https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 05:49:10 +0000 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0924 certfr-2025-avi-0924 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0924 https://cve.radiocsirt.org/vuln/cleanstart-2026-ac01087 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: gitness</p> <p>Multiple security vulnerabilities affect the gitness package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: gitness</p> <p>Multiple security vulnerabilities affect the gitness package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ac01087 https://cve.radiocsirt.org/vuln/euvd-2026-223705 EUVD-2026-223705 https://cve.radiocsirt.org/vuln/euvd-2026-223705 https://cve.radiocsirt.org/vuln/fkie_cve-2025-30153 <p>kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory. The root cause comes from the ZipFileBodyDecoder, which is registered automatically by the module (contrary to what the documentation says). This vulnerability is fixed in 0.131.0.</p> <p>kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory. The root cause comes from the ZipFileBodyDecoder, which is registered automatically by the module (contrary to what the documentation says). This vulnerability is fixed in 0.131.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-30153 https://cve.radiocsirt.org/vuln/ghsa-wq9g-9vfc-cfq9 <p><strong>Affected:</strong> Go: github.com/getkin/kin-openapi</p> <p>### Summary</p> <p>When validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory.</p> <p>### Details</p> <p>The root cause comes from the [ZipFileBodyDecoder](https://github.com/getkin/kin-openapi/blob/6da871e0e170b7637eb568c265c08bc2b5d6e7a3/openapi3filter/req_resp_decoder.go#L1523), which is registered [automatically](https://github.com/getkin/kin-openapi/blob/6da871e0e170b7637eb568c265c08bc2b5d6e7a3/openapi3filter/req_resp_decoder.go#L1275) by the module (contrary to what the [documentation says](https://github.com/getkin/kin-openapi?tab=readme-ov-file#custom-content-type-for-body-of-http-requestresponse).</p> <p>### PoC To reproduce the vulnerability, you can use the following OpenAPI schema: ```yaml openapi: 3.0.0 info: title: &#39;Validator&#39; version: 0.0.1 paths: /: post: requestBody: required: true content: multipart/form-data: schema: type: object required: - file properties: file: type: string format: binary responses: &#39;200&#39;: description: Created ``` And this code to validate the request (nothing fancy, it basically only calls the `openapi3filter.ValidateRequest` function`): ```go package main</p> <p>import ( &#34;fmt&#34; &#34;log&#34; &#34;net/http&#34;</p> <p>&#34;github.com/getkin/kin-openap…</p> <p><strong>Affected:</strong> Go: github.com/getkin/kin-openapi</p> <p>### Summary</p> <p>When validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory.</p> <p>### Details</p> <p>The root cause comes from the [ZipFileBodyDecoder](https://github.com/getkin/kin-openapi/blob/6da871e0e170b7637eb568c265c08bc2b5d6e7a3/openapi3filter/req_resp_decoder.go#L1523), which is registered [automatically](https://github.com/getkin/kin-openapi/blob/6da871e0e170b7637eb568c265c08bc2b5d6e7a3/openapi3filter/req_resp_decoder.go#L1275) by the module (contrary to what the [documentation says](https://github.com/getkin/kin-openapi?tab=readme-ov-file#custom-content-type-for-body-of-http-requestresponse).</p> <p>### PoC To reproduce the vulnerability, you can use the following OpenAPI schema: ```yaml openapi: 3.0.0 info: title: &#39;Validator&#39; version: 0.0.1 paths: /: post: requestBody: required: true content: multipart/form-data: schema: type: object required: - file properties: file: type: string format: binary responses: &#39;200&#39;: description: Created ``` And this code to validate the request (nothing fancy, it basically only calls the `openapi3filter.ValidateRequest` function`): ```go package main</p> <p>import ( &#34;fmt&#34; &#34;log&#34; &#34;net/http&#34;</p> <p>&#34;github.com/getkin/kin-openap…</p> https://cve.radiocsirt.org/vuln/ghsa-wq9g-9vfc-cfq9 https://cve.radiocsirt.org/vuln/opensuse-su-2025:14937-1 <p>govulncheck-vulndb-0.0.20250327T184518-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250327T184518-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:14937-1 https://cve.radiocsirt.org/vuln/rhsa-2026:22689 <p>github.com/getkin/kin-openapi/openapi3filter: Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation</p> <p>github.com/getkin/kin-openapi/openapi3filter: Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation</p> https://cve.radiocsirt.org/vuln/rhsa-2026:22689 https://cve.radiocsirt.org/vuln/suse-su-2026:21756-1 <p>Security update for mcphost</p> <p>Security update for mcphost</p> https://cve.radiocsirt.org/vuln/suse-su-2026:21756-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-30153 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: golang-github-getkin-kin-openapi, Ubuntu:24.04:LTS: golang-github-getkin-kin-openapi, Ubuntu:26.04:LTS: golang-github-getkin-kin-openapi</p> <p>kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory. The root cause comes from the ZipFileBodyDecoder, which is registered automatically by the module (contrary to what the documentation says). This vulnerability is fixed in 0.131.0.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: golang-github-getkin-kin-openapi, Ubuntu:24.04:LTS: golang-github-getkin-kin-openapi, Ubuntu:26.04:LTS: golang-github-getkin-kin-openapi</p> <p>kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory. The root cause comes from the ZipFileBodyDecoder, which is registered automatically by the module (contrary to what the documentation says). This vulnerability is fixed in 0.131.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-30153