{"bom":{"$schema":"http://cyclonedx.org/schema/bom-1.6.schema.json","bomFormat":"CycloneDX","components":[{"bom-ref":"a837bfd943468ec8","hashes":[{"alg":"SHA-1","content":"27c743816c58f82387af122ebf374a460b2e38c2"},{"alg":"SHA-256","content":"926071c23216776504ac7f2505242bc53e444ca045dcea2cc667e0aec5dc0c75"}],"name":"/target/app","properties":[{"name":"bomlens:licenseClass","value":"uncategorized"}],"type":"file"},{"bom-ref":"pkg:golang/github.com/spf13/cobra@v1.8.0?package-id=60e0742d712df822","cpe":"cpe:2.3:a:spf13:cobra:v1.8.0:*:*:*:*:*:*:*","name":"github.com/spf13/cobra","properties":[{"name":"syft:package:foundBy","value":"go-module-binary-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-buildinfo-entry"},{"name":"syft:location:0:path","value":"/app"},{"name":"syft:metadata:architecture","value":"arm64"},{"name":"syft:metadata:goCompiledVersion","value":"go1.25.5"},{"name":"syft:metadata:h1Digest","value":"h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0="},{"name":"syft:metadata:mainModule","value":"scab-binary-go"},{"name":"bomlens:licenseClass","value":"uncategorized"}],"purl":"pkg:golang/github.com/spf13/cobra@v1.8.0","type":"library","version":"v1.8.0"},{"bom-ref":"pkg:golang/github.com/spf13/pflag@v1.0.5?package-id=eb49fdb2ac5f1e6c","cpe":"cpe:2.3:a:spf13:pflag:v1.0.5:*:*:*:*:*:*:*","name":"github.com/spf13/pflag","properties":[{"name":"syft:package:foundBy","value":"go-module-binary-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-buildinfo-entry"},{"name":"syft:location:0:path","value":"/app"},{"name":"syft:metadata:architecture","value":"arm64"},{"name":"syft:metadata:goCompiledVersion","value":"go1.25.5"},{"name":"syft:metadata:h1Digest","value":"h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA="},{"name":"syft:metadata:mainModule","value":"scab-binary-go"},{"name":"bomlens:licenseClass","value":"uncategorized"}],"purl":"pkg:golang/github.com/spf13/pflag@v1.0.5","type":"library","version":"v1.0.5"},{"bom-ref":"pkg:golang/scab-binary-go@v0.0.0-20260701150924-3c359d138227?package-id=3a36dd2001076abe","name":"scab-binary-go","properties":[{"name":"syft:package:foundBy","value":"go-module-binary-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-buildinfo-entry"},{"name":"syft:location:0:path","value":"/app"},{"name":"syft:metadata:architecture","value":"arm64"},{"name":"syft:metadata:goCompiledVersion","value":"go1.25.5"},{"name":"syft:metadata:mainModule","value":"scab-binary-go"},{"name":"bomlens:licenseClass","value":"uncategorized"}],"purl":"pkg:golang/scab-binary-go@v0.0.0-20260701150924-3c359d138227","type":"library","version":"v0.0.0-20260701150924-3c359d138227"},{"bom-ref":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa","cpe":"cpe:2.3:a:golang:go:1.25.5:-:*:*:*:*:*:*","licenses":[{"license":{"id":"BSD-3-Clause"}}],"name":"stdlib","properties":[{"name":"syft:package:foundBy","value":"go-module-binary-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-buildinfo-entry"},{"name":"syft:location:0:path","value":"/app"},{"name":"syft:metadata:goCompiledVersion","value":"go1.25.5"},{"name":"bomlens:licenseClass","value":"permissive"}],"purl":"pkg:golang/stdlib@1.25.5","type":"library","version":"go1.25.5"}],"dependencies":[{"dependsOn":["pkg:golang/github.com/spf13/cobra@v1.8.0?package-id=60e0742d712df822","pkg:golang/github.com/spf13/pflag@v1.0.5?package-id=eb49fdb2ac5f1e6c","pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"],"ref":"pkg:golang/scab-binary-go@v0.0.0-20260701150924-3c359d138227?package-id=3a36dd2001076abe"}],"metadata":{"component":{"bom-ref":"16249dd84d246d5b","hashes":[{"alg":"SHA-256","content":"926071c23216776504ac7f2505242bc53e444ca045dcea2cc667e0aec5dc0c75"}],"name":"app","type":"file","version":"sha256:926071c23216776504ac7f2505242bc53e444ca045dcea2cc667e0aec5dc0c75"},"lifecycles":[{"phase":"post-build"}],"properties":[{"name":"bomlens:undeclared-fields","value":"unknown-to-author"}],"timestamp":"2026-10-14T22:36:01Z","tools":{"components":[{"author":"anchore","name":"syft","type":"application","version":"1.54.1"},{"name":"BomLens","publisher":"SK Telecom","type":"application","version":"1.13.4"}]}},"serialNumber":"urn:uuid:0ed95ae0-7971-4ea7-afd4-bfe8daba4e87","specVersion":"1.6","version":1,"compositions":[{"aggregate":"unknown"}]},"security":{"SchemaVersion":2,"Trivy":{"Version":"0.75.0"},"ReportID":"01a13c8f-344e-787e-a9a9-dfb97d898808","CreatedAt":"2026-10-14T22:36:20.430558836Z","ArtifactName":"binary-go_1.0.0_bom.json","ArtifactType":"cyclonedx","Results":[{"Target":"","Class":"lang-pkgs","Type":"gobinary","Packages":[{"ID":"github.com/spf13/cobra@v1.8.0","Name":"github.com/spf13/cobra","Identifier":{"PURL":"pkg:golang/github.com/spf13/cobra@v1.8.0","UID":"c5d69a48b2216f5","BOMRef":"pkg:golang/github.com/spf13/cobra@v1.8.0?package-id=60e0742d712df822"},"Version":"v1.8.0"},{"ID":"github.com/spf13/pflag@v1.0.5","Name":"github.com/spf13/pflag","Identifier":{"PURL":"pkg:golang/github.com/spf13/pflag@v1.0.5","UID":"f3dfa93fa26ac2","BOMRef":"pkg:golang/github.com/spf13/pflag@v1.0.5?package-id=eb49fdb2ac5f1e6c"},"Version":"v1.0.5"},{"ID":"scab-binary-go@v0.0.0-20260701150924-3c359d138227","Name":"scab-binary-go","Identifier":{"PURL":"pkg:golang/scab-binary-go@v0.0.0-20260701150924-3c359d138227","UID":"4e48c4117354e2b5","BOMRef":"pkg:golang/scab-binary-go@v0.0.0-20260701150924-3c359d138227?package-id=3a36dd2001076abe"},"Version":"v0.0.0-20260701150924-3c359d138227","DependsOn":["github.com/spf13/cobra@v1.8.0","github.com/spf13/pflag@v1.0.5","stdlib@v1.25.5"]},{"ID":"stdlib@v1.25.5","Name":"stdlib","Identifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"Version":"1.25.5","Licenses":["BSD-3-Clause"]}],"Vulnerabilities":[{"VulnerabilityID":"CVE-2025-68121","VendorIDs":["GO-2026-4337"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.24.13, 1.25.7, 1.26.0-rc.3","Status":"fixed","SeveritySource":"nvd","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2025-68121","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:cca46cd6760f5bf85e69d4da11443a714df2a7f9533aaa81e08bfb171e872edc","Title":"crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption","Description":"During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.","Severity":"CRITICAL","CweIDs":["CWE-295"],"VendorSeverity":{"alma":3,"amazon":2,"azure":2,"bitnami":4,"cbl-mariner":2,"nvd":4,"oracle-oval":3,"photon":4,"redhat":2,"rocky":3,"ubuntu":2},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","V3Score":9.1},"nvd":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","V3Score":10},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","V3Score":7.4}},"References":["https://access.redhat.com/errata/RHSA-2026:4177","https://access.redhat.com/security/cve/CVE-2025-68121","https://bugzilla.redhat.com/2434432","https://bugzilla.redhat.com/2437111","https://bugzilla.redhat.com/show_bug.cgi?id=2434432","https://bugzilla.redhat.com/show_bug.cgi?id=2437111","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121","https://errata.almalinux.org/9/ALSA-2026-4177.html","https://errata.rockylinux.org/RLSA-2026:4177","https://github.com/golang/go/issues/77113","https://go.dev/cl/737700","https://go.dev/issue/77217","https://groups.google.com/g/golang-announce/c/K09ubi9FQFk","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc","https://linux.oracle.com/cve/CVE-2025-68121.html","https://linux.oracle.com/errata/ELSA-2026-5146.html","https://nvd.nist.gov/vuln/detail/CVE-2025-68121","https://pkg.go.dev/vuln/GO-2026-4337","https://www.cve.org/CVERecord?id=CVE-2025-68121"],"PublishedDate":"2026-02-05T18:16:10.857Z","LastModifiedDate":"2026-06-17T09:58:33.833Z"},{"VulnerabilityID":"CVE-2025-61726","VendorIDs":["GO-2026-4341"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.24.12, 1.25.6","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2025-61726","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:22c2e3b789c4618945821d097cdc885456ccc3a05d2cd7e165b52a23b2433f09","Title":"golang: net/url: Memory exhaustion in query parameter parsing in net/url","Description":"The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.","Severity":"HIGH","CweIDs":["CWE-770"],"VendorSeverity":{"alma":3,"amazon":3,"azure":2,"bitnami":3,"cbl-mariner":2,"oracle-oval":3,"photon":3,"redhat":3,"rocky":3},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5}},"References":["https://access.redhat.com/errata/RHSA-2026:10096","https://access.redhat.com/errata/RHSA-2026:10104","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:10225","https://access.redhat.com/errata/RHSA-2026:10250","https://access.redhat.com/errata/RHSA-2026:11408","https://access.redhat.com/errata/RHSA-2026:11414","https://access.redhat.com/errata/RHSA-2026:11747","https://access.redhat.com/errata/RHSA-2026:11749","https://access.redhat.com/errata/RHSA-2026:12028","https://access.redhat.com/errata/RHSA-2026:12029","https://access.redhat.com/errata/RHSA-2026:12030","https://access.redhat.com/errata/RHSA-2026:12031","https://access.redhat.com/errata/RHSA-2026:12032","https://access.redhat.com/errata/RHSA-2026:12033","https://access.redhat.com/errata/RHSA-2026:12279","https://access.redhat.com/errata/RHSA-2026:12282","https://access.redhat.com/errata/RHSA-2026:13542","https://access.redhat.com/errata/RHSA-2026:13548","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:14100","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:14868","https://access.redhat.com/errata/RHSA-2026:14879","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:15984","https://access.redhat.com/errata/RHSA-2026:16102","https://access.redhat.com/errata/RHSA-2026:16696","https://access.redhat.com/errata/RHSA-2026:17040","https://access.redhat.com/errata/RHSA-2026:17084","https://access.redhat.com/errata/RHSA-2026:17446","https://access.redhat.com/errata/RHSA-2026:17460","https://access.redhat.com/errata/RHSA-2026:17463","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17595","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:18913","https://access.redhat.com/errata/RHSA-2026:19013","https://access.redhat.com/errata/RHSA-2026:19132","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19634","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21657","https://access.redhat.com/errata/RHSA-2026:21691","https://access.redhat.com/errata/RHSA-2026:22450","https://access.redhat.com/errata/RHSA-2026:22627","https://access.redhat.com/errata/RHSA-2026:22714","https://access.redhat.com/errata/RHSA-2026:22937","https://access.redhat.com/errata/RHSA-2026:23228","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25251","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:25253","https://access.redhat.com/errata/RHSA-2026:26420","https://access.redhat.com/errata/RHSA-2026:26527","https://access.redhat.com/errata/RHSA-2026:26541","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:2681","https://access.redhat.com/errata/RHSA-2026:2706","https://access.redhat.com/errata/RHSA-2026:2708","https://access.redhat.com/errata/RHSA-2026:2709","https://access.redhat.com/errata/RHSA-2026:2754","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:2844","https://access.redhat.com/errata/RHSA-2026:28441","https://access.redhat.com/errata/RHSA-2026:28886","https://access.redhat.com/errata/RHSA-2026:28961","https://access.redhat.com/errata/RHSA-2026:2914","https://access.redhat.com/errata/RHSA-2026:2920","https://access.redhat.com/errata/RHSA-2026:3035","https://access.redhat.com/errata/RHSA-2026:3040","https://access.redhat.com/errata/RHSA-2026:3089","https://access.redhat.com/errata/RHSA-2026:3092","https://access.redhat.com/errata/RHSA-2026:3184","https://access.redhat.com/errata/RHSA-2026:3186","https://access.redhat.com/errata/RHSA-2026:3187","https://access.redhat.com/errata/RHSA-2026:3188","https://access.redhat.com/errata/RHSA-2026:3192","https://access.redhat.com/errata/RHSA-2026:3193","https://access.redhat.com/errata/RHSA-2026:3291","https://access.redhat.com/errata/RHSA-2026:3296","https://access.redhat.com/errata/RHSA-2026:3297","https://access.redhat.com/errata/RHSA-2026:3298","https://access.redhat.com/errata/RHSA-2026:3336","https://access.redhat.com/errata/RHSA-2026:3337","https://access.redhat.com/errata/RHSA-2026:3340","https://access.redhat.com/errata/RHSA-2026:3341","https://access.redhat.com/errata/RHSA-2026:3343","https://access.redhat.com/errata/RHSA-2026:3391","https://access.redhat.com/errata/RHSA-2026:3416","https://access.redhat.com/errata/RHSA-2026:3427","https://access.redhat.com/errata/RHSA-2026:3459","https://access.redhat.com/errata/RHSA-2026:3468","https://access.redhat.com/errata/RHSA-2026:3469","https://access.redhat.com/errata/RHSA-2026:3470","https://access.redhat.com/errata/RHSA-2026:3471","https://access.redhat.com/errata/RHSA-2026:3472","https://access.redhat.com/errata/RHSA-2026:3473","https://access.redhat.com/errata/RHSA-2026:3489","https://access.redhat.com/errata/RHSA-2026:3506","https://access.redhat.com/errata/RHSA-2026:3556","https://access.redhat.com/errata/RHSA-2026:3559","https://access.redhat.com/errata/RHSA-2026:3668","https://access.redhat.com/errata/RHSA-2026:3669","https://access.redhat.com/errata/RHSA-2026:36873","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:3699","https://access.redhat.com/errata/RHSA-2026:3713","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:3752","https://access.redhat.com/errata/RHSA-2026:3753","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:3812","https://access.redhat.com/errata/RHSA-2026:3813","https://access.redhat.com/errata/RHSA-2026:3814","https://access.redhat.com/errata/RHSA-2026:3815","https://access.redhat.com/errata/RHSA-2026:3816","https://access.redhat.com/errata/RHSA-2026:3817","https://access.redhat.com/errata/RHSA-2026:3818","https://access.redhat.com/errata/RHSA-2026:3820","https://access.redhat.com/errata/RHSA-2026:3821","https://access.redhat.com/errata/RHSA-2026:3822","https://access.redhat.com/errata/RHSA-2026:3831","https://access.redhat.com/errata/RHSA-2026:3833","https://access.redhat.com/errata/RHSA-2026:3835","https://access.redhat.com/errata/RHSA-2026:3836","https://access.redhat.com/errata/RHSA-2026:3838","https://access.redhat.com/errata/RHSA-2026:3839","https://access.redhat.com/errata/RHSA-2026:3840","https://access.redhat.com/errata/RHSA-2026:3841","https://access.redhat.com/errata/RHSA-2026:3843","https://access.redhat.com/errata/RHSA-2026:3854","https://access.redhat.com/errata/RHSA-2026:3855","https://access.redhat.com/errata/RHSA-2026:3856","https://access.redhat.com/errata/RHSA-2026:3864","https://access.redhat.com/errata/RHSA-2026:3869","https://access.redhat.com/errata/RHSA-2026:3874","https://access.redhat.com/errata/RHSA-2026:3875","https://access.redhat.com/errata/RHSA-2026:3879","https://access.redhat.com/errata/RHSA-2026:3880","https://access.redhat.com/errata/RHSA-2026:3884","https://access.redhat.com/errata/RHSA-2026:3898","https://access.redhat.com/errata/RHSA-2026:3905","https://access.redhat.com/errata/RHSA-2026:3906","https://access.redhat.com/errata/RHSA-2026:3928","https://access.redhat.com/errata/RHSA-2026:3929","https://access.redhat.com/errata/RHSA-2026:3930","https://access.redhat.com/errata/RHSA-2026:3931","https://access.redhat.com/errata/RHSA-2026:3932","https://access.redhat.com/errata/RHSA-2026:3958","https://access.redhat.com/errata/RHSA-2026:3959","https://access.redhat.com/errata/RHSA-2026:3960","https://access.redhat.com/errata/RHSA-2026:3970","https://access.redhat.com/errata/RHSA-2026:3971","https://access.redhat.com/errata/RHSA-2026:3972","https://access.redhat.com/errata/RHSA-2026:3973","https://access.redhat.com/errata/RHSA-2026:3974","https://access.redhat.com/errata/RHSA-2026:3977","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:3985","https://access.redhat.com/errata/RHSA-2026:40924","https://access.redhat.com/errata/RHSA-2026:4164","https://access.redhat.com/errata/RHSA-2026:4166","https://access.redhat.com/errata/RHSA-2026:4170","https://access.redhat.com/errata/RHSA-2026:4174","https://access.redhat.com/errata/RHSA-2026:4177","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:4211","https://access.redhat.com/errata/RHSA-2026:4220","https://access.redhat.com/errata/RHSA-2026:4256","https://access.redhat.com/errata/RHSA-2026:4264","https://access.redhat.com/errata/RHSA-2026:4267","https://access.redhat.com/errata/RHSA-2026:4270","https://access.redhat.com/errata/RHSA-2026:4276","https://access.redhat.com/errata/RHSA-2026:4434","https://access.redhat.com/errata/RHSA-2026:4435","https://access.redhat.com/errata/RHSA-2026:4460","https://access.redhat.com/errata/RHSA-2026:4466","https://access.redhat.com/errata/RHSA-2026:4467","https://