https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 12:12:01 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0218 certfr-2026-avi-0218 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0218 https://cve.radiocsirt.org/vuln/cleanstart-2026-bb57522 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: kubernetes-dns-node-cache</p> <p>Package kubernetes-dns-node-cache version 1.25.0-r8 fixes 17 vulnerabilities: CVE-2026-41178, CVE-2026-35579, CVE-2026-46600, CVE-2025-64702, CVE-2025-68151...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: kubernetes-dns-node-cache</p> <p>Package kubernetes-dns-node-cache version 1.25.0-r8 fixes 17 vulnerabilities: CVE-2026-41178, CVE-2026-35579, CVE-2026-46600, CVE-2025-64702, CVE-2025-68151...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-bb57522 https://cve.radiocsirt.org/vuln/euvd-2026-263484 EUVD-2026-263484 https://cve.radiocsirt.org/vuln/euvd-2026-263484 https://cve.radiocsirt.org/vuln/fkie_cve-2025-64702 <p>quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go&#39;s HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.</p> <p>quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go&#39;s HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-64702 https://cve.radiocsirt.org/vuln/ghsa-g754-hx8w-x2g6 <p><strong>Affected:</strong> Go: github.com/quic-go/quic-go</p> <p>## Summary</p> <p>An attacker can cause excessive memory allocation in quic-go&#39;s HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an `http.Header` (used on the `http.Request` and `http.Response`, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion.</p> <p>## Impact</p> <p>A misbehaving or malicious peer can cause a denial-of-service (DoS) attack on quic-go&#39;s HTTP/3 servers or clients by triggering excessive memory allocation, potentially leading to crashes or exhaustion. It affects both servers and clients due to symmetric header construction.</p> <p>## Details</p> <p>In HTTP/3, headers are compressed using QPACK (RFC 9204). quic-go&#39;s HTTP/3 server (and client) decodes the QPACK-encoded HEADERS frame into header fields, then constructs an http.Request (or response).</p> <p>`http3.Server.MaxHeaderBytes` and `http3.Transport.MaxResponseHeaderBytes`, respectively, limit encoded HEADERS frame size (default: 1 MB server, 10 MB client), but not decoded size. A maliciously crafted HEADERS frame can expand to ~50x the encoded size using QPACK static table entries with long names / values.</p> <p>RFC 9114 requires enforcing decoded field section size limits via SETTINGS, which quic-go did not do.</p> <p>## The Fix</p> <p>quic-go now enforces RFC 9114 decoded field section size limits…</p> <p><strong>Affected:</strong> Go: github.com/quic-go/quic-go</p> <p>## Summary</p> <p>An attacker can cause excessive memory allocation in quic-go&#39;s HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an `http.Header` (used on the `http.Request` and `http.Response`, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion.</p> <p>## Impact</p> <p>A misbehaving or malicious peer can cause a denial-of-service (DoS) attack on quic-go&#39;s HTTP/3 servers or clients by triggering excessive memory allocation, potentially leading to crashes or exhaustion. It affects both servers and clients due to symmetric header construction.</p> <p>## Details</p> <p>In HTTP/3, headers are compressed using QPACK (RFC 9204). quic-go&#39;s HTTP/3 server (and client) decodes the QPACK-encoded HEADERS frame into header fields, then constructs an http.Request (or response).</p> <p>`http3.Server.MaxHeaderBytes` and `http3.Transport.MaxResponseHeaderBytes`, respectively, limit encoded HEADERS frame size (default: 1 MB server, 10 MB client), but not decoded size. A maliciously crafted HEADERS frame can expand to ~50x the encoded size using QPACK static table entries with long names / values.</p> <p>RFC 9114 requires enforcing decoded field section size limits via SETTINGS, which quic-go did not do.</p> <p>## The Fix</p> <p>quic-go now enforces RFC 9114 decoded field section size limits…</p> https://cve.radiocsirt.org/vuln/ghsa-g754-hx8w-x2g6 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10035-1 <p>teleport-17.7.13-1.1 on GA media</p> <p>teleport-17.7.13-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10035-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-64702 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: golang-github-lucas-clemente-quic-go, Ubuntu:24.04:LTS: golang-github-lucas-clemente-quic-go, Ubuntu:25.10: golang-github-lucas-clemente-quic-go, Ubuntu:26.04:LTS: golang-github-lucas-clemente-quic-go</p> <p>quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go&#39;s HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: golang-github-lucas-clemente-quic-go, Ubuntu:24.04:LTS: golang-github-lucas-clemente-quic-go, Ubuntu:25.10: golang-github-lucas-clemente-quic-go, Ubuntu:26.04:LTS: golang-github-lucas-clemente-quic-go</p> <p>quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go&#39;s HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (many unique header names and/or large values). The implementation builds an http.Header (used on the http.Request and http.Response, respectively), while only enforcing limits on the size of the (QPACK-compressed) HEADERS frame, but not on the decoded header, leading to memory exhaustion. This issue is fixed in version 0.57.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-64702