https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T21:03:04.212877+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-61729 CVE-2025-61729 — Excessive resource consumption when printing error string for host certificate validation in crypto/x509 2026-10-08T21:03:04.333334+00:00

Affected: Go standard library crypto/x509

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.

 https://cve.radiocsirt.org/vuln/ghsa-273p-m2cw-6833 GHSA-273p-m2cw-6833 — Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty Message 2026-10-08T21:03:04.333404+00:00

Affected: Go: github.com/sigstore/rekor

## Summary

Rekor’s cose v0.0.1 entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty `spec.message`. `validate()` returns nil (success) when `message` is empty, leaving `sign1Msg` uninitialized, and `Canonicalize()` later dereferences `v.sign1Msg.Payload`.

## Impact

A malformed proposed entry of the `cose/v0.0.1` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal.

## Patches

Upgrade to v1.5.0

## Workarounds

None