access.redhat.com/errata/RHSA-2026:4498","https://access.redhat.com/errata/RHSA-2026:4500","https://access.redhat.com/errata/RHSA-2026:4510","https://access.redhat.com/errata/RHSA-2026:4511","https://access.redhat.com/errata/RHSA-2026:4672","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:4753","https://access.redhat.com/errata/RHSA-2026:4892","https://access.redhat.com/errata/RHSA-2026:4901","https://access.redhat.com/errata/RHSA-2026:4907","https://access.redhat.com/errata/RHSA-2026:4939","https://access.redhat.com/errata/RHSA-2026:4942","https://access.redhat.com/errata/RHSA-2026:4943","https://access.redhat.com/errata/RHSA-2026:4952","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:5022","https://access.redhat.com/errata/RHSA-2026:5030","https://access.redhat.com/errata/RHSA-2026:5031","https://access.redhat.com/errata/RHSA-2026:5076","https://access.redhat.com/errata/RHSA-2026:5077","https://access.redhat.com/errata/RHSA-2026:5078","https://access.redhat.com/errata/RHSA-2026:5079","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:5110","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:5129","https://access.redhat.com/errata/RHSA-2026:5130","https://access.redhat.com/errata/RHSA-2026:5131","https://access.redhat.com/errata/RHSA-2026:5132","https://access.redhat.com/errata/RHSA-2026:5145","https://access.redhat.com/errata/RHSA-2026:5146","https://access.redhat.com/errata/RHSA-2026:5168","https://access.redhat.com/errata/RHSA-2026:5327","https://access.redhat.com/errata/RHSA-2026:5394","https://access.redhat.com/errata/RHSA-2026:5439","https://access.redhat.com/errata/RHSA-2026:5444","https://access.redhat.com/errata/RHSA-2026:5447","https://access.redhat.com/errata/RHSA-2026:5452","https://access.redhat.com/errata/RHSA-2026:5461","https://access.redhat.com/errata/RHSA-2026:5463","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:5533","https://access.redhat.com/errata/RHSA-2026:5544","https://access.redhat.com/errata/RHSA-2026:5549","https://access.redhat.com/errata/RHSA-2026:5636","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:5645","https://access.redhat.com/errata/RHSA-2026:5649","https://access.redhat.com/errata/RHSA-2026:5665","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:5807","https://access.redhat.com/errata/RHSA-2026:5851","https://access.redhat.com/errata/RHSA-2026:5852","https://access.redhat.com/errata/RHSA-2026:5853","https://access.redhat.com/errata/RHSA-2026:5948","https://access.redhat.com/errata/RHSA-2026:5950","https://access.redhat.com/errata/RHSA-2026:5952","https://access.redhat.com/errata/RHSA-2026:5968","https://access.redhat.com/errata/RHSA-2026:6184","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6226","https://access.redhat.com/errata/RHSA-2026:6251","https://access.redhat.com/errata/RHSA-2026:6277","https://access.redhat.com/errata/RHSA-2026:6278","https://access.redhat.com/errata/RHSA-2026:6428","https://access.redhat.com/errata/RHSA-2026:6429","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6554","https://access.redhat.com/errata/RHSA-2026:6564","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:6568","https://access.redhat.com/errata/RHSA-2026:66401","https://access.redhat.com/errata/RHSA-2026:7052","https://access.redhat.com/errata/RHSA-2026:7249","https://access.redhat.com/errata/RHSA-2026:7291","https://access.redhat.com/errata/RHSA-2026:7385","https://access.redhat.com/errata/RHSA-2026:7676","https://access.redhat.com/errata/RHSA-2026:7854","https://access.redhat.com/errata/RHSA-2026:7942","https://access.redhat.com/errata/RHSA-2026:8151","https://access.redhat.com/errata/RHSA-2026:8167","https://access.redhat.com/errata/RHSA-2026:8218","https://access.redhat.com/errata/RHSA-2026:8229","https://access.redhat.com/errata/RHSA-2026:8337","https://access.redhat.com/errata/RHSA-2026:8338","https://access.redhat.com/errata/RHSA-2026:8431","https://access.redhat.com/errata/RHSA-2026:8433","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:9097","https://access.redhat.com/errata/RHSA-2026:9098","https://access.redhat.com/errata/RHSA-2026:9108","https://access.redhat.com/errata/RHSA-2026:9109","https://access.redhat.com/errata/RHSA-2026:9848","https://access.redhat.com/security/cve/CVE-2025-61726","https://bugzilla.redhat.com/2434432","https://bugzilla.redhat.com/2437111","https://bugzilla.redhat.com/show_bug.cgi?id=2434432","https://bugzilla.redhat.com/show_bug.cgi?id=2437111","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121","https://errata.almalinux.org/9/ALSA-2026-4177.html","https://errata.rockylinux.org/RLSA-2026:4177","https://go.dev/cl/736712","https://go.dev/issue/77101","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc","https://linux.oracle.com/cve/CVE-2025-61726.html","https://linux.oracle.com/errata/ELSA-2026-5146.html","https://nvd.nist.gov/vuln/detail/CVE-2025-61726","https://pkg.go.dev/vuln/GO-2026-4341","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61726.json","https://www.cve.org/CVERecord?id=CVE-2025-61726"],"PublishedDate":"2026-01-28T20:16:09.713Z","LastModifiedDate":"2026-09-17T12:17:11.443Z"},{"VulnerabilityID":"CVE-2026-25679","VendorIDs":["GO-2026-4601"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.8, 1.26.1","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-25679","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:7e03069978be1d7af87dbb0854fddae746e228a65212778c7a0fd9a95c28c171","Title":"net/url: Incorrect parsing of IPv6 host literals in net/url","Description":"url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.","Severity":"HIGH","CweIDs":["CWE-425","CWE-1286"],"VendorSeverity":{"alma":3,"amazon":2,"azure":3,"bitnami":3,"oracle-oval":3,"photon":3,"redhat":3,"rocky":3},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5}},"References":["https://access.redhat.com/errata/RHSA-2026:10065","https://access.redhat.com/errata/RHSA-2026:10125","https://access.redhat.com/errata/RHSA-2026:10133","https://access.redhat.com/errata/RHSA-2026:10140","https://access.redhat.com/errata/RHSA-2026:10141","https://access.redhat.com/errata/RHSA-2026:10158","https://access.redhat.com/errata/RHSA-2026:10169","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:10225","https://access.redhat.com/errata/RHSA-2026:10250","https://access.redhat.com/errata/RHSA-2026:10701","https://access.redhat.com/errata/RHSA-2026:10712","https://access.redhat.com/errata/RHSA-2026:10929","https://access.redhat.com/errata/RHSA-2026:11217","https://access.redhat.com/errata/RHSA-2026:11375","https://access.redhat.com/errata/RHSA-2026:11412","https://access.redhat.com/errata/RHSA-2026:11413","https://access.redhat.com/errata/RHSA-2026:11686","https://access.redhat.com/errata/RHSA-2026:11688","https://access.redhat.com/errata/RHSA-2026:11747","https://access.redhat.com/errata/RHSA-2026:11749","https://access.redhat.com/errata/RHSA-2026:11768","https://access.redhat.com/errata/RHSA-2026:11800","https://access.redhat.com/errata/RHSA-2026:11856","https://access.redhat.com/errata/RHSA-2026:11916","https://access.redhat.com/errata/RHSA-2026:11996","https://access.redhat.com/errata/RHSA-2026:12028","https://access.redhat.com/errata/RHSA-2026:12029","https://access.redhat.com/errata/RHSA-2026:12030","https://access.redhat.com/errata/RHSA-2026:12031","https://access.redhat.com/errata/RHSA-2026:12032","https://access.redhat.com/errata/RHSA-2026:12033","https://access.redhat.com/errata/RHSA-2026:12282","https://access.redhat.com/errata/RHSA-2026:13508","https://access.redhat.com/errata/RHSA-2026:13512","https://access.redhat.com/errata/RHSA-2026:13545","https://access.redhat.com/errata/RHSA-2026:13642","https://access.redhat.com/errata/RHSA-2026:13643","https://access.redhat.com/errata/RHSA-2026:13671","https://access.redhat.com/errata/RHSA-2026:13791","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:14020","https://access.redhat.com/errata/RHSA-2026:14100","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:14868","https://access.redhat.com/errata/RHSA-2026:14879","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:16102","https://access.redhat.com/errata/RHSA-2026:16696","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:16875","https://access.redhat.com/errata/RHSA-2026:17040","https://access.redhat.com/errata/RHSA-2026:17084","https://access.redhat.com/errata/RHSA-2026:17287","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:19017","https://access.redhat.com/errata/RHSA-2026:19022","https://access.redhat.com/errata/RHSA-2026:19026","https://access.redhat.com/errata/RHSA-2026:19027","https://access.redhat.com/errata/RHSA-2026:19031","https://access.redhat.com/errata/RHSA-2026:19032","https://access.redhat.com/errata/RHSA-2026:19049","https://access.redhat.com/errata/RHSA-2026:19055","https://access.redhat.com/errata/RHSA-2026:19126","https://access.redhat.com/errata/RHSA-2026:19128","https://access.redhat.com/errata/RHSA-2026:19132","https://access.redhat.com/errata/RHSA-2026:19133","https://access.redhat.com/errata/RHSA-2026:19135","https://access.redhat.com/errata/RHSA-2026:19181","https://access.redhat.com/errata/RHSA-2026:19184","https://access.redhat.com/errata/RHSA-2026:19185","https://access.redhat.com/errata/RHSA-2026:19207","https://access.redhat.com/errata/RHSA-2026:19350","https://access.redhat.com/errata/RHSA-2026:19353","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19475","https://access.redhat.com/errata/RHSA-2026:19634","https://access.redhat.com/errata/RHSA-2026:19719","https://access.redhat.com/errata/RHSA-2026:19720","https://access.redhat.com/errata/RHSA-2026:19721","https://access.redhat.com/errata/RHSA-2026:19750","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:20088","https://access.redhat.com/errata/RHSA-2026:20581","https://access.redhat.com/errata/RHSA-2026:20582","https://access.redhat.com/errata/RHSA-2026:20584","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21655","https://access.redhat.com/errata/RHSA-2026:21657","https://access.redhat.com/errata/RHSA-2026:21691","https://access.redhat.com/errata/RHSA-2026:21696","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:22423","https://access.redhat.com/errata/RHSA-2026:22450","https://access.redhat.com/errata/RHSA-2026:22627","https://access.redhat.com/errata/RHSA-2026:22714","https://access.redhat.com/errata/RHSA-2026:22733","https://access.redhat.com/errata/RHSA-2026:22862","https://access.redhat.com/errata/RHSA-2026:22937","https://access.redhat.com/errata/RHSA-2026:23228","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:24386","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:25043","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:25180","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25251","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:25253","https://access.redhat.com/errata/RHSA-2026:26445","https://access.redhat.com/errata/RHSA-2026:26527","https://access.redhat.com/errata/RHSA-2026:26541","https://access.redhat.com/errata/RHSA-2026:26568","https://access.redhat.com/errata/RHSA-2026:26585","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:27076","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:28441","https://access.redhat.com/errata/RHSA-2026:28886","https://access.redhat.com/errata/RHSA-2026:28893","https://access.redhat.com/errata/RHSA-2026:28961","https://access.redhat.com/errata/RHSA-2026:29035","https://access.redhat.com/errata/RHSA-2026:29195","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/errata/RHSA-2026:29702","https://access.redhat.com/errata/RHSA-2026:29703","https://access.redhat.com/errata/RHSA-2026:29854","https://access.redhat.com/errata/RHSA-2026:33722","https://access.redhat.com/errata/RHSA-2026:34097","https://access.redhat.com/errata/RHSA-2026:34365","https://access.redhat.com/errata/RHSA-2026:36317","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:48036","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:5110","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:52389","https://access.redhat.com/errata/RHSA-2026:52390","https://access.redhat.com/errata/RHSA-2026:52391","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:5549","https://access.redhat.com/errata/RHSA-2026:56785","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:5941","https://access.redhat.com/errata/RHSA-2026:5942","https://access.redhat.com/errata/RHSA-2026:5943","https://access.redhat.com/errata/RHSA-2026:5944","https://access.redhat.com/errata/RHSA-2026:59830","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:6341","https://access.redhat.com/errata/RHSA-2026:6344","https://access.redhat.com/errata/RHSA-2026:6382","https://access.redhat.com/errata/RHSA-2026:6383","https://access.redhat.com/errata/RHSA-2026:6388","https://access.redhat.com/errata/RHSA-2026:6564","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:66401","https://access.redhat.com/errata/RHSA-2026:6720","https://access.redhat.com/errata/RHSA-2026:6802","https://access.redhat.com/errata/RHSA-2026:6949","https://access.redhat.com/errata/RHSA-2026:7005","https://access.redhat.com/errata/RHSA-2026:7009","https://access.redhat.com/errata/RHSA-2026:7011","https://access.redhat.com/errata/RHSA-2026:7259","https://access.redhat.com/errata/RHSA-2026:7291","https://access.redhat.com/errata/RHSA-2026:7315","https://access.redhat.com/errata/RHSA-2026:7328","https://access.redhat.com/errata/RHSA-2026:7385","https://access.redhat.com/errata/RHSA-2026:7665","https://access.redhat.com/errata/RHSA-2026:7669","https://access.redhat.com/errata/RHSA-2026:7674","https://access.redhat.com/errata/RHSA-2026:7833","https://access.redhat.com/errata/RHSA-2026:7834","https://access.redhat.com/errata/RHSA-2026:7876","https://access.redhat.com/errata/RHSA-2026:7877","https://access.redhat.com/errata/RHSA-2026:7878","https://access.redhat.com/errata/RHSA-2026:7879","https://access.redhat.com/errata/RHSA-2026:7883","https://access.redhat.com/errata/RHSA-2026:7992","https://access.redhat.com/errata/RHSA-2026:8151","https://access.redhat.com/errata/RHSA-2026:8167","https://access.redhat.com/errata/RHSA-2026:8314","https://access.redhat.com/errata/RHSA-2026:8322","https://access.redhat.com/errata/RHSA-2026:8324","https://access.redhat.com/errata/RHSA-2026:8337","https://access.redhat.com/errata/RHSA-2026:8338","https://access.redhat.com/errata/RHSA-2026:8433","https://access.redhat.com/errata/RHSA-2026:8434","https://access.redhat.com/errata/RHSA-2026:8456","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:8484","https://access.redhat.com/errata/RHSA-2026:8490","https://access.redhat.com/errata/RHSA-2026:8491","https://access.redhat.com/errata/RHSA-2026:8493","https://access.redhat.com/errata/RHSA-2026:8840","https://access.redhat.com/errata/RHSA-2026:8841","https://access.redhat.com/errata/RHSA-2026:8842","https://access.redhat.com/errata/RHSA-2026:8845","https://access.redhat.com/errata/RHSA-2026:8847","https://access.redhat.com/errata/RHSA-2026:8848","https://access.redhat.com/errata/RHSA-2026:8849","https://access.redhat.com/errata/RHSA-2026:8851","https://access.redhat.com/errata/RHSA-2026:8852","https://access.redhat.com/errata/RHSA-2026:8853","https://access.redhat.com/errata/RHSA-2026:8855","https://access.redhat.com/errata/RHSA-2026:8856","https://access.redhat.com/errata/RHSA-2026:8860","https://access.redhat.com/errata/RHSA-2026:8877","https://access.redhat.com/errata/RHSA-2026:8878","https://access.redhat.com/errata/RHSA-2026:8879","https://access.redhat.com/errata/RHSA-2026:8881","https://access.redhat.com/errata/RHSA-2026:8882","https://access.redhat.com/errata/RHSA-2026:8930","https://access.redhat.com/errata/RHSA-2026:8931","https://access.redhat.com/errata/RHSA-2026:8949","https://access.redhat.com/errata/RHSA-2026:9043","https://access.redhat.com/errata/RHSA-2026:9044","https://access.redhat.com/errata/RHSA-2026:9052","https://access.redhat.com/errata/RHSA-2026:9090","https://access.redhat.com/errata/RHSA-2026:9093","https://access.redhat.com/errata/RHSA-2026:9094","https://access.redhat.com/errata/RHSA-2026:9097","https://access.redhat.com/errata/RHSA-2026:9098","https://access.redhat.com/errata/RHSA-2026:9108","https://access.redhat.com/errata/RHSA-2026:9109","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/errata/RHSA-2026:9434","https://access.redhat.com/errata/RHSA-2026:9435","https://access.redhat.com/errata/RHSA-2026:9436","https://access.redhat.com/errata/RHSA-2026:9439","https://access.redhat.com/errata/RHSA-2026:9440","https://access.redhat.com/errata/RHSA-2026:9448","https://access.redhat.com/errata/RHSA-2026:9453","https://access.redhat.com/errata/RHSA-2026:9461","https://access.redhat.com/errata/RHSA-2026:9695","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/errata/RHSA-2026:9872","https://access.redhat.com/security/cve/CVE-2026-25679","https://bugzilla.redhat.com/2445356","https://bugzilla.redhat.com/show_bug.cgi?id=2445356","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679","https://errata.almalinux.org/9/ALSA-2026-9044.html","https://errata.rockylinux.org/RLSA-2026:9044","https://go.dev/cl/752180","https://go.dev/issue/77578","https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","https://linux.oracle.com/cve/CVE-2026-25679.html","https://linux.oracle.com/errata/ELSA-2026-9044.html","https://nvd.nist.gov/vuln/detail/CVE-2026-25679","https://pkg.go.dev/vuln/GO-2026-4601","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25679.json","https://www.cve.org/CVERecord?id=CVE-2026-25679"],"PublishedDate":"2026-03-06T22:16:00.72Z","LastModifiedDate":"2026-09-18T13:17:30.067Z"},{"VulnerabilityID":"CVE-2026-27145","VendorIDs":["GO-2026-5037"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.11, 