https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 16:59:34 +0000 https://vulnerability.circl.lu/vuln/cleanstart-2026-ha46232 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: metallb</p> <p>Multiple security vulnerabilities affect the metallb package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: metallb</p> <p>Multiple security vulnerabilities affect the metallb package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details.</p> https://vulnerability.circl.lu/vuln/cleanstart-2026-ha46232 https://vulnerability.circl.lu/vuln/fkie_cve-2026-14362 <p>HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.</p> <p>HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-14362 https://vulnerability.circl.lu/vuln/ghsa-6r3r-6rpf-v429 <p>HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.</p> <p>HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.</p> https://vulnerability.circl.lu/vuln/ghsa-6r3r-6rpf-v429 https://vulnerability.circl.lu/vuln/rhsa-2026:54427 <p>github.com/hashicorp/memberlist: HashiCorp memberlist: Denial of Service via push/pull state handling golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation postcss: PostCSS: Information disclosure and denial of service via crafted CSS input console: Stored DOM XSS via unescaped pod logs in document.write</p> <p>github.com/hashicorp/memberlist: HashiCorp memberlist: Denial of Service via push/pull state handling golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation postcss: PostCSS: Information disclosure and denial of service via crafted CSS input console: Stored DOM XSS via unescaped pod logs in document.write</p> https://vulnerability.circl.lu/vuln/rhsa-2026:54427