https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 03:32:23 +0000 https://cve.radiocsirt.org/vuln/bdu:2023-05841 bdu:2023-05841 https://cve.radiocsirt.org/vuln/bdu:2023-05841 https://cve.radiocsirt.org/vuln/certfr-2022-avi-1040 certfr-2022-avi-1040 https://cve.radiocsirt.org/vuln/certfr-2022-avi-1040 https://cve.radiocsirt.org/vuln/cleanstart-2024-ik84393 <p><strong>Affected:</strong> CleanStart: docker-cli-compose, CleanStart: gitea</p> <p>CVE-2022-32149 affects multiple packages. An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: docker-cli-compose, CleanStart: gitea</p> <p>CVE-2022-32149 affects multiple packages. An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2024-ik84393 https://cve.radiocsirt.org/vuln/euvd-2026-239726 EUVD-2026-239726 https://cve.radiocsirt.org/vuln/euvd-2026-239726 https://cve.radiocsirt.org/vuln/fkie_cve-2022-32149 <p>An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.</p> <p>An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-32149 https://cve.radiocsirt.org/vuln/ghsa-69ch-w2m2-3vjp <p><strong>Affected:</strong> Go: golang.org/x/text</p> <p>The BCP 47 tag parser has quadratic time complexity due to inherent aspects of its design. Since the parser is, by design, exposed to untrusted user input, this can be leveraged to force a program to consume significant time parsing Accept-Language headers. The parser cannot be easily rewritten to fix this behavior for various reasons. Instead the solution implemented in this CL is to limit the total complexity of tags passed into ParseAcceptLanguage by limiting the number of dashes in the string to 1000. This should be more than enough for the majority of real world use cases, where the number of tags being sent is likely to be in the single digits.</p> <p>### Specific Go Packages Affected golang.org/x/text/language</p> <p><strong>Affected:</strong> Go: golang.org/x/text</p> <p>The BCP 47 tag parser has quadratic time complexity due to inherent aspects of its design. Since the parser is, by design, exposed to untrusted user input, this can be leveraged to force a program to consume significant time parsing Accept-Language headers. The parser cannot be easily rewritten to fix this behavior for various reasons. Instead the solution implemented in this CL is to limit the total complexity of tags passed into ParseAcceptLanguage by limiting the number of dashes in the string to 1000. This should be more than enough for the majority of real world use cases, where the number of tags being sent is likely to be in the single digits.</p> <p>### Specific Go Packages Affected golang.org/x/text/language</p> https://cve.radiocsirt.org/vuln/ghsa-69ch-w2m2-3vjp https://cve.radiocsirt.org/vuln/gsd-2022-32149 gsd-2022-32149 https://cve.radiocsirt.org/vuln/gsd-2022-32149 https://cve.radiocsirt.org/vuln/msrc_cve-2022-32149 msrc_CVE-2022-32149 https://cve.radiocsirt.org/vuln/msrc_cve-2022-32149 https://cve.radiocsirt.org/vuln/oesa-2024-1527 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP2: podman</p> <p>Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library. Security Fix(es): An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.(CVE-2022-32149)</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP2: podman</p> <p>Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library. Security Fix(es): An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.(CVE-2022-32149)</p> https://cve.radiocsirt.org/vuln/oesa-2024-1527 https://cve.radiocsirt.org/vuln/opensuse-su-2024:12426-1 <p>starboard-0.15.11-1.1 on GA media</p> <p>starboard-0.15.11-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:12426-1 https://cve.radiocsirt.org/vuln/rhba-2023:4275 <p>golang: net/http: handle server errors after sending GOAWAY golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags golang: net/url: JoinPath does not strip relative path components in all circumstances golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding golang: crypto/tls: large handshake records may cause panics golang: net/http, mime/multipart: denial of service from excessive resource consumption golang: net/http, net/textproto: denial of service from excessive memory allocation golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption golang: go/parser: Infinite loop in parsing golang: html/template: backticks not treated as string delimiters golang: html/template: improper sanitization of CSS values golang: html/template: improper handling of JavaScript whitespace golang: html/template: improper handling of empty HTML attributes</p> <p>golang: net/http: handle server errors after sending GOAWAY golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags golang: net/url: JoinPath does not strip relative path components in all circumstances golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding golang: crypto/tls: large handshake records may cause panics golang: net/http, mime/multipart: denial of service from excessive resource consumption golang: net/http, net/textproto: denial of service from excessive memory allocation golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption golang: go/parser: Infinite loop in parsing golang: html/template: backticks not treated as string delimiters golang: html/template: improper sanitization of CSS values golang: html/template: improper handling of JavaScript whitespace golang: html/template: improper handling of empty HTML attributes</p> https://cve.radiocsirt.org/vuln/rhba-2023:4275 https://cve.radiocsirt.org/vuln/suse-el-9-client-tools-2023-3875 <p>Security update for SUSE Manager Client Tools</p> <p>Security update for SUSE Manager Client Tools</p> https://cve.radiocsirt.org/vuln/suse-el-9-client-tools-2023-3875 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-32149 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: golang-x-text, Ubuntu:18.04:LTS: golang-x-text, Ubuntu:20.04:LTS: golang-golang-x-text, Ubuntu:20.04:LTS: golang-x-text, Ubuntu:22.04:LTS: golang-golang-x-text</p> <p>An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: golang-x-text, Ubuntu:18.04:LTS: golang-x-text, Ubuntu:20.04:LTS: golang-golang-x-text, Ubuntu:20.04:LTS: golang-x-text, Ubuntu:22.04:LTS: golang-golang-x-text</p> <p>An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-32149 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-2134 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and Red Hat OpenShift ausnutzen, um einen Cross site Scripting Angriff durchzuführen, Informationen offenzulegen oder einen Denial of Service zu verursachen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and Red Hat OpenShift ausnutzen, um einen Cross site Scripting Angriff durchzuführen, Informationen offenzulegen oder einen Denial of Service zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2022-2134