https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T20:10:00.498537+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2023:0328 ALSA-2023:0328 — Moderate: go-toolset and golang security and bug fix update 2026-10-02T20:10:00.836611+00:00

Affected: AlmaLinux:9: go-toolset, AlmaLinux:9: golang, AlmaLinux:9: golang-bin, AlmaLinux:9: golang-docs, AlmaLinux:9: golang-misc, AlmaLinux:9: golang-race, AlmaLinux:9: golang-src, AlmaLinux:9: golang-tests

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

The golang packages provide the Go programming language compiler.

Security Fix(es):

* golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879) * golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880) * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* Internal linking fails on ppc64le (BZ#2144547) * crypto testcases fail on golang on s390x [almalinux-9] (BZ#2149311)

 https://cve.radiocsirt.org/vuln/bell-cve-2022-2879 Withdrawn: BELL-CVE-2022-2879 — CVE-2022-2879 does not affect BellSoft software 2026-10-02T20:10:00.836742+00:00

Withdrawn by the publisher.

https://cve.radiocsirt.org/vuln/bit-golang-2022-2879 BIT-golang-2022-2879 — Unbounded memory consumption when reading headers in archive/tar 2026-10-02T20:10:00.836767+00:00

Affected: Bitnami: golang

Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.

 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0258 certfr-2023-avi-0258 — De multiples vulnérabilités ont été découvertes dans les produits <span class="textit">IBM</span>. Elles permettent à u… 2026-10-02T20:10:00.836791+00:00 certfr-2023-avi-0258 https://cve.radiocsirt.org/vuln/cnvd-2022-87371 cnvd-2022-87371 2026-10-02T20:10:00.836809+00:00 cnvd-2022-87371 https://cve.radiocsirt.org/vuln/euvd-2026-216026 EUVD-2026-216026 2026-10-02T20:10:00.836822+00:00 EUVD-2026-216026 https://cve.radiocsirt.org/vuln/fkie_cve-2022-2879 fkie_cve-2022-2879 2026-10-02T20:10:00.836832+00:00

Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.

 https://cve.radiocsirt.org/vuln/ghsa-fqpx-62jv-7r6r GHSA-fqpx-62jv-7r6r 2026-10-02T20:10:00.836858+00:00

Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.

 https://cve.radiocsirt.org/vuln/gsd-2022-2879 gsd-2022-2879 2026-10-02T20:10:00.836885+00:00 gsd-2022-2879 https://cve.radiocsirt.org/vuln/msrc_cve-2022-2879 msrc_CVE-2022-2879 — Unbounded memory consumption when reading headers in archive/tar 2026-10-02T20:10:00.836903+00:00 msrc_CVE-2022-2879 https://cve.radiocsirt.org/vuln/oesa-2022-2004 OESA-2022-2004 — golang security update 2026-10-02T20:10:00.836939+00:00

Affected: openEuler:20.03-LTS-SP1: golang, openEuler:20.03-LTS-SP3: golang, openEuler:22.03-LTS: golang

The Go Programming Language Security Fix(es): Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.(CVE-2022-2879) Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparseable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparseable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request&apos;s Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.(CVE-2022-2880) Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions…

 https://cve.radiocsirt.org/vuln/opensuse-su-2024:12391-1 openSUSE-SU-2024:12391-1 — go1.18-1.18.7-1.1 on GA media 2026-10-02T20:10:00.837014+00:00

go1.18-1.18.7-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2022:7398 RHSA-2022:7398 — Red Hat Security Advisory: OpenShift Container Platform 4.12.0 packages and security update 2026-10-02T20:10:00.837042+00:00

go-yaml: Denial of Service in go-yaml golang: net/http: improper sanitization of Transfer-Encoding header golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters cri-o: incorrect handling of the supplementary groups python-scciclient: missing server certificate verification kubernetes: Unauthorized read of Custom Resources kube-apiserver: Aggregated API server can cause clients to be redirected (SSRF) OpenShift: Missing HTTP Strict Transport Security cri-o: Security regression of CVE-2022-27652 golang: net/http: handle server errors after sending GOAWAY golang: compress/gzip: stack exhaustion in Reader.Read golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service golang: net/url: JoinPath does not strip relative path components in all circumstances golang: regexp/syntax: limit memory used by parsing regexps

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-2879 UBUNTU-CVE-2022-2879 2026-10-02T20:10:00.837118+00:00

Affected: Ubuntu:14.04:LTS: golang-1.10, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:18.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:18.04:LTS: golang-1.8 and 8 more

Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0157 WID-SEC-W-2023-0157 — Red Hat OpenShift: Mehrere Schwachstellen 2026-10-02T20:10:00.837176+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um beliebigen Programmcode auszuführen Informationen offenzulegen oder einen Denial of Service zu verursachen.