https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T01:40:51.517119+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-61727 CVE-2025-61727 — Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509 2026-10-04T01:40:51.831773+00:00

Affected: Go standard library crypto/x509

An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.

 https://cve.radiocsirt.org/vuln/ghsa-273p-m2cw-6833 GHSA-273p-m2cw-6833 — Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty Message 2026-10-04T01:40:51.831852+00:00

Affected: Go: github.com/sigstore/rekor

## Summary

Rekor’s cose v0.0.1 entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty `spec.message`. `validate()` returns nil (success) when `message` is empty, leaving `sign1Msg` uninitialized, and `Canonicalize()` later dereferences `v.sign1Msg.Payload`.

## Impact

A malformed proposed entry of the `cose/v0.0.1` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal.

## Patches

Upgrade to v1.5.0

## Workarounds

None