https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 03:17:45 +0000 https://cve.radiocsirt.org/vuln/cve-2025-47912 <p><strong>Affected:</strong> Go standard library net/url</p> <p>The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: &#34;http://[::1]/&#34;. IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.</p> <p><strong>Affected:</strong> Go standard library net/url</p> <p>The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: &#34;http://[::1]/&#34;. IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.</p> https://cve.radiocsirt.org/vuln/cve-2025-47912 https://cve.radiocsirt.org/vuln/ghsa-vh4v-2xq2-g5cg <p><strong>Affected:</strong> Go: oras.land/oras-go/v2</p> <p># ORAS Go forwards registry credentials across registry redirects</p> <p>Reporter / public credit: JUNYI LIU</p> <p>## Summary</p> <p>ORAS Go can forward registry credentials configured for one registry origin to a different HTTP origin during registry redirects.</p> <p>There are two related paths:</p> <p>1. A manifest or metadata request authenticates to the origin registry, then the origin returns a redirect to another host or port. The redirected request can carry the origin `Authorization` header to the redirect target. 2. A blob upload `POST` authenticates to the origin registry, then the origin returns an upload `Location` on another host or port. The follow-up `PUT` can carry the origin `Authorization` header to the `Location` target.</p> <p>The upload `Location` issue appears related to the existing public fix in pull request #1152 / GHSA-jxpm-75mh-9fp7. The manifest redirect path is a residual adjacent route: the v2 branch after the upload `Location` fix still forwards Basic credentials on an authenticated manifest redirect.</p> <p>## Impact</p> <p>A registry response can cause an ORAS Go or ORAS CLI client to send configured registry credentials to an unintended endpoint. In common workflows, those credentials may come from a registry config / Docker-style auth file rather than command-line flags.</p> <p>This is a credential exposure across the registry-origin boundary. I am not claiming remote code execution, registry compromise, arbitrary token theft, or live third-party impact.</p> <p>## Affected Versions Tested</p> <p>- `oras…</p> <p><strong>Affected:</strong> Go: oras.land/oras-go/v2</p> <p># ORAS Go forwards registry credentials across registry redirects</p> <p>Reporter / public credit: JUNYI LIU</p> <p>## Summary</p> <p>ORAS Go can forward registry credentials configured for one registry origin to a different HTTP origin during registry redirects.</p> <p>There are two related paths:</p> <p>1. A manifest or metadata request authenticates to the origin registry, then the origin returns a redirect to another host or port. The redirected request can carry the origin `Authorization` header to the redirect target. 2. A blob upload `POST` authenticates to the origin registry, then the origin returns an upload `Location` on another host or port. The follow-up `PUT` can carry the origin `Authorization` header to the `Location` target.</p> <p>The upload `Location` issue appears related to the existing public fix in pull request #1152 / GHSA-jxpm-75mh-9fp7. The manifest redirect path is a residual adjacent route: the v2 branch after the upload `Location` fix still forwards Basic credentials on an authenticated manifest redirect.</p> <p>## Impact</p> <p>A registry response can cause an ORAS Go or ORAS CLI client to send configured registry credentials to an unintended endpoint. In common workflows, those credentials may come from a registry config / Docker-style auth file rather than command-line flags.</p> <p>This is a credential exposure across the registry-origin boundary. I am not claiming remote code execution, registry compromise, arbitrary token theft, or live third-party impact.</p> <p>## Affected Versions Tested</p> <p>- `oras…</p> https://cve.radiocsirt.org/vuln/ghsa-vh4v-2xq2-g5cg