access.redhat.com/errata/RHSA-2026:11688", "https://access.redhat.com/errata/RHSA-2026:13545", "https://access.redhat.com/errata/RHSA-2026:13791", "https://access.redhat.com/errata/RHSA-2026:13826", "https://access.redhat.com/errata/RHSA-2026:13829", "https://access.redhat.com/errata/RHSA-2026:14020", "https://access.redhat.com/errata/RHSA-2026:14162", "https://access.redhat.com/errata/RHSA-2026:14200", "https://access.redhat.com/errata/RHSA-2026:14391", "https://access.redhat.com/errata/RHSA-2026:15980", "https://access.redhat.com/errata/RHSA-2026:16021", "https://access.redhat.com/errata/RHSA-2026:16024", "https://access.redhat.com/errata/RHSA-2026:16101", "https://access.redhat.com/errata/RHSA-2026:16476", "https://access.redhat.com/errata/RHSA-2026:16477", "https://access.redhat.com/errata/RHSA-2026:16505", "https://access.redhat.com/errata/RHSA-2026:16508", "https://access.redhat.com/errata/RHSA-2026:16532", "https://access.redhat.com/errata/RHSA-2026:16534", "https://access.redhat.com/errata/RHSA-2026:16535", "https://access.redhat.com/errata/RHSA-2026:16537", "https://access.redhat.com/errata/RHSA-2026:16542", "https://access.redhat.com/errata/RHSA-2026:16874", "https://access.redhat.com/errata/RHSA-2026:16875", "https://access.redhat.com/errata/RHSA-2026:17084", "https://access.redhat.com/errata/RHSA-2026:17287", "https://access.redhat.com/errata/RHSA-2026:18027", "https://access.redhat.com/errata/RHSA-2026:18032", "https://access.redhat.com/errata/RHSA-2026:19133", "https://access.redhat.com/errata/RHSA-2026:19135", "https://access.redhat.com/errata/RHSA-2026:19144", "https://access.redhat.com/errata/RHSA-2026:19350", "https://access.redhat.com/errata/RHSA-2026:19353", "https://access.redhat.com/errata/RHSA-2026:19375", "https://access.redhat.com/errata/RHSA-2026:19450", "https://access.redhat.com/errata/RHSA-2026:19550", "https://access.redhat.com/errata/RHSA-2026:19634", "https://access.redhat.com/errata/RHSA-2026:19714", "https://access.redhat.com/errata/RHSA-2026:19715", "https://access.redhat.com/errata/RHSA-2026:19719", "https://access.redhat.com/errata/RHSA-2026:19720", "https://access.redhat.com/errata/RHSA-2026:19721", "https://access.redhat.com/errata/RHSA-2026:19722", "https://access.redhat.com/errata/RHSA-2026:19750", "https://access.redhat.com/errata/RHSA-2026:19839", "https://access.redhat.com/errata/RHSA-2026:20556", "https://access.redhat.com/errata/RHSA-2026:20569", "https://access.redhat.com/errata/RHSA-2026:20570", "https://access.redhat.com/errata/RHSA-2026:20571", "https://access.redhat.com/errata/RHSA-2026:20607", "https://access.redhat.com/errata/RHSA-2026:20608", "https://access.redhat.com/errata/RHSA-2026:20609", "https://access.redhat.com/errata/RHSA-2026:20889", "https://access.redhat.com/errata/RHSA-2026:21017", "https://access.redhat.com/errata/RHSA-2026:21338", "https://access.redhat.com/errata/RHSA-2026:21655", "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:21772", "https://access.redhat.com/errata/RHSA-2026:22130", "https://access.redhat.com/errata/RHSA-2026:22141", "https://access.redhat.com/errata/RHSA-2026:22258", "https://access.redhat.com/errata/RHSA-2026:22260", "https://access.redhat.com/errata/RHSA-2026:22268", "https://access.redhat.com/errata/RHSA-2026:22309", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:22415", "https://access.redhat.com/errata/RHSA-2026:22422", "https://access.redhat.com/errata/RHSA-2026:22465", "https://access.redhat.com/errata/RHSA-2026:22485", "https://access.redhat.com/errata/RHSA-2026:22709", "https://access.redhat.com/errata/RHSA-2026:22713", "https://access.redhat.com/errata/RHSA-2026:22840", "https://access.redhat.com/errata/RHSA-2026:22862", "https://access.redhat.com/errata/RHSA-2026:22958", "https://access.redhat.com/errata/RHSA-2026:22959", "https://access.redhat.com/errata/RHSA-2026:22960", "https://access.redhat.com/errata/RHSA-2026:22961", "https://access.redhat.com/errata/RHSA-2026:22962", "https://access.redhat.com/errata/RHSA-2026:23102", "https://access.redhat.com/errata/RHSA-2026:23103", "https://access.redhat.com/errata/RHSA-2026:23244", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/errata/RHSA-2026:23361", "https://access.redhat.com/errata/RHSA-2026:24337", "https://access.redhat.com/errata/RHSA-2026:24359", "https://access.redhat.com/errata/RHSA-2026:24470", "https://access.redhat.com/errata/RHSA-2026:24478", "https://access.redhat.com/errata/RHSA-2026:24716", "https://access.redhat.com/errata/RHSA-2026:24761", "https://access.redhat.com/errata/RHSA-2026:24762", "https://access.redhat.com/errata/RHSA-2026:24853", "https://access.redhat.com/errata/RHSA-2026:24977", "https://access.redhat.com/errata/RHSA-2026:25089", "https://access.redhat.com/errata/RHSA-2026:25127", "https://access.redhat.com/errata/RHSA-2026:25180", "https://access.redhat.com/errata/RHSA-2026:25248", "https://access.redhat.com/errata/RHSA-2026:25250", "https://access.redhat.com/errata/RHSA-2026:25251", "https://access.redhat.com/errata/RHSA-2026:25252", "https://access.redhat.com/errata/RHSA-2026:25253", "https://access.redhat.com/errata/RHSA-2026:26447", "https://access.redhat.com/errata/RHSA-2026:26568", "https://access.redhat.com/errata/RHSA-2026:26571", "https://access.redhat.com/errata/RHSA-2026:26585", "https://access.redhat.com/errata/RHSA-2026:26636", "https://access.redhat.com/errata/RHSA-2026:27076", "https://access.redhat.com/errata/RHSA-2026:28038", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:28074", "https://access.redhat.com/errata/RHSA-2026:28196", "https://access.redhat.com/errata/RHSA-2026:28198", "https://access.redhat.com/errata/RHSA-2026:28441", "https://access.redhat.com/errata/RHSA-2026:28886", "https://access.redhat.com/errata/RHSA-2026:28961", "https://access.redhat.com/errata/RHSA-2026:29035", "https://access.redhat.com/errata/RHSA-2026:29195", "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