1.26.4","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-27145","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:60969bd927960bdd83d05d0b6247699df5f04b8674133528de9dff360d854a8d","Title":"crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries","Description":"(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.","Severity":"HIGH","CweIDs":["CWE-606"],"VendorSeverity":{"alma":3,"amazon":2,"azure":2,"bitnami":3,"oracle-oval":3,"photon":3,"redhat":3,"rocky":3},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5}},"References":["https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:29980","https://access.redhat.com/errata/RHSA-2026:29981","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34357","https://access.redhat.com/errata/RHSA-2026:34359","https://access.redhat.com/errata/RHSA-2026:35832","https://access.redhat.com/errata/RHSA-2026:36317","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:38995","https://access.redhat.com/errata/RHSA-2026:39005","https://access.redhat.com/errata/RHSA-2026:39573","https://access.redhat.com/errata/RHSA-2026:39879","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41930","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42080","https://access.redhat.com/errata/RHSA-2026:42082","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:42240","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42946","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:46394","https://access.redhat.com/errata/RHSA-2026:46395","https://access.redhat.com/errata/RHSA-2026:47149","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49703","https://access.redhat.com/errata/RHSA-2026:49705","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:49729","https://access.redhat.com/errata/RHSA-2026:49744","https://access.redhat.com/errata/RHSA-2026:49765","https://access.redhat.com/errata/RHSA-2026:49770","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:50319","https://access.redhat.com/errata/RHSA-2026:51057","https://access.redhat.com/errata/RHSA-2026:51187","https://access.redhat.com/errata/RHSA-2026:52946","https://access.redhat.com/errata/RHSA-2026:53374","https://access.redhat.com/errata/RHSA-2026:53412","https://access.redhat.com/errata/RHSA-2026:53413","https://access.redhat.com/errata/RHSA-2026:53415","https://access.redhat.com/errata/RHSA-2026:53416","https://access.redhat.com/errata/RHSA-2026:53530","https://access.redhat.com/errata/RHSA-2026:54168","https://access.redhat.com/errata/RHSA-2026:54401","https://access.redhat.com/errata/RHSA-2026:54427","https://access.redhat.com/errata/RHSA-2026:54432","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54441","https://access.redhat.com/errata/RHSA-2026:54500","https://access.redhat.com/errata/RHSA-2026:54525","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54603","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:55899","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57488","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:59556","https://access.redhat.com/errata/RHSA-2026:59557","https://access.redhat.com/errata/RHSA-2026:59558","https://access.redhat.com/errata/RHSA-2026:59559","https://access.redhat.com/errata/RHSA-2026:59579","https://access.redhat.com/errata/RHSA-2026:59593","https://access.redhat.com/errata/RHSA-2026:60025","https://access.redhat.com/errata/RHSA-2026:60315","https://access.redhat.com/errata/RHSA-2026:60354","https://access.redhat.com/errata/RHSA-2026:60386","https://access.redhat.com/errata/RHSA-2026:60387","https://access.redhat.com/errata/RHSA-2026:60388","https://access.redhat.com/errata/RHSA-2026:60390","https://access.redhat.com/errata/RHSA-2026:60391","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:63016","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:68334","https://access.redhat.com/errata/RHSA-2026:68335","https://access.redhat.com/security/cve/CVE-2026-27145","https://bugzilla.redhat.com/2445356","https://bugzilla.redhat.com/2484207","https://bugzilla.redhat.com/show_bug.cgi?id=2445356","https://bugzilla.redhat.com/show_bug.cgi?id=2484207","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27145","https://errata.almalinux.org/9/ALSA-2026-36317.html","https://errata.rockylinux.org/RLSA-2026:36317","https://go.dev/cl/783621","https://go.dev/issue/79694","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","https://linux.oracle.com/cve/CVE-2026-27145.html","https://linux.oracle.com/errata/ELSA-2026-53416.html","https://nvd.nist.gov/vuln/detail/CVE-2026-27145","https://pkg.go.dev/vuln/GO-2026-5037","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27145.json","https://www.cve.org/CVERecord?id=CVE-2026-27145"],"PublishedDate":"2026-06-02T23:16:35.57Z","LastModifiedDate":"2026-09-18T13:17:43.283Z"},{"VulnerabilityID":"CVE-2026-32280","VendorIDs":["GO-2026-4947"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.9, 1.26.2","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-32280","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:eeec6dca2087e0b29566f4ba9553eeaa4e045e33995cbec18f32b89d035c6577","Title":"crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building","Description":"During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.","Severity":"HIGH","CweIDs":["CWE-770"],"VendorSeverity":{"alma":3,"amazon":3,"bitnami":3,"oracle-oval":3,"photon":3,"redhat":3,"rocky":3,"ubuntu":2},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5}},"References":["https://access.redhat.com/errata/RHSA-2026:10217","https://access.redhat.com/errata/RHSA-2026:10219","https://access.redhat.com/errata/RHSA-2026:10704","https://access.redhat.com/errata/RHSA-2026:11507","https://access.redhat.com/errata/RHSA-2026:11514","https://access.redhat.com/errata/RHSA-2026:11688","https://access.redhat.com/errata/RHSA-2026:13545","https://access.redhat.com/errata/RHSA-2026:13791","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:14020","https://access.redhat.com/errata/RHSA-2026:14162","https://access.redhat.com/errata/RHSA-2026:14200","https://access.redhat.com/errata/RHSA-2026:14391","https://access.redhat.com/errata/RHSA-2026:15980","https://access.redhat.com/errata/RHSA-2026:16021","https://access.redhat.com/errata/RHSA-2026:16024","https://access.redhat.com/errata/RHSA-2026:16101","https://access.redhat.com/errata/RHSA-2026:16476","https://access.redhat.com/errata/RHSA-2026:16477","https://access.redhat.com/errata/RHSA-2026:16505","https://access.redhat.com/errata/RHSA-2026:16508","https://access.redhat.com/errata/RHSA-2026:16532","https://access.redhat.com/errata/RHSA-2026:16534","https://access.redhat.com/errata/RHSA-2026:16535","https://access.redhat.com/errata/RHSA-2026:16537","https://access.redhat.com/errata/RHSA-2026:16542","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:16875","https://access.redhat.com/errata/RHSA-2026:17084","https://access.redhat.com/errata/RHSA-2026:17287","https://access.redhat.com/errata/RHSA-2026:18027","https://access.redhat.com/errata/RHSA-2026:18032","https://access.redhat.com/errata/RHSA-2026:19133","https://access.redhat.com/errata/RHSA-2026:19135","https://access.redhat.com/errata/RHSA-2026:19144","https://access.redhat.com/errata/RHSA-2026:19350","https://access.redhat.com/errata/RHSA-2026:19353","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19450","https://access.redhat.com/errata/RHSA-2026:19550","https://access.redhat.com/errata/RHSA-2026:19634","https://access.redhat.com/errata/RHSA-2026:19714","https://access.redhat.com/errata/RHSA-2026:19715","https://access.redhat.com/errata/RHSA-2026:19719","https://access.redhat.com/errata/RHSA-2026:19720","https://access.redhat.com/errata/RHSA-2026:19721","https://access.redhat.com/errata/RHSA-2026:19722","https://access.redhat.com/errata/RHSA-2026:19750","https://access.redhat.com/errata/RHSA-2026:19839","https://access.redhat.com/errata/RHSA-2026:20556","https://access.redhat.com/errata/RHSA-2026:20569","https://access.redhat.com/errata/RHSA-2026:20570","https://access.redhat.com/errata/RHSA-2026:20571","https://access.redhat.com/errata/RHSA-2026:20607","https://access.redhat.com/errata/RHSA-2026:20608","https://access.redhat.com/errata/RHSA-2026:20609","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21338","https://access.redhat.com/errata/RHSA-2026:21655","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:22130","https://access.redhat.com/errata/RHSA-2026:22141","https://access.redhat.com/errata/RHSA-2026:22258","https://access.redhat.com/errata/RHSA-2026:22260","https://access.redhat.com/errata/RHSA-2026:22268","https://access.redhat.com/errata/RHSA-2026:22309","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:22415","https://access.redhat.com/errata/RHSA-2026:22422","https://access.redhat.com/errata/RHSA-2026:22465","https://access.redhat.com/errata/RHSA-2026:22485","https://access.redhat.com/errata/RHSA-2026:22709","https://access.redhat.com/errata/RHSA-2026:22713","https://access.redhat.com/errata/RHSA-2026:22840","https://access.redhat.com/errata/RHSA-2026:22862","https://access.redhat.com/errata/RHSA-2026:22958","https://access.redhat.com/errata/RHSA-2026:22959","https://access.redhat.com/errata/RHSA-2026:22960","https://access.redhat.com/errata/RHSA-2026:22961","https://access.redhat.com/errata/RHSA-2026:22962","https://access.redhat.com/errata/RHSA-2026:23102","https://access.redhat.com/errata/RHSA-2026:23103","https://access.redhat.com/errata/RHSA-2026:23244","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24337","https://access.redhat.com/errata/RHSA-2026:24359","https://access.redhat.com/errata/RHSA-2026:24470","https://access.redhat.com/errata/RHSA-2026:24478","https://access.redhat.com/errata/RHSA-2026:24716","https://access.redhat.com/errata/RHSA-2026:24761","https://access.redhat.com/errata/RHSA-2026:24762","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:25180","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25251","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:25253","https://access.redhat.com/errata/RHSA-2026:26447","https://access.redhat.com/errata/RHSA-2026:26568","https://access.redhat.com/errata/RHSA-2026:26571","https://access.redhat.com/errata/RHSA-2026:26585","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:27076","https://access.redhat.com/errata/RHSA-2026:28038","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:28074","https://access.redhat.com/errata/RHSA-2026:28196","https://access.redhat.com/errata/RHSA-2026:28198","https://access.redhat.com/errata/RHSA-2026:28441","https://access.redhat.com/errata/RHSA-2026:28886","https://access.redhat.com/errata/RHSA-2026:28961","https://access.redhat.com/errata/RHSA-2026:29035","https://access.redhat.com/errata/RHSA-2026:29195","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/errata/RHSA-2026:29702","https://access.redhat.com/errata/RHSA-2026:29703","https://access.redhat.com/errata/RHSA-2026:29854","https://access.redhat.com/errata/RHSA-2026:33722","https://access.redhat.com/errata/RHSA-2026:34097","https://access.redhat.com/errata/RHSA-2026:34192","https://access.redhat.com/errata/RHSA-2026:34196","https://access.redhat.com/errata/RHSA-2026:34197","https://access.redhat.com/errata/RHSA-2026:34365","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:39894","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:47712","https://access.redhat.com/errata/RHSA-2026:47714","https://access.redhat.com/errata/RHSA-2026:47716","https://access.redhat.com/errata/RHSA-2026:47719","https://access.redhat.com/errata/RHSA-2026:47721","https://access.redhat.com/errata/RHSA-2026:47722","https://access.redhat.com/errata/RHSA-2026:47910","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:48036","https://access.redhat.com/errata/RHSA-2026:48790","https://access.redhat.com/errata/RHSA-2026:49509","https://access.redhat.com/errata/RHSA-2026:49526","https://access.redhat.com/errata/RHSA-2026:49600","https://access.redhat.com/errata/RHSA-2026:49838","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54603","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:56785","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56855","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:56913","https://access.redhat.com/errata/RHSA-2026:57409","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57488","https://access.redhat.com/errata/RHSA-2026:59830","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:59834","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61685","https://access.redhat.com/errata/RHSA-2026:61906","https://access.redhat.com/errata/RHSA-2026:61907","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:66401","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/security/cve/CVE-2026-32280","https://bugzilla.redhat.com/2456333","https://bugzilla.redhat.com/2456339","https://bugzilla.redhat.com/show_bug.cgi?id=2456333","https://bugzilla.redhat.com/show_bug.cgi?id=2456339","https://bugzilla.redhat.com/show_bug.cgi?id=2467809","https://bugzilla.redhat.com/show_bug.cgi?id=2467820","https://bugzilla.redhat.com/show_bug.cgi?id=2467822","https://bugzilla.redhat.com/show_bug.cgi?id=2480756","https://bugzilla.redhat.com/show_bug.cgi?id=2484204","https://bugzilla.redhat.com/show_bug.cgi?id=2515815","https://bugzilla.redhat.com/show_bug.cgi?id=2515820","https://bugzilla.redhat.com/show_bug.cgi?id=2515827","https://bugzilla.redhat.com/show_bug.cgi?id=2515838","https://bugzilla.redhat.com/show_bug.cgi?id=2515839","https://bugzilla.redhat.com/show_bug.cgi?id=2515840","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862","https://errata.almalinux.org/9/ALSA-2026-49838.html","https://errata.rockylinux.org/RLSA-2026:65886","https://go.dev/cl/758320","https://go.dev/issue/78282","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://linux.oracle.com/cve/CVE-2026-32280.html","https://linux.oracle.com/errata/ELSA-2026-65886-0.html","https://nvd.nist.gov/vuln/detail/CVE-2026-32280","https://pkg.go.dev/vuln/GO-2026-4947","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32280.json","https://www.cve.org/CVERecord?id=CVE-2026-32280"],"PublishedDate":"2026-04-08T02:16:03.247Z","LastModifiedDate":"2026-09-18T13:17:45.92Z"},{"VulnerabilityID":"CVE-2026-32281","VendorIDs":["GO-2026-4946"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.9, 1.26.2","Status":"fixed","SeveritySource":"nvd","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-32281","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:d69d611da69fa7de5ffafb71c797b29919df04b1373ff374f602e8c23231b795","Title":"crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation","Description":"Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.","Severity":"HIGH","CweIDs":["CWE-295"],"VendorSeverity":{"alma":3,"amazon":3,"bitnami":3,"nvd":3,"oracle-oval":3,"photon":3,"redhat":2,"rocky":3},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5},"nvd":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":5.9}},"References":["https://access.redhat.com/errata/RHSA-2026:49838","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/security/cve/CVE-2026-32281","https://bugzilla.redhat.com/2456333","https://bugzilla.redhat.com/2456339","https://bugzilla.redhat.com/show_bug.cgi?id=2456333","https://bugzilla.redhat.com/show_bug.cgi?id=2456339","https://bugzilla.redhat.com/show_bug.cgi?id=2467809","https://bugzilla.redhat.com/show_bug.cgi?id=2467820","https://bugzilla.redhat.com/show_bug.cgi?id=2467822","https://bugzilla.redhat.com/show_bug.cgi?id=2480756","https://bugzilla.redhat.com/show_bug.cgi?id=2484204","https://bugzilla.redhat.com/show_bug.cgi?id=2515815","https://bugzilla.redhat.com/show_bug.cgi?id=2515820","https://bugzilla.redhat.com/show_bug.cgi?id=2515827","https://bugzilla.redhat.com/show_bug.cgi?id=2515838","https://bugzilla.redhat.com/show_bug.cgi?id=2515839","https://bugzilla.redhat.com/show_bug.cgi?id=2515840","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862","https://errata.almalinux.org/9/ALSA-2026-49838.html","https://errata.rockylinux.org/RLSA-2026:65886","https://go.dev/cl/758061","https://go.dev/issue/78281","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://linux.oracle.com/cve/CVE-2026-32281.html","https://linux.oracle.com/errata/ELSA-2026-67148-0.html","https://nvd.nist.gov/vuln/detail/CVE-2026-32281","https://pkg.go.dev/vuln/GO-2026-4946","https://www.cve.org/CVERecord?id=CVE-2026-32281"],"PublishedDate":"2026-04-08T02:16:03.35Z","LastModifiedDate":"2026-07-25T10:10:00.167Z"},{"VulnerabilityID":"CVE-2026-32283","VendorIDs":["GO-2026-4870"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.9, 