https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 20:47:23 +0000 https://cve.radiocsirt.org/vuln/alsa-2024:0748 <p><strong>Affected:</strong> AlmaLinux:8: aardvark-dns, AlmaLinux:8: buildah, AlmaLinux:8: buildah-tests, AlmaLinux:8: cockpit-podman, AlmaLinux:8: conmon, AlmaLinux:8: container-selinux, AlmaLinux:8: containernetworking-plugins, AlmaLinux:8: containers-common, AlmaLinux:8: crit, AlmaLinux:8: criu and 24 more</p> <p>The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.</p> <p>Security Fix(es):</p> <p>* runc: file descriptor leak (&#34;Leaky Vessels&#34;) (CVE-2024-21626)</p> <p>A AlmaLinux Security Bulletin which addresses further details about the Leaky Vessels flaw is available in the References section.</p> <p>* golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests (CVE-2023-39326) * golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges. (CVE-2023-45287)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: aardvark-dns, AlmaLinux:8: buildah, AlmaLinux:8: buildah-tests, AlmaLinux:8: cockpit-podman, AlmaLinux:8: conmon, AlmaLinux:8: container-selinux, AlmaLinux:8: containernetworking-plugins, AlmaLinux:8: containers-common, AlmaLinux:8: crit, AlmaLinux:8: criu and 24 more</p> <p>The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.</p> <p>Security Fix(es):</p> <p>* runc: file descriptor leak (&#34;Leaky Vessels&#34;) (CVE-2024-21626)</p> <p>A AlmaLinux Security Bulletin which addresses further details about the Leaky Vessels flaw is available in the References section.</p> <p>* golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests (CVE-2023-39326) * golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges. (CVE-2023-45287)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2024:0748 https://cve.radiocsirt.org/vuln/bdu:2024-00175 bdu:2024-00175 https://cve.radiocsirt.org/vuln/bdu:2024-00175 https://cve.radiocsirt.org/vuln/bell-cve-2023-39326 <p><strong>Affected:</strong> Alpaquita:23: go, Alpaquita:stream: go, BellSoft Hardened Containers:23: go, BellSoft Hardened Containers:stream: go</p> <p><strong>Affected:</strong> Alpaquita:23: go, Alpaquita:stream: go, BellSoft Hardened Containers:23: go, BellSoft Hardened Containers:stream: go</p> https://cve.radiocsirt.org/vuln/bell-cve-2023-39326 https://cve.radiocsirt.org/vuln/bit-golang-2023-39326 <p><strong>Affected:</strong> Bitnami: golang</p> <p>A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.</p> <p><strong>Affected:</strong> Bitnami: golang</p> <p>A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.</p> https://cve.radiocsirt.org/vuln/bit-golang-2023-39326 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0350 certfr-2024-avi-0350 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0350 https://cve.radiocsirt.org/vuln/euvd-2026-216696 EUVD-2026-216696 https://cve.radiocsirt.org/vuln/euvd-2026-216696 https://cve.radiocsirt.org/vuln/fkie_cve-2023-39326 <p>A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.</p> <p>A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-39326 https://cve.radiocsirt.org/vuln/ghsa-9f76-wg39-x86h <p>A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.</p> <p>A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.</p> https://cve.radiocsirt.org/vuln/ghsa-9f76-wg39-x86h https://cve.radiocsirt.org/vuln/gsd-2023-39326 gsd-2023-39326 https://cve.radiocsirt.org/vuln/gsd-2023-39326 https://cve.radiocsirt.org/vuln/msrc_cve-2023-39326 msrc_CVE-2023-39326 https://cve.radiocsirt.org/vuln/msrc_cve-2023-39326 https://cve.radiocsirt.org/vuln/oesa-2023-1935 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: golang, openEuler:20.03-LTS-SP3: golang, openEuler:20.03-LTS-SP4: golang, openEuler:22.03-LTS: golang, openEuler:22.03-LTS-SP1: golang, openEuler:22.03-LTS-SP2: golang</p> <p>. Security Fix(es): A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.(CVE-2023-39326) Using go get to fetch a module with the &amp;quot;.git&amp;quot; suffix may unexpectedly fallback to the insecure &amp;quot;git://&amp;quot; protocol if the module is unavailable via the secure &amp;quot;https://&amp;quot; and &amp;quot;git+ssh://&amp;quot; protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).(CVE-2023-45285)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: golang, openEuler:20.03-LTS-SP3: golang, openEuler:20.03-LTS-SP4: golang, openEuler:22.03-LTS: golang, openEuler:22.03-LTS-SP1: golang, openEuler:22.03-LTS-SP2: golang</p> <p>. Security Fix(es): A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.(CVE-2023-39326) Using go get to fetch a module with the &amp;quot;.git&amp;quot; suffix may unexpectedly fallback to the insecure &amp;quot;git://&amp;quot; protocol if the module is unavailable via the secure &amp;quot;https://&amp;quot; and &amp;quot;git+ssh://&amp;quot; protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).(CVE-2023-45285)</p> https://cve.radiocsirt.org/vuln/oesa-2023-1935 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13491-1 <p>go1.20-1.20.12-1.1 on GA media</p> <p>go1.20-1.20.12-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:13491-1 https://cve.radiocsirt.org/vuln/rhba-2024:1440 <p>golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests nodejs-ip: arbitrary code execution via the isPublic() function</p> <p>golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests nodejs-ip: arbitrary code execution via the isPublic() function</p> https://cve.radiocsirt.org/vuln/rhba-2024:1440 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-39326 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: golang-1.20, Ubuntu:20.04:LTS: golang-1.21, Ubuntu:22.04:LTS: golang-1.20, Ubuntu:22.04:LTS: golang-1.21</p> <p>A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: golang-1.20, Ubuntu:20.04:LTS: golang-1.21, Ubuntu:22.04:LTS: golang-1.20, Ubuntu:22.04:LTS: golang-1.21</p> <p>A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-39326 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-3038 <p>Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-3038