https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T16:26:14.443421+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-61727 CVE-2025-61727 — Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509 2026-10-07T16:26:14.448138+00:00

Affected: Go standard library crypto/x509

An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.

 https://cve.radiocsirt.org/vuln/ghsa-c6gw-w398-hv78 GHSA-c6gw-w398-hv78 — DoS in go-jose Parsing 2026-10-07T16:26:14.448190+00:00

Affected: Go: github.com/go-jose/go-jose/v4, Go: github.com/go-jose/go-jose/v3, Go: github.com/go-jose/go-jose

### Impact When parsing compact JWS or JWE input, go-jose could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of '.' characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service.

### Patches Version 4.0.5 fixes this issue

### Workarounds Applications could pre-validate payloads passed to go-jose do not contain an excessive number of '.' characters.

### References This is the same sort of issue as in the golang.org/x/oauth2/jws package as CVE-2025-22868 and Go issue https://go.dev/issue/71490.