https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T13:29:15.387713+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-333731 EUVD-2026-333731 2026-10-03T13:29:15.510137+00:00 EUVD-2026-333731 https://cve.radiocsirt.org/vuln/fkie_cve-2026-50134 fkie_cve-2026-50134 2026-10-03T13:29:15.510176+00:00

Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server (or an attacker controlling its DNS or response) could therefore redirect the request to a host that the policy was meant to forbid and Hugo would fetch from the redirected target. The same bypass also lifted any host-shape restriction the operator had put in place. This vulnerability is fixed in 0.162.0.

 https://cve.radiocsirt.org/vuln/ghsa-vxgm-5rmg-5w8g GHSA-vxgm-5rmg-5w8g — Hugo: security.http.urls allow-list bypass via HTTP redirects 2026-10-03T13:29:15.510214+00:00

Affected: Go: github.com/gohugoio/hugo

**Commit:** [86fbb0f7a8](https://github.com/gohugoio/hugo/commit/86fbb0f7a8) — _security: Validate redirects against security.http.urls_ **Affected versions:** v0.91.0 (when `security.http.urls` was introduced) through v0.161.1. **Fixed in:** v0.162.0. **Severity:** Only relevant for sites that rely on `security.http.urls` as a trust boundary — e.g. CI builds that fetch remote resources but want to constrain which hosts can be reached. Not an issue if you fully trust every URL passed to `resources.GetRemote`.

**Description.** `resources.GetRemote` enforces `security.http.urls` on the URL it is called with, but until v0.162.0 it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server (or an attacker controlling its DNS or response) could therefore redirect the request to a host that the policy was meant to forbid — for example, `http://localhost/` or an internal IP — and Hugo would fetch from the redirected target. The same bypass also lifted any host-shape restriction the operator had put in place.

**Mitigation.** v0.162.0 installs a `CheckRedirect` on the HTTP client used by `resources.GetRemote` that re-runs `security.http.urls` on every redirect target and caps the redirect chain at 10 hops. No configuration change is required.

 https://cve.radiocsirt.org/vuln/rhsa-2026:24577 RHSA-2026:24577 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-03T13:29:15.510256+00:00

go.opentelemetry.io/otel: go.opentelemetry.io/otel/schema/v1.0: go.opentelemetry.io/otel/schema/v1.1: OpenTelemetry-Go: Denial of Service due to file descriptor leak github.com/gohugoio/hugo: Hugo: Security policy bypass via HTTP redirect manipulation github.com/gohugoio/hugo: Hugo: Information disclosure due to symlink confinement bypass

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-50134 UBUNTU-CVE-2026-50134 2026-10-03T13:29:15.510282+00:00

Affected: Ubuntu:16.04:LTS: hugo, Ubuntu:18.04:LTS: hugo, Ubuntu:20.04:LTS: hugo, Ubuntu:22.04:LTS: hugo, Ubuntu:Pro:24.04:LTS: hugo, Ubuntu:25.10: hugo, Ubuntu:26.04:LTS: hugo

Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server (or an attacker controlling its DNS or response) could therefore redirect the request to a host that the policy was meant to forbid and Hugo would fetch from the redirected target. The same bypass also lifted any host-shape restriction the operator had put in place. This vulnerability is fixed in 0.162.0.