https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 03:53:24 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0986 certfr-2026-avi-0986 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0986 https://cve.radiocsirt.org/vuln/cleanstart-2026-aq98798 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: tigera-operator</p> <p>Multiple security vulnerabilities affect the tigera-operator package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: tigera-operator</p> <p>Multiple security vulnerabilities affect the tigera-operator package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-aq98798 https://cve.radiocsirt.org/vuln/euvd-2026-338866 EUVD-2026-338866 https://cve.radiocsirt.org/vuln/euvd-2026-338866 https://cve.radiocsirt.org/vuln/fkie_cve-2026-50151 <p>oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller&#39;s credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.</p> <p>oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller&#39;s credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-50151 https://cve.radiocsirt.org/vuln/ghsa-jxpm-75mh-9fp7 <p><strong>Affected:</strong> Go: oras.land/oras-go/v2</p> <p>## Summary</p> <p>oras-go follows a registry-controlled `Location` header during the monolithic blob upload flow and reuses the `Authorization` header from the initial `POST` request for the subsequent `PUT` request. If a malicious registry returns a cross-host `Location`, oras-go can send the caller&#39;s credentials to an attacker-controlled endpoint.</p> <p>## Affected Versions</p> <p>tested: v2.6.0 (commit 03243809936cce826494b5506f724c6dc11115b1, as-of 2026-01-24) range: unknown; likely affects earlier v2.x releases that include the same upload flow</p> <p>## Impact</p> <p>Credential leak to an attacker-controlled endpoint and client-side ssrf to a cross-host target.</p> <p>## Affected Component</p> <p>- `registry/remote/repository.go:878-916` (`blobStore.completePushAfterInitialPost`)</p> <p>## Reproduction</p> <p>Attachments include `poc.zip` with a local-only harness (no real registry required). It runs a fake registry server that returns a cross-host `Location` and a second server that records whether it received `Authorization`.</p> <p>```bash unzip -q -o poc.zip -d /tmp/poc cd /tmp/poc/poc-F-ORAS-LOCATION-UPLOAD-001 make canonical make control ```</p> <p>## Recommended Fix</p> <p>- validate `Location` before uploading (scheme + hostname + effective port) against the original request, or require an explicit opt-in allowlist for cross-host upload urls - never forward `Authorization` when the upload target changes host or scheme</p> <p>## references</p> <p>- security policy: https://github.com/oras-project/oras-go/security/policy - vulnerable code: `reg…</p> <p><strong>Affected:</strong> Go: oras.land/oras-go/v2</p> <p>## Summary</p> <p>oras-go follows a registry-controlled `Location` header during the monolithic blob upload flow and reuses the `Authorization` header from the initial `POST` request for the subsequent `PUT` request. If a malicious registry returns a cross-host `Location`, oras-go can send the caller&#39;s credentials to an attacker-controlled endpoint.</p> <p>## Affected Versions</p> <p>tested: v2.6.0 (commit 03243809936cce826494b5506f724c6dc11115b1, as-of 2026-01-24) range: unknown; likely affects earlier v2.x releases that include the same upload flow</p> <p>## Impact</p> <p>Credential leak to an attacker-controlled endpoint and client-side ssrf to a cross-host target.</p> <p>## Affected Component</p> <p>- `registry/remote/repository.go:878-916` (`blobStore.completePushAfterInitialPost`)</p> <p>## Reproduction</p> <p>Attachments include `poc.zip` with a local-only harness (no real registry required). It runs a fake registry server that returns a cross-host `Location` and a second server that records whether it received `Authorization`.</p> <p>```bash unzip -q -o poc.zip -d /tmp/poc cd /tmp/poc/poc-F-ORAS-LOCATION-UPLOAD-001 make canonical make control ```</p> <p>## Recommended Fix</p> <p>- validate `Location` before uploading (scheme + hostname + effective port) against the original request, or require an explicit opt-in allowlist for cross-host upload urls - never forward `Authorization` when the upload target changes host or scheme</p> <p>## references</p> <p>- security policy: https://github.com/oras-project/oras-go/security/policy - vulnerable code: `reg…</p> https://cve.radiocsirt.org/vuln/ghsa-jxpm-75mh-9fp7 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11291-1 <p>helm-4.2.3-2.1 on GA media</p> <p>helm-4.2.3-2.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11291-1 https://cve.radiocsirt.org/vuln/rhsa-2026:47737 <p>golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation oras-go: oras-go: Credential forwarding via unvalidated Location header during blob upload github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin js-yaml: js-yaml: Denial of Service via crafted YAML documents</p> <p>golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation oras-go: oras-go: Credential forwarding via unvalidated Location header during blob upload github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin js-yaml: js-yaml: Denial of Service via crafted YAML documents</p> https://cve.radiocsirt.org/vuln/rhsa-2026:47737 https://cve.radiocsirt.org/vuln/suse-su-2026:23456-1 <p>Security update for helm</p> <p>Security update for helm</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23456-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-50151 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: golang-oras-oras-go, Ubuntu:26.04:LTS: golang-oras-oras-go</p> <p>oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller&#39;s credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: golang-oras-oras-go, Ubuntu:26.04:LTS: golang-oras-oras-go</p> <p>oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller&#39;s credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-50151