https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 06:09:13 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-160476 EUVD-2026-160476 https://cve.radiocsirt.org/vuln/euvd-2026-160476 https://cve.radiocsirt.org/vuln/fkie_cve-2023-45286 <p>A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn&#39;t had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request. The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.</p> <p>A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn&#39;t had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request. The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-45286 https://cve.radiocsirt.org/vuln/ghsa-xwh9-gc39-5298 <p><strong>Affected:</strong> Go: github.com/go-resty/resty/v2</p> <p>A race condition in go-resty can result in HTTP request body disclosure across requests.</p> <p>This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn&#39;t had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request.</p> <p>The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.</p> <p><strong>Affected:</strong> Go: github.com/go-resty/resty/v2</p> <p>A race condition in go-resty can result in HTTP request body disclosure across requests.</p> <p>This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn&#39;t had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request.</p> <p>The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.</p> https://cve.radiocsirt.org/vuln/ghsa-xwh9-gc39-5298 https://cve.radiocsirt.org/vuln/gsd-2023-45286 gsd-2023-45286 https://cve.radiocsirt.org/vuln/gsd-2023-45286 https://cve.radiocsirt.org/vuln/msrc_cve-2023-45286 msrc_CVE-2023-45286 https://cve.radiocsirt.org/vuln/msrc_cve-2023-45286 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13569-1 <p>rclone-1.65.1-1.1 on GA media</p> <p>rclone-1.65.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:13569-1 https://cve.radiocsirt.org/vuln/rhsa-2024:3316 <p>follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse() css-tools: Improper Input Validation causes Denial of Service via Regular Expression golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests go-resty: HTTP request body disclosure in github.com/go-resty/resty/v2 golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges. golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS axios: exposure of confidential data stored in cookies css-tools: regular expression denial of service (ReDoS) when parsing CSS golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON follow-redirects: Possible credential leak webpack-dev-middleware: lack of URL validation may lead to file leak</p> <p>follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse() css-tools: Improper Input Validation causes Denial of Service via Regular Expression golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests go-resty: HTTP request body disclosure in github.com/go-resty/resty/v2 golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges. golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS axios: exposure of confidential data stored in cookies css-tools: regular expression denial of service (ReDoS) when parsing CSS golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON follow-redirects: Possible credential leak webpack-dev-middleware: lack of URL validation may lead to file leak</p> https://cve.radiocsirt.org/vuln/rhsa-2024:3316 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-45286 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: golang-github-go-resty-resty, Ubuntu:24.04:LTS: golang-github-go-resty-resty, Ubuntu:25.10: golang-github-go-resty-resty, Ubuntu:26.04:LTS: golang-github-go-resty-resty</p> <p>A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn&#39;t had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request. The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: golang-github-go-resty-resty, Ubuntu:24.04:LTS: golang-github-go-resty-resty, Ubuntu:25.10: golang-github-go-resty-resty, Ubuntu:26.04:LTS: golang-github-go-resty-resty</p> <p>A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn&#39;t had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request. The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-45286 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1226 <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Dateien zu manipulieren, einen Denial-of-Service-Zustand zu verursachen, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern oder um weitere nicht spezifizierte Angriffe auszuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Dateien zu manipulieren, einen Denial-of-Service-Zustand zu verursachen, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern oder um weitere nicht spezifizierte Angriffe auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1226