https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 23:33:10 +0000 https://cve.radiocsirt.org/vuln/cve-2026-33811 <p><strong>Affected:</strong> Go standard library net, Red Hat Cryostat 4 on RHEL 9, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 10, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8 and 137 more</p> <p>When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.</p> <p><strong>Affected:</strong> Go standard library net, Red Hat Cryostat 4 on RHEL 9, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 10, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8 and 137 more</p> <p>When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.</p> https://cve.radiocsirt.org/vuln/cve-2026-33811 https://cve.radiocsirt.org/vuln/ghsa-xmrv-pmrh-hhx2 <p><strong>Affected:</strong> Go: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream, Go: github.com/aws/aws-sdk-go-v2/service/bedrockagentcore, Go: github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime, Go: github.com/aws/aws-sdk-go-v2/service/bedrockruntime, Go: github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs, Go: github.com/aws/aws-sdk-go-v2/service/iotsitewise, Go: github.com/aws/aws-sdk-go-v2/service/kinesis, Go: github.com/aws/aws-sdk-go-v2/service/lambda, Go: github.com/aws/aws-sdk-go-v2/service/lexruntimev2, Go: github.com/aws/aws-sdk-go-v2/service/s3 and 2 more</p> <p>**CVSSv3.1 Rating**: [Medium] **CVSSv3.1 Score**: [5.9] **CVSSv3.1 Vector String**: [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H]</p> <p>## Summary and Impact An issue exists in the the EventStream header decoder in AWS SDK for Go v2 in versions predating [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23). An actor can send a malformed EventStream response frame containing a crafted header value type byte outside the valid range, which can cause the host process to terminate.</p> <p>Impacted versions: &lt; [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23)</p> <p>## Patches This issue has been addressed in versions [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23) and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.</p> <p>## Workarounds Not Applicable</p> <p>## References If you have any questions or comments about this advisory, we ask that you contact [AWS/Amazon] Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.</p> <p><strong>Affected:</strong> Go: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream, Go: github.com/aws/aws-sdk-go-v2/service/bedrockagentcore, Go: github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime, Go: github.com/aws/aws-sdk-go-v2/service/bedrockruntime, Go: github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs, Go: github.com/aws/aws-sdk-go-v2/service/iotsitewise, Go: github.com/aws/aws-sdk-go-v2/service/kinesis, Go: github.com/aws/aws-sdk-go-v2/service/lambda, Go: github.com/aws/aws-sdk-go-v2/service/lexruntimev2, Go: github.com/aws/aws-sdk-go-v2/service/s3 and 2 more</p> <p>**CVSSv3.1 Rating**: [Medium] **CVSSv3.1 Score**: [5.9] **CVSSv3.1 Vector String**: [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H]</p> <p>## Summary and Impact An issue exists in the the EventStream header decoder in AWS SDK for Go v2 in versions predating [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23). An actor can send a malformed EventStream response frame containing a crafted header value type byte outside the valid range, which can cause the host process to terminate.</p> <p>Impacted versions: &lt; [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23)</p> <p>## Patches This issue has been addressed in versions [2026-03-23](https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23) and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.</p> <p>## Workarounds Not Applicable</p> <p>## References If you have any questions or comments about this advisory, we ask that you contact [AWS/Amazon] Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.</p> https://cve.radiocsirt.org/vuln/ghsa-xmrv-pmrh-hhx2