https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 17:31:14 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-204859 EUVD-2026-204859 https://cve.radiocsirt.org/vuln/euvd-2026-204859 https://cve.radiocsirt.org/vuln/fkie_cve-2023-25656 <p>notation-go is a collection of libraries for supporting Notation sign, verify, push, and pull of oci artifacts. Prior to version 1.0.0-rc.3, notation-go users will find their application using excessive memory when verifying signatures. The application will be killed, and thus availability is impacted. The problem has been patched in the release v1.0.0-rc.3. Some workarounds are available. Users can review their own trust policy file and check if the identity string contains `=#`. Meanwhile, users should only put trusted certificates in their trust stores referenced by their own trust policy files, and make sure the `authenticity` validation is set to `enforce`.</p> <p>notation-go is a collection of libraries for supporting Notation sign, verify, push, and pull of oci artifacts. Prior to version 1.0.0-rc.3, notation-go users will find their application using excessive memory when verifying signatures. The application will be killed, and thus availability is impacted. The problem has been patched in the release v1.0.0-rc.3. Some workarounds are available. Users can review their own trust policy file and check if the identity string contains `=#`. Meanwhile, users should only put trusted certificates in their trust stores referenced by their own trust policy files, and make sure the `authenticity` validation is set to `enforce`.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-25656 https://cve.radiocsirt.org/vuln/ghsa-87x9-7grx-m28v <p><strong>Affected:</strong> Go: github.com/notaryproject/notation-go</p> <p>### Impact</p> <p>`notation-go` users will find their application using excessive memory when verifying signatures and the application will be finally killed, and thus availability is impacted.</p> <p>### Patches</p> <p>The problem has been patched in the release [v1.0.0-rc.3](https://github.com/notaryproject/notation-go/releases/tag/v1.0.0-rc.3). Users should upgrade their `notation-go` packages to `v1.0.0-rc.3` or above.</p> <p>### Workarounds</p> <p>Users can review their own trust policy file and check if the identity string contains `=#`. Meanwhile, users should only put trusted certificates in their trust stores referenced by their own trust policy files, and make sure the `authenticity` validation is set to `enforce`</p> <p>### Credits</p> <p>The `notation-go` project would like to thank Adam Korczynski (@AdamKorcz) for responsibly disclosing this issue during a security fuzzing audit sponsored by CNCF and Shiwei Zhang (@shizhMSFT) for root cause analysis and detailed vulnerability report.</p> <p>### References</p> <p>- [Resource exhaustion attacks](https://en.wikipedia.org/wiki/Resource_exhaustion_attack)</p> <p><strong>Affected:</strong> Go: github.com/notaryproject/notation-go</p> <p>### Impact</p> <p>`notation-go` users will find their application using excessive memory when verifying signatures and the application will be finally killed, and thus availability is impacted.</p> <p>### Patches</p> <p>The problem has been patched in the release [v1.0.0-rc.3](https://github.com/notaryproject/notation-go/releases/tag/v1.0.0-rc.3). Users should upgrade their `notation-go` packages to `v1.0.0-rc.3` or above.</p> <p>### Workarounds</p> <p>Users can review their own trust policy file and check if the identity string contains `=#`. Meanwhile, users should only put trusted certificates in their trust stores referenced by their own trust policy files, and make sure the `authenticity` validation is set to `enforce`</p> <p>### Credits</p> <p>The `notation-go` project would like to thank Adam Korczynski (@AdamKorcz) for responsibly disclosing this issue during a security fuzzing audit sponsored by CNCF and Shiwei Zhang (@shizhMSFT) for root cause analysis and detailed vulnerability report.</p> <p>### References</p> <p>- [Resource exhaustion attacks](https://en.wikipedia.org/wiki/Resource_exhaustion_attack)</p> https://cve.radiocsirt.org/vuln/ghsa-87x9-7grx-m28v https://cve.radiocsirt.org/vuln/gsd-2023-25656 gsd-2023-25656 https://cve.radiocsirt.org/vuln/gsd-2023-25656