Most recent entries from all

Withdrawn: CLEANSTART-2026-AE16267 — gRPC-Go is the Go language implementation of gRPC

Withdrawn by the publisher.

Affected: CleanStart: step

Multiple security vulnerabilities affect the step package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details.

EUVD-2026-363465

fkie_cve-2026-56855

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

msrc_CVE-2026-56855 — Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh

msrc_CVE-2026-56855

openSUSE-SU-2026:11685-1 — hauler-2.1.0-2.1 on GA media

hauler-2.1.0-2.1 on GA media

RLSA-2026:70640 — Important: buildah security update

Affected: Rocky Linux:9: buildah

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

* buildah: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

* buildah: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

* buildah: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

* buildah: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

* buildah: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:23736-1 — Security update for google-guest-agent

Security update for google-guest-agent

UBUNTU-CVE-2026-56855

Affected: Ubuntu:16.04:LTS: golang-defaults, Ubuntu:18.04:LTS: golang-defaults, Ubuntu:20.04:LTS: golang-defaults, Ubuntu:20.04:LTS: golang-1.20, Ubuntu:20.04:LTS: golang-1.21, Ubuntu:20.04:LTS: golang-1.22, Ubuntu:22.04:LTS: golang-1.17, Ubuntu:22.04:LTS: golang-1.20, Ubuntu:22.04:LTS: golang-1.21, Ubuntu:22.04:LTS: golang-1.22 and 13 more