https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 02:41:32 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0556 certfr-2026-avi-0556 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0556 https://cve.radiocsirt.org/vuln/cleanstart-2026-ly29111 <p><strong>Affected:</strong> CleanStart: grafana-alloy</p> <p>Security vulnerability affects the grafana-alloy package. The DataRow.</p> <p><strong>Affected:</strong> CleanStart: grafana-alloy</p> <p>Security vulnerability affects the grafana-alloy package. The DataRow.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ly29111 https://cve.radiocsirt.org/vuln/euvd-2026-366112 EUVD-2026-366112 https://cve.radiocsirt.org/vuln/euvd-2026-366112 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32286 <p>The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.</p> <p>The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-32286 https://cve.radiocsirt.org/vuln/ghsa-jqcq-xjh3-6g23 <p><strong>Affected:</strong> Go: github.com/jackc/pgproto3/v2</p> <p>The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.</p> <p><strong>Affected:</strong> Go: github.com/jackc/pgproto3/v2</p> <p>The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.</p> https://cve.radiocsirt.org/vuln/ghsa-jqcq-xjh3-6g23 https://cve.radiocsirt.org/vuln/rhsa-2026:11070 <p>immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code</p> <p>immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code</p> https://cve.radiocsirt.org/vuln/rhsa-2026:11070 https://cve.radiocsirt.org/vuln/rhsa-2026:22450 <p>golang: net/url: Memory exhaustion in query parameter parsing in net/url golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption net/url: Incorrect parsing of IPv6 host literals in net/url crypto/x509: Incorrect enforcement of email constraints in crypto/x509 golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object</p> <p>golang: net/url: Memory exhaustion in query parameter parsing in net/url golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption net/url: Incorrect parsing of IPv6 host literals in net/url crypto/x509: Incorrect enforcement of email constraints in crypto/x509 golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object</p> https://cve.radiocsirt.org/vuln/rhsa-2026:22450 https://cve.radiocsirt.org/vuln/rlsa-2026:22450 <p><strong>Affected:</strong> Rocky Linux:10: osbuild-composer</p> <p>A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.</p> <p>Security Fix(es):</p> <p>* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)</p> <p>* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)</p> <p>* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)</p> <p>* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)</p> <p>* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)</p> <p>* github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)</p> <p>* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)</p> <p>* github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server (CVE-2026-32286)</p> <p>* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)</p> <p>* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)</p> <p>* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key updat…</p> <p><strong>Affected:</strong> Rocky Linux:10: osbuild-composer</p> <p>A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.</p> <p>Security Fix(es):</p> <p>* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)</p> <p>* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)</p> <p>* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)</p> <p>* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)</p> <p>* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)</p> <p>* github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)</p> <p>* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)</p> <p>* github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server (CVE-2026-32286)</p> <p>* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)</p> <p>* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)</p> <p>* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key updat…</p> https://cve.radiocsirt.org/vuln/rlsa-2026:22450 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-32286 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: golang-github-jackc-pgproto3, Ubuntu:25.10: golang-github-jackc-pgproto3, Ubuntu:26.04:LTS: golang-github-jackc-pgproto3</p> <p>The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: golang-github-jackc-pgproto3, Ubuntu:25.10: golang-github-jackc-pgproto3, Ubuntu:26.04:LTS: golang-github-jackc-pgproto3</p> <p>The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-32286