1.26.2","Status":"fixed","SeveritySource":"nvd","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-32283","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:9dfe107a5d79d8df72200565f29171ef19fc561d11e8be955ecc8ede17ecf8c3","Title":"crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages","Description":"If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.","Severity":"HIGH","CweIDs":["CWE-770","CWE-764"],"VendorSeverity":{"alma":3,"amazon":3,"bitnami":3,"nvd":3,"oracle-oval":3,"photon":3,"redhat":3,"rocky":3},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5},"nvd":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5}},"References":["https://access.redhat.com/errata/RHSA-2026:10217","https://access.redhat.com/errata/RHSA-2026:10219","https://access.redhat.com/errata/RHSA-2026:10704","https://access.redhat.com/errata/RHSA-2026:11507","https://access.redhat.com/errata/RHSA-2026:11514","https://access.redhat.com/errata/RHSA-2026:11704","https://access.redhat.com/errata/RHSA-2026:11711","https://access.redhat.com/errata/RHSA-2026:11712","https://access.redhat.com/errata/RHSA-2026:11863","https://access.redhat.com/errata/RHSA-2026:11881","https://access.redhat.com/errata/RHSA-2026:14162","https://access.redhat.com/errata/RHSA-2026:14200","https://access.redhat.com/errata/RHSA-2026:14391","https://access.redhat.com/errata/RHSA-2026:15980","https://access.redhat.com/errata/RHSA-2026:16021","https://access.redhat.com/errata/RHSA-2026:16024","https://access.redhat.com/errata/RHSA-2026:16101","https://access.redhat.com/errata/RHSA-2026:16102","https://access.redhat.com/errata/RHSA-2026:16875","https://access.redhat.com/errata/RHSA-2026:17075","https://access.redhat.com/errata/RHSA-2026:17084","https://access.redhat.com/errata/RHSA-2026:17287","https://access.redhat.com/errata/RHSA-2026:18027","https://access.redhat.com/errata/RHSA-2026:18032","https://access.redhat.com/errata/RHSA-2026:19126","https://access.redhat.com/errata/RHSA-2026:19132","https://access.redhat.com/errata/RHSA-2026:19133","https://access.redhat.com/errata/RHSA-2026:19134","https://access.redhat.com/errata/RHSA-2026:19135","https://access.redhat.com/errata/RHSA-2026:19136","https://access.redhat.com/errata/RHSA-2026:19137","https://access.redhat.com/errata/RHSA-2026:19139","https://access.redhat.com/errata/RHSA-2026:19144","https://access.redhat.com/errata/RHSA-2026:19156","https://access.redhat.com/errata/RHSA-2026:19350","https://access.redhat.com/errata/RHSA-2026:19351","https://access.redhat.com/errata/RHSA-2026:19352","https://access.redhat.com/errata/RHSA-2026:19353","https://access.redhat.com/errata/RHSA-2026:19369","https://access.redhat.com/errata/RHSA-2026:19450","https://access.redhat.com/errata/RHSA-2026:19550","https://access.redhat.com/errata/RHSA-2026:19634","https://access.redhat.com/errata/RHSA-2026:19714","https://access.redhat.com/errata/RHSA-2026:19715","https://access.redhat.com/errata/RHSA-2026:19719","https://access.redhat.com/errata/RHSA-2026:19720","https://access.redhat.com/errata/RHSA-2026:19721","https://access.redhat.com/errata/RHSA-2026:19722","https://access.redhat.com/errata/RHSA-2026:19750","https://access.redhat.com/errata/RHSA-2026:19839","https://access.redhat.com/errata/RHSA-2026:20556","https://access.redhat.com/errata/RHSA-2026:20569","https://access.redhat.com/errata/RHSA-2026:20570","https://access.redhat.com/errata/RHSA-2026:20571","https://access.redhat.com/errata/RHSA-2026:20607","https://access.redhat.com/errata/RHSA-2026:20608","https://access.redhat.com/errata/RHSA-2026:20609","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:22423","https://access.redhat.com/errata/RHSA-2026:22450","https://access.redhat.com/errata/RHSA-2026:22485","https://access.redhat.com/errata/RHSA-2026:22709","https://access.redhat.com/errata/RHSA-2026:22713","https://access.redhat.com/errata/RHSA-2026:22714","https://access.redhat.com/errata/RHSA-2026:22937","https://access.redhat.com/errata/RHSA-2026:23102","https://access.redhat.com/errata/RHSA-2026:23103","https://access.redhat.com/errata/RHSA-2026:23228","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:24337","https://access.redhat.com/errata/RHSA-2026:24470","https://access.redhat.com/errata/RHSA-2026:24761","https://access.redhat.com/errata/RHSA-2026:24762","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25251","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:26447","https://access.redhat.com/errata/RHSA-2026:26571","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:27076","https://access.redhat.com/errata/RHSA-2026:28038","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:28074","https://access.redhat.com/errata/RHSA-2026:29035","https://access.redhat.com/errata/RHSA-2026:29195","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/errata/RHSA-2026:29703","https://access.redhat.com/errata/RHSA-2026:33722","https://access.redhat.com/errata/RHSA-2026:34192","https://access.redhat.com/errata/RHSA-2026:34196","https://access.redhat.com/errata/RHSA-2026:34197","https://access.redhat.com/errata/RHSA-2026:34365","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:47712","https://access.redhat.com/errata/RHSA-2026:47714","https://access.redhat.com/errata/RHSA-2026:47716","https://access.redhat.com/errata/RHSA-2026:47719","https://access.redhat.com/errata/RHSA-2026:47721","https://access.redhat.com/errata/RHSA-2026:47722","https://access.redhat.com/errata/RHSA-2026:47910","https://access.redhat.com/errata/RHSA-2026:48036","https://access.redhat.com/errata/RHSA-2026:48790","https://access.redhat.com/errata/RHSA-2026:49509","https://access.redhat.com/errata/RHSA-2026:49600","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:55898","https://access.redhat.com/errata/RHSA-2026:55900","https://access.redhat.com/errata/RHSA-2026:55901","https://access.redhat.com/errata/RHSA-2026:55902","https://access.redhat.com/errata/RHSA-2026:55903","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:57409","https://access.redhat.com/errata/RHSA-2026:57801","https://access.redhat.com/errata/RHSA-2026:57802","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:65343","https://access.redhat.com/errata/RHSA-2026:65514","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66084","https://access.redhat.com/errata/RHSA-2026:66401","https://access.redhat.com/errata/RHSA-2026:66523","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/errata/RHSA-2026:7291","https://access.redhat.com/errata/RHSA-2026:7385","https://access.redhat.com/security/cve/CVE-2026-32283","https://bugzilla.redhat.com/2445356","https://bugzilla.redhat.com/2456333","https://bugzilla.redhat.com/2456338","https://bugzilla.redhat.com/2456339","https://bugzilla.redhat.com/show_bug.cgi?id=2445356","https://bugzilla.redhat.com/show_bug.cgi?id=2456333","https://bugzilla.redhat.com/show_bug.cgi?id=2456338","https://bugzilla.redhat.com/show_bug.cgi?id=2456339","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283","https://errata.almalinux.org/9/ALSA-2026-29703.html","https://errata.rockylinux.org/RLSA-2026:29703","https://go.dev/cl/763767","https://go.dev/issue/78334","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://linux.oracle.com/cve/CVE-2026-32283.html","https://linux.oracle.com/errata/ELSA-2026-48790.html","https://nvd.nist.gov/vuln/detail/CVE-2026-32283","https://pkg.go.dev/vuln/GO-2026-4870","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32283.json","https://www.cve.org/CVERecord?id=CVE-2026-32283"],"PublishedDate":"2026-04-08T02:16:03.58Z","LastModifiedDate":"2026-09-18T13:17:48.437Z"},{"VulnerabilityID":"CVE-2026-33811","VendorIDs":["GO-2026-4981"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.10, 1.26.3","Status":"fixed","SeveritySource":"nvd","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-33811","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:bdabec5918da8d584020b8015d7205a214f580a3626e39b9bae3d196f2919945","Title":"net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME","Description":"When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.","Severity":"HIGH","CweIDs":["CWE-415","CWE-1341"],"VendorSeverity":{"alma":3,"amazon":3,"bitnami":3,"nvd":3,"oracle-oval":3,"photon":3,"redhat":3,"rocky":3},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5},"nvd":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5}},"References":["https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34357","https://access.redhat.com/errata/RHSA-2026:34359","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:35832","https://access.redhat.com/errata/RHSA-2026:35993","https://access.redhat.com/errata/RHSA-2026:35994","https://access.redhat.com/errata/RHSA-2026:35995","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36617","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36776","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:38504","https://access.redhat.com/errata/RHSA-2026:39266","https://access.redhat.com/errata/RHSA-2026:39272","https://access.redhat.com/errata/RHSA-2026:39319","https://access.redhat.com/errata/RHSA-2026:39573","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40119","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42048","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42082","https://access.redhat.com/errata/RHSA-2026:42132","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:42240","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42852","https://access.redhat.com/errata/RHSA-2026:42946","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:47149","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49703","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50319","https://access.redhat.com/errata/RHSA-2026:50336","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51057","https://access.redhat.com/errata/RHSA-2026:51187","https://access.redhat.com/errata/RHSA-2026:51194","https://access.redhat.com/errata/RHSA-2026:51341","https://access.redhat.com/errata/RHSA-2026:53412","https://access.redhat.com/errata/RHSA-2026:53413","https://access.redhat.com/errata/RHSA-2026:53415","https://access.redhat.com/errata/RHSA-2026:53530","https://access.redhat.com/errata/RHSA-2026:54168","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54441","https://access.redhat.com/errata/RHSA-2026:54500","https://access.redhat.com/errata/RHSA-2026:54552","https://access.redhat.com/errata/RHSA-2026:54556","https://access.redhat.com/errata/RHSA-2026:54584","https://access.redhat.com/errata/RHSA-2026:54602","https://access.redhat.com/errata/RHSA-2026:54603","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56785","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56790","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56855","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:56913","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57488","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59559","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:60025","https://access.redhat.com/errata/RHSA-2026:60302","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:61313","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:67149","https://access.redhat.com/errata/RHSA-2026:67287","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/security/cve/CVE-2026-33811","https://bugzilla.redhat.com/2467822","https://bugzilla.redhat.com/show_bug.cgi?id=2456333","https://bugzilla.redhat.com/show_bug.cgi?id=2456339","https://bugzilla.redhat.com/show_bug.cgi?id=2467809","https://bugzilla.redhat.com/show_bug.cgi?id=2467820","https://bugzilla.redhat.com/show_bug.cgi?id=2467822","https://bugzilla.redhat.com/show_bug.cgi?id=2480756","https://bugzilla.redhat.com/show_bug.cgi?id=2484204","https://bugzilla.redhat.com/show_bug.cgi?id=2515815","https://bugzilla.redhat.com/show_bug.cgi?id=2515820","https://bugzilla.redhat.com/show_bug.cgi?id=2515827","https://bugzilla.redhat.com/show_bug.cgi?id=2515838","https://bugzilla.redhat.com/show_bug.cgi?id=2515839","https://bugzilla.redhat.com/show_bug.cgi?id=2515840","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862","https://errata.almalinux.org/9/ALSA-2026-39319.html","https://errata.rockylinux.org/RLSA-2026:65886","https://go.dev/cl/767860","https://go.dev/issue/78803","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://linux.oracle.com/cve/CVE-2026-33811.html","https://linux.oracle.com/errata/ELSA-2026-65886-0.html","https://nvd.nist.gov/vuln/detail/CVE-2026-33811","https://pkg.go.dev/vuln/GO-2026-4981","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33811.json","https://www.cve.org/CVERecord?id=CVE-2026-33811"],"PublishedDate":"2026-05-07T20:16:42.77Z","LastModifiedDate":"2026-09-18T13:17:57.51Z"},{"VulnerabilityID":"CVE-2026-33814","VendorIDs":["GO-2026-4918"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.10, 1.26.3","Status":"fixed","SeveritySource":"nvd","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-33814","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:57608178485942a19b71f1ac4bfdf654c993809a6807cb2f7e2fa6a9a72fa1b2","Title":"net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame","Description":"When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.","Severity":"HIGH","CweIDs":["CWE-835","CWE-606"],"VendorSeverity":{"alma":3,"amazon":3,"azure":2,"bitnami":3,"nvd":3,"oracle-oval":3,"photon":3,"redhat":3,"rocky":3,"ubuntu":2},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5},"nvd":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5}},"References":["https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57365","https://access.redhat.com/errata/RHSA-2026:57367","https://access.redhat.com/errata/RHSA-2026:57408","https://access.redhat.com/errata/RHSA-2026:57545","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:60025","https://access.redhat.com/errata/RHSA-2026:60441","https://access.redhat.com/errata/RHSA-2026:60442","https://access.redhat.com/errata/RHSA-2026:60446","https://access.redhat.com/errata/RHSA-2026:60447","https://access.redhat.com/errata/RHSA-2026:60454","https://access.redhat.com/errata/RHSA-2026:60477","https://access.redhat.com/errata/RHSA-2026:60478","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:60668","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62410","https://access.redhat.com/errata/RHSA-2026:62550","https://access.redhat.com/errata/RHSA-2026:62551","https://access.redhat.com/errata/RHSA-2026:63046","https://access.redhat.com/errata/RHSA-2026:63047","https://access.redhat.com/errata/RHSA-2026:63048","https://access.redhat.com/errata/RHSA-2026:63050","https://access.redhat.com/errata/RHSA-2026:63091","https://access.redhat.com/errata/RHSA-2026:63096","https://access.redhat.com/errata/RHSA-2026:63097","https://access.redhat.com/errata/RHSA-2026:63103","https://access.redhat.com/errata/RHSA-2026:63104","https://access.redhat.com/errata/RHSA-2026:63636","https://access.redhat.com/errata/RHSA-2026:63637","https://access.redhat.com/errata/RHSA-2026:63639","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66350","https://access.redhat.com/security/cve/CVE-2026-33814","https://bugzilla.redhat.com/2467822","https://bugzilla.redhat.com/show_bug.cgi?id=2467809","https://bugzilla.redhat.com/show_bug.cgi?id=2467810","https://bugzilla.redhat.com/show_bug.cgi?id=2467811","https://bugzilla.redhat.com/show_bug.cgi?id=2467813","https://bugzilla.redhat.com/show_bug.cgi?id=2467815","https://bugzilla.redhat.com/show_bug.cgi?id=2467820","https://bugzilla.redhat.com/show_bug.cgi?id=2467822","https://bugzilla.redhat.com/show_bug.cgi?id=2467823","https://bugzilla.redhat.com/show_bug.cgi?id=2467825","https://bugzilla.redhat.com/show_bug.cgi?id=2467826","https://bugzilla.redhat.com/show_bug.cgi?id=2467827","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501","https://errata.almalinux.org/8/ALSA-2026-22112.html","https://errata.rockylinux.org/RLSA-2026:22121","https://github.com/golang/go/issues/78476","https://go-review.googlesource.com/c/go/+/761581","https://go-review.googlesource.com/c/net/+/761640","https://go.dev/cl/761581","https://go.dev/cl/761640","https://go.dev/issue/78476","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://linux.oracle.com/cve/CVE-2026-33814.html","https://linux.oracle.com/errata/ELSA-2026-22121.html","https://nvd.nist.gov/vuln/detail/CVE-2026-33814","https://pkg.go.dev/vuln/GO-2026-4918","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json","https://ubuntu.com/security/notices/USN-8430-1","https://ubuntu.com/security/notices/USN-8471-1","https://ubuntu.com/security/notices/USN-8472-1","https://ubuntu.com/security/notices/USN-8473-1","https://www.cve.org/CVERecord?id=CVE-2026-33814"],"PublishedDate":"2026-05-07T20:16:42.88Z","LastModifiedDate":"2026-09-18T13:17:59.293Z"},{"VulnerabilityID":"CVE-2026-33818","VendorIDs":["GO-2026-5972"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.13, 