https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 13:03:12 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:18913 <p><strong>Affected:</strong> AlmaLinux:9: containernetworking-plugins</p> <p>The Container Network Interface (CNI) project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted.</p> <p>Security Fix(es):</p> <p>* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p>Additional Changes:</p> <p>For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: containernetworking-plugins</p> <p>The Container Network Interface (CNI) project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted.</p> <p>Security Fix(es):</p> <p>* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p>Additional Changes:</p> <p>For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:18913 https://cve.radiocsirt.org/vuln/bdu:2026-03409 bdu:2026-03409 https://cve.radiocsirt.org/vuln/bdu:2026-03409 https://cve.radiocsirt.org/vuln/bell-cve-2025-61726 <p><strong>Affected:</strong> Alpaquita:23: go, Alpaquita:25: etcd, Alpaquita:25: go, Alpaquita:stream: etcd, Alpaquita:stream: go, BellSoft Hardened Containers:23: go, BellSoft Hardened Containers:25: go, BellSoft Hardened Containers:stream: go</p> <p><strong>Affected:</strong> Alpaquita:23: go, Alpaquita:25: etcd, Alpaquita:25: go, Alpaquita:stream: etcd, Alpaquita:stream: go, BellSoft Hardened Containers:23: go, BellSoft Hardened Containers:25: go, BellSoft Hardened Containers:stream: go</p> https://cve.radiocsirt.org/vuln/bell-cve-2025-61726 https://cve.radiocsirt.org/vuln/bit-golang-2025-61726 <p><strong>Affected:</strong> Bitnami: golang</p> <p>The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.</p> <p><strong>Affected:</strong> Bitnami: golang</p> <p>The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.</p> https://cve.radiocsirt.org/vuln/bit-golang-2025-61726 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0199 certfr-2026-avi-0199 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0199 https://cve.radiocsirt.org/vuln/cleanstart-2026-ab85050 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: kafka_exporter-fips</p> <p>Package kafka_exporter-fips version 1.6.0-r0 fixes 8 vulnerabilities: ghsa-8r3f-844c-mc37, CVE-2025-68121, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: kafka_exporter-fips</p> <p>Package kafka_exporter-fips version 1.6.0-r0 fixes 8 vulnerabilities: ghsa-8r3f-844c-mc37, CVE-2025-68121, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ab85050 https://cve.radiocsirt.org/vuln/cnvd-2026-10649 cnvd-2026-10649 https://cve.radiocsirt.org/vuln/cnvd-2026-10649 https://cve.radiocsirt.org/vuln/euvd-2026-371764 EUVD-2026-371764 https://cve.radiocsirt.org/vuln/euvd-2026-371764 https://cve.radiocsirt.org/vuln/fkie_cve-2025-61726 <p>The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.</p> <p>The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-61726 https://cve.radiocsirt.org/vuln/ghsa-gm9r-q53w-2gh4 <p>The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.</p> <p>The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.</p> https://cve.radiocsirt.org/vuln/ghsa-gm9r-q53w-2gh4 https://cve.radiocsirt.org/vuln/msrc_cve-2025-61726 msrc_CVE-2025-61726 https://cve.radiocsirt.org/vuln/msrc_cve-2025-61726 https://cve.radiocsirt.org/vuln/oesa-2026-1698 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP2: golang</p> <p>The Go Programming Language. Security Fix(es):</p> <p>The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.(CVE-2025-61726)</p> <p>archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.(CVE-2025-61728)</p> <p>Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The &amp;quot;#cgo pkg-config:&amp;quot; directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a &amp;quot;--log-file&amp;quot; argument to this directive, causing pkg-config to write to an attacker-controlled location.(CVE-2025-61731)</p> <p>A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.(CVE-2025-61732)</p> <p>Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how external…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP2: golang</p> <p>The Go Programming Language. Security Fix(es):</p> <p>The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.(CVE-2025-61726)</p> <p>archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.(CVE-2025-61728)</p> <p>Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The &amp;quot;#cgo pkg-config:&amp;quot; directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a &amp;quot;--log-file&amp;quot; argument to this directive, causing pkg-config to write to an attacker-controlled location.(CVE-2025-61731)</p> <p>A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.(CVE-2025-61732)</p> <p>Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how external…</p> https://cve.radiocsirt.org/vuln/oesa-2026-1698 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10063-1 <p>go1.24-1.24.12-1.1 on GA media</p> <p>go1.24-1.24.12-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10063-1 https://cve.radiocsirt.org/vuln/rhsa-2026:10096 <p>golang: net/url: Memory exhaustion in query parameter parsing in net/url</p> <p>golang: net/url: Memory exhaustion in query parameter parsing in net/url</p> https://cve.radiocsirt.org/vuln/rhsa-2026:10096 https://cve.radiocsirt.org/vuln/rlsa-2026:22450 <p><strong>Affected:</strong> Rocky Linux:10: osbuild-composer</p> <p>A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.</p> <p>Security Fix(es):</p> <p>* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)</p> <p>* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)</p> <p>* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)</p> <p>* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)</p> <p>* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)</p> <p>* github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)</p> <p>* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)</p> <p>* github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server (CVE-2026-32286)</p> <p>* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)</p> <p>* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)</p> <p>* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key updat…</p> <p><strong>Affected:</strong> Rocky Linux:10: osbuild-composer</p> <p>A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.</p> <p>Security Fix(es):</p> <p>* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)</p> <p>* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)</p> <p>* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)</p> <p>* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)</p> <p>* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)</p> <p>* github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)</p> <p>* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)</p> <p>* github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server (CVE-2026-32286)</p> <p>* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)</p> <p>* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)</p> <p>* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key updat…</p> https://cve.radiocsirt.org/vuln/rlsa-2026:22450 https://cve.radiocsirt.org/vuln/suse-su-2026:20122-1 <p>Security update for go1.24</p> <p>Security update for go1.24</p> https://cve.radiocsirt.org/vuln/suse-su-2026:20122-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-61726 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.8 and 26 more</p> <p>The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.8 and 26 more</p> <p>The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-61726 https://cve.radiocsirt.org/vuln/vde-2026-088 <p>The vulnerabilities found in LabX Standard versions 21.3.22 - 21.4.23 are CVE-2025-69419, CVE-2026-0915, CVE-2025-15467, CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Standard v21.4.25.</p> <p>The vulnerabilities found in LabX Enterprise versions 21.3.22 - 21.4.23 are CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Enterprise v21.4.25</p> <p>All other vulnerabilities are to be fixed in the upcoming releases.</p> <p>The vulnerabilities found in LabX Standard versions 21.3.22 - 21.4.23 are CVE-2025-69419, CVE-2026-0915, CVE-2025-15467, CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Standard v21.4.25.</p> <p>The vulnerabilities found in LabX Enterprise versions 21.3.22 - 21.4.23 are CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Enterprise v21.4.25</p> <p>All other vulnerabilities are to be fixed in the upcoming releases.</p> https://cve.radiocsirt.org/vuln/vde-2026-088 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0129 <p>Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen Denial of Service Angriff durchzuführen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen Denial of Service Angriff durchzuführen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0129