https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 13:41:41 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-01060 bdu:2026-01060 https://cve.radiocsirt.org/vuln/bdu:2026-01060 https://cve.radiocsirt.org/vuln/bell-cve-2026-23991 <p><strong>Affected:</strong> Alpaquita:stream: docker-cli-buildx</p> <p><strong>Affected:</strong> Alpaquita:stream: docker-cli-buildx</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-23991 https://cve.radiocsirt.org/vuln/cleanstart-2026-ba61304 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: cosign</p> <p>Package cosign version 2.4.3-r0 fixes 82 vulnerabilities: CVE-2025-0913, CVE-2025-15558, CVE-2025-22868, CVE-2025-22869, CVE-2025-22870...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: cosign</p> <p>Package cosign version 2.4.3-r0 fixes 82 vulnerabilities: CVE-2025-0913, CVE-2025-15558, CVE-2025-22868, CVE-2025-22869, CVE-2025-22870...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ba61304 https://cve.radiocsirt.org/vuln/euvd-2026-266317 EUVD-2026-266317 https://cve.radiocsirt.org/vuln/euvd-2026-266317 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23991 <p>go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available.</p> <p>go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-23991 https://cve.radiocsirt.org/vuln/ghsa-846p-jg2w-w324 <p><strong>Affected:</strong> Go: github.com/theupdateframework/go-tuf/v2</p> <p># Security Disclosure: Client DoS via malformed server response</p> <p>## Summary</p> <p>If the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic _during parsing_, causing a DoS. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key.</p> <p>## Impact</p> <p>Client crashes upon receiving and parsing malformed TUF metadata. This can cause long running services to enter an restart/crash loop.</p> <p>## Workarounds</p> <p>None currently.</p> <p>## Affected code</p> <p>The `metadata.checkType` function did not properly type assert the (untrusted) input causing it to panic on malformed data.</p> <p><strong>Affected:</strong> Go: github.com/theupdateframework/go-tuf/v2</p> <p># Security Disclosure: Client DoS via malformed server response</p> <p>## Summary</p> <p>If the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic _during parsing_, causing a DoS. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key.</p> <p>## Impact</p> <p>Client crashes upon receiving and parsing malformed TUF metadata. This can cause long running services to enter an restart/crash loop.</p> <p>## Workarounds</p> <p>None currently.</p> <p>## Affected code</p> <p>The `metadata.checkType` function did not properly type assert the (untrusted) input causing it to panic on malformed data.</p> https://cve.radiocsirt.org/vuln/ghsa-846p-jg2w-w324 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10235-1 <p>cosign-3.0.5-1.1 on GA media</p> <p>cosign-3.0.5-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10235-1 https://cve.radiocsirt.org/vuln/suse-su-2026:20904-1 <p>Security update for cosign</p> <p>Security update for cosign</p> https://cve.radiocsirt.org/vuln/suse-su-2026:20904-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-23991 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: golang-github-theupdateframework-go-tuf, Ubuntu:25.10: golang-github-theupdateframework-go-tuf, Ubuntu:26.04:LTS: golang-github-theupdateframework-go-tuf</p> <p>go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: golang-github-theupdateframework-go-tuf, Ubuntu:25.10: golang-github-theupdateframework-go-tuf, Ubuntu:26.04:LTS: golang-github-theupdateframework-go-tuf</p> <p>go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-23991