Most recent entries from all

ALSA-2025:7466 — Moderate: delve and golang security update

Affected: AlmaLinux:10: delve, AlmaLinux:10: go-toolset, AlmaLinux:10: golang, AlmaLinux:10: golang-bin, AlmaLinux:10: golang-docs, AlmaLinux:10: golang-misc, AlmaLinux:10: golang-src, AlmaLinux:10: golang-tests

Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.

Security Fix(es):

* golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints (CVE-2024-45341) * golang: net/[http:](http:) net/[http:](http:) sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336) * crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-03456

Withdrawn: BELL-CVE-2025-22866 — CVE-2025-22866 does not affect BellSoft software

Withdrawn by the publisher.

BIT-golang-2025-22866 — Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec

Affected: Bitnami: golang

Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols.

certfr-2025-avi-0256 — De multiples vulnérabilités ont été découvertes dans Broadcom VMware Tanzu Greenplum. Elles permettent à un attaquant d…

certfr-2025-avi-0256

Withdrawn: CLEANSTART-2026-CR41732 — net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines

Withdrawn by the publisher.

Affected: CleanStart: ingress-nginx-controller

Multiple security vulnerabilities affect the ingress-nginx-controller package. The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. See references for individual vulnerability details.

EUVD-2026-218592

fkie_cve-2025-22866

GHSA-3whm-j4xm-rv8x

msrc_CVE-2025-22866 — Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec

msrc_CVE-2025-22866

openSUSE-SU-2025:14735-1 — go1.24-1.24rc3-1.1 on GA media

go1.24-1.24rc3-1.1 on GA media

RHEA-2025:3039 — Red Hat Enhancement Advisory: RHEA: Submariner 0.19.3 - bug fix and enhancement update

golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec

RLSA-2026:67148 — Important: osbuild-composer security update

Affected: Rocky Linux:8: osbuild-composer

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

* crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866)

* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)

* mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)

* github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)

* github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2025:0392-1 — Security update for go1.22

Security update for go1.22

UBUNTU-CVE-2025-22866

Affected: Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.8 and 24 more

WID-SEC-W-2025-0263 — Golang Go: Schwachstelle ermöglicht Offenlegung von Informationen

Ein lokaler Angreifer kann eine Schwachstelle in Golang Go ausnutzen, um Informationen offenzulegen.