logging 6.0 Schwachstellen (CVE)

9.6Kritisch

CVE-2026-39821 vor 5 Monaten

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Go standard library net/http; Go standard library net/http/internal/http2; golang.org/x/net golang.org/x/net/idna; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …

1.8%EPSS

7.5Hoch

CVE-2026-39820 vor 6 Monaten

Quadratic string concatentation in consumeComment in net/mail

Go standard library net/mail; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

7.5Hoch

CVE-2026-33811 vor 6 Monaten

Crash when handling long CNAME response in net

Go standard library net; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

7.5Hoch

CVE-2026-42499 vor 6 Monaten

Quadratic string concatenation in consumePhrase in net/mail

Go standard library net/mail; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

7.5Hoch

CVE-2026-42154 vor 6 Monaten

Prometheus: remote read endpoint allows denial of service via crafted snappy payload

prometheus prometheus; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 9

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An…

7.5Hoch

CVE-2026-42151 vor 6 Monaten

Prometheus Azure AD remote write OAuth client secret exposed via config API

prometheus prometheus; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 9

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus re…

7.5Hoch

CVE-2026-32280 vor 7 Monaten

Unexpected work during chain building in crypto/x509

Go standard library crypto/x509; Red Hat Cryostat 4 on RHEL 9; Red Hat HawtIO HawtIO 4.4.0; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 an…

7.5Hoch

CVE-2026-33810 vor 7 Monaten

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

Go standard library crypto/x509; Red Hat Cryostat 4 on RHEL 9; Red Hat HawtIO HawtIO 4.4.0; Red Hat Red Hat Enterprise Linux 10

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issu…

7.5Hoch

CVE-2026-34986 vor 7 Monaten

Go JOSE affect by a panic in JWE decryption

go-jose go-jose; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JS…

9.1Kritisch

CVE-2026-33186 vor 7 Monaten

gRPC-Go has an authorization bypass via missing leading slash in :path

grpc grpc-go; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests …

1.6%EPSS

7.5Hoch

CVE-2026-25679 vor 8 Monaten

Incorrect parsing of IPv6 host literals in net/url

Go standard library net/url; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

7.5Hoch

CVE-2026-27137 vor 8 Monaten

Incorrect enforcement of email constraints in crypto/x509

Go standard library crypto/x509; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 9

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be…

7.5Hoch

CVE-2025-61726 vor 9 Monaten

Memory exhaustion in query parameter parsing in net/url

Go standard library net/url; Red Hat Cryostat 4 on RHEL 9; Red Hat HawtIO HawtIO 4.3.1; Red Hat HawtIO HawtIO 4.4.0

The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encode…

2.3%EPSS