:29702", "https://access.redhat.com/errata/RHSA-2026:29703", "https://access.redhat.com/errata/RHSA-2026:29854", "https://access.redhat.com/errata/RHSA-2026:33722", "https://access.redhat.com/errata/RHSA-2026:34097", "https://access.redhat.com/errata/RHSA-2026:34192", "https://access.redhat.com/errata/RHSA-2026:34196", "https://access.redhat.com/errata/RHSA-2026:34197", "https://access.redhat.com/errata/RHSA-2026:34365", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:39894", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:47712", "https://access.redhat.com/errata/RHSA-2026:47714", "https://access.redhat.com/errata/RHSA-2026:47716", "https://access.redhat.com/errata/RHSA-2026:47719", "https://access.redhat.com/errata/RHSA-2026:47721", "https://access.redhat.com/errata/RHSA-2026:47722", "https://access.redhat.com/errata/RHSA-2026:47910", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:48036", "https://access.redhat.com/errata/RHSA-2026:48790", "https://access.redhat.com/errata/RHSA-2026:49509", "https://access.redhat.com/errata/RHSA-2026:49526", "https://access.redhat.com/errata/RHSA-2026:49600", "https://access.redhat.com/errata/RHSA-2026:49838", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56855", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:56913", "https://access.redhat.com/errata/RHSA-2026:57409", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:59834", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61685", "https://access.redhat.com/errata/RHSA-2026:61906", "https://access.redhat.com/errata/RHSA-2026:61907", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66401", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:9385", "https://access.redhat.com/security/cve/CVE-2026-32280", "https://bugzilla.redhat.com/2456333", "https://bugzilla.redhat.com/2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-49838.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/758320", "https://go.dev/issue/78282", "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "https://linux.oracle.com/cve/CVE-2026-32280.html", "https://linux.oracle.com/errata/ELSA-2026-65886-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-32280", "https://pkg.go.dev/vuln/GO-2026-4947", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32280.json", "https://www.cve.org/CVERecord?id=CVE-2026-32280" ], "PublishedDate": "2026-04-08T02:16:03.247Z", "LastModifiedDate": "2026-09-18T13:17:45.92Z" }, { "VulnerabilityID": "CVE-2026-32281", "VendorIDs": [ "GO-2026-4946" ], "PkgID": "stdlib@v1.25.8", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.8", "UID": "d0005ada20383185" }, "InstalledVersion": "v1.25.8", "FixedVersion": "1.25.9, 1.26.2", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32281", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:431ecef8b4a57fa1ba3c61c75cc689d5f584559f6ec38de670d79aa591664adb", "Title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation", "Description": "Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:49838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/security/cve/CVE-2026-32281", "https://bugzilla.redhat.com/2456333", "https://bugzilla.redhat.com/2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-49838.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/758061", "https://go.dev/issue/78281", "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "https://linux.oracle.com/cve/CVE-2026-32281.html", "https://linux.oracle.com/errata/ELSA-2026-67148-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-32281", "https://pkg.go.dev/vuln/GO-2026-4946", "https://www.cve.org/CVERecord?id=CVE-2026-32281" ], "PublishedDate": "2026-04-08T02:16:03.35Z", "LastModifiedDate": "2026-07-25T10:10:00.167Z" }, { "VulnerabilityID": "CVE-2026-32283", "VendorIDs": [ "GO-2026-4870" ], "PkgID": "stdlib@v1.25.8", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.8", "UID": "d0005ada20383185" }, "InstalledVersion": "v1.25.8", "FixedVersion": "1.25.9, 1.26.2", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32283", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:320b6ab7f55e551ec0662702ff92c1d264a99b38bc44627e3fd34ebf89beb654", "Title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages", "Description": "If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.", "Severity": "HIGH", "CweIDs": [ "CWE-770", "CWE-764" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10217", "https://access.redhat.com/errata/RHSA-2026:10219", "https://access.redhat.com/errata/RHSA-2026:10704", "https://access.redhat.com/errata/RHSA-2026:11507", "https://access.redhat.com/errata/RHSA-2026:11514", "https://access.redhat.com/errata/RHSA-2026:11704", "https://access.redhat.com/errata/RHSA-2026:11711", "https://access.redhat.com/errata/RHSA-2026:11712", "https://access.redhat.com/errata/RHSA-2026:11863", "https://access.redhat.com/errata/RHSA-2026:11881", "https://access.redhat.com/errata/RHSA-2026:14162", "https://access.redhat.com/errata/RHSA-2026:14200", "https://access.redhat.com/errata/RHSA-2026:14391", "https://access.redhat.com/errata/RHSA-2026:15980", "https://access.redhat.com/errata/RHSA-2026:16021", "https://access.redhat.com/errata/RHSA-2026:16024", "https://access.redhat.com/errata/RHSA-2026:16101", "https://access.redhat.com/errata/RHSA-2026:16102", "https://access.redhat.com/errata/RHSA-2026:16875", "https://access.redhat.com/errata/RHSA-2026:17075", "https://access.redhat.com/errata/RHSA-2026:17084", "https://access.redhat.com/errata/RHSA-2026:17287", "https://access.redhat.com/errata/RHSA-2026:18027", "https://access.redhat.com/errata/RHSA-2026:18032", "https://access.redhat.com/errata/RHSA-2026:19126", "https://access.redhat.com/errata/RHSA-2026:19132", "https://access.redhat.com/errata/RHSA-2026:19133", "https://access.redhat.com/errata/RHSA-2026:19134", "https://access.redhat.com/errata/RHSA-2026:19135", "https://access.redhat.com/errata/RHSA-2026:19136", "https://access.redhat.com/errata/RHSA-2026:19137", "https://access.redhat.com/errata/RHSA-2026:19139", "https://access.redhat.com/errata/RHSA-2026:19144", "https://access.redhat.com/errata/RHSA-2026:19156", "https://access.redhat.com/errata/RHSA-2026:19350", "https://access.redhat.com/errata/RHSA-2026:19351", "https://access.redhat.com/errata/RHSA-2026:19352", "https://access.redhat.com/errata/RHSA-2026:19353", "https://access.redhat.com/errata/RHSA-2026:19369", "https://access.redhat.com/errata/RHSA-2026:19450", "https://access.redhat.com/errata/RHSA-2026:19550", "https://access.redhat.com/errata/RHSA-2026:19634", "https://access.redhat.com/errata/RHSA-2026:19714", "https://access.redhat.com/errata/RHSA-2026:19715", "https://access.redhat.com/errata/RHSA-2026:19719", "https://access.redhat.com/errata/RHSA-2026:19720", "https://access.redhat.com/errata/RHSA-2026:19721", "https://access.redhat.com/errata/RHSA-2026:19722", "https://access.redhat.com/errata/RHSA-2026:19750", "https://access.redhat.com/errata/RHSA-2026:19839", "https://access.redhat.com/errata/RHSA-2026:20556", "https://access.redhat.com/errata/RHSA-2026:20569", "https://access.redhat.com/errata/RHSA-2026:20570", "https://access.redhat.com/errata/RHSA-2026:20571", "https://access.redhat.com/errata/RHSA-2026:20607", "https://access.redhat.com/errata/RHSA-2026:20608", "https://access.redhat.com/errata/RHSA-2026:20609", "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:22423", "https://access.redhat.com/errata/RHSA-2026:22450", "https://access.redhat.com/errata/RHSA-2026:22485", "https://access.redhat.com/errata/RHSA-2026:22709", "https://access.redhat.com/errata/RHSA-2026:22713", "https://access.redhat.com/errata/RHSA-2026:22714", "https://access.redhat.com/errata/RHSA-2026:22937", "https://access.redhat.com/errata/RHSA-2026:23102", "https://access.redhat.com/errata/RHSA-2026:23103", "https://access.redhat.com/errata/RHSA-2026:23228", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/errata/RHSA-2026:24337", "https://access.redhat.com/errata/RHSA-2026:24470", "https://access.redhat.com/errata/RHSA-2026:24761", "https://access.redhat.com/errata/RHSA-2026:24762", "https://access.redhat.com/errata/RHSA-2026:25248", "https://access.redhat.com/errata/RHSA-2026:25250", "https://access.redhat.com/errata/RHSA-2026:25251", "https://access.redhat.com/errata/RHSA-2026:25252", "https://access.redhat.com/errata/RHSA-2026:26447", "https://access.redhat.com/errata/RHSA-2026:26571", "https://access.redhat.com/errata/RHSA-2026:26636", "https://access.redhat.com/errata/RHSA-2026:27076", "https://access.redhat.com/errata/RHSA-2026:28038", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:28074", "https://access.redhat.com/errata/RHSA-2026:29035", "https://access.redhat.com/errata/RHSA-2026:29195", "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:29703", "https://access.redhat.com/errata/RHSA-2026:33722", "https://access.redhat.com/errata/RHSA-2026:34192", "https://access.redhat.com/errata/RHSA-2026:34196", "https://access.redhat.com/errata/RHSA-2026:34197", "https://access.redhat.com/errata/RHSA-2026:34365", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:47712", "https://access.redhat.com/errata/RHSA-2026:47714", "https://access.redhat.com/errata/RHSA-2026:47716", "https://access.redhat.com/errata/RHSA-2026:47719", "https://access.redhat.com/errata/RHSA-2026:47721", "https://access.redhat.com/errata/RHSA-2026:47722", "https://access.redhat.com/errata/RHSA-2026:47910", "https://access.redhat.com/errata/RHSA-2026:48036", "https://access.redhat.com/errata/RHSA-2026:48790", "https://access.redhat.com/errata/RHSA-2026:49509", "https://access.redhat.com/errata/RHSA-2026:49600", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:55898", "https://access.redhat.com/errata/RHSA-2026:55900", "https://access.redhat.com/errata/RHSA-2026:55901", "https://access.redhat.com/errata/RHSA-2026:55902", "https://access.redhat.com/errata/RHSA-2026:55903", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:57409", "https://access.redhat.com/errata/RHSA-2026:57801", "https://access.redhat.com/errata/RHSA-2026:57802", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65343", "https://access.redhat.com/errata/RHSA-2026:65514", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66084", "https://access.redhat.com/errata/RHSA-2026:66401", "https://access.redhat.com/errata/RHSA-2026:66523", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:7291", "https://access.redhat.com/errata/RHSA-2026:7385", "https://access.redhat.com/security/cve/CVE-2026-32283", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/2456333", "https://bugzilla.redhat.com/2456338", "https://bugzilla.redhat.com/2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456338", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283", "https://errata.almalinux.org/9/ALSA-2026-29703.html", "https://errata.rockylinux.org/RLSA-2026:29703", "https://go.dev/cl/763767", "https://go.dev/issue/78334", "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "https://linux.oracle.com/cve/CVE-2026-32283.html", "https://linux.oracle.com/errata/ELSA-2026-48790.