https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 08:27:32 +0000 https://cve.radiocsirt.org/vuln/cve-2026-33811 <p><strong>Affected:</strong> Go standard library net, Red Hat Cryostat 4 on RHEL 9, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 10, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8 and 137 more</p> <p>When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.</p> <p><strong>Affected:</strong> Go standard library net, Red Hat Cryostat 4 on RHEL 9, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 10, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8 and 137 more</p> <p>When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.</p> https://cve.radiocsirt.org/vuln/cve-2026-33811 https://cve.radiocsirt.org/vuln/ghsa-389r-gv7p-r3rp <p><strong>Affected:</strong> Go: github.com/go-git/go-git/v6, Go: github.com/go-git/go-git/v5</p> <p>### Impact `go-git` may parse malformed Git objects in a way that differs from upstream Git. When `commit` or `tag` objects contain ambiguous or malformed headers, `go-git`’s decoded representation may expose values differently from how Git itself would interpret or reject the same object.</p> <p>Additionally, `go-git`’s commit signing and verification logic operates over commit data reconstructed from `go-git`’s parsed representation rather than the original raw object bytes. As a result, `go-git` may sign or verify a commit payload that is not byte-for-byte equivalent to the object stored in the repository.</p> <p>This can cause a signature to appear valid for a commit whose displayed or effective metadata differs from the object that was intended to be signed.</p> <p>### Patches Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported `go-git` version.</p> <p>### Credit</p> <p>Thanks to @bugbunny-research (https://bugbunny.ai/) for reporting this to `sigstore/gitsign`, and to @wlynch, @patzielinski and @adityasaky for coordinating the disclosure with the `go-git` project. :bow: :1st_place_medal:</p> <p>Thanks to @wayphinder for reporting this to the `go-git` project. :bow:</p> <p><strong>Affected:</strong> Go: github.com/go-git/go-git/v6, Go: github.com/go-git/go-git/v5</p> <p>### Impact `go-git` may parse malformed Git objects in a way that differs from upstream Git. When `commit` or `tag` objects contain ambiguous or malformed headers, `go-git`’s decoded representation may expose values differently from how Git itself would interpret or reject the same object.</p> <p>Additionally, `go-git`’s commit signing and verification logic operates over commit data reconstructed from `go-git`’s parsed representation rather than the original raw object bytes. As a result, `go-git` may sign or verify a commit payload that is not byte-for-byte equivalent to the object stored in the repository.</p> <p>This can cause a signature to appear valid for a commit whose displayed or effective metadata differs from the object that was intended to be signed.</p> <p>### Patches Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported `go-git` version.</p> <p>### Credit</p> <p>Thanks to @bugbunny-research (https://bugbunny.ai/) for reporting this to `sigstore/gitsign`, and to @wlynch, @patzielinski and @adityasaky for coordinating the disclosure with the `go-git` project. :bow: :1st_place_medal:</p> <p>Thanks to @wayphinder for reporting this to the `go-git` project. :bow:</p> https://cve.radiocsirt.org/vuln/ghsa-389r-gv7p-r3rp