1.26.6, 1.27.0-rc.3","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-33818","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:b0fbf3df8e58c20fad0f9018d552d156564a49463a96d974e041cd2133495e18","Title":"encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal","Description":"Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.","Severity":"HIGH","CweIDs":["CWE-400"],"VendorSeverity":{"alma":3,"amazon":3,"bitnami":3,"oracle-oval":3,"photon":3,"redhat":3,"rocky":3},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5}},"References":["https://access.redhat.com/errata/RHSA-2026:70641","https://access.redhat.com/security/cve/CVE-2026-33818","https://bugzilla.redhat.com/2515815","https://bugzilla.redhat.com/2515820","https://bugzilla.redhat.com/2515827","https://bugzilla.redhat.com/2515838","https://bugzilla.redhat.com/2515839","https://bugzilla.redhat.com/show_bug.cgi?id=2402034","https://bugzilla.redhat.com/show_bug.cgi?id=2515815","https://bugzilla.redhat.com/show_bug.cgi?id=2515820","https://bugzilla.redhat.com/show_bug.cgi?id=2515827","https://bugzilla.redhat.com/show_bug.cgi?id=2515838","https://bugzilla.redhat.com/show_bug.cgi?id=2515839","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862","https://errata.almalinux.org/9/ALSA-2026-70641.html","https://errata.rockylinux.org/RLSA-2026:70641","https://go.dev/cl/814980","https://go.dev/issue/80405","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://linux.oracle.com/cve/CVE-2026-33818.html","https://linux.oracle.com/errata/ELSA-2026-70641.html","https://nvd.nist.gov/vuln/detail/CVE-2026-33818","https://pkg.go.dev/vuln/GO-2026-5972","https://www.cve.org/CVERecord?id=CVE-2026-33818"],"PublishedDate":"2026-08-13T22:17:19.84Z","LastModifiedDate":"2026-09-03T16:37:52.17Z"},{"VulnerabilityID":"CVE-2026-39820","VendorIDs":["GO-2026-4986"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.10, 1.26.3","Status":"fixed","SeveritySource":"nvd","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-39820","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:7ad41015f902203edb1284649bac853d7c9b55eda9374beef9120ddc8ab873a1","Title":"net/mail: golang: Go net/mail: Denial of Service via crafted email inputs","Description":"Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.","Severity":"HIGH","CweIDs":["CWE-770","CWE-606"],"VendorSeverity":{"alma":3,"amazon":3,"bitnami":3,"nvd":3,"oracle-oval":3,"photon":3,"redhat":3,"rocky":3},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5},"nvd":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5}},"References":["https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50319","https://access.redhat.com/errata/RHSA-2026:50336","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51112","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54552","https://access.redhat.com/errata/RHSA-2026:54555","https://access.redhat.com/errata/RHSA-2026:54583","https://access.redhat.com/errata/RHSA-2026:54602","https://access.redhat.com/errata/RHSA-2026:54883","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57401","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:57914","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59830","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:62406","https://access.redhat.com/errata/RHSA-2026:62407","https://access.redhat.com/errata/RHSA-2026:62753","https://access.redhat.com/errata/RHSA-2026:62754","https://access.redhat.com/errata/RHSA-2026:62803","https://access.redhat.com/errata/RHSA-2026:63022","https://access.redhat.com/errata/RHSA-2026:65116","https://access.redhat.com/errata/RHSA-2026:65117","https://access.redhat.com/errata/RHSA-2026:65153","https://access.redhat.com/errata/RHSA-2026:65335","https://access.redhat.com/errata/RHSA-2026:65336","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:65895","https://access.redhat.com/errata/RHSA-2026:66016","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66327","https://access.redhat.com/errata/RHSA-2026:67517","https://access.redhat.com/errata/RHSA-2026:67974","https://access.redhat.com/errata/RHSA-2026:67975","https://access.redhat.com/errata/RHSA-2026:68334","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/errata/RHSA-2026:68527","https://access.redhat.com/security/cve/CVE-2026-39820","https://bugzilla.redhat.com/2467809","https://bugzilla.redhat.com/2467820","https://bugzilla.redhat.com/2480756","https://bugzilla.redhat.com/2484204","https://bugzilla.redhat.com/2515815","https://bugzilla.redhat.com/2515820","https://bugzilla.redhat.com/2515827","https://bugzilla.redhat.com/2515838","https://bugzilla.redhat.com/2515839","https://bugzilla.redhat.com/2515840","https://bugzilla.redhat.com/show_bug.cgi?id=2456333","https://bugzilla.redhat.com/show_bug.cgi?id=2456339","https://bugzilla.redhat.com/show_bug.cgi?id=2467809","https://bugzilla.redhat.com/show_bug.cgi?id=2467820","https://bugzilla.redhat.com/show_bug.cgi?id=2467822","https://bugzilla.redhat.com/show_bug.cgi?id=2480756","https://bugzilla.redhat.com/show_bug.cgi?id=2484204","https://bugzilla.redhat.com/show_bug.cgi?id=2515815","https://bugzilla.redhat.com/show_bug.cgi?id=2515820","https://bugzilla.redhat.com/show_bug.cgi?id=2515827","https://bugzilla.redhat.com/show_bug.cgi?id=2515838","https://bugzilla.redhat.com/show_bug.cgi?id=2515839","https://bugzilla.redhat.com/show_bug.cgi?id=2515840","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862","https://errata.almalinux.org/9/ALSA-2026-65153.html","https://errata.rockylinux.org/RLSA-2026:65886","https://go.dev/cl/759940","https://go.dev/issue/78566","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://linux.oracle.com/cve/CVE-2026-39820.html","https://linux.oracle.com/errata/ELSA-2026-65895-0.html","https://nvd.nist.gov/vuln/detail/CVE-2026-39820","https://pkg.go.dev/vuln/GO-2026-4986","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39820.json","https://www.cve.org/CVERecord?id=CVE-2026-39820"],"PublishedDate":"2026-05-07T20:16:43.187Z","LastModifiedDate":"2026-09-18T13:18:07.977Z"},{"VulnerabilityID":"CVE-2026-39821","VendorIDs":["GO-2026-5026"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.13, 1.26.6, 1.27.0-rc.3","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-39821","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:d7ead3e17320d6739c07f72ef5d335e1041890cd893bca9ec5c4513f6e2a5769","Title":"golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing","Description":"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".","Severity":"HIGH","CweIDs":["CWE-1289"],"VendorSeverity":{"alma":3,"amazon":3,"azure":4,"oracle-oval":3,"redhat":3,"rocky":3,"ubuntu":3},"CVSS":{"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","V3Score":8.2}},"References":["https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:30853","https://access.redhat.com/errata/RHSA-2026:30854","https://access.redhat.com/errata/RHSA-2026:30855","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33524","https://access.redhat.com/errata/RHSA-2026:33531","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:34357","https://access.redhat.com/errata/RHSA-2026:34359","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:34789","https://access.redhat.com/errata/RHSA-2026:35826","https://access.redhat.com/errata/RHSA-2026:35827","https://access.redhat.com/errata/RHSA-2026:35828","https://access.redhat.com/errata/RHSA-2026:35829","https://access.redhat.com/errata/RHSA-2026:35830","https://access.redhat.com/errata/RHSA-2026:35831","https://access.redhat.com/errata/RHSA-2026:35993","https://access.redhat.com/errata/RHSA-2026:35994","https://access.redhat.com/errata/RHSA-2026:36105","https://access.redhat.com/errata/RHSA-2026:36167","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37435","https://access.redhat.com/errata/RHSA-2026:37436","https://access.redhat.com/errata/RHSA-2026:38995","https://access.redhat.com/errata/RHSA-2026:39005","https://access.redhat.com/errata/RHSA-2026:39573","https://access.redhat.com/errata/RHSA-2026:39879","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41930","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42048","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42080","https://access.redhat.com/errata/RHSA-2026:42082","https://access.redhat.com/errata/RHSA-2026:42132","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:42240","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:42852","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:44624","https://access.redhat.com/errata/RHSA-2026:46395","https://access.redhat.com/errata/RHSA-2026:47149","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51112","https://access.redhat.com/errata/RHSA-2026:51187","https://access.redhat.com/errata/RHSA-2026:51194","https://access.redhat.com/errata/RHSA-2026:51341","https://access.redhat.com/errata/RHSA-2026:52826","https://access.redhat.com/errata/RHSA-2026:53374","https://access.redhat.com/errata/RHSA-2026:53412","https://access.redhat.com/errata/RHSA-2026:53413","https://access.redhat.com/errata/RHSA-2026:53415","https://access.redhat.com/errata/RHSA-2026:53530","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54395","https://access.redhat.com/errata/RHSA-2026:54401","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54441","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54580","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:56143","https://access.redhat.com/errata/RHSA-2026:56223","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57541","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:59546","https://access.redhat.com/errata/RHSA-2026:59549","https://access.redhat.com/errata/RHSA-2026:59562","https://access.redhat.com/errata/RHSA-2026:60315","https://access.redhat.com/errata/RHSA-2026:60354","https://access.redhat.com/errata/RHSA-2026:60387","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61245","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62549","https://access.redhat.com/errata/RHSA-2026:63134","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:65153","https://access.redhat.com/errata/RHSA-2026:65359","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65851","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:66016","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66350","https://access.redhat.com/errata/RHSA-2026:66432","https://access.redhat.com/errata/RHSA-2026:67149","https://access.redhat.com/errata/RHSA-2026:67159","https://access.redhat.com/errata/RHSA-2026:67160","https://access.redhat.com/errata/RHSA-2026:67287","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/errata/RHSA-2026:67517","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/security/cve/CVE-2026-39821","https://bugzilla.redhat.com/2467809","https://bugzilla.redhat.com/2467820","https://bugzilla.redhat.com/2480756","https://bugzilla.redhat.com/2484204","https://bugzilla.redhat.com/2515815","https://bugzilla.redhat.com/2515820","https://bugzilla.redhat.com/2515827","https://bugzilla.redhat.com/2515838","https://bugzilla.redhat.com/2515839","https://bugzilla.redhat.com/2515840","https://bugzilla.redhat.com/show_bug.cgi?id=2456333","https://bugzilla.redhat.com/show_bug.cgi?id=2456339","https://bugzilla.redhat.com/show_bug.cgi?id=2467809","https://bugzilla.redhat.com/show_bug.cgi?id=2467820","https://bugzilla.redhat.com/show_bug.cgi?id=2467822","https://bugzilla.redhat.com/show_bug.cgi?id=2480756","https://bugzilla.redhat.com/show_bug.cgi?id=2484204","https://bugzilla.redhat.com/show_bug.cgi?id=2515815","https://bugzilla.redhat.com/show_bug.cgi?id=2515820","https://bugzilla.redhat.com/show_bug.cgi?id=2515827","https://bugzilla.redhat.com/show_bug.cgi?id=2515838","https://bugzilla.redhat.com/show_bug.cgi?id=2515839","https://bugzilla.redhat.com/show_bug.cgi?id=2515840","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862","https://errata.almalinux.org/9/ALSA-2026-65153.html","https://errata.rockylinux.org/RLSA-2026:65886","https://go.dev/cl/767220","https://go.dev/issue/78760","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://linux.oracle.com/cve/CVE-2026-39821.html","https://linux.oracle.com/errata/ELSA-2026-66432-0.html","https://nvd.nist.gov/vuln/detail/CVE-2026-39821","https://pkg.go.dev/vuln/GO-2026-5026","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json","https://ubuntu.com/security/notices/USN-8416-1","https://ubuntu.com/security/notices/USN-8883-1","https://ubuntu.com/security/notices/USN-8900-1","https://ubuntu.com/security/notices/USN-8914-1","https://www.cve.org/CVERecord?id=CVE-2026-39821"],"PublishedDate":"2026-05-22T16:16:20.41Z","LastModifiedDate":"2026-09-17T12:18:05.767Z"},{"VulnerabilityID":"CVE-2026-39822","VendorIDs":["GO-2026-4970"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.12, 1.26.5, 1.27.0-rc.2","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-39822","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:cc64f437511f9cf6262b3d03d89be8687ea7ba8536cd62ebf954f40fd08a00f5","Title":"golang: Go os.Root: Symlink following vulnerability allows directory traversal","Description":"On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root.","Severity":"HIGH","CweIDs":["CWE-61"],"VendorSeverity":{"alma":3,"amazon":2,"azure":3,"bitnami":3,"oracle-oval":3,"photon":3,"redhat":3,"rocky":3},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","V3Score":7.8},"redhat":{"V3Vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","V3Score":7.8}},"References":["https://access.redhat.com/errata/RHSA-2026:38878","https://access.redhat.com/security/cve/CVE-2026-39822","https://bugzilla.redhat.com/2498152","https://bugzilla.redhat.com/show_bug.cgi?id=2498152","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39822","https://errata.almalinux.org/9/ALSA-2026-38878.html","https://errata.rockylinux.org/RLSA-2026:38878","https://go.dev/cl/797880","https://go.dev/issue/79005","https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc","https://linux.oracle.com/cve/CVE-2026-39822.html","https://linux.oracle.com/errata/ELSA-2026-38995.html","https://nvd.nist.gov/vuln/detail/CVE-2026-39822","https://pkg.go.dev/vuln/GO-2026-4970","https://www.cve.org/CVERecord?id=CVE-2026-39822"],"PublishedDate":"2026-07-08T17:17:21.31Z","LastModifiedDate":"2026-09-17T17:10:20.047Z"},{"VulnerabilityID":"CVE-2026-39836","VendorIDs":["GO-2026-4971"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.10, 1.26.3","Status":"fixed","SeveritySource":"nvd","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-39836","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:ff03137bc4ce2e9b21205acbc892502473d9959359b20c3627365af13dce3e82","Title":"net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows","Description":"The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).","Severity":"HIGH","CweIDs":["CWE-476"],"VendorSeverity":{"alma":3,"bitnami":3,"nvd":3,"oracle-oval":3,"photon":3,"redhat":2,"rocky":3},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5},"nvd":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5}},"References":["https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/security/cve/CVE-2026-39836","https://bugzilla.redhat.com/2467822","https://bugzilla.redhat.com/show_bug.cgi?id=2467809","https://bugzilla.redhat.com/show_bug.cgi?id=2467810","https://bugzilla.redhat.com/show_bug.cgi?id=2467811","https://bugzilla.redhat.com/show_bug.cgi?id=2467813","https://bugzilla.redhat.com/show_bug.cgi?id=2467815","https://bugzilla.redhat.com/show_bug.cgi?id=2467820","https://bugzilla.redhat.com/show_bug.cgi?id=2467822","https://bugzilla.redhat.com/show_bug.cgi?id=2467823","https://bugzilla.redhat.com/show_bug.cgi?id=2467825","https://bugzilla.redhat.com/show_bug.cgi?id=2467826","https://bugzilla.redhat.com/show_bug.cgi?id=2467827","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501","https://errata.almalinux.org/8/ALSA-2026-22112.html","https://errata.rockylinux.org/RLSA-2026:22121","https://go.dev/cl/775320","https://go.dev/issue/79006","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://linux.oracle.com/cve/CVE-2026-39836.html","https://linux.oracle.com/errata/ELSA-2026-22121.html","https://nvd.nist.gov/vuln/detail/CVE-2026-39836","https://pkg.go.dev/vuln/GO-2026-4971","https://www.cve.org/CVERecord?id=CVE-2026-39836"],"PublishedDate":"2026-05-07T20:16:43.593Z","LastModifiedDate":"2026-06-17T10:42:40.34Z"},{"VulnerabilityID":"CVE-2026-42499","VendorIDs":["GO-2026-4977"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.10, 