Most recent entries from all

ALSA-2025:3772 — Moderate: go-toolset:rhel8 security update

Affected: AlmaLinux:8: delve, AlmaLinux:8: go-toolset, AlmaLinux:8: golang, AlmaLinux:8: golang-bin, AlmaLinux:8: golang-docs, AlmaLinux:8: golang-misc, AlmaLinux:8: golang-src, AlmaLinux:8: golang-tests

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

* golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints (CVE-2024-45341) * golang: net/[http:](http:) net/[http:](http:) sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-03335

BELL-CVE-2024-45341

Affected: Alpaquita:23: go, Alpaquita:stream: go, BellSoft Hardened Containers:23: go, BellSoft Hardened Containers:stream: go

BIT-golang-2024-45341 — Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509

Affected: Bitnami: golang

A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.

certfr-2025-avi-0256 — De multiples vulnérabilités ont été découvertes dans Broadcom VMware Tanzu Greenplum. Elles permettent à un attaquant d…

certfr-2025-avi-0256

Withdrawn: CLEANSTART-2026-CR41732 — net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines

Withdrawn by the publisher.

Affected: CleanStart: ingress-nginx-controller

Multiple security vulnerabilities affect the ingress-nginx-controller package. The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. See references for individual vulnerability details.

EUVD-2026-218591

fkie_cve-2024-45341

GHSA-3f6r-qh9c-x6mm

msrc_CVE-2024-45341 — Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509

msrc_CVE-2024-45341

OESA-2025-1221 — golang security update

Affected: openEuler:20.03-LTS-SP4: golang

. Security Fix(es):

HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service. With fix, header parsing now correctly allocates only the memory required to hold parsed headers..(CVE-2023-24534)

Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed, leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3. ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage collector. The combination of these factors can permit an attacker to cause an program that parses multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service. This affec…

openSUSE-SU-2025:14693-1 — go1.24-1.24rc2-1.1 on GA media

go1.24-1.24rc2-1.1 on GA media

RHSA-2025:7466 — Red Hat Security Advisory: delve and golang security update

golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec

SUSE-SU-2025:0297-1 — Security update for govulncheck-vulndb

Security update for govulncheck-vulndb

UBUNTU-CVE-2024-45341

Affected: Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-go.crypto, Ubuntu:Pro:16.04:LTS: lxd, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: lxd, Ubuntu:Pro:18.04:LTS: golang-1.13 and 31 more

WID-SEC-W-2025-0111 — Golang Go: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen und vertrauliche Informationen offenzulegen.