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-32283", "https://pkg.go.dev/vuln/GO-2026-4870", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32283.json", "https://www.cve.org/CVERecord?id=CVE-2026-32283" ], "PublishedDate": "2026-04-08T02:16:03.58Z", "LastModifiedDate": "2026-09-18T13:17:48.437Z" }, { "VulnerabilityID": "CVE-2026-33811", "VendorIDs": [ "GO-2026-4981" ], "PkgID": "stdlib@v1.25.8", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.8", "UID": "d0005ada20383185" }, "InstalledVersion": "v1.25.8", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33811", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:b744e85905692d12b2b425e29a1115d961a5d62b80f3e211959dd036d0bf43db", "Title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME", "Description": "When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.", "Severity": "HIGH", "CweIDs": [ "CWE-415", "CWE-1341" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:35832", "https://access.redhat.com/errata/RHSA-2026:35993", "https://access.redhat.com/errata/RHSA-2026:35994", "https://access.redhat.com/errata/RHSA-2026:35995", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36617", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36776", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:38504", "https://access.redhat.com/errata/RHSA-2026:39266", "https://access.redhat.com/errata/RHSA-2026:39272", "https://access.redhat.com/errata/RHSA-2026:39319", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40119", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42048", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:42946", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49703", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51057", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51341", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54168", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54500", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54556", "https://access.redhat.com/errata/RHSA-2026:54584", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56790", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56855", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:56913", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60302", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:61313", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:67149", "https://access.redhat.com/errata/RHSA-2026:67287", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/security/cve/CVE-2026-33811", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-39319.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/767860", "https://go.dev/issue/78803", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-33811.html", "https://linux.oracle.com/errata/ELSA-2026-65886-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33811", "https://pkg.go.dev/vuln/GO-2026-4981", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33811.json", "https://www.cve.org/CVERecord?id=CVE-2026-33811" ], "PublishedDate": "2026-05-07T20:16:42.77Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-33814", "VendorIDs": [ "GO-2026-4918" ], "PkgID": "stdlib@v1.25.8", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.8", "UID": "d0005ada20383185" }, "InstalledVersion": "v1.25.8", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33814", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:0350e9dcdec59c08078e57e16969e1c8530774369d20e803785eed020ab5c08c", "Title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame", "Description": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.", "Severity": "HIGH", "CweIDs": [ "CWE-835", "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57365", "https://access.redhat.com/errata/RHSA-2026:57367", "https://access.redhat.com/errata/RHSA-2026:57408", "https://access.redhat.com/errata/RHSA-2026:57545", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60441", "https://access.redhat.com/errata/RHSA-2026:60442", "https://access.redhat.com/errata/RHSA-2026:60446", "https://access.redhat.com/errata/RHSA-2026:60447", "https://access.redhat.com/errata/RHSA-2026:60454", "https://access.redhat.com/errata/RHSA-2026:60477", "https://access.redhat.com/errata/RHSA-2026:60478", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:60668", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62410", "https://access.redhat.com/errata/RHSA-2026:62550", "https://access.redhat.com/errata/RHSA-2026:62551", "https://access.redhat.com/errata/RHSA-2026:63046", "https://access.redhat.com/errata/RHSA-2026:63047", "https://access.redhat.com/errata/RHSA-2026:63048", "https://access.redhat.com/errata/RHSA-2026:63050", "https://access.redhat.com/errata/RHSA-2026:63091", "https://access.redhat.com/errata/RHSA-2026:63096", "https://access.redhat.com/errata/RHSA-2026:63097", "https://access.redhat.com/errata/RHSA-2026:63103", "https://access.redhat.com/errata/RHSA-2026:63104", "https://access.redhat.com/errata/RHSA-2026:63636", "https://access.redhat.com/errata/RHSA-2026:63637", "https://access.redhat.com/errata/RHSA-2026:63639", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/security/cve/CVE-2026-33814", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467810", "https://bugzilla.redhat.com/show_bug.cgi?id=2467811", "https://bugzilla.redhat.com/show_bug.cgi?id=2467813", "https://bugzilla.redhat.com/show_bug.cgi?id=2467815", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467823", "https://bugzilla.redhat.com/show_bug.cgi?id=2467825", "https://bugzilla.redhat.com/show_bug.cgi?id=2467826", "https://bugzilla.redhat.com/show_bug.cgi?id=2467827", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501", "https://errata.almalinux.org/9/ALSA-2026-22121.html", "https://errata.rockylinux.org/RLSA-2026:22121", "https://github.com/golang/go/issues/78476", "https://go-review.googlesource.com/c/go/+/761581", "https://go-review.googlesource.com/c/net/+/761640", "https://go.dev/cl/761581", "https://go.dev/cl/761640", "https://go.dev/issue/78476", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-33814.html", "https://linux.oracle.com/errata/ELSA-2026-22121.