1.26.3","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-42499","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:998855a4231ef68ba79476ae9eb73f9347cf56f0b8693100fe6297efcfc31095","Title":"net/mail: golang: net/mail: Denial of Service via pathological email address parsing","Description":"Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.","Severity":"HIGH","CweIDs":["CWE-1046"],"VendorSeverity":{"alma":3,"amazon":3,"bitnami":3,"oracle-oval":3,"photon":3,"redhat":3,"rocky":3},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5}},"References":["https://access.redhat.com/errata/RHSA-2026:17713","https://access.redhat.com/errata/RHSA-2026:17714","https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50319","https://access.redhat.com/errata/RHSA-2026:50336","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51112","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54552","https://access.redhat.com/errata/RHSA-2026:54555","https://access.redhat.com/errata/RHSA-2026:54583","https://access.redhat.com/errata/RHSA-2026:54602","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56785","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:57914","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59830","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:62406","https://access.redhat.com/errata/RHSA-2026:62407","https://access.redhat.com/errata/RHSA-2026:62753","https://access.redhat.com/errata/RHSA-2026:62754","https://access.redhat.com/errata/RHSA-2026:62803","https://access.redhat.com/errata/RHSA-2026:63022","https://access.redhat.com/errata/RHSA-2026:63163","https://access.redhat.com/errata/RHSA-2026:63332","https://access.redhat.com/errata/RHSA-2026:63636","https://access.redhat.com/errata/RHSA-2026:64818","https://access.redhat.com/errata/RHSA-2026:65116","https://access.redhat.com/errata/RHSA-2026:65117","https://access.redhat.com/errata/RHSA-2026:65153","https://access.redhat.com/errata/RHSA-2026:65335","https://access.redhat.com/errata/RHSA-2026:65336","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:65895","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66327","https://access.redhat.com/errata/RHSA-2026:67148","https://access.redhat.com/errata/RHSA-2026:67517","https://access.redhat.com/errata/RHSA-2026:67974","https://access.redhat.com/errata/RHSA-2026:67975","https://access.redhat.com/errata/RHSA-2026:68334","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/errata/RHSA-2026:68527","https://access.redhat.com/security/cve/CVE-2026-42499","https://bugzilla.redhat.com/2467809","https://bugzilla.redhat.com/2467820","https://bugzilla.redhat.com/2480756","https://bugzilla.redhat.com/2484204","https://bugzilla.redhat.com/2515815","https://bugzilla.redhat.com/2515820","https://bugzilla.redhat.com/2515827","https://bugzilla.redhat.com/2515838","https://bugzilla.redhat.com/2515839","https://bugzilla.redhat.com/2515840","https://bugzilla.redhat.com/show_bug.cgi?id=2456333","https://bugzilla.redhat.com/show_bug.cgi?id=2456339","https://bugzilla.redhat.com/show_bug.cgi?id=2467809","https://bugzilla.redhat.com/show_bug.cgi?id=2467820","https://bugzilla.redhat.com/show_bug.cgi?id=2467822","https://bugzilla.redhat.com/show_bug.cgi?id=2480756","https://bugzilla.redhat.com/show_bug.cgi?id=2484204","https://bugzilla.redhat.com/show_bug.cgi?id=2515815","https://bugzilla.redhat.com/show_bug.cgi?id=2515820","https://bugzilla.redhat.com/show_bug.cgi?id=2515827","https://bugzilla.redhat.com/show_bug.cgi?id=2515838","https://bugzilla.redhat.com/show_bug.cgi?id=2515839","https://bugzilla.redhat.com/show_bug.cgi?id=2515840","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862","https://errata.almalinux.org/9/ALSA-2026-65153.html","https://errata.rockylinux.org/RLSA-2026:65886","https://go.dev/cl/771520","https://go.dev/issue/78987","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://linux.oracle.com/cve/CVE-2026-42499.html","https://linux.oracle.com/errata/ELSA-2026-70201.html","https://nvd.nist.gov/vuln/detail/CVE-2026-42499","https://pkg.go.dev/vuln/GO-2026-4977","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42499.json","https://www.cve.org/CVERecord?id=CVE-2026-42499"],"PublishedDate":"2026-05-07T20:16:44.54Z","LastModifiedDate":"2026-09-18T13:18:17.093Z"},{"VulnerabilityID":"CVE-2026-42504","VendorIDs":["GO-2026-5038"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.11, 1.26.4","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-42504","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:ea12edc8c55028f28dd438ab92ab2e584e7842cb2279b7a69b88ee847129da3e","Title":"mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header","Description":"Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.","Severity":"HIGH","CweIDs":["CWE-407"],"VendorSeverity":{"alma":3,"amazon":2,"azure":3,"bitnami":3,"oracle-oval":3,"photon":3,"redhat":3,"rocky":3},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5}},"References":["https://access.redhat.com/errata/RHSA-2026:65153","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/security/cve/CVE-2026-42504","https://bugzilla.redhat.com/2467809","https://bugzilla.redhat.com/2467820","https://bugzilla.redhat.com/2480756","https://bugzilla.redhat.com/2484204","https://bugzilla.redhat.com/2515815","https://bugzilla.redhat.com/2515820","https://bugzilla.redhat.com/2515827","https://bugzilla.redhat.com/2515838","https://bugzilla.redhat.com/2515839","https://bugzilla.redhat.com/2515840","https://bugzilla.redhat.com/show_bug.cgi?id=2456333","https://bugzilla.redhat.com/show_bug.cgi?id=2456339","https://bugzilla.redhat.com/show_bug.cgi?id=2467809","https://bugzilla.redhat.com/show_bug.cgi?id=2467820","https://bugzilla.redhat.com/show_bug.cgi?id=2467822","https://bugzilla.redhat.com/show_bug.cgi?id=2480756","https://bugzilla.redhat.com/show_bug.cgi?id=2484204","https://bugzilla.redhat.com/show_bug.cgi?id=2515815","https://bugzilla.redhat.com/show_bug.cgi?id=2515820","https://bugzilla.redhat.com/show_bug.cgi?id=2515827","https://bugzilla.redhat.com/show_bug.cgi?id=2515838","https://bugzilla.redhat.com/show_bug.cgi?id=2515839","https://bugzilla.redhat.com/show_bug.cgi?id=2515840","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862","https://errata.almalinux.org/9/ALSA-2026-65153.html","https://errata.rockylinux.org/RLSA-2026:65886","https://go.dev/cl/774481","https://go.dev/issue/79217","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","https://linux.oracle.com/cve/CVE-2026-42504.html","https://linux.oracle.com/errata/ELSA-2026-69308.html","https://nvd.nist.gov/vuln/detail/CVE-2026-42504","https://pkg.go.dev/vuln/GO-2026-5038","https://www.cve.org/CVERecord?id=CVE-2026-42504"],"PublishedDate":"2026-06-02T23:16:37.927Z","LastModifiedDate":"2026-07-22T19:10:00.12Z"},{"VulnerabilityID":"CVE-2026-56853","VendorIDs":["GO-2026-6089"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.13, 1.26.6, 1.27.0-rc.3","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-56853","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:be33ca0e1d31362ae9165b598a2bc8d848c0b392f5a1902a163343ecd80c3924","Title":"net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service","Description":"When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.","Severity":"HIGH","CweIDs":["CWE-770"],"VendorSeverity":{"alma":3,"amazon":3,"bitnami":3,"oracle-oval":3,"photon":3,"redhat":3,"rocky":3},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5}},"References":["https://access.redhat.com/errata/RHSA-2026:70641","https://access.redhat.com/security/cve/CVE-2026-56853","https://bugzilla.redhat.com/2515815","https://bugzilla.redhat.com/2515820","https://bugzilla.redhat.com/2515827","https://bugzilla.redhat.com/2515838","https://bugzilla.redhat.com/2515839","https://bugzilla.redhat.com/show_bug.cgi?id=2402034","https://bugzilla.redhat.com/show_bug.cgi?id=2515815","https://bugzilla.redhat.com/show_bug.cgi?id=2515820","https://bugzilla.redhat.com/show_bug.cgi?id=2515827","https://bugzilla.redhat.com/show_bug.cgi?id=2515838","https://bugzilla.redhat.com/show_bug.cgi?id=2515839","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862","https://errata.almalinux.org/9/ALSA-2026-70641.html","https://errata.rockylinux.org/RLSA-2026:70641","https://go.dev/cl/795540","https://go.dev/issue/80205","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://linux.oracle.com/cve/CVE-2026-56853.html","https://linux.oracle.com/errata/ELSA-2026-70641.html","https://nvd.nist.gov/vuln/detail/CVE-2026-56853","https://pkg.go.dev/vuln/GO-2026-6089","https://www.cve.org/CVERecord?id=CVE-2026-56853"],"PublishedDate":"2026-08-13T22:17:22.093Z","LastModifiedDate":"2026-09-03T16:37:52.17Z"},{"VulnerabilityID":"CVE-2026-56858","VendorIDs":["GO-2026-6091"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.13, 1.26.6, 1.27.0-rc.3","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-56858","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:b64719fec5ba977aeb3d15c8ddeec1eacea3843e69a50cb96116307881a7d28a","Title":"html/template: golang: Go html/template: Cross-Site Scripting via pathological input","Description":"Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.","Severity":"HIGH","CweIDs":["CWE-79"],"VendorSeverity":{"alma":3,"amazon":3,"bitnami":2,"oracle-oval":3,"photon":2,"redhat":3,"rocky":3},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","V3Score":6.1},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","V3Score":8.1}},"References":["https://access.redhat.com/errata/RHSA-2026:70641","https://access.redhat.com/security/cve/CVE-2026-56858","https://bugzilla.redhat.com/2515815","https://bugzilla.redhat.com/2515820","https://bugzilla.redhat.com/2515827","https://bugzilla.redhat.com/2515838","https://bugzilla.redhat.com/2515839","https://bugzilla.redhat.com/show_bug.cgi?id=2402034","https://bugzilla.redhat.com/show_bug.cgi?id=2515815","https://bugzilla.redhat.com/show_bug.cgi?id=2515820","https://bugzilla.redhat.com/show_bug.cgi?id=2515827","https://bugzilla.redhat.com/show_bug.cgi?id=2515838","https://bugzilla.redhat.com/show_bug.cgi?id=2515839","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862","https://errata.almalinux.org/9/ALSA-2026-70641.html","https://errata.rockylinux.org/RLSA-2026:70641","https://go.dev/cl/807100","https://go.dev/issue/80435","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://linux.oracle.com/cve/CVE-2026-56858.html","https://linux.oracle.com/errata/ELSA-2026-70641.html","https://nvd.nist.gov/vuln/detail/CVE-2026-56858","https://pkg.go.dev/vuln/GO-2026-6091","https://www.cve.org/CVERecord?id=CVE-2026-56858"],"PublishedDate":"2026-08-13T22:17:22.207Z","LastModifiedDate":"2026-09-03T16:37:52.17Z"},{"VulnerabilityID":"CVE-2026-56859","VendorIDs":["GO-2026-6088"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.13, 1.26.6, 1.27.0-rc.3","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-56859","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:d1d98ea162eadc0c4a118257321b130c572100fca6591ddda4e03df17c9b61a9","Title":"encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue","Description":"Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.","Severity":"HIGH","CweIDs":["CWE-770"],"VendorSeverity":{"alma":3,"amazon":3,"bitnami":3,"oracle-oval":3,"photon":3,"redhat":3,"rocky":3},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5}},"References":["https://access.redhat.com/errata/RHSA-2026:69961","https://access.redhat.com/security/cve/CVE-2026-56859","https://bugzilla.redhat.com/2480684","https://bugzilla.redhat.com/2508234","https://bugzilla.redhat.com/2515815","https://bugzilla.redhat.com/2515820","https://bugzilla.redhat.com/2515827","https://bugzilla.redhat.com/2515838","https://bugzilla.redhat.com/2515839","https://bugzilla.redhat.com/2515840","https://bugzilla.redhat.com/show_bug.cgi?id=2480684","https://bugzilla.redhat.com/show_bug.cgi?id=2508234","https://bugzilla.redhat.com/show_bug.cgi?id=2515815","https://bugzilla.redhat.com/show_bug.cgi?id=2515820","https://bugzilla.redhat.com/show_bug.cgi?id=2515827","https://bugzilla.redhat.com/show_bug.cgi?id=2515838","https://bugzilla.redhat.com/show_bug.cgi?id=2515839","https://bugzilla.redhat.com/show_bug.cgi?id=2515840","https://bugzilla.redhat.com/show_bug.cgi?id=2518147","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17106","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19730","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39830","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862","https://errata.almalinux.org/9/ALSA-2026-69961.html","https://errata.rockylinux.org/RLSA-2026:69961","https://go.dev/cl/803320","https://go.dev/issue/80481","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://linux.oracle.com/cve/CVE-2026-56859.html","https://linux.oracle.com/errata/ELSA-2026-70201.html","https://nvd.nist.gov/vuln/detail/CVE-2026-56859","https://pkg.go.dev/vuln/GO-2026-6088","https://www.cve.org/CVERecord?id=CVE-2026-56859"],"PublishedDate":"2026-08-13T22:17:22.32Z","LastModifiedDate":"2026-09-03T16:37:52.17Z"},{"VulnerabilityID":"CVE-2026-56860","VendorIDs":["GO-2026-6218"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.13, 1.26.6, 1.27.0-rc.3","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-56860","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:1bb283c639d4a2eb91c085deb7e7f658b7a1c55ed52ec9d400753e668cbb9495","Title":"net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution","Description":"Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.","Severity":"HIGH","CweIDs":["CWE-407"],"VendorSeverity":{"alma":3,"amazon":3,"bitnami":2,"oracle-oval":3,"photon":2,"redhat":3,"rocky":3},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":5.9},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5}},"References":["https://access.redhat.com/errata/RHSA-2026:70641","https://access.redhat.com/security/cve/CVE-2026-56860","https://bugzilla.redhat.com/2515815","https://bugzilla.redhat.com/2515820","https://bugzilla.redhat.com/2515827","https://bugzilla.redhat.com/2515838","https://bugzilla.redhat.com/2515839","https://bugzilla.redhat.com/show_bug.cgi?id=2402034","https://bugzilla.redhat.com/show_bug.cgi?id=2515815","https://bugzilla.redhat.com/show_bug.cgi?id=2515820","https://bugzilla.redhat.com/show_bug.cgi?id=2515827","https://bugzilla.redhat.com/show_bug.cgi?id=2515838","https://bugzilla.redhat.com/show_bug.cgi?id=2515839","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862","https://errata.almalinux.org/9/ALSA-2026-70641.html","https://errata.rockylinux.org/RLSA-2026:70641","https://go.dev/cl/803681","https://go.dev/issue/80494","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://linux.oracle.com/cve/CVE-2026-56860.html","https://linux.oracle.com/errata/ELSA-2026-70641.html","https://nvd.nist.gov/vuln/detail/CVE-2026-56860","https://pkg.go.dev/vuln/GO-2026-6218","https://www.cve.org/CVERecord?id=CVE-2026-56860"],"PublishedDate":"2026-08-13T22:17:22.44Z","LastModifiedDate":"2026-09-03T16:37:52.17Z"},{"VulnerabilityID":"CVE-2026-56862","VendorIDs":["GO-2026-6090"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.13, 1.26.6, 