https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 09:40:56 +0000 https://cve.radiocsirt.org/vuln/cve-2026-32280 <p><strong>Affected:</strong> Go standard library crypto/x509, Red Hat Cryostat 4 on RHEL 9, Red Hat HawtIO HawtIO 4.4.0, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 10, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support and 132 more</p> <p>During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.</p> <p><strong>Affected:</strong> Go standard library crypto/x509, Red Hat Cryostat 4 on RHEL 9, Red Hat HawtIO HawtIO 4.4.0, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 10, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support and 132 more</p> <p>During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.</p> https://cve.radiocsirt.org/vuln/cve-2026-32280 https://cve.radiocsirt.org/vuln/ghsa-mh2q-q3fh-2475 <p><strong>Affected:</strong> Go: go.opentelemetry.io/otel</p> <p>multi-value `baggage:` header extraction parses each header field-value independently and aggregates members across values. this allows an attacker to amplify cpu and allocations by sending many `baggage:` header lines, even when each individual value is within the 8192-byte per-value parse limit.</p> <p>## severity</p> <p>HIGH (availability / remote request amplification)</p> <p>## relevant links</p> <p>- repository: https://github.com/open-telemetry/opentelemetry-go - pinned callsite: https://github.com/open-telemetry/opentelemetry-go/blob/1ee4a4126dbdd1bc79e9fae072fa488beffac52a/propagation/baggage.go#L58</p> <p>## vulnerability details</p> <p>**pins:** open-telemetry/opentelemetry-go@1ee4a4126dbdd1bc79e9fae072fa488beffac52a **as-of:** 2026-02-04 **policy:** direct (no program scope provided)</p> <p>**callsite:** propagation/baggage.go:58 (`extractMultiBaggage`) **attacker control:** inbound HTTP request headers (many `baggage` field-values) → `propagation.HeaderCarrier.Values(&#34;baggage&#34;)` → repeated `baggage.Parse` + member aggregation</p> <p>### root cause</p> <p>`extractMultiBaggage` iterates over all `baggage` header field-values and parses each one independently, then appends members into a shared slice. the 8192-byte parsing cap applies per header value, but the multi-value path repeats that work once per header line (bounded only by the server/proxy header byte limit).</p> <p>### impact</p> <p>in a default `net/http` configuration (max header bytes 1mb), a single request with many `baggage:` header field-values can cause large per…</p> <p><strong>Affected:</strong> Go: go.opentelemetry.io/otel</p> <p>multi-value `baggage:` header extraction parses each header field-value independently and aggregates members across values. this allows an attacker to amplify cpu and allocations by sending many `baggage:` header lines, even when each individual value is within the 8192-byte per-value parse limit.</p> <p>## severity</p> <p>HIGH (availability / remote request amplification)</p> <p>## relevant links</p> <p>- repository: https://github.com/open-telemetry/opentelemetry-go - pinned callsite: https://github.com/open-telemetry/opentelemetry-go/blob/1ee4a4126dbdd1bc79e9fae072fa488beffac52a/propagation/baggage.go#L58</p> <p>## vulnerability details</p> <p>**pins:** open-telemetry/opentelemetry-go@1ee4a4126dbdd1bc79e9fae072fa488beffac52a **as-of:** 2026-02-04 **policy:** direct (no program scope provided)</p> <p>**callsite:** propagation/baggage.go:58 (`extractMultiBaggage`) **attacker control:** inbound HTTP request headers (many `baggage` field-values) → `propagation.HeaderCarrier.Values(&#34;baggage&#34;)` → repeated `baggage.Parse` + member aggregation</p> <p>### root cause</p> <p>`extractMultiBaggage` iterates over all `baggage` header field-values and parses each one independently, then appends members into a shared slice. the 8192-byte parsing cap applies per header value, but the multi-value path repeats that work once per header line (bounded only by the server/proxy header byte limit).</p> <p>### impact</p> <p>in a default `net/http` configuration (max header bytes 1mb), a single request with many `baggage:` header field-values can cause large per…</p> https://cve.radiocsirt.org/vuln/ghsa-mh2q-q3fh-2475