Most recent entries from all

ALSA-2026:70201 — Important: podman security update

Affected: AlmaLinux:10: podman, AlmaLinux:10: podman-docker, AlmaLinux:10: podman-remote, AlmaLinux:10: podman-tests

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * podman: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * podman: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * podman: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) * podman: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * podman: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * podman: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852) * podman: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * podman: Quadlet install --replace non-truncating write retains removed host-access directives (CVE-2026-19730) * podman: moby/go-archive: Arbitrary file write via link following in tar extraction (CVE-2026-17106)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(…

certfr-2026-avi-1094 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2026-avi-1094

Withdrawn: CLEANSTART-2026-AE16267 — gRPC-Go is the Go language implementation of gRPC

Withdrawn by the publisher.

Affected: CleanStart: step

Multiple security vulnerabilities affect the step package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details.

EUVD-2026-350851

fkie_cve-2026-56852

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

GHSA-jpjm-c3r5-q96r

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

msrc_CVE-2026-56852 — Infinite loop on invalid input in golang.org/x/text

msrc_CVE-2026-56852

openSUSE-SU-2026:11302-1 — trivy-0.72.0-2.1 on GA media

trivy-0.72.0-2.1 on GA media

RHSA-2026:40964 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

RLSA-2026:70201 — Important: podman security update

Affected: Rocky Linux:10: podman

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)

* podman: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

* podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

* podman: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

* podman: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

* podman: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

* podman: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

* podman: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852)

* podman: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)

* podman: Quadlet install --replace non-truncating write retains removed host-access directives (CVE-2026-19730)

* podman: moby/go-archive: Arbitrary file write via link following in tar extraction (CVE-2026-17106)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the Reference…

SUSE-SU-2026:22855-1 — Security update for helm

Security update for helm

UBUNTU-CVE-2026-56852

Affected: Ubuntu:20.04:LTS: golang-golang-x-text, Ubuntu:22.04:LTS: golang-golang-x-text, Ubuntu:24.04:LTS: golang-golang-x-text, Ubuntu:26.04:LTS: golang-golang-x-text

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

WID-SEC-W-2026-3481 — Red Hat Enterprise Linux (golang.org/x/text): Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.