https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 14:23:46 +0000 https://cve.radiocsirt.org/vuln/cve-2026-25680 <p><strong>Affected:</strong> golang.org/x/net/html</p> <p>Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.</p> <p><strong>Affected:</strong> golang.org/x/net/html</p> <p>Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.</p> https://cve.radiocsirt.org/vuln/cve-2026-25680 https://cve.radiocsirt.org/vuln/ghsa-crhj-59gh-8x96 <p><strong>Affected:</strong> Go: github.com/go-git/go-git/v5, Go: github.com/go-git/go-git/v6, Go: github.com/go-git/go-git</p> <p>### Impact A path validation issue in `go-git` could allow crafted repository data to affect files outside the intended checkout target, including the repository&#39;s `.git` directory.</p> <p>These validations were introduced in upstream Git years ago, so the vulnerability arose from go-git drifting from those checks. Some attack vectors were platform-specific: certain payloads affected only Windows users, others affected only macOS users, and some applied across all supported platforms.</p> <p>Using non-descendant `go-billy` filesystem instances, or different filesystem types, for the `Storer` and `Worktree` may provide some isolation against `.git` directory manipulation. For example, users that store the `.git` directory through `memfs` while using `osfs` for the worktree are not affected by this vulnerability in the main repository, because repository metadata is not materialized inside the worktree filesystem.</p> <p>However, this isolation does not necessarily apply when the repository contains submodules, since submodule dotgit directories may still be represented or materialized within the worktree context.</p> <p>It is important to note that exploitation requires a maliciously crafted repository payload. Users should always exercise caution when interacting with repositories or Git servers they do not trust.</p> <p>### Patches Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to `v5` are likely to be affected, users are recommended to upgrade to a sup…</p> <p><strong>Affected:</strong> Go: github.com/go-git/go-git/v5, Go: github.com/go-git/go-git/v6, Go: github.com/go-git/go-git</p> <p>### Impact A path validation issue in `go-git` could allow crafted repository data to affect files outside the intended checkout target, including the repository&#39;s `.git` directory.</p> <p>These validations were introduced in upstream Git years ago, so the vulnerability arose from go-git drifting from those checks. Some attack vectors were platform-specific: certain payloads affected only Windows users, others affected only macOS users, and some applied across all supported platforms.</p> <p>Using non-descendant `go-billy` filesystem instances, or different filesystem types, for the `Storer` and `Worktree` may provide some isolation against `.git` directory manipulation. For example, users that store the `.git` directory through `memfs` while using `osfs` for the worktree are not affected by this vulnerability in the main repository, because repository metadata is not materialized inside the worktree filesystem.</p> <p>However, this isolation does not necessarily apply when the repository contains submodules, since submodule dotgit directories may still be represented or materialized within the worktree context.</p> <p>It is important to note that exploitation requires a maliciously crafted repository payload. Users should always exercise caution when interacting with repositories or Git servers they do not trust.</p> <p>### Patches Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to `v5` are likely to be affected, users are recommended to upgrade to a sup…</p> https://cve.radiocsirt.org/vuln/ghsa-crhj-59gh-8x96