https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T16:53:20.929589+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:22112 ALSA-2026:22112 — Important: go-toolset:rhel8 security update 2026-10-03T16:53:21.435487+00:00

Affected: AlmaLinux:8: delve, AlmaLinux:8: go-toolset, AlmaLinux:8: golang, AlmaLinux:8: golang-bin, AlmaLinux:8: golang-docs, AlmaLinux:8: golang-misc, AlmaLinux:8: golang-race, AlmaLinux:8: golang-src, AlmaLinux:8: golang-tests

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy (CVE-2026-42501) * html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content (CVE-2026-39823) * cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack (CVE-2026-39819) * net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814) * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820) * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (CVE-2026-39825) * cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction (CVE-2026-39817) * html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826) * net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows (CVE-2026-39836)

For more details about the security issue(s), including t…

 https://cve.radiocsirt.org/vuln/bdu:2026-07952 bdu:2026-07952 2026-10-03T16:53:21.435608+00:00 bdu:2026-07952 https://cve.radiocsirt.org/vuln/bell-cve-2026-39817 BELL-CVE-2026-39817 2026-10-03T16:53:21.435628+00:00

Affected: Alpaquita:23: go, Alpaquita:25: go, Alpaquita:stream: go, BellSoft Hardened Containers:23: go, BellSoft Hardened Containers:25: go, BellSoft Hardened Containers:stream: go

 https://cve.radiocsirt.org/vuln/bit-golang-2026-39817 BIT-golang-2026-39817 — Invoking "go tool pack" does not sanitize output paths in cmd/go 2026-10-03T16:53:21.435655+00:00

Affected: Bitnami: golang

The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1249 certfr-2026-avi-1249 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer… 2026-10-03T16:53:21.435677+00:00 certfr-2026-avi-1249 https://cve.radiocsirt.org/vuln/cleanstart-2026-ab44357 Withdrawn: CLEANSTART-2026-AB44357 — Security fixes in opentofu-fips 1.9.4-r6 2026-10-03T16:53:21.435693+00:00

Withdrawn by the publisher.

Affected: CleanStart: opentofu-fips

Package opentofu-fips version 1.9.4-r6 fixes 13 vulnerabilities: CVE-2026-39820, CVE-2026-42499, CVE-2026-33814, CVE-2026-33811, CVE-2026-39836...

 https://cve.radiocsirt.org/vuln/euvd-2026-309267 EUVD-2026-309267 2026-10-03T16:53:21.435713+00:00 EUVD-2026-309267 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39817 fkie_cve-2026-39817 2026-10-03T16:53:21.435724+00:00

The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.

 https://cve.radiocsirt.org/vuln/ghsa-qc64-m6c2-v4x7 GHSA-qc64-m6c2-v4x7 2026-10-03T16:53:21.435745+00:00

The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-39817 msrc_CVE-2026-39817 — Invoking "go tool pack" does not sanitize output paths in cmd/go 2026-10-03T16:53:21.435760+00:00 msrc_CVE-2026-39817 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10723-1 openSUSE-SU-2026:10723-1 — go1.25-1.25.10-1.1 on GA media 2026-10-03T16:53:21.435777+00:00

go1.25-1.25.10-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:43692 RHSA-2026:43692 — Red Hat Security Advisory: Red Hat OpenShift API for Data Protection 2026-10-03T16:53:21.435799+00:00

golang.org/x/net/html: Quadratic parsing complexity in golang.org/x/net/html golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication golang.org/x/net/html: Infinite parsing loop in golang.org/x/net golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction net/mail: golang: Go net/mail: Denial of Service via crafted email inputs golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content n…

 https://cve.radiocsirt.org/vuln/rlsa-2026:22112 RLSA-2026:22112 — Important: go-toolset:rhel8 security update 2026-10-03T16:53:21.435918+00:00

Affected: Rocky Linux:8: delve, Rocky Linux:8: golang

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)

* cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy (CVE-2026-42501)

* html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content (CVE-2026-39823)

* cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack (CVE-2026-39819)

* net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814)

* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)

* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

* net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (CVE-2026-39825)

* cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction (CVE-2026-39817)

* html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826)

* net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows (CVE-2026-39836)

For more details about the security issue(s), including the impact, a CVSS…

 https://cve.radiocsirt.org/vuln/suse-su-2026:21804-1 SUSE-SU-2026:21804-1 — Security update for go1.26 2026-10-03T16:53:21.435961+00:00

Security update for go1.26

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-39817 UBUNTU-CVE-2026-39817 2026-10-03T16:53:21.435983+00:00

Affected: Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.8 and 26 more

The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1437 WID-SEC-W-2026-1437 — Golang Go: Mehrere Schwachstellen 2026-10-03T16:53:21.436043+00:00

Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.