1.27.0-rc.3","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-56862","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:c4baedfa2c551d8a0278b0d75a5ad0fb96c9f9b30ec7d3806551261c19d4c5ac","Title":"crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages","Description":"Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.","Severity":"HIGH","CweIDs":["CWE-770"],"VendorSeverity":{"alma":3,"amazon":3,"bitnami":3,"oracle-oval":3,"photon":3,"redhat":3,"rocky":3},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5}},"References":["https://access.redhat.com/errata/RHSA-2026:70641","https://access.redhat.com/security/cve/CVE-2026-56862","https://bugzilla.redhat.com/2515815","https://bugzilla.redhat.com/2515820","https://bugzilla.redhat.com/2515827","https://bugzilla.redhat.com/2515838","https://bugzilla.redhat.com/2515839","https://bugzilla.redhat.com/show_bug.cgi?id=2402034","https://bugzilla.redhat.com/show_bug.cgi?id=2515815","https://bugzilla.redhat.com/show_bug.cgi?id=2515820","https://bugzilla.redhat.com/show_bug.cgi?id=2515827","https://bugzilla.redhat.com/show_bug.cgi?id=2515838","https://bugzilla.redhat.com/show_bug.cgi?id=2515839","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862","https://errata.almalinux.org/9/ALSA-2026-70641.html","https://errata.rockylinux.org/RLSA-2026:70641","https://go.dev/cl/804261","https://go.dev/issue/80528","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://linux.oracle.com/cve/CVE-2026-56862.html","https://linux.oracle.com/errata/ELSA-2026-70641.html","https://nvd.nist.gov/vuln/detail/CVE-2026-56862","https://pkg.go.dev/vuln/GO-2026-6090","https://www.cve.org/CVERecord?id=CVE-2026-56862"],"PublishedDate":"2026-08-13T22:17:22.55Z","LastModifiedDate":"2026-09-03T16:37:52.17Z"},{"VulnerabilityID":"CVE-2026-78667","VendorIDs":["GO-2026-6609"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.26.9, 1.27.2","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-78667","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:75edef91fd57d5791a114c39aeb14f76de72f90fe99f749effdf3b95855873ab","Title":"net/http: golang: golang: Denial of Service via crafted HTTP Range headers","Description":"When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.","Severity":"HIGH","CweIDs":["CWE-770"],"VendorSeverity":{"redhat":3},"CVSS":{"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5}},"References":["https://access.redhat.com/security/cve/CVE-2026-78667","https://go.dev/cl/847309","https://go.dev/issue/81858","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://nvd.nist.gov/vuln/detail/CVE-2026-78667","https://pkg.go.dev/vuln/GO-2026-6609","https://www.cve.org/CVERecord?id=CVE-2026-78667"],"PublishedDate":"2026-10-08T23:17:03.88Z","LastModifiedDate":"2026-10-09T17:16:49.69Z"},{"VulnerabilityID":"CVE-2026-78669","VendorIDs":["GO-2026-6611"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.26.9, 1.27.2","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-78669","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:d084694adab1295e35a9bd4f8b1b2f3f3e383395bb692b6b92d8e04a3fcc1a32","Title":"net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames","Description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.","Severity":"HIGH","CweIDs":["CWE-405"],"VendorSeverity":{"redhat":3},"CVSS":{"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5}},"References":["https://access.redhat.com/security/cve/CVE-2026-78669","https://go.dev/cl/847186","https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://nvd.nist.gov/vuln/detail/CVE-2026-78669","https://pkg.go.dev/vuln/GO-2026-6611","https://www.cve.org/CVERecord?id=CVE-2026-78669"],"PublishedDate":"2026-10-08T23:17:04.01Z","LastModifiedDate":"2026-10-09T17:16:49.857Z"},{"VulnerabilityID":"CVE-2026-97031","VendorIDs":["GO-2026-6607"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.26.9, 1.27.2","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-97031","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:4dfe4b734c7ec3833089e6387266a86e3268786946970ed3b719fed419b97997","Title":"crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references","Description":"Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.","Severity":"HIGH","CweIDs":["CWE-405"],"VendorSeverity":{"redhat":3},"CVSS":{"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5}},"References":["https://access.redhat.com/security/cve/CVE-2026-97031","https://go.dev/cl/847312","https://go.dev/issue/81855","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://nvd.nist.gov/vuln/detail/CVE-2026-97031","https://pkg.go.dev/vuln/GO-2026-6607","https://www.cve.org/CVERecord?id=CVE-2026-97031"],"PublishedDate":"2026-10-08T23:17:06.037Z","LastModifiedDate":"2026-10-09T16:35:35.9Z"},{"VulnerabilityID":"CVE-2025-61728","VendorIDs":["GO-2026-4342"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.24.12, 1.25.6","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2025-61728","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:a2fd289c39b437767dcf6e66006a71bdf163ea1754d852cb071438e189f23d6d","Title":"golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip","Description":"archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.","Severity":"MEDIUM","CweIDs":["CWE-770"],"VendorSeverity":{"alma":3,"amazon":3,"azure":2,"bitnami":2,"oracle-oval":3,"photon":2,"redhat":2,"rocky":3},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","V3Score":6.5},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":7.5}},"References":["http://www.openwall.com/lists/oss-security/2026/01/15/4","https://access.redhat.com/errata/RHSA-2026:3753","https://access.redhat.com/security/cve/CVE-2025-61728","https://bugzilla.redhat.com/2418462","https://bugzilla.redhat.com/2434431","https://bugzilla.redhat.com/2434432","https://bugzilla.redhat.com/2437111","https://bugzilla.redhat.com/show_bug.cgi?id=2418462","https://bugzilla.redhat.com/show_bug.cgi?id=2434431","https://bugzilla.redhat.com/show_bug.cgi?id=2434432","https://bugzilla.redhat.com/show_bug.cgi?id=2437111","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61728","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121","https://errata.almalinux.org/9/ALSA-2026-3753.html","https://errata.rockylinux.org/RLSA-2026:3753","https://go.dev/cl/736713","https://go.dev/issue/77102","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc","https://linux.oracle.com/cve/CVE-2025-61728.html","https://linux.oracle.com/errata/ELSA-2026-4672.html","https://nvd.nist.gov/vuln/detail/CVE-2025-61728","https://pkg.go.dev/vuln/GO-2026-4342","https://www.cve.org/CVERecord?id=CVE-2025-61728"],"PublishedDate":"2026-01-28T20:16:09.83Z","LastModifiedDate":"2026-06-17T09:50:48.36Z"},{"VulnerabilityID":"CVE-2025-61730","VendorIDs":["GO-2026-4340"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.24.12, 1.25.6","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2025-61730","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:26abb64b26e07b79123088ac8e08e5987887d8fdf023e8632281c565d85b74ae","Title":"crypto/tls: Handshake messages may be processed at the incorrect encryption level in crypto/tls","Description":"During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.","Severity":"MEDIUM","VendorSeverity":{"amazon":3,"azure":1,"bitnami":2,"cbl-mariner":1,"photon":2,"redhat":2},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","V3Score":5.3},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","V3Score":5.3}},"References":["https://access.redhat.com/security/cve/CVE-2025-61730","https://go.dev/cl/724120","https://go.dev/issue/76443","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc","https://nvd.nist.gov/vuln/detail/CVE-2025-61730","https://pkg.go.dev/vuln/GO-2026-4340","https://www.cve.org/CVERecord?id=CVE-2025-61730"],"PublishedDate":"2026-01-28T20:16:09.94Z","LastModifiedDate":"2026-06-17T09:50:48.643Z"},{"VulnerabilityID":"CVE-2026-27142","VendorIDs":["GO-2026-4603"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.8, 1.26.1","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-27142","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:bcd5c0970ff5be782861812fa584191f1d449f479564d0bfe9ba9bbeaa3bdc6c","Title":"html/template: URLs in meta content attribute actions are not escaped in html/template","Description":"Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value \"refresh\". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow \"url=\" by setting htmlmetacontenturlescape=0.","Severity":"MEDIUM","CweIDs":["CWE-79"],"VendorSeverity":{"amazon":3,"bitnami":2,"photon":2,"redhat":2},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","V3Score":6.1},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","V3Score":5.4}},"References":["https://access.redhat.com/security/cve/CVE-2026-27142","https://go.dev/cl/752081","https://go.dev/issue/77954","https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","https://nvd.nist.gov/vuln/detail/CVE-2026-27142","https://pkg.go.dev/vuln/GO-2026-4603","https://www.cve.org/CVERecord?id=CVE-2026-27142"],"PublishedDate":"2026-03-06T22:16:01.177Z","LastModifiedDate":"2026-06-17T10:26:44.67Z"},{"VulnerabilityID":"CVE-2026-32282","VendorIDs":["GO-2026-4864"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.9, 1.26.2","Status":"fixed","SeveritySource":"nvd","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-32282","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:ae484be3260ce10f727cdde77e404013820026d38889a16cd0d380872cbc4ec8","Title":"golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root","Description":"On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.","Severity":"MEDIUM","CweIDs":["CWE-59"],"VendorSeverity":{"alma":3,"amazon":3,"bitnami":2,"nvd":2,"oracle-oval":3,"photon":2,"redhat":2,"rocky":3},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","V3Score":6.4},"nvd":{"V3Vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","V3Score":6.4},"redhat":{"V3Vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","V3Score":7.8}},"References":["https://access.redhat.com/errata/RHSA-2026:19353","https://access.redhat.com/errata/RHSA-2026:23228","https://access.redhat.com/security/cve/CVE-2026-32282","https://bugzilla.redhat.com/2445356","https://bugzilla.redhat.com/2449833","https://bugzilla.redhat.com/2455470","https://bugzilla.redhat.com/2456333","https://bugzilla.redhat.com/2456335","https://bugzilla.redhat.com/2456336","https://bugzilla.redhat.com/2456338","https://bugzilla.redhat.com/2456339","https://bugzilla.redhat.com/show_bug.cgi?id=2434432","https://bugzilla.redhat.com/show_bug.cgi?id=2437111","https://bugzilla.redhat.com/show_bug.cgi?id=2445345","https://bugzilla.redhat.com/show_bug.cgi?id=2445356","https://bugzilla.redhat.com/show_bug.cgi?id=2449833","https://bugzilla.redhat.com/show_bug.cgi?id=2455470","https://bugzilla.redhat.com/show_bug.cgi?id=2456336","https://bugzilla.redhat.com/show_bug.cgi?id=2456338","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27137","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33186","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34986","https://errata.almalinux.org/9/ALSA-2026-19353.html","https://errata.rockylinux.org/RLSA-2026:23228","https://go.dev/cl/763761","https://go.dev/issue/78293","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://linux.oracle.com/cve/CVE-2026-32282.html","https://linux.oracle.com/errata/ELSA-2026-48790.html","https://nvd.nist.gov/vuln/detail/CVE-2026-32282","https://pkg.go.dev/vuln/GO-2026-4864","https://www.cve.org/CVERecord?id=CVE-2026-32282"],"PublishedDate":"2026-04-08T02:16:03.467Z","LastModifiedDate":"2026-07-25T10:10:00.167Z"},{"VulnerabilityID":"CVE-2026-32288","VendorIDs":["GO-2026-4869"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.9, 1.26.2","Status":"fixed","SeveritySource":"nvd","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-32288","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:e170874223b9d603d6f6c14845b4083196d4309b891302940145735f20034825","Title":"archive/tar: golang: Go's archive/tar package: Denial of Service via maliciously-crafted archive","Description":"tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the \"old GNU sparse map\" format.","Severity":"MEDIUM","CweIDs":["CWE-770"],"VendorSeverity":{"amazon":3,"azure":2,"bitnami":2,"nvd":2,"photon":2,"redhat":2,"ubuntu":2},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","V3Score":5.5},"nvd":{"V3Vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","V3Score":5.5},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","V3Score":4.3}},"References":["https://access.redhat.com/security/cve/CVE-2026-32288","https://go.dev/cl/763766","https://go.dev/issue/78301","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://nvd.nist.gov/vuln/detail/CVE-2026-32288","https://pkg.go.dev/vuln/GO-2026-4869","https://www.cve.org/CVERecord?id=CVE-2026-32288"],"PublishedDate":"2026-04-08T02:16:03.707Z","LastModifiedDate":"2026-07-25T10:10:00.167Z"},{"VulnerabilityID":"CVE-2026-32289","VendorIDs":["GO-2026-4865"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.9, 1.26.2","Status":"fixed","SeveritySource":"nvd","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-32289","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:c75f91302d94992ee38e2e11147bcefddd8569475ac21b9097908594f9453139","Title":"html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals","Description":"Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.","Severity":"MEDIUM","CweIDs":["CWE-79"],"VendorSeverity":{"amazon":3,"bitnami":2,"nvd":2,"photon":2,"redhat":2},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","V3Score":6.1},"nvd":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","V3Score":6.1},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","V3Score":5.4}},"References":["https://access.redhat.com/security/cve/CVE-2026-32289","https://go.dev/cl/763762","https://go.dev/issue/78331","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://nvd.nist.gov/vuln/detail/CVE-2026-32289","https://pkg.go.dev/vuln/GO-2026-4865","https://www.cve.org/CVERecord?id=CVE-2026-32289"],"PublishedDate":"2026-04-08T02:16:03.82Z","LastModifiedDate":"2026-07-25T10:10:00.167Z"},{"VulnerabilityID":"CVE-2026-39823","VendorIDs":["GO-2026-4982"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.10, 1.26.3","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-39823","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:05fe37cccb07af172f3a0b54a3d9d19e7e49fa0442f672bedf2a3ac250067a8f","Title":"html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content","Description":"CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS.","Severity":"MEDIUM","CweIDs":["CWE-79"],"VendorSeverity":{"alma":3,"amazon":3,"bitnami":2,"oracle-oval":3,"photon":2,"redhat":2,"rocky":3},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","V3Score":6.1},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","V3Score":5.4}},"References":["https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/security/cve/CVE-2026-39823","https://bugzilla.redhat.com/2467822","https://bugzilla.redhat.com/show_bug.cgi?id=2467809","https://bugzilla.redhat.com/show_bug.cgi?id=2467810","https://bugzilla.redhat.com/show_bug.cgi?id=2467811","https://bugzilla.redhat.com/show_bug.cgi?id=2467813","https://bugzilla.redhat.com/show_bug.cgi?id=2467815","https://bugzilla.redhat.com/show_bug.cgi?id=2467820","https://bugzilla.redhat.com/show_bug.cgi?id=2467822","https://bugzilla.redhat.com/show_bug.cgi?id=2467823","https://bugzilla.redhat.com/show_bug.cgi?id=2467825","https://bugzilla.redhat.com/show_bug.cgi?id=2467826","https://bugzilla.redhat.com/show_bug.cgi?id=2467827","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501","https://errata.almalinux.org/8/ALSA-2026-22112.html","https://errata.rockylinux.org/RLSA-2026:22121","https://go.dev/cl/769920","https://go.dev/issue/78913","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://linux.oracle.com/cve/CVE-2026-39823.html","https://linux.oracle.com/errata/ELSA-2026-22121.html","https://nvd.nist.gov/vuln/detail/CVE-2026-39823","https://pkg.go.dev/vuln/GO-2026-4982","https://www.cve.org/CVERecord?id=CVE-2026-39823"],"PublishedDate":"2026-05-07T20:16:43.29Z","LastModifiedDate":"2026-06-17T10:42:38.473Z"},{"VulnerabilityID":"CVE-2026-39825","VendorIDs":["GO-2026-4976"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.10, 1.26.3","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-39825","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:603e6955a3502f62211c8b66e1c9f0fb86dec7383afa7345a6de171601216cec","Title":"net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls","Description":"ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query \"a1=x&a2=x&...