https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 12:25:55 +0000 https://cve.radiocsirt.org/vuln/cve-2026-41178 <p><strong>Affected:</strong> open-telemetry go.opentelemetry.io/otel/baggage, open-telemetry go.opentelemetry.io/otel/propagation</p> <p>OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.</p> <p><strong>Affected:</strong> open-telemetry go.opentelemetry.io/otel/baggage, open-telemetry go.opentelemetry.io/otel/propagation</p> <p>OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.</p> https://cve.radiocsirt.org/vuln/cve-2026-41178 https://cve.radiocsirt.org/vuln/ghsa-vh4v-2xq2-g5cg <p><strong>Affected:</strong> Go: oras.land/oras-go/v2</p> <p># ORAS Go forwards registry credentials across registry redirects</p> <p>Reporter / public credit: JUNYI LIU</p> <p>## Summary</p> <p>ORAS Go can forward registry credentials configured for one registry origin to a different HTTP origin during registry redirects.</p> <p>There are two related paths:</p> <p>1. A manifest or metadata request authenticates to the origin registry, then the origin returns a redirect to another host or port. The redirected request can carry the origin `Authorization` header to the redirect target. 2. A blob upload `POST` authenticates to the origin registry, then the origin returns an upload `Location` on another host or port. The follow-up `PUT` can carry the origin `Authorization` header to the `Location` target.</p> <p>The upload `Location` issue appears related to the existing public fix in pull request #1152 / GHSA-jxpm-75mh-9fp7. The manifest redirect path is a residual adjacent route: the v2 branch after the upload `Location` fix still forwards Basic credentials on an authenticated manifest redirect.</p> <p>## Impact</p> <p>A registry response can cause an ORAS Go or ORAS CLI client to send configured registry credentials to an unintended endpoint. In common workflows, those credentials may come from a registry config / Docker-style auth file rather than command-line flags.</p> <p>This is a credential exposure across the registry-origin boundary. I am not claiming remote code execution, registry compromise, arbitrary token theft, or live third-party impact.</p> <p>## Affected Versions Tested</p> <p>- `oras…</p> <p><strong>Affected:</strong> Go: oras.land/oras-go/v2</p> <p># ORAS Go forwards registry credentials across registry redirects</p> <p>Reporter / public credit: JUNYI LIU</p> <p>## Summary</p> <p>ORAS Go can forward registry credentials configured for one registry origin to a different HTTP origin during registry redirects.</p> <p>There are two related paths:</p> <p>1. A manifest or metadata request authenticates to the origin registry, then the origin returns a redirect to another host or port. The redirected request can carry the origin `Authorization` header to the redirect target. 2. A blob upload `POST` authenticates to the origin registry, then the origin returns an upload `Location` on another host or port. The follow-up `PUT` can carry the origin `Authorization` header to the `Location` target.</p> <p>The upload `Location` issue appears related to the existing public fix in pull request #1152 / GHSA-jxpm-75mh-9fp7. The manifest redirect path is a residual adjacent route: the v2 branch after the upload `Location` fix still forwards Basic credentials on an authenticated manifest redirect.</p> <p>## Impact</p> <p>A registry response can cause an ORAS Go or ORAS CLI client to send configured registry credentials to an unintended endpoint. In common workflows, those credentials may come from a registry config / Docker-style auth file rather than command-line flags.</p> <p>This is a credential exposure across the registry-origin boundary. I am not claiming remote code execution, registry compromise, arbitrary token theft, or live third-party impact.</p> <p>## Affected Versions Tested</p> <p>- `oras…</p> https://cve.radiocsirt.org/vuln/ghsa-vh4v-2xq2-g5cg