https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T15:48:18.169202+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-61726 CVE-2025-61726 — Memory exhaustion in query parameter parsing in net/url 2026-10-08T15:48:18.298038+00:00

Affected: Go standard library net/url, Red Hat Cryostat 4 on RHEL 9, Red Hat HawtIO HawtIO 4.3.1, Red Hat HawtIO HawtIO 4.4.0, Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 10, Red Hat Ansible Automation Platform 2.6 for RHEL 9 and 152 more

The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.

 https://cve.radiocsirt.org/vuln/ghsa-3p65-76g6-3w7r GHSA-3p65-76g6-3w7r — Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm 2026-10-08T15:48:18.299774+00:00

Affected: Go: github.com/distribution/distribution/v3, Go: github.com/distribution/distribution

hi guys,

commit: 40594bd98e6d6ed993b5c6021c93fdf96d2e5851 (as-of 2026-01-31) contact: GitHub Security Advisory (https://github.com/distribution/distribution/security/advisories/new)

## summary

in pull-through cache mode, distribution discovers token auth endpoints by parsing `WWW-Authenticate` challenges returned by the configured upstream registry. the `realm` URL from a bearer challenge is used without validating that it matches the upstream registry host. as a result, an attacker-controlled upstream (or an attacker with MitM position to the upstream) can cause distribution to send the configured upstream credentials via basic auth to an attacker-controlled `realm` URL.

this is the same vulnerability class as CVE-2020-15157 (containerd), but in distribution’s pull-through cache proxy auth flow.

## severity

HIGH

note: the baseline impact is credential disclosure of the configured upstream credentials. if a deployment uses broader credentials for upstream auth (for example cloud iam credentials), the downstream impact can be higher; i am not claiming this as default for all deployments.

## impact

credential exfiltration of the upstream authentication material configured for the pull-through cache.

attacker starting positions that make this realistic: - supply chain / configuration: an operator configures a proxy cache to use an upstream that becomes attacker-controlled (compromised registry, stale domain, or a malicious mirror) - network: MitM on the upstream conne…