https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-13T02:03:43.060759+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-ld70674 CLEANSTART-2026-LD70674 — When http 2026-10-13T02:03:43.066239+00:00

Affected: CleanStart: ollama-fips, CleanStart: vt-cli

CVE-2026-56866 affects multiple packages. When http. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-384924 EUVD-2026-384924 2026-10-13T02:03:43.066295+00:00 EUVD-2026-384924 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56866 fkie_cve-2026-56866 2026-10-13T02:03:43.066311+00:00

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.

 https://cve.radiocsirt.org/vuln/ghsa-f5vf-8pvc-394g GHSA-f5vf-8pvc-394g 2026-10-13T02:03:43.066336+00:00

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-56866 msrc_CVE-2026-56866 — HTTP/1 client connection desynchronization after CONNECT rejection in net/http 2026-10-13T02:03:43.066355+00:00 msrc_CVE-2026-56866 https://cve.radiocsirt.org/vuln/opensuse-su-2026:12093-1 openSUSE-SU-2026:12093-1 — go1.26-1.26.9-1.1 on GA media 2026-10-13T02:03:43.066370+00:00

go1.26-1.26.9-1.1 on GA media

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-56866 UBUNTU-CVE-2026-56866 2026-10-13T02:03:43.066390+00:00

Affected: Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.8 and 24 more

[Unknown description]