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33814", "https://pkg.go.dev/vuln/GO-2026-4918", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json", "https://ubuntu.com/security/notices/USN-8430-1", "https://ubuntu.com/security/notices/USN-8471-1", "https://ubuntu.com/security/notices/USN-8472-1", "https://ubuntu.com/security/notices/USN-8473-1", "https://www.cve.org/CVERecord?id=CVE-2026-33814" ], "PublishedDate": "2026-05-07T20:16:42.88Z", "LastModifiedDate": "2026-10-26T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-33818", "VendorIDs": [ "GO-2026-5972" ], "PkgID": "stdlib@v1.25.8", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.8", "UID": "d0005ada20383185" }, "InstalledVersion": "v1.25.8", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33818", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:488be1ea50390ba0932059473e6ff4e1a122c03ced37d90fc4d1b77cc2417e71", "Title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal", "Description": "Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-33818", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://github.com/golang/go/issues/80405", "https://go.dev/cl/814980", "https://go.dev/issue/80405", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-33818.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33818", "https://pkg.go.dev/vuln/GO-2026-5972", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-33818" ], "PublishedDate": "2026-08-13T22:17:19.84Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-39820", "VendorIDs": [ "GO-2026-4986" ], "PkgID": "stdlib@v1.25.8", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.8", "UID": "d0005ada20383185" }, "InstalledVersion": "v1.25.8", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39820", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:c39124e7eb1ed4428f1c18544cd29f4a0db159de15486b142b766af612bde82d", "Title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs", "Description": "Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.", "Severity": "HIGH", "CweIDs": [ "CWE-770", "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36754", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54555", "https://access.redhat.com/errata/RHSA-2026:54583", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:54883", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57401", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57487", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:57914", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:62406", "https://access.redhat.com/errata/RHSA-2026:62407", "https://access.redhat.com/errata/RHSA-2026:62753", "https://access.redhat.com/errata/RHSA-2026:62754", "https://access.redhat.com/errata/RHSA-2026:62803", "https://access.redhat.com/errata/RHSA-2026:63022", "https://access.redhat.com/errata/RHSA-2026:65116", "https://access.redhat.com/errata/RHSA-2026:65117", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65335", "https://access.redhat.com/errata/RHSA-2026:65336", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:65895", "https://access.redhat.com/errata/RHSA-2026:66016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66327", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:67974", "https://access.redhat.com/errata/RHSA-2026:67975", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:68527", "https://access.redhat.com/security/cve/CVE-2026-39820", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/759940", "https://go.dev/issue/78566", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-39820.html", "https://linux.oracle.com/errata/ELSA-2026-65895-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39820", "https://pkg.go.dev/vuln/GO-2026-4986", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39820.json", "https://www.cve.org/CVERecord?id=CVE-2026-39820" ], "PublishedDate": "2026-05-07T20:16:43.187Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-39821", "VendorIDs": [ "GO-2026-5026" ], "PkgID": "stdlib@v1.25.8", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.8", "UID": "d0005ada20383185" }, "InstalledVersion": "v1.25.8", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39821", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:785b0fae40f62f945721c6518be683211207adb9bbbc576af927e4e07edcb494", "Title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing", "Description": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".", "Severity": "HIGH", "CweIDs": [ "CWE-1289" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:30650", "https://access.redhat.com/errata/RHSA-2026:30651", "https://access.redhat.com/errata/RHSA-2026:30853", "https://access.redhat.com/errata/RHSA-2026:30854", "https://access.redhat.com/errata/RHSA-2026:30855", "https://access.redhat.com/errata/RHSA-2026:33155", "https://access.redhat.com/errata/RHSA-2026:33160", "https://access.redhat.com/errata/RHSA-2026:33163", "https://access.redhat.com/errata/RHSA-2026:33173", "https://access.redhat.com/errata/RHSA-2026:33183", "https://access.redhat.com/errata/RHSA-2026:33524", "https://access.redhat.com/errata/RHSA-2026:33531", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:34789", "https://access.redhat.com/errata/RHSA-2026:35826", "https://access.redhat.com/errata/RHSA-2026:35827", "https://access.redhat.com/errata/RHSA-2026:35828", "https://access.redhat.com/errata/RHSA-2026:35829", "https://access.redhat.com/errata/RHSA-2026:35830", "https://access.redhat.com/errata/RHSA-2026:35831", "https://access.redhat.com/errata/RHSA-2026:35993", "https://access.redhat.com/errata/RHSA-2026:35994", "https://access.redhat.com/errata/RHSA-2026:36105", "https://access.redhat.com/errata/RHSA-2026:36167", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:36883", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:37435", "https://access.redhat.com/errata/RHSA-2026:37436", "https://access.redhat.com/errata/RHSA-2026:38995", "https://access.redhat.com/errata/RHSA-2026:39005", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39879", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:41930", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42048", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42080", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:44624", "https://access.redhat.com/errata/RHSA-2026:46395", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51341", "https://access.redhat.com/errata/RHSA-2026:52826", "https://