https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 12:05:49 +0000 https://vulnerability.circl.lu/vuln/bell-cve-2026-56864 <p><strong>Affected:</strong> Alpaquita:23: go, Alpaquita:25: go, Alpaquita:stream: go, BellSoft Hardened Containers:23: go, BellSoft Hardened Containers:25: go, BellSoft Hardened Containers:stream: go</p> <p><strong>Affected:</strong> Alpaquita:23: go, Alpaquita:25: go, Alpaquita:stream: go, BellSoft Hardened Containers:23: go, BellSoft Hardened Containers:25: go, BellSoft Hardened Containers:stream: go</p> https://vulnerability.circl.lu/vuln/bell-cve-2026-56864 https://vulnerability.circl.lu/vuln/bit-golang-2026-56864 <p><strong>Affected:</strong> Bitnami: golang</p> <p>A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ &amp;&amp; go mod tidy</p> <p><strong>Affected:</strong> Bitnami: golang</p> <p>A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ &amp;&amp; go mod tidy</p> https://vulnerability.circl.lu/vuln/bit-golang-2026-56864 https://vulnerability.circl.lu/vuln/certfr-2026-avi-1125 certfr-2026-avi-1125 https://vulnerability.circl.lu/vuln/certfr-2026-avi-1125 https://vulnerability.circl.lu/vuln/cleanstart-2026-aq94704 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: minio-operator</p> <p>Multiple security vulnerabilities affect the minio-operator package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: minio-operator</p> <p>Multiple security vulnerabilities affect the minio-operator package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details.</p> https://vulnerability.circl.lu/vuln/cleanstart-2026-aq94704 https://vulnerability.circl.lu/vuln/fkie_cve-2026-56864 <p>A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ &amp;&amp; go mod tidy</p> <p>A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ &amp;&amp; go mod tidy</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-56864 https://vulnerability.circl.lu/vuln/msrc_cve-2026-56864 msrc_CVE-2026-56864 https://vulnerability.circl.lu/vuln/msrc_cve-2026-56864 https://vulnerability.circl.lu/vuln/oesa-2026-3715 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: golang</p> <p>. Security Fix(es):</p> <p>Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.(CVE-2026-33818)</p> <p>When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.(CVE-2026-56853)</p> <p>Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.(CVE-2026-56859)</p> <p>Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.(CVE-2026-56862)</p> <p>A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ &amp;amp;&amp;amp; go mod tidy(CVE-2026-56864)</p> <p>A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to ser…</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: golang</p> <p>. Security Fix(es):</p> <p>Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.(CVE-2026-33818)</p> <p>When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.(CVE-2026-56853)</p> <p>Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.(CVE-2026-56859)</p> <p>Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.(CVE-2026-56862)</p> <p>A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ &amp;amp;&amp;amp; go mod tidy(CVE-2026-56864)</p> <p>A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to ser…</p> https://vulnerability.circl.lu/vuln/oesa-2026-3715 https://vulnerability.circl.lu/vuln/opensuse-su-2026:11516-1 <p>go1.25-1.25.13-1.1 on GA media</p> <p>go1.25-1.25.13-1.1 on GA media</p> https://vulnerability.circl.lu/vuln/opensuse-su-2026:11516-1 https://vulnerability.circl.lu/vuln/rhsa-2026:67714 <p>encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service html/template: golang: Go html/template: Cross-Site Scripting via pathological input encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages golang.org/x/mod/sumdb: golang.org/x/mod/sumdb: Integrity bypass via malicious GOSUMDB golang.org/x/mod/sumdb/tlog: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass axios: axios: Denial of Service via object serialization bypass dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization qs: qs: Denial of Service via improper validation in stringify function js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing</p> <p>encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service html/template: golang: Go html/template: Cross-Site Scripting via pathological input encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages golang.org/x/mod/sumdb: golang.org/x/mod/sumdb: Integrity bypass via malicious GOSUMDB golang.org/x/mod/sumdb/tlog: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass axios: axios: Denial of Service via object serialization bypass dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization qs: qs: Denial of Service via improper validation in stringify function js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing</p> https://vulnerability.circl.lu/vuln/rhsa-2026:67714 https://vulnerability.circl.lu/vuln/suse-su-2026:23300-1 <p>Security update for go1.25</p> <p>Security update for go1.25</p> https://vulnerability.circl.lu/vuln/suse-su-2026:23300-1 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-56864 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.8 and 23 more</p> <p>A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ &amp;&amp; go mod tidy</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:Pro:18.04:LTS: golang-1.16, Ubuntu:Pro:18.04:LTS: golang-1.18, Ubuntu:18.04:LTS: golang-1.8 and 23 more</p> <p>A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ &amp;&amp; go mod tidy</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-56864 https://vulnerability.circl.lu/vuln/wid-sec-w-2026-2850 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen Denial of Service zu verursachen, ein Cross Site Scripting durchzuführen, Sicherheitsmaßnahmen zu umgehen oder Daten zu manipulieren.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen Denial of Service zu verursachen, ein Cross Site Scripting durchzuführen, Sicherheitsmaßnahmen zu umgehen oder Daten zu manipulieren.</p> https://vulnerability.circl.lu/vuln/wid-sec-w-2026-2850