https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 14:34:10 +0000 https://cve.radiocsirt.org/vuln/alsa-2025:19566 <p><strong>Affected:</strong> AlmaLinux:10: osbuild-composer, AlmaLinux:10: osbuild-composer-core, AlmaLinux:10: osbuild-composer-worker</p> <p>A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.</p> <p>Security Fix(es):</p> <p>* go-jose: Go JOSE&#39;s Parsing Vulnerable to Denial of Service (CVE-2025-27144)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:10: osbuild-composer, AlmaLinux:10: osbuild-composer-core, AlmaLinux:10: osbuild-composer-worker</p> <p>A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.</p> <p>Security Fix(es):</p> <p>* go-jose: Go JOSE&#39;s Parsing Vulnerable to Denial of Service (CVE-2025-27144)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2025:19566 https://cve.radiocsirt.org/vuln/bdu:2025-08606 bdu:2025-08606 https://cve.radiocsirt.org/vuln/bdu:2025-08606 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0481 certfr-2025-avi-0481 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0481 https://cve.radiocsirt.org/vuln/cleanstart-2026-ba61304 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: cosign</p> <p>Package cosign version 2.4.3-r0 fixes 82 vulnerabilities: CVE-2025-0913, CVE-2025-15558, CVE-2025-22868, CVE-2025-22869, CVE-2025-22870...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: cosign</p> <p>Package cosign version 2.4.3-r0 fixes 82 vulnerabilities: CVE-2025-0913, CVE-2025-15558, CVE-2025-22868, CVE-2025-22869, CVE-2025-22870...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ba61304 https://cve.radiocsirt.org/vuln/euvd-2026-218794 EUVD-2026-218794 https://cve.radiocsirt.org/vuln/euvd-2026-218794 https://cve.radiocsirt.org/vuln/fkie_cve-2025-27144 <p>Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, &#34;.&#34;) to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.</p> <p>Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, &#34;.&#34;) to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-27144 https://cve.radiocsirt.org/vuln/ghsa-c6gw-w398-hv78 <p><strong>Affected:</strong> Go: github.com/go-jose/go-jose/v4, Go: github.com/go-jose/go-jose/v3, Go: github.com/go-jose/go-jose</p> <p>### Impact When parsing compact JWS or JWE input, go-jose could use excessive memory. The code used strings.Split(token, &#34;.&#34;) to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of &#39;.&#39; characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service.</p> <p>### Patches Version 4.0.5 fixes this issue</p> <p>### Workarounds Applications could pre-validate payloads passed to go-jose do not contain an excessive number of &#39;.&#39; characters.</p> <p>### References This is the same sort of issue as in the golang.org/x/oauth2/jws package as CVE-2025-22868 and Go issue https://go.dev/issue/71490.</p> <p><strong>Affected:</strong> Go: github.com/go-jose/go-jose/v4, Go: github.com/go-jose/go-jose/v3, Go: github.com/go-jose/go-jose</p> <p>### Impact When parsing compact JWS or JWE input, go-jose could use excessive memory. The code used strings.Split(token, &#34;.&#34;) to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of &#39;.&#39; characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service.</p> <p>### Patches Version 4.0.5 fixes this issue</p> <p>### Workarounds Applications could pre-validate payloads passed to go-jose do not contain an excessive number of &#39;.&#39; characters.</p> <p>### References This is the same sort of issue as in the golang.org/x/oauth2/jws package as CVE-2025-22868 and Go issue https://go.dev/issue/71490.</p> https://cve.radiocsirt.org/vuln/ghsa-c6gw-w398-hv78 https://cve.radiocsirt.org/vuln/msrc_cve-2025-27144 msrc_CVE-2025-27144 https://cve.radiocsirt.org/vuln/msrc_cve-2025-27144 https://cve.radiocsirt.org/vuln/oesa-2025-2176 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: buildah</p> <p>The package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container&amp;amp;apos;s root file system for manipulation * save container&amp;amp;apos;s root file system layer to create a new image * delete a working container or an image Security Fix(es):</p> <p>Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, &amp;quot;.&amp;quot;) to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.(CVE-2025-27144)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: buildah</p> <p>The package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container&amp;amp;apos;s root file system for manipulation * save container&amp;amp;apos;s root file system layer to create a new image * delete a working container or an image Security Fix(es):</p> <p>Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, &amp;quot;.&amp;quot;) to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.(CVE-2025-27144)</p> https://cve.radiocsirt.org/vuln/oesa-2025-2176 https://cve.radiocsirt.org/vuln/opensuse-su-2025:0080-1 <p>Security update for trivy</p> <p>Security update for trivy</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:0080-1 https://cve.radiocsirt.org/vuln/rhba-2025:8687 <p>quay: Incorrect Privilege Assignment redis: Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client go-jose: Go JOSE&#39;s Parsing Vulnerable to Denial of Service</p> <p>quay: Incorrect Privilege Assignment redis: Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client go-jose: Go JOSE&#39;s Parsing Vulnerable to Denial of Service</p> https://cve.radiocsirt.org/vuln/rhba-2025:8687 https://cve.radiocsirt.org/vuln/suse-ru-2025:02092-1 <p>Recommended update for podman</p> <p>Recommended update for podman</p> https://cve.radiocsirt.org/vuln/suse-ru-2025:02092-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-27144 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: golang-github-go-jose-go-jose, Ubuntu:25.10: golang-github-go-jose-go-jose, Ubuntu:Pro:26.04:LTS: golang-github-go-jose-go-jose</p> <p>Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, &#34;.&#34;) to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: golang-github-go-jose-go-jose, Ubuntu:25.10: golang-github-go-jose-go-jose, Ubuntu:Pro:26.04:LTS: golang-github-go-jose-go-jose</p> <p>Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, &#34;.&#34;) to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-27144 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0625 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat OpenShift Container Platform ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat OpenShift Container Platform ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0625