access.redhat.com/errata/RHSA-2026:53374", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54395", "https://access.redhat.com/errata/RHSA-2026:54401", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54580", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56143", "https://access.redhat.com/errata/RHSA-2026:56223", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57541", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59546", "https://access.redhat.com/errata/RHSA-2026:59549", "https://access.redhat.com/errata/RHSA-2026:59562", "https://access.redhat.com/errata/RHSA-2026:60315", "https://access.redhat.com/errata/RHSA-2026:60354", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61245", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62549", "https://access.redhat.com/errata/RHSA-2026:63134", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65359", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65851", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/errata/RHSA-2026:66432", "https://access.redhat.com/errata/RHSA-2026:67149", "https://access.redhat.com/errata/RHSA-2026:67159", "https://access.redhat.com/errata/RHSA-2026:67160", "https://access.redhat.com/errata/RHSA-2026:67287", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/security/cve/CVE-2026-39821", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/767220", "https://go.dev/issue/78760", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "https://linux.oracle.com/cve/CVE-2026-39821.html", "https://linux.oracle.com/errata/ELSA-2026-66432-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39821", "https://pkg.go.dev/vuln/GO-2026-5026", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json", "https://ubuntu.com/security/notices/USN-8416-1", "https://ubuntu.com/security/notices/USN-8883-1", "https://ubuntu.com/security/notices/USN-8883-2", "https://ubuntu.com/security/notices/USN-8900-1", "https://ubuntu.com/security/notices/USN-8914-1", "https://www.cve.org/CVERecord?id=CVE-2026-39821" ], "PublishedDate": "2026-05-22T16:16:20.41Z", "LastModifiedDate": "2026-09-17T12:18:05.767Z" }, { "VulnerabilityID": "CVE-2026-39822", "VendorIDs": [ "GO-2026-4970" ], "PkgID": "stdlib@v1.25.8", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.8", "UID": "d0005ada20383185" }, "InstalledVersion": "v1.25.8", "FixedVersion": "1.25.12, 1.26.5, 1.27.0-rc.2", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39822", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:d26105ba1f8f5a80c7c1003d70ffdf168db6a195af8ca2ac903aa236689c45b9", "Title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal", "Description": "On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root.", "Severity": "HIGH", "CweIDs": [ "CWE-61" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:38878", "https://access.redhat.com/security/cve/CVE-2026-39822", "https://bugzilla.redhat.com/2498152", "https://bugzilla.redhat.com/show_bug.cgi?id=2498152", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39822", "https://errata.almalinux.org/9/ALSA-2026-38878.html", "https://errata.rockylinux.org/RLSA-2026:38878", "https://github.com/golang/go/issues/79005", "https://go.dev/cl/797880", "https://go.dev/issue/79005", "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc", "https://linux.oracle.com/cve/CVE-2026-39822.html", "https://linux.oracle.com/errata/ELSA-2026-38995.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39822", "https://pkg.go.dev/vuln/GO-2026-4970", "https://www.cve.org/CVERecord?id=CVE-2026-39822" ], "PublishedDate": "2026-07-08T17:17:21.31Z", "LastModifiedDate": "2026-10-25T17:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-39836", "VendorIDs": [ "GO-2026-4971" ], "PkgID": "stdlib@v1.25.8", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.8", "UID": "d0005ada20383185" }, "InstalledVersion": "v1.25.8", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39836", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:c91fff241e26660cd86c51e471c6e5e0f09181a7e7a2971b46f122723181db03", "Title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows", "Description": "The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/security/cve/CVE-2026-39836", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467810", "https://bugzilla.redhat.com/show_bug.cgi?id=2467811", "https://bugzilla.redhat.com/show_bug.cgi?id=2467813", "https://bugzilla.redhat.com/show_bug.cgi?id=2467815", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467823", "https://bugzilla.redhat.com/show_bug.cgi?id=2467825", "https://bugzilla.redhat.com/show_bug.cgi?id=2467826", "https://bugzilla.redhat.com/show_bug.cgi?id=2467827", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501", "https://errata.almalinux.org/9/ALSA-2026-22121.html", "https://errata.rockylinux.org/RLSA-2026:22121", "https://go.dev/cl/775320", "https://go.dev/issue/79006", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-39836.html", "https://linux.oracle.com/errata/ELSA-2026-22121.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39836", "https://pkg.go.dev/vuln/GO-2026-4971", "https://www.cve.org/CVERecord?id=CVE-2026-39836" ], "PublishedDate": "2026-05-07T20:16:43.593Z", "LastModifiedDate": "2026-10-26T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-42499", "VendorIDs": [ "GO-2026-4977" ], "PkgID": "stdlib@v1.25.8", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.8", "UID": "d0005ada20383185" }, "InstalledVersion": "v1.25.8", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42499", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:713255f2098140f7f63d422b522d3004be35751757b641daa86b372256be9ad1", "Title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing", "Description": "Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.", "Severity": "HIGH", "CweIDs": [ "CWE-1046" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:17713", "https://access.redhat.com/errata/RHSA-2026:17714", "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36754", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54555", "https://access.redhat.com/errata/RHSA-2026:54583", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57487", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:57914", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:62406", "https://access.redhat.com/errata/RHSA-2026:62407", "https://access.redhat.com/errata/RHSA-2026:62753", "https://access.redhat.com/errata/RHSA-2026:62754", "https://access.redhat.com/errata/RHSA-2026:62803", "https://access.redhat.com/errata/RHSA-2026:63022", "https://access.redhat.com/errata/RHSA-2026:63163", "https://access.redhat.com/errata/RHSA-2026:63332", "https://access.redhat.com/errata/RHSA-2026:63636", "https://access.redhat.com/errata/RHSA-2026:64818", "https://access.redhat.com/errata/RHSA-2026:65116", "https://access.redhat.com/errata/RHSA-2026:65117", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65335", "https://access.redhat.com/errata/RHSA-2026:65336", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:65895", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66327", "https://access.redhat.com/errata/RHSA-2026:67148", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:67974", "https://access.redhat.com/errata/RHSA-2026:67975", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:68527", "https://access.redhat.com/security/cve/CVE-2026-42499", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/771520", "https://go.dev/issue/78987", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-42499.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42499", "https://pkg.go.dev/vuln/GO-2026-4977", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42499.json", "https://www.cve.org/CVERecord?id=CVE-2026-42499" ], "PublishedDate": "2026-05-07T20:16:44.54Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-42504", "VendorIDs": [ "GO-2026-5038" ], "PkgID": "stdlib@v1.25.8", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.8", "UID": "d0005ada20383185" }, "InstalledVersion": "v1.25.8", "FixedVersion": "1.25.11, 1.26.4", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42504", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:b4c7943daa899afe355a0badcaed359a061321f48dc8705f80f6fe15e608a6f2", "Title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header", "Description": "Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/security/cve/CVE-2026-42504", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/774481", "https://go.dev/issue/79217", "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw", "https://linux.oracle.com/cve/CVE-2026-42504.html", "https://linux.oracle.com/errata/ELSA-2026-69308.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42504", "https://pkg.go.dev/vuln/GO-2026-5038", "https://www.cve.org/CVERecord?id=CVE-2026-42504" ], "PublishedDate": "2026-06-02T23:16:37.927Z", "LastModifiedDate": "2026-07-22T19:10:00.12Z" }, { "VulnerabilityID": "CVE-2026-56853", "VendorIDs": [ "GO-2026-6089" ], "PkgID": "stdlib@v1.25.8", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.8", "UID": "d0005ada20383185" }, "InstalledVersion": "v1.25.8", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56853", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:1a7621ef46402c293b0a30ff3a3ca31a78cc0cab0e2efcd2001e95f6614bbc92", "Title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service", "Description": "When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56853", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/795540", "https://go.dev/issue/80205", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56853.html", "https://linux.oracle.com/errata/ELSA-2026-89752.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56853", "https://pkg.go.dev/vuln/GO-2026-6089", "https://www.cve.org/CVERecord?id=CVE-2026-56853" ], "PublishedDate": "2026-08-13T22:17:22.093Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56858", "VendorIDs": [ "GO-2026-6091" ], "PkgID": "stdlib@v1.25.8", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.8", "UID": "d0005ada20383185" }, "InstalledVersion": "v1.25.8", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56858", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:d5f72c9867b5e6983fab5b1fd5a70b4e73453dc8daba220fd462cadd7b72a735", "Title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input", "Description": "Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.", "Severity": "HIGH", "CweIDs": [ "CWE-79" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "V3Score": 6.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56858", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/807100", "https://go.dev/issue/80435", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56858.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56858", "https://pkg.go.dev/vuln/GO-2026-6091", "https://www.cve.org/CVERecord?id=CVE-2026-56858" ], "PublishedDate": "2026-08-13T22:17:22.207Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56859", "VendorIDs": [ "GO-2026-6088" ], "PkgID": "stdlib@v1.25.8", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.8", "UID": "d0005ada20383185" }, "InstalledVersion": "v1.25.8", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56859", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:870f2a02fae105609ea2459f1529236811ecad30fc87e848cdd93024341550f6", "Title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue", "Description": "Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69961", "https://access.redhat.com/security/cve/CVE-2026-56859", "https://bugzilla.redhat.com/2480684", "https://bugzilla.redhat.com/2508234", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2480684", "https://bugzilla.redhat.com/show_bug.cgi?id=2508234", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2518147", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17106", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19730", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39830", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-69961.html", "https://errata.rockylinux.org/RLSA-2026:69961", "https://github.com/golang/go/issues/80481", "https://go.dev/cl/803320", "https://go.dev/issue/80481", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56859.