https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T11:35:35.742569+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:46391 ALSA-2026:46391 — Important: grafana security, bug fix, and enhancement update 2026-10-02T11:35:36.197686+00:00

Affected: AlmaLinux:8: grafana, AlmaLinux:8: grafana-selinux

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation (CVE-2026-44740)

Bug Fix(es) and Enhancement(s):

* [grafana / almalinux-8.10.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:AlmaLinux-188279)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/cleanstart-2026-aq65185 Withdrawn: CLEANSTART-2026-AQ65185 — Security fixes for CVE-2025-47913, CVE-2025-47914, CVE-2025-58181, CVE-2025-61727, CVE-2025-61729, CVE-2026-1229, CVE-2… 2026-10-02T11:35:36.197776+00:00

Withdrawn by the publisher.

Affected: CleanStart: terragrunt-fips

Multiple security vulnerabilities affect the terragrunt-fips package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-323552 EUVD-2026-323552 2026-10-02T11:35:36.197806+00:00 EUVD-2026-323552 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44740 fkie_cve-2026-44740 2026-10-02T11:35:36.197821+00:00

Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.

 https://cve.radiocsirt.org/vuln/ghsa-m3xc-h892-ggx6 GHSA-m3xc-h892-ggx6 — go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion 2026-10-02T11:35:36.197845+00:00

Affected: Go: github.com/go-git/go-billy/v5, Go: github.com/go-git/go-billy/v6

### Impact Multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption.

These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures.

### Patches Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to `v5` are likely to be affected, users are recommended to upgrade to a supported `go-billy` version.

### Credits Thanks to @faran66 for finding and reporting this issue privately to the go-git project. 🙇

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10856-1 openSUSE-SU-2026:10856-1 — rclone-1.74.2-1.1 on GA media 2026-10-02T11:35:36.197879+00:00

rclone-1.74.2-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:32963 RHSA-2026:32963 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-02T11:35:36.197909+00:00

github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation github.com/containerd/containerd: containerd: Denial of Service via maliciously crafted image leading to unbounded group parsing github.com/containerd/containerd: containerd: Arbitrary host file read via symlink following in CRI checkpoint restore github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration.

 https://cve.radiocsirt.org/vuln/rlsa-2026:46391 RLSA-2026:46391 — Important: grafana security, bug fix, and enhancement update 2026-10-02T11:35:36.197932+00:00

Affected: Rocky Linux:8: grafana

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation (CVE-2026-44740)

Bug Fix(es) and Enhancement(s):

* [grafana / rhel-8.10.z] Remove Lua ExclusiveArch macro for Konflux build (JIRA:Rocky Linux-188279)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:22157-1 SUSE-SU-2026:22157-1 — Security update for amazon-ssm-agent 2026-10-02T11:35:36.197957+00:00

Security update for amazon-ssm-agent

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-44740 UBUNTU-CVE-2026-44740 2026-10-02T11:35:36.197980+00:00

Affected: Ubuntu:22.04:LTS: golang-github-go-git-go-billy, Ubuntu:24.04:LTS: golang-github-go-git-go-billy, Ubuntu:25.10: golang-github-go-git-go-billy, Ubuntu:26.04:LTS: golang-github-go-git-go-billy

Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2520 WID-SEC-W-2026-2520 — Red Hat Enterprise Linux (go-billy): Schwachstelle ermöglicht Denial of Service 2026-10-02T11:35:36.198006+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.