Most recent entries from all

bdu:2025-14688

certfr-2025-avi-1129 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer…

certfr-2025-avi-1129

Withdrawn: CLEANSTART-2026-AD41794 — SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the c…

Withdrawn by the publisher.

Affected: CleanStart: cert-manager-webhook-pdns-fips

Multiple security vulnerabilities affect the cert-manager-webhook-pdns-fips package. SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process. See references for individual vulnerability details.

EUVD-2026-261473

fkie_cve-2025-58181

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

GHSA-j5w8-q4qc-rx2x — golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption

Affected: Go: golang.org/x/crypto

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

OESA-2026-3398 — buildah security update

Affected: openEuler:22.03-LTS-SP4: buildah

The package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container&apos;s root file system for manipulation * save container&apos;s root file system layer to create a new image * delete a working container or an image Security Fix(es):

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.(CVE-2025-47914)

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.(CVE-2025-58181)

openSUSE-RU-2026:20010-1 — Recommended update for trivy

Recommended update for trivy

RHSA-2026:15979 — Red Hat Security Advisory: Red Hat Ceph Storage

nodemailer: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate js-yaml: js-yaml prototype pollution in merge glob: glob: Command Injection Vulnerability via Malicious Filenames github.com/expr-lang/expr: Expr: Denial of Service via uncontrolled recursion in expression evaluation

SUSE-SU-2026:0439-1 — Security update for apptainer

Security update for apptainer

UBUNTU-CVE-2025-58181

Affected: Ubuntu:Pro:16.04:LTS: google-guest-agent, Ubuntu:Pro:16.04:LTS: golang-go.crypto, Ubuntu:Pro:16.04:LTS: lxd, Ubuntu:Pro:16.04:LTS: snapd, Ubuntu:Pro:18.04:LTS: lxd, Ubuntu:Pro:18.04:LTS: snapd, Ubuntu:Pro:18.04:LTS: golang-go.crypto, Ubuntu:Pro:18.04:LTS: google-guest-agent, Ubuntu:Pro:20.04:LTS: google-guest-agent, Ubuntu:Pro:20.04:LTS: snapd and 13 more

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

WID-SEC-W-2025-2645 — Golang Go: Mehrere Schwachstellen ermöglichen Denial of Service

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen Denial of Service Angriff durchzuführen.