https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 14:14:46 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:19022 <p><strong>Affected:</strong> AlmaLinux:10: go-toolset, AlmaLinux:10: golang, AlmaLinux:10: golang-bin, AlmaLinux:10: golang-docs, AlmaLinux:10: golang-misc, AlmaLinux:10: golang-race, AlmaLinux:10: golang-src, AlmaLinux:10: golang-tests</p> <p>The golang packages provide the Go programming language compiler.</p> <p>Security Fix(es):</p> <p>* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137) * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:10: go-toolset, AlmaLinux:10: golang, AlmaLinux:10: golang-bin, AlmaLinux:10: golang-docs, AlmaLinux:10: golang-misc, AlmaLinux:10: golang-race, AlmaLinux:10: golang-src, AlmaLinux:10: golang-tests</p> <p>The golang packages provide the Go programming language compiler.</p> <p>Security Fix(es):</p> <p>* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137) * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:19022 https://cve.radiocsirt.org/vuln/bdu:2026-04124 bdu:2026-04124 https://cve.radiocsirt.org/vuln/bdu:2026-04124 https://cve.radiocsirt.org/vuln/bell-cve-2026-27137 <p><strong>Affected:</strong> Alpaquita:stream: go, BellSoft Hardened Containers:stream: go</p> <p><strong>Affected:</strong> Alpaquita:stream: go, BellSoft Hardened Containers:stream: go</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-27137 https://cve.radiocsirt.org/vuln/bit-golang-2026-27137 <p><strong>Affected:</strong> Bitnami: golang</p> <p>When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.</p> <p><strong>Affected:</strong> Bitnami: golang</p> <p>When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.</p> https://cve.radiocsirt.org/vuln/bit-golang-2026-27137 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0299 certfr-2026-avi-0299 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0299 https://cve.radiocsirt.org/vuln/cleanstart-2026-ab43319 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: stakater-reloader</p> <p>Multiple security vulnerabilities affect the stakater-reloader package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: stakater-reloader</p> <p>Multiple security vulnerabilities affect the stakater-reloader package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ab43319 https://cve.radiocsirt.org/vuln/euvd-2026-371761 EUVD-2026-371761 https://cve.radiocsirt.org/vuln/euvd-2026-371761 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27137 <p>When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.</p> <p>When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-27137 https://cve.radiocsirt.org/vuln/ghsa-7hfw-r8qc-89v4 <p>When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.</p> <p>When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.</p> https://cve.radiocsirt.org/vuln/ghsa-7hfw-r8qc-89v4 https://cve.radiocsirt.org/vuln/msrc_cve-2026-27137 msrc_CVE-2026-27137 https://cve.radiocsirt.org/vuln/msrc_cve-2026-27137 https://cve.radiocsirt.org/vuln/oesa-2026-3879 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: git-lfs</p> <p>Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es):</p> <p>The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)</p> <p>Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk&amp;apos;s Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)</p> <p>Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)</p> <p>If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath (&amp;quot;&amp;quot;, &amp;quot;.&amp;quot;, and &amp;quot;..&amp;quot;), can result in the bin…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: git-lfs</p> <p>Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es):</p> <p>The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)</p> <p>Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk&amp;apos;s Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)</p> <p>Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)</p> <p>If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath (&amp;quot;&amp;quot;, &amp;quot;.&amp;quot;, and &amp;quot;..&amp;quot;), can result in the bin…</p> https://cve.radiocsirt.org/vuln/oesa-2026-3879 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10299-1 <p>go1.26-1.26.1-1.1 on GA media</p> <p>go1.26-1.26.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10299-1 https://cve.radiocsirt.org/vuln/rhsa-2026:10125 <p>crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption net/url: Incorrect parsing of IPv6 host literals in net/url crypto/x509: Incorrect enforcement of email constraints in crypto/x509 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation Tekton Pipelines: github.com/tektoncd/pipeline: Tekton Pipelines: Information disclosure via path traversal in git resolver BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object</p> <p>crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption net/url: Incorrect parsing of IPv6 host literals in net/url crypto/x509: Incorrect enforcement of email constraints in crypto/x509 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation Tekton Pipelines: github.com/tektoncd/pipeline: Tekton Pipelines: Information disclosure via path traversal in git resolver BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object</p> https://cve.radiocsirt.org/vuln/rhsa-2026:10125 https://cve.radiocsirt.org/vuln/rlsa-2026:22450 <p><strong>Affected:</strong> Rocky Linux:10: osbuild-composer</p> <p>A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.</p> <p>Security Fix(es):</p> <p>* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)</p> <p>* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)</p> <p>* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)</p> <p>* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)</p> <p>* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)</p> <p>* github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)</p> <p>* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)</p> <p>* github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server (CVE-2026-32286)</p> <p>* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)</p> <p>* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)</p> <p>* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key updat…</p> <p><strong>Affected:</strong> Rocky Linux:10: osbuild-composer</p> <p>A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.</p> <p>Security Fix(es):</p> <p>* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)</p> <p>* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)</p> <p>* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)</p> <p>* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)</p> <p>* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)</p> <p>* github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)</p> <p>* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)</p> <p>* github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server (CVE-2026-32286)</p> <p>* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)</p> <p>* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)</p> <p>* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key updat…</p> https://cve.radiocsirt.org/vuln/rlsa-2026:22450 https://cve.radiocsirt.org/vuln/suse-su-2026:21195-1 <p>Security update for go1.26-openssl</p> <p>Security update for go1.26-openssl</p> https://cve.radiocsirt.org/vuln/suse-su-2026:21195-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-27137 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: golang-1.24, Ubuntu:24.04:LTS: golang-1.24, Ubuntu:25.10: golang-1.24, Ubuntu:25.10: golang-1.25, Ubuntu:26.04:LTS: golang-1.24, Ubuntu:26.04:LTS: golang-1.25, Ubuntu:26.04:LTS: golang-1.26</p> <p>When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: golang-1.24, Ubuntu:24.04:LTS: golang-1.24, Ubuntu:25.10: golang-1.24, Ubuntu:25.10: golang-1.25, Ubuntu:26.04:LTS: golang-1.24, Ubuntu:26.04:LTS: golang-1.25, Ubuntu:26.04:LTS: golang-1.26</p> <p>When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-27137 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0548 <p>Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0548