https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T12:13:51.399018+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:10704 ALSA-2026:10704 — Important: go-toolset:rhel8 security update 2026-10-02T12:13:55.582328+00:00

Affected: AlmaLinux:8: delve, AlmaLinux:8: go-toolset, AlmaLinux:8: golang, AlmaLinux:8: golang-bin, AlmaLinux:8: golang-docs, AlmaLinux:8: golang-misc, AlmaLinux:8: golang-race, AlmaLinux:8: golang-src, AlmaLinux:8: golang-tests

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) * golang: cmd/compile: no-op interface conversion bypasses overlap checking (CVE-2026-27144) * cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names (CVE-2026-27140) * golang: cmd/compile: possible memory corruption after bound check elimination (CVE-2026-27143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2026-07246 bdu:2026-07246 2026-10-02T12:13:55.582448+00:00 bdu:2026-07246 https://cve.radiocsirt.org/vuln/bell-cve-2026-32283 BELL-CVE-2026-32283 2026-10-02T12:13:55.582468+00:00

Affected: Alpaquita:23: go, Alpaquita:25: go, Alpaquita:stream: go, BellSoft Hardened Containers:23: go, BellSoft Hardened Containers:25: go, BellSoft Hardened Containers:stream: go

 https://cve.radiocsirt.org/vuln/bit-golang-2026-32283 BIT-golang-2026-32283 — Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls 2026-10-02T12:13:55.582496+00:00

Affected: Bitnami: golang

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0498 certfr-2026-avi-0498 — De multiples vulnérabilités ont été découvertes dans Zabbix Agent2. Elles permettent à un attaquant de provoquer un pro… 2026-10-02T12:13:55.582520+00:00 certfr-2026-avi-0498 https://cve.radiocsirt.org/vuln/cleanstart-2026-ac01087 Withdrawn: CLEANSTART-2026-AC01087 — During chain building, the amount of work that is done is not correctly limited when a large number of intermediate cer… 2026-10-02T12:13:55.582536+00:00

Withdrawn by the publisher.

Affected: CleanStart: gitness

Multiple security vulnerabilities affect the gitness package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-371751 EUVD-2026-371751 2026-10-02T12:13:55.582558+00:00 EUVD-2026-371751 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32283 fkie_cve-2026-32283 2026-10-02T12:13:55.582571+00:00

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

 https://cve.radiocsirt.org/vuln/ghsa-jrg3-gfjw-hm96 GHSA-jrg3-gfjw-hm96 2026-10-02T12:13:55.582593+00:00

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-32283 msrc_CVE-2026-32283 — Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls 2026-10-02T12:13:55.582608+00:00 msrc_CVE-2026-32283 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10514-1 openSUSE-SU-2026:10514-1 — go1.25-1.25.9-1.1 on GA media 2026-10-02T12:13:55.582625+00:00

go1.25-1.25.9-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:11863 RHSA-2026:11863 — Red Hat Security Advisory: rhc-worker-playbook security update 2026-10-02T12:13:55.582645+00:00

golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages

 https://cve.radiocsirt.org/vuln/rlsa-2026:19133 RLSA-2026:19133 — Important: git-lfs security update 2026-10-02T12:13:55.582665+00:00

Affected: Rocky Linux:10: git-lfs

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:21355-1 SUSE-SU-2026:21355-1 — Security update for go1.25 2026-10-02T12:13:55.582693+00:00

Security update for go1.25

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-32283 UBUNTU-CVE-2026-32283 2026-10-02T12:13:55.582714+00:00

Affected: Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.8 and 26 more

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

 https://cve.radiocsirt.org/vuln/vde-2026-088 VDE-2026-088 — METTLER TOLEDO: LabX Standard and Enterprise Report on External Component Analysis - v21.4 2026-10-02T12:13:55.582777+00:00

The vulnerabilities found in LabX Standard versions 21.3.22 - 21.4.23 are CVE-2025-69419, CVE-2026-0915, CVE-2025-15467, CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Standard v21.4.25.

The vulnerabilities found in LabX Enterprise versions 21.3.22 - 21.4.23 are CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Enterprise v21.4.25

All other vulnerabilities are to be fixed in the upcoming releases.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1006 WID-SEC-W-2026-1006 — Golang Go: Mehrere Schwachstellen 2026-10-02T12:13:55.582834+00:00

Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um Speicherbeschädigungen zu verursachen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand auszulösen oder andere, nicht näher spezifizierte Angriffe durchzuführen.