https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 02:45:41 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:5941 <p><strong>Affected:</strong> AlmaLinux:10: golang-docs, AlmaLinux:10: golang-misc, AlmaLinux:10: golang-src, AlmaLinux:10: golang-tests</p> <p>The golang packages provide the Go programming language compiler.</p> <p>Security Fix(es):</p> <p>* cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:10: golang-docs, AlmaLinux:10: golang-misc, AlmaLinux:10: golang-src, AlmaLinux:10: golang-tests</p> <p>The golang packages provide the Go programming language compiler.</p> <p>Security Fix(es):</p> <p>* cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:5941 https://cve.radiocsirt.org/vuln/bdu:2026-03411 bdu:2026-03411 https://cve.radiocsirt.org/vuln/bdu:2026-03411 https://cve.radiocsirt.org/vuln/bell-cve-2025-61731 <p><strong>Affected:</strong> Alpaquita:23: go, Alpaquita:25: etcd, Alpaquita:25: go, Alpaquita:stream: etcd, Alpaquita:stream: go, BellSoft Hardened Containers:23: go, BellSoft Hardened Containers:25: go, BellSoft Hardened Containers:stream: go</p> <p><strong>Affected:</strong> Alpaquita:23: go, Alpaquita:25: etcd, Alpaquita:25: go, Alpaquita:stream: etcd, Alpaquita:stream: go, BellSoft Hardened Containers:23: go, BellSoft Hardened Containers:25: go, BellSoft Hardened Containers:stream: go</p> https://cve.radiocsirt.org/vuln/bell-cve-2025-61731 https://cve.radiocsirt.org/vuln/bit-golang-2025-61731 <p><strong>Affected:</strong> Bitnami: golang</p> <p>Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The &#34;#cgo pkg-config:&#34; directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a &#34;--log-file&#34; argument to this directive, causing pkg-config to write to an attacker-controlled location.</p> <p><strong>Affected:</strong> Bitnami: golang</p> <p>Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The &#34;#cgo pkg-config:&#34; directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a &#34;--log-file&#34; argument to this directive, causing pkg-config to write to an attacker-controlled location.</p> https://cve.radiocsirt.org/vuln/bit-golang-2025-61731 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0199 certfr-2026-avi-0199 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0199 https://cve.radiocsirt.org/vuln/cleanstart-2026-ag74269 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: cert-manager-fips</p> <p>Package cert-manager-fips version 1.17.4-r1 fixes 24 vulnerabilities: CVE-2026-33186, ghsa-p77j-4mvh-x3m3, CVE-2026-24051, CVE-2026-39883, ghsa-9h8m-3fm2-qjrq...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: cert-manager-fips</p> <p>Package cert-manager-fips version 1.17.4-r1 fixes 24 vulnerabilities: CVE-2026-33186, ghsa-p77j-4mvh-x3m3, CVE-2026-24051, CVE-2026-39883, ghsa-9h8m-3fm2-qjrq...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ag74269 https://cve.radiocsirt.org/vuln/cnvd-2026-10648 cnvd-2026-10648 https://cve.radiocsirt.org/vuln/cnvd-2026-10648 https://cve.radiocsirt.org/vuln/euvd-2026-366092 EUVD-2026-366092 https://cve.radiocsirt.org/vuln/euvd-2026-366092 https://cve.radiocsirt.org/vuln/fkie_cve-2025-61731 <p>Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The &#34;#cgo pkg-config:&#34; directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a &#34;--log-file&#34; argument to this directive, causing pkg-config to write to an attacker-controlled location.</p> <p>Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The &#34;#cgo pkg-config:&#34; directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a &#34;--log-file&#34; argument to this directive, causing pkg-config to write to an attacker-controlled location.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-61731 https://cve.radiocsirt.org/vuln/ghsa-xvqr-69v8-f3gv <p>Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The &#34;#cgo pkg-config:&#34; directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a &#34;--log-file&#34; argument to this directive, causing pkg-config to write to an attacker-controlled location.</p> <p>Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The &#34;#cgo pkg-config:&#34; directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a &#34;--log-file&#34; argument to this directive, causing pkg-config to write to an attacker-controlled location.</p> https://cve.radiocsirt.org/vuln/ghsa-xvqr-69v8-f3gv https://cve.radiocsirt.org/vuln/msrc_cve-2025-61731 msrc_CVE-2025-61731 https://cve.radiocsirt.org/vuln/msrc_cve-2025-61731 https://cve.radiocsirt.org/vuln/oesa-2026-1698 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP2: golang</p> <p>The Go Programming Language. Security Fix(es):</p> <p>The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.(CVE-2025-61726)</p> <p>archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.(CVE-2025-61728)</p> <p>Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The &amp;quot;#cgo pkg-config:&amp;quot; directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a &amp;quot;--log-file&amp;quot; argument to this directive, causing pkg-config to write to an attacker-controlled location.(CVE-2025-61731)</p> <p>A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.(CVE-2025-61732)</p> <p>Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how external…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP2: golang</p> <p>The Go Programming Language. Security Fix(es):</p> <p>The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.(CVE-2025-61726)</p> <p>archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.(CVE-2025-61728)</p> <p>Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The &amp;quot;#cgo pkg-config:&amp;quot; directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a &amp;quot;--log-file&amp;quot; argument to this directive, causing pkg-config to write to an attacker-controlled location.(CVE-2025-61731)</p> <p>A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.(CVE-2025-61732)</p> <p>Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how external…</p> https://cve.radiocsirt.org/vuln/oesa-2026-1698 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10063-1 <p>go1.24-1.24.12-1.1 on GA media</p> <p>go1.24-1.24.12-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10063-1 https://cve.radiocsirt.org/vuln/rhsa-2026:12118 <p>cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code</p> <p>cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code</p> https://cve.radiocsirt.org/vuln/rhsa-2026:12118 https://cve.radiocsirt.org/vuln/suse-su-2026:20122-1 <p>Security update for go1.24</p> <p>Security update for go1.24</p> https://cve.radiocsirt.org/vuln/suse-su-2026:20122-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-61731 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:20.04:LTS: golang-1.13, Ubuntu:20.04:LTS: golang-1.14 and 23 more</p> <p>Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The &#34;#cgo pkg-config:&#34; directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a &#34;--log-file&#34; argument to this directive, causing pkg-config to write to an attacker-controlled location.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:20.04:LTS: golang-1.13, Ubuntu:20.04:LTS: golang-1.14 and 23 more</p> <p>Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The &#34;#cgo pkg-config:&#34; directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a &#34;--log-file&#34; argument to this directive, causing pkg-config to write to an attacker-controlled location.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-61731 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0129 <p>Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen Denial of Service Angriff durchzuführen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen Denial of Service Angriff durchzuführen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0129