https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T10:44:11.012525+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0199 certfr-2026-avi-0199 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Certaines d'entre elles permettent à un attaq… 2026-10-02T10:44:11.046349+00:00 certfr-2026-avi-0199 https://cve.radiocsirt.org/vuln/cleanstart-2026-ba61304 Withdrawn: CLEANSTART-2026-BA61304 — Security fixes in cosign 2.4.3-r0 2026-10-02T10:44:11.046398+00:00

Withdrawn by the publisher.

Affected: CleanStart: cosign

Package cosign version 2.4.3-r0 fixes 82 vulnerabilities: CVE-2025-0913, CVE-2025-15558, CVE-2025-22868, CVE-2025-22869, CVE-2025-22870...

 https://cve.radiocsirt.org/vuln/euvd-2026-262633 EUVD-2026-262633 2026-10-02T10:44:11.046433+00:00 EUVD-2026-262633 https://cve.radiocsirt.org/vuln/fkie_cve-2025-66564 fkie_cve-2025-66564 2026-10-02T10:44:11.046446+00:00

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits the Content-Type header (which is also untrusted data) on an application string. As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed Content-Type header, a call to api.ParseJSONRequest or api.getContentType incurs allocations of O(n) bytes (where n stands for the length of the function's argument). This vulnerability is fixed in 2.0.3.

 https://cve.radiocsirt.org/vuln/ghsa-4qg8-fj49-pxjh GHSA-4qg8-fj49-pxjh — Sigstore Timestamp Authority allocates excessive memory during request parsing 2026-10-02T10:44:11.046473+00:00

Affected: Go: github.com/sigstore/timestamp-authority

### Impact

**Excessive memory allocation**

Function [api.ParseJSONRequest](https://github.com/sigstore/timestamp-authority/blob/26d7d426d3000abdbdf2df34de56bb92246c0365/pkg/api/timestamp.go#L63) currently splits (via a call to [strings.Split](https://pkg.go.dev/strings#Split)) an optionally-provided OID (which is untrusted data) on periods. Similarly, function [api.getContentType](https://github.com/sigstore/timestamp-authority/blob/26d7d426d3000abdbdf2df34de56bb92246c0365/pkg/api/timestamp.go#L114) splits the `Content-Type` header (which is also untrusted data) on an `application` string.

As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed `Content-Type` header, a call to `api.ParseJSONRequest` or `api.getContentType` incurs allocations of O(n) bytes (where n stands for the length of the function's argument). Relevant weakness: [CWE-405: Asymmetric Resource Consumption (Amplification)](https://cwe.mitre.org/data/definitions/405.html)

### Patches

Upgrade to v2.0.3.

### Workarounds

There are no workarounds with the service itself. If the service is behind a load balancer, configure the load balancer to reject excessively large requests.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10131-1 openSUSE-SU-2026:10131-1 — trivy-0.69.0-1.1 on GA media 2026-10-02T10:44:11.046507+00:00

trivy-0.69.0-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:1517 RHSA-2026:1517 — Red Hat Security Advisory: RHACS 4.8.8 security and bug fix update 2026-10-02T10:44:11.046525+00:00

node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications qs: qs: Denial of Service via improper input validation in array parsing golang: archive/tar: Unbounded allocation when parsing GNU sparse map crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate node-forge: node-forge ASN.1 Unbounded Recursion github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token github.com/sigstore/timestamp-authority: Sigstore Timestamp Authority: Denial of Service via excessive OID or Content-Type header parsing jspdf: jsPDF Local File Inclusion/Path Traversal vulnerability GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write @remix-run/router: react-router: React Router vulnerable to XSS via Open Redirects

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-66564 UBUNTU-CVE-2025-66564 2026-10-02T10:44:11.046556+00:00

Affected: Ubuntu:25.10: golang-github-sigstore-timestamp-authority, Ubuntu:26.04:LTS: golang-github-sigstore-timestamp-authority

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits the Content-Type header (which is also untrusted data) on an application string. As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed Content-Type header, a call to api.ParseJSONRequest or api.getContentType incurs allocations of O(n) bytes (where n stands for the length of the function's argument). This vulnerability is fixed in 2.0.3.