https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 20:04:21 +0000 https://cve.radiocsirt.org/vuln/cve-2026-32280 <p><strong>Affected:</strong> Go standard library crypto/x509, Red Hat Cryostat 4 on RHEL 9, Red Hat HawtIO HawtIO 4.4.0, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 10, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support and 132 more</p> <p>During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.</p> <p><strong>Affected:</strong> Go standard library crypto/x509, Red Hat Cryostat 4 on RHEL 9, Red Hat HawtIO HawtIO 4.4.0, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 10, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support and 132 more</p> <p>During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.</p> https://cve.radiocsirt.org/vuln/cve-2026-32280 https://cve.radiocsirt.org/vuln/ghsa-3xc5-wrhm-f963 <p><strong>Affected:</strong> Go: github.com/go-git/go-git/v5, Go: github.com/go-git/go-git/v6</p> <p>### Impact `go-git` may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations.</p> <p>If a remote repository responds to the initial `/info/refs` request with a redirect to a different host, go-git updates the session endpoint to the redirected location and reuses the original authentication for subsequent requests. This can result in the credentials (e.g. Authorization headers) being sent to an unintended host.</p> <p>An attacker controlling or influencing the redirect target can capture these credentials and potentially reuse them to access the victim’s repositories or other resources, depending on the scope of the credential.</p> <p>**Clients using `go-git` exclusively with trusted remotes (for example, GitHub or GitLab), and over a secure HTTPS connection, are not affected by this issue.** The risk arises when interacting with untrusted or misconfigured Git servers, or when using unsecured HTTP connections, which is not recommended. Such configurations also expose clients to a broader class of security risks beyond this issue, including credential interception and tampering of repository data.</p> <p>### Patches Users should upgrade to `v5.18.0`, or `v6.0.0-alpha.2`, in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported `go-git` version.</p> <p>The patched versions add support for configuring [followRedirects](https://git-scm.com/docs/git-config#Documentation/git-con…</p> <p><strong>Affected:</strong> Go: github.com/go-git/go-git/v5, Go: github.com/go-git/go-git/v6</p> <p>### Impact `go-git` may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations.</p> <p>If a remote repository responds to the initial `/info/refs` request with a redirect to a different host, go-git updates the session endpoint to the redirected location and reuses the original authentication for subsequent requests. This can result in the credentials (e.g. Authorization headers) being sent to an unintended host.</p> <p>An attacker controlling or influencing the redirect target can capture these credentials and potentially reuse them to access the victim’s repositories or other resources, depending on the scope of the credential.</p> <p>**Clients using `go-git` exclusively with trusted remotes (for example, GitHub or GitLab), and over a secure HTTPS connection, are not affected by this issue.** The risk arises when interacting with untrusted or misconfigured Git servers, or when using unsecured HTTP connections, which is not recommended. Such configurations also expose clients to a broader class of security risks beyond this issue, including credential interception and tampering of repository data.</p> <p>### Patches Users should upgrade to `v5.18.0`, or `v6.0.0-alpha.2`, in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported `go-git` version.</p> <p>The patched versions add support for configuring [followRedirects](https://git-scm.com/docs/git-config#Documentation/git-con…</p> https://cve.radiocsirt.org/vuln/ghsa-3xc5-wrhm-f963