Most recent entries from all

certfr-2026-avi-1094 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2026-avi-1094

Withdrawn: CLEANSTART-2026-PW57640 — Security fixes for CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-61732, CVE-2025-68119, CVE-2025-68121, CVE-…

Withdrawn by the publisher.

Affected: CleanStart: grafana-alloy-fips

Multiple security vulnerabilities affect the grafana-alloy-fips package. These issues are resolved in later releases. See references for individual vulnerability details.

fkie_cve-2026-4427

Rejected reason: Duplicate of CVE-2026-32286

Withdrawn: GHSA-x6gf-mpr2-68h6 — Duplicate Advisory: pgproto3: Negative field length panics in DataRow.Decode

Withdrawn by the publisher.

Affected: Go: github.com/jackc/pgproto3/v2

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-jqcq-xjh3-6g23. This link is maintained to preserve external references.

## Original Description A flaw was found in pgproto3. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message with a negative field length. This input validation vulnerability can lead to a denial of service (DoS) due to a slice bounds out of range panic.

openSUSE-SU-2026:10669-1 — alloy-1.16.0-2.1 on GA media

alloy-1.16.0-2.1 on GA media

RHSA-2026:10126 — Red Hat Security Advisory: RHTAS 1.3.4 - Red Hat Trusted Artifact Signer Release

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

RLSA-2026:22450 — Important: osbuild-composer security update

Affected: Rocky Linux:10: osbuild-composer

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)

* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)

* github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server (CVE-2026-32286)

* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key updat…

SUSE-SU-2026:21793-1 — Security update for alloy

Security update for alloy

Withdrawn: UBUNTU-CVE-2026-4427

Withdrawn by the publisher.

Affected: Ubuntu:24.04:LTS: golang-github-jackc-pgproto3, Ubuntu:25.10: golang-github-jackc-pgproto3

A flaw was found in pgproto3. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message with a negative field length. This input validation vulnerability can lead to a denial of service (DoS) due to a slice bounds out of range panic.