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56859", "https://pkg.go.dev/vuln/GO-2026-6088", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-56859" ], "PublishedDate": "2026-08-13T22:17:22.32Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56860", "VendorIDs": [ "GO-2026-6218" ], "PkgID": "stdlib@v1.25.8", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.8", "UID": "d0005ada20383185" }, "InstalledVersion": "v1.25.8", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56860", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:bc7a36105f72b4b6ecdcb2b3994b85ce8e5606efeed139209bcace8ffc85eeaa", "Title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution", "Description": "Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56860", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/803681", "https://go.dev/issue/80494", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56860.html", "https://linux.oracle.com/errata/ELSA-2026-71619.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56860", "https://pkg.go.dev/vuln/GO-2026-6218", "https://www.cve.org/CVERecord?id=CVE-2026-56860" ], "PublishedDate": "2026-08-13T22:17:22.44Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56862", "VendorIDs": [ "GO-2026-6090" ], "PkgID": "stdlib@v1.25.8", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.8", "UID": "d0005ada20383185" }, "InstalledVersion": "v1.25.8", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56862", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:9cfb2adbdd502452575cf31f91ca53c33eb059a4cf8745fdf60da3b80eafe5e1", "Title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages", "Description": "Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56862", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://github.com/golang/go/issues/80528", "https://go.dev/cl/804261", "https://go.dev/issue/80528", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56862.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56862", "https://pkg.go.dev/vuln/GO-2026-6090", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-56862" ], "PublishedDate": "2026-08-13T22:17:22.55Z", "LastModifiedDate": "2026-10-24T16:10:00.153Z" }, { "VulnerabilityID": "CVE-2026-78667", "VendorIDs": [ "GO-2026-6609" ], "PkgID": "stdlib@v1.25.8", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.8", "UID": "d0005ada20383185" }, "InstalledVersion": "v1.25.8", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78667", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:081207902f97a77acfd45421fc32dffaf09419cc9a24cca7922ca88f8f28de5d", "Title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers", "Description": "When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78667", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81858", "https://go.dev/cl/847309", "https://go.dev/issue/81858", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://linux.oracle.com/cve/CVE-2026-78667.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78667", "https://pkg.go.dev/vuln/GO-2026-6609", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78667", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:03.88Z", "LastModifiedDate": "2026-10-09T17:16:49.69Z" }, { "VulnerabilityID": "CVE-2026-78669", "VendorIDs": [ "GO-2026-6611" ], "PkgID": "stdlib@v1.25.8", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.8", "UID": "d0005ada20383185" }, "InstalledVersion": "v1.25.8", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78669", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:b67e4aca720de259d27435f5cdbdcc2928172b9683d84d972af6593479da599a", "Title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "Description": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78669", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81742", "https://go.dev/cl/847186", "https://go.dev/cl/847308", "https://go.dev/issue/81742", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs", "https://linux.oracle.com/cve/CVE-2026-78669.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78669", "https://pkg.go.dev/vuln/GO-2026-6611", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78669", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:04.01Z", "LastModifiedDate": "2026-10-09T17:16:49.857Z" }, { "VulnerabilityID": "CVE-2026-97031", "VendorIDs": [ "GO-2026-6607" ], "PkgID": "stdlib@v1.25.8", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.8", "UID": "d0005ada20383185" }, "InstalledVersion": "v1.25.8", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:9e7e316ead3b9b790894cebe5490212dfa35f6598f2014425db33f06e346c47c" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-97031", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:d61196980c24f85a88ec821fecb553c81df7d2b69849938303e36fa97b1788b0", "Title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references", "Description": "Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:95518", "https://access.redhat.com/security/cve/CVE-2026-97031", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-95518.html", "https://errata.rockylinux.org/RLSA-2026:95518", "https://go.dev/cl/847312", "https://go.dev/issue/81855", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://linux.oracle.com/cve/CVE-2026-97031.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-97031", "https://pkg.go.dev/vuln/GO-2026-6607", "https://www.cve.org/CVERecord?id=CVE-2026-97031" ], "PublishedDate": "2026-10-08T23:17:06.037Z", "LastModifiedDate": "2026-10-09T16:35:35.9Z" } ] } ] }