https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T13:06:01.077849+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-ae16267 Withdrawn: CLEANSTART-2026-AE16267 — gRPC-Go is the Go language implementation of gRPC 2026-10-02T13:06:01.713822+00:00

Withdrawn by the publisher.

Affected: CleanStart: step

Multiple security vulnerabilities affect the step package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-363465 EUVD-2026-363465 2026-10-02T13:06:01.713890+00:00 EUVD-2026-363465 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56855 fkie_cve-2026-56855 2026-10-02T13:06:01.713906+00:00

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-56855 msrc_CVE-2026-56855 — Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh 2026-10-02T13:06:01.713931+00:00 msrc_CVE-2026-56855 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11685-1 openSUSE-SU-2026:11685-1 — hauler-2.1.0-2.1 on GA media 2026-10-02T13:06:01.713949+00:00

hauler-2.1.0-2.1 on GA media

 https://cve.radiocsirt.org/vuln/rlsa-2026:70640 RLSA-2026:70640 — Important: buildah security update 2026-10-02T13:06:01.713965+00:00

Affected: Rocky Linux:9: buildah

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

* buildah: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

* buildah: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

* buildah: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

* buildah: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

* buildah: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:23736-1 SUSE-SU-2026:23736-1 — Security update for google-guest-agent 2026-10-02T13:06:01.713995+00:00

Security update for google-guest-agent

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-56855 UBUNTU-CVE-2026-56855 2026-10-02T13:06:01.714013+00:00

Affected: Ubuntu:16.04:LTS: golang-defaults, Ubuntu:18.04:LTS: golang-defaults, Ubuntu:20.04:LTS: golang-defaults, Ubuntu:20.04:LTS: golang-1.20, Ubuntu:20.04:LTS: golang-1.21, Ubuntu:20.04:LTS: golang-1.22, Ubuntu:22.04:LTS: golang-1.17, Ubuntu:22.04:LTS: golang-1.20, Ubuntu:22.04:LTS: golang-1.21, Ubuntu:22.04:LTS: golang-1.22 and 13 more

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.