Most recent entries from all

ALSA-2026:10704 — Important: go-toolset:rhel8 security update

Affected: AlmaLinux:8: delve, AlmaLinux:8: go-toolset, AlmaLinux:8: golang, AlmaLinux:8: golang-bin, AlmaLinux:8: golang-docs, AlmaLinux:8: golang-misc, AlmaLinux:8: golang-race, AlmaLinux:8: golang-src, AlmaLinux:8: golang-tests

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) * golang: cmd/compile: no-op interface conversion bypasses overlap checking (CVE-2026-27144) * cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names (CVE-2026-27140) * golang: cmd/compile: possible memory corruption after bound check elimination (CVE-2026-27143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-07245

BELL-CVE-2026-27144

Affected: Alpaquita:23: go, Alpaquita:25: go, Alpaquita:stream: go, BellSoft Hardened Containers:23: go, BellSoft Hardened Containers:25: go, BellSoft Hardened Containers:stream: go

BIT-golang-2026-27144 — Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile

Affected: Bitnami: golang

The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corruption at runtime.

certfr-2026-avi-0498 — De multiples vulnérabilités ont été découvertes dans Zabbix Agent2. Elles permettent à un attaquant de provoquer un pro…

certfr-2026-avi-0498

Withdrawn: CLEANSTART-2026-AH29678 — Security fixes for CVE-2025-61726, CVE-2025-61727, CVE-2025-61728, CVE-2025-61729, CVE-2025-61730, CVE-2025-61732, CVE-…

Withdrawn by the publisher.

Affected: CleanStart: stakater-reloader-fips

Multiple security vulnerabilities affect the stakater-reloader-fips package. These issues are resolved in later releases. See references for individual vulnerability details.

EUVD-2026-290979

fkie_cve-2026-27144

GHSA-cqrx-3m42-5p5w

msrc_CVE-2026-27144 — Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile

msrc_CVE-2026-27144

OESA-2026-2247 — golang security update

Affected: openEuler:24.03-LTS: golang

. Security Fix(es):

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.(CVE-2026-27140)

Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.(CVE-2026-27143)

tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.(CVE-2026-32288)

openSUSE-SU-2026:10514-1 — go1.25-1.25.9-1.1 on GA media

go1.25-1.25.9-1.1 on GA media

RHSA-2026:11688 — Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.6.15

net/url: Incorrect parsing of IPv6 host literals in net/url golang: cmd/compile: possible memory corruption after bound check elimination golang: cmd/compile: no-op interface conversion bypasses overlap checking crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

SUSE-SU-2026:21355-1 — Security update for go1.25

Security update for go1.25

UBUNTU-CVE-2026-27144

Affected: Ubuntu:20.04:LTS: golang-1.20, Ubuntu:20.04:LTS: golang-1.21, Ubuntu:20.04:LTS: golang-1.22, Ubuntu:22.04:LTS: golang-1.20, Ubuntu:22.04:LTS: golang-1.21, Ubuntu:22.04:LTS: golang-1.22, Ubuntu:22.04:LTS: golang-1.23, Ubuntu:22.04:LTS: golang-1.24, Ubuntu:24.04:LTS: golang-1.21, Ubuntu:24.04:LTS: golang-1.22 and 8 more

WID-SEC-W-2026-1006 — Golang Go: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um Speicherbeschädigungen zu verursachen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand auszulösen oder andere, nicht näher spezifizierte Angriffe durchzuführen.