&a10000=x&hidden=y\" can forward the parameter \"hidden=y\" while hiding it from the proxy's Rewrite function.","Severity":"MEDIUM","VendorSeverity":{"alma":3,"amazon":3,"bitnami":2,"oracle-oval":3,"photon":2,"redhat":2,"rocky":3},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","V3Score":5.3},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","V3Score":6.5}},"References":["https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/security/cve/CVE-2026-39825","https://bugzilla.redhat.com/2467822","https://bugzilla.redhat.com/show_bug.cgi?id=2467809","https://bugzilla.redhat.com/show_bug.cgi?id=2467810","https://bugzilla.redhat.com/show_bug.cgi?id=2467811","https://bugzilla.redhat.com/show_bug.cgi?id=2467813","https://bugzilla.redhat.com/show_bug.cgi?id=2467815","https://bugzilla.redhat.com/show_bug.cgi?id=2467820","https://bugzilla.redhat.com/show_bug.cgi?id=2467822","https://bugzilla.redhat.com/show_bug.cgi?id=2467823","https://bugzilla.redhat.com/show_bug.cgi?id=2467825","https://bugzilla.redhat.com/show_bug.cgi?id=2467826","https://bugzilla.redhat.com/show_bug.cgi?id=2467827","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501","https://errata.almalinux.org/8/ALSA-2026-22112.html","https://errata.rockylinux.org/RLSA-2026:22121","https://go.dev/cl/770541","https://go.dev/issue/78948","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://linux.oracle.com/cve/CVE-2026-39825.html","https://linux.oracle.com/errata/ELSA-2026-22121.html","https://nvd.nist.gov/vuln/detail/CVE-2026-39825","https://pkg.go.dev/vuln/GO-2026-4976","https://www.cve.org/CVERecord?id=CVE-2026-39825"],"PublishedDate":"2026-05-07T20:16:43.39Z","LastModifiedDate":"2026-06-17T10:42:38.77Z"},{"VulnerabilityID":"CVE-2026-39826","VendorIDs":["GO-2026-4980"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.10, 1.26.3","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-39826","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:647172cc5d69f3744d0d95a5bdd73eb16687329b7ac0be77e2d7354d2620cb79","Title":"html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping","Description":"If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.","Severity":"MEDIUM","CweIDs":["CWE-116"],"VendorSeverity":{"alma":3,"amazon":3,"bitnami":2,"oracle-oval":3,"photon":2,"redhat":2,"rocky":3},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","V3Score":6.1},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","V3Score":5.4}},"References":["https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/security/cve/CVE-2026-39826","https://bugzilla.redhat.com/2467822","https://bugzilla.redhat.com/show_bug.cgi?id=2467809","https://bugzilla.redhat.com/show_bug.cgi?id=2467810","https://bugzilla.redhat.com/show_bug.cgi?id=2467811","https://bugzilla.redhat.com/show_bug.cgi?id=2467813","https://bugzilla.redhat.com/show_bug.cgi?id=2467815","https://bugzilla.redhat.com/show_bug.cgi?id=2467820","https://bugzilla.redhat.com/show_bug.cgi?id=2467822","https://bugzilla.redhat.com/show_bug.cgi?id=2467823","https://bugzilla.redhat.com/show_bug.cgi?id=2467825","https://bugzilla.redhat.com/show_bug.cgi?id=2467826","https://bugzilla.redhat.com/show_bug.cgi?id=2467827","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501","https://errata.almalinux.org/8/ALSA-2026-22112.html","https://errata.rockylinux.org/RLSA-2026:22121","https://go.dev/cl/771180","https://go.dev/issue/78981","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://linux.oracle.com/cve/CVE-2026-39826.html","https://linux.oracle.com/errata/ELSA-2026-22121.html","https://nvd.nist.gov/vuln/detail/CVE-2026-39826","https://pkg.go.dev/vuln/GO-2026-4980","https://www.cve.org/CVERecord?id=CVE-2026-39826"],"PublishedDate":"2026-05-07T20:16:43.49Z","LastModifiedDate":"2026-06-17T10:42:38.923Z"},{"VulnerabilityID":"CVE-2026-42505","VendorIDs":["GO-2026-5856"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.12, 1.26.5, 1.27.0-rc.2","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-42505","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:90520e5bfa0cc2f8d83d3faae621239fad0d49654703204118b425bedd7ed0d9","Title":"crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client Hello","Description":"Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.","Severity":"MEDIUM","CweIDs":["CWE-201"],"VendorSeverity":{"alma":3,"amazon":2,"azure":2,"bitnami":2,"photon":2,"redhat":2},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","V3Score":5.3},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","V3Score":5.3}},"References":["https://access.redhat.com/errata/RHSA-2026:66364","https://access.redhat.com/security/cve/CVE-2026-42505","https://bugzilla.redhat.com/2515815","https://bugzilla.redhat.com/2515820","https://bugzilla.redhat.com/2515839","https://errata.almalinux.org/9/ALSA-2026-66364.html","https://go.dev/cl/775960","https://go.dev/issue/79282","https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc","https://nvd.nist.gov/vuln/detail/CVE-2026-42505","https://pkg.go.dev/vuln/GO-2026-5856","https://www.cve.org/CVERecord?id=CVE-2026-42505"],"PublishedDate":"2026-07-08T17:17:21.497Z","LastModifiedDate":"2026-09-16T20:14:44.473Z"},{"VulnerabilityID":"CVE-2026-42507","VendorIDs":["GO-2026-5039"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.11, 1.26.4","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-42507","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:84f66c24310023e9d786832ecfc748a5604759eb6c9f7a40db1c2a84170a2cf9","Title":"net/textproto: golang: Golang net/textproto: Misleading error messages via input injection","Description":"When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.","Severity":"MEDIUM","VendorSeverity":{"alma":3,"amazon":2,"azure":2,"bitnami":2,"oracle-oval":2,"photon":2,"redhat":2,"rocky":2},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","V3Score":5.3},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","V3Score":5.3}},"References":["https://access.redhat.com/errata/RHSA-2026:29981","https://access.redhat.com/errata/RHSA-2026:66364","https://access.redhat.com/security/cve/CVE-2026-42507","https://bugzilla.redhat.com/2515815","https://bugzilla.redhat.com/2515820","https://bugzilla.redhat.com/2515839","https://bugzilla.redhat.com/show_bug.cgi?id=2484205","https://bugzilla.redhat.com/show_bug.cgi?id=2484207","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27145","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42507","https://errata.almalinux.org/9/ALSA-2026-66364.html","https://errata.rockylinux.org/RLSA-2026:29981","https://go.dev/cl/777060","https://go.dev/issue/79346","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","https://linux.oracle.com/cve/CVE-2026-42507.html","https://linux.oracle.com/errata/ELSA-2026-29981.html","https://nvd.nist.gov/vuln/detail/CVE-2026-42507","https://pkg.go.dev/vuln/GO-2026-5039","https://www.cve.org/CVERecord?id=CVE-2026-42507"],"PublishedDate":"2026-06-02T23:16:38.027Z","LastModifiedDate":"2026-07-22T19:10:00.12Z"},{"VulnerabilityID":"CVE-2026-56866","VendorIDs":["GO-2026-6605"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.26.9, 1.27.2","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-56866","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:b14ac3ac5ae8c17511c013203a4c5e0d7b00b20f65fa0f5ffe4196b1b763486f","Title":"net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections","Description":"When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.","Severity":"MEDIUM","CweIDs":["CWE-444"],"VendorSeverity":{"redhat":2},"CVSS":{"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","V3Score":6.5}},"References":["https://access.redhat.com/security/cve/CVE-2026-56866","https://go.dev/cl/847306","https://go.dev/issue/81740","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://nvd.nist.gov/vuln/detail/CVE-2026-56866","https://pkg.go.dev/vuln/GO-2026-6605","https://www.cve.org/CVERecord?id=CVE-2026-56866"],"PublishedDate":"2026-10-08T23:17:01.62Z","LastModifiedDate":"2026-10-09T16:35:35.9Z"},{"VulnerabilityID":"CVE-2026-78663","VendorIDs":["GO-2026-6612"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.26.9, 1.27.2","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-78663","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:3dba524fcfee311b3c001d62c826eb6b7a3f0d2447db3865fa8d5cc899a81809","Title":"net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server","Description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","Severity":"MEDIUM","CweIDs":["CWE-675"],"VendorSeverity":{"redhat":2},"CVSS":{"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","V3Score":5.3}},"References":["https://access.redhat.com/security/cve/CVE-2026-78663","https://go.dev/cl/847187","https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://nvd.nist.gov/vuln/detail/CVE-2026-78663","https://pkg.go.dev/vuln/GO-2026-6612","https://www.cve.org/CVERecord?id=CVE-2026-78663"],"PublishedDate":"2026-10-08T23:17:03.647Z","LastModifiedDate":"2026-10-09T17:16:49.42Z"},{"VulnerabilityID":"CVE-2026-94439","VendorIDs":["GO-2026-6613"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.26.9, 1.27.2","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-94439","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:e647068f87bf602dc18e44e155b4e80f5a66b01b288f302c7ccf5fb6ab91dabc","Title":"net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses","Description":"When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.","Severity":"MEDIUM","CweIDs":["CWE-444"],"VendorSeverity":{"redhat":2},"CVSS":{"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","V3Score":6.5}},"References":["https://access.redhat.com/security/cve/CVE-2026-94439","https://go.dev/cl/847311","https://go.dev/issue/81744","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://nvd.nist.gov/vuln/detail/CVE-2026-94439","https://pkg.go.dev/vuln/GO-2026-6613","https://www.cve.org/CVERecord?id=CVE-2026-94439"],"PublishedDate":"2026-10-08T23:17:04.76Z","LastModifiedDate":"2026-10-09T17:16:50.703Z"},{"VulnerabilityID":"CVE-2026-94448","VendorIDs":["GO-2026-6599"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.26.9, 1.27.2","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-94448","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:4e647a52376229f6fb3f0d9079d7bdedd0a3324d93b872d67cf56e7208c693cd","Title":"html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals","Description":"When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.","Severity":"MEDIUM","VendorSeverity":{"redhat":2},"CVSS":{"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","V3Score":6.1}},"References":["https://access.redhat.com/security/cve/CVE-2026-94448","https://go.dev/cl/839866","https://go.dev/issue/81821","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://nvd.nist.gov/vuln/detail/CVE-2026-94448","https://pkg.go.dev/vuln/GO-2026-6599","https://www.cve.org/CVERecord?id=CVE-2026-94448"],"PublishedDate":"2026-10-08T23:17:05.3Z","LastModifiedDate":"2026-10-09T16:35:35.9Z"},{"VulnerabilityID":"CVE-2026-97032","VendorIDs":["GO-2026-6617"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.26.9, 1.27.2","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-97032","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:fee20e5ee95534b2475eac3503bdbbc9d38ee19b2bb05f5a87664fb79caf4a4e","Title":"net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification","Description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.","Severity":"MEDIUM","VendorSeverity":{"redhat":2},"CVSS":{"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","V3Score":5.9}},"References":["https://access.redhat.com/security/cve/CVE-2026-97032","https://go.dev/cl/847188","https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://nvd.nist.gov/vuln/detail/CVE-2026-97032","https://pkg.go.dev/vuln/GO-2026-6617","https://www.cve.org/CVERecord?id=CVE-2026-97032"],"PublishedDate":"2026-10-08T23:17:06.213Z","LastModifiedDate":"2026-10-09T16:35:35.9Z"},{"VulnerabilityID":"CVE-2026-27139","VendorIDs":["GO-2026-4602"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.25.8, 1.26.1","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-27139","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:05e24463440a3f12100481cb0a8df1f939ba48aebf825060a3f9f0cf4fbc4b00","Title":"os: FileInfo can escape from a Root in golang os module","Description":"On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.","Severity":"LOW","CweIDs":["CWE-22"],"VendorSeverity":{"amazon":3,"azure":1,"bitnami":1,"photon":1,"redhat":1},"CVSS":{"bitnami":{"V3Vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","V3Score":2.5},"redhat":{"V3Vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","V3Score":2.5}},"References":["https://access.redhat.com/security/cve/CVE-2026-27139","https://go.dev/cl/749480","https://go.dev/issue/77827","https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","https://nvd.nist.gov/vuln/detail/CVE-2026-27139","https://pkg.go.dev/vuln/GO-2026-4602","https://www.cve.org/CVERecord?id=CVE-2026-27139"],"PublishedDate":"2026-03-06T22:16:01.07Z","LastModifiedDate":"2026-06-17T10:26:44.23Z"},{"VulnerabilityID":"CVE-2026-56857","VendorIDs":["GO-2026-6604"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.26.9, 1.27.2","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-56857","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:9c93aa6f1fa8ccdd11d22243cc6c7ee64ddc3fa3dc1866a723a7804368cc5799","Title":"os: golang: golang: Directory traversal via Windows junction handling","Description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).","Severity":"LOW","CweIDs":["CWE-1386"],"VendorSeverity":{"redhat":1},"CVSS":{"redhat":{"V3Vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","V3Score":3.3}},"References":["https://access.redhat.com/security/cve/CVE-2026-56857","https://go.dev/cl/847305","https://go.dev/issue/81739","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://nvd.nist.gov/vuln/detail/CVE-2026-56857","https://pkg.go.dev/vuln/GO-2026-6604","https://www.cve.org/CVERecord?id=CVE-2026-56857"],"PublishedDate":"2026-10-08T23:17:01.487Z","LastModifiedDate":"2026-10-09T16:35:35.9Z"},{"VulnerabilityID":"CVE-2026-78659","VendorIDs":["GO-2026-6603"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.26.9, 1.27.2","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-78659","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:18511b084d63632c93462eacf7bd20047ab067bfa6aef96fa67f13ae1488910d","Title":"When \"Trailer\" headers are sent by a client, the HTTP server internall ...","Description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.","Severity":"UNKNOWN","CweIDs":["CWE-405"],"References":["https://go.dev/cl/847185","https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6603"],"PublishedDate":"2026-10-08T23:17:03.27Z","LastModifiedDate":"2026-10-09T16:35:35.9Z"},{"VulnerabilityID":"CVE-2026-78660","VendorIDs":["GO-2026-6610"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.26.9, 1.27.2","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-78660","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:d01cf23e1a948e13ca625d3a85565a78c2801520b7a99d59d0136e326f931ea1","Title":"Historically, we have been rather lax about malformed framing-related  ...","Description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.","Severity":"UNKNOWN","CweIDs":["CWE-444"],"References":["https://go.dev/cl/835145","https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6610"],"PublishedDate":"2026-10-08T23:17:03.51Z","LastModifiedDate":"2026-10-09T17:16:49.243Z"},{"VulnerabilityID":"CVE-2026-94440","VendorIDs":["GO-2026-6608"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.26.9, 1.27.2","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-94440","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:7d90a870dcb09e21a9d67436d76e475b9f7c3593c0ac21bb5d147c3c0d48292b","Title":"Parsing a multipart form can bypass memory limits and read an arbitrar ...","Description":"Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.","Severity":"UNKNOWN","CweIDs":["CWE-770"],"References":["https://go.dev/cl/847307","https://go.dev/issue/81741","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6608"],"PublishedDate":"2026-10-08T23:17:04.917Z","LastModifiedDate":"2026-10-09T17:16:50.907Z"},{"VulnerabilityID":"CVE-2026-97030","VendorIDs":["GO-2026-6600"],"PkgID":"stdlib@v1.25.5","PkgName":"stdlib","PkgIdentifier":{"PURL":"pkg:golang/stdlib@1.25.5","UID":"c1ae13a074084d3c","BOMRef":"pkg:golang/stdlib@1.25.5?package-id=10047b98d8b2abfa"},"InstalledVersion":"1.25.5","FixedVersion":"1.26.9, 1.27.2","Status":"fixed","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-97030","DataSource":{"ID":"govulndb","Name":"The Go Vulnerability Database","URL":"https://pkg.go.dev/vuln/"},"Fingerprint":"sha256:5ba99112f2ced35db156638aa714f658981cd3709e88f6c82efdb1fce301a126","Title":"A trusted template author may have previously written a valid template ...","Description":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.","Severity":"UNKNOWN","References":["https://go.dev/cl/840925","https://go.dev/issue/81823","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6600"],"PublishedDate":"2026-10-08T23:17:05.91Z","LastModifiedDate":"2026-10-09T16:35:35.9Z"}]}],"UncheckedComponents":{"Count":0,"Components":[]}},"scancode":null}