IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API

Vulnerabilidades de logging (CVE)

Registros CVE publicados para logging, los más recientes primero. Siga el producto para recibir un correo con cada nueva.

6.4 156.2 146.0 135.8 116.6 86.5 75.7 26.3 15.9 1
37 resultados
9.6Crítica
CVE-2026-39821

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Go standard library net/http; Go standard library net/http/internal/http2; golang.org/x/net golang.org/x/net/idna; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …

1.8%EPSS
9.1Crítica
CVE-2026-42508

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

golang.org/x/crypto golang.org/x/crypto/ssh/knownhosts; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

6.9%EPSS
9.1Crítica
CVE-2026-39830

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

golang.org/x/crypto golang.org/x/crypto/ssh; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited glob…

5.3Media
CVE-2026-39835

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

golang.org/x/crypto golang.org/x/crypto/ssh; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

9.1Crítica
CVE-2026-39832

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

golang.org/x/crypto golang.org/x/crypto/ssh/agent; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote…

6.3Media
CVE-2026-39828

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

golang.org/x/crypto golang.org/x/crypto/ssh; Red Hat Cryostat 4 on RHEL 9; Red Hat RHEM 1.0 for RHEL 9; Red Hat RHEM 1.1 for RHEL 10

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil…

7.5Alta
CVE-2026-39820

Quadratic string concatentation in consumeComment in net/mail

Go standard library net/mail; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

7.5Alta
CVE-2026-33811

Crash when handling long CNAME response in net

Go standard library net; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

7.5Alta
CVE-2026-42499

Quadratic string concatenation in consumePhrase in net/mail

Go standard library net/mail; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

7.5Alta
CVE-2026-42154

Prometheus: remote read endpoint allows denial of service via crafted snappy payload

prometheus prometheus; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 9

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An…

7.5Alta
CVE-2026-42151

Prometheus Azure AD remote write OAuth client secret exposed via config API

prometheus prometheus; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 9

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus re…

8.7Alta
CVE-2026-35469

SpdyStream: DOS on CRI

moby spdystream; Red Hat Red Hat OpenShift Container Platform 4.19; Red Hat RHEM 1.0 for RHEL 9; Red Hat RHEM 1.1 for RHEL 10

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTING…

7.5Alta
CVE-2026-32280

Unexpected work during chain building in crypto/x509

Go standard library crypto/x509; Red Hat Cryostat 4 on RHEL 9; Red Hat HawtIO HawtIO 4.4.0; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 an…

7.5Alta
CVE-2026-33810

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

Go standard library crypto/x509; Red Hat Cryostat 4 on RHEL 9; Red Hat HawtIO HawtIO 4.4.0; Red Hat Red Hat Enterprise Linux 10

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issu…

7.5Alta
CVE-2026-29181

OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

open-telemetry opentelemetry-go; Red Hat Cert Manager support for Red Hat OpenShift release 1.19; Red Hat Cluster Observability Operator 1.5.0; Red Hat Logging Subsystem for Red Hat OpenShift 6.6

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. This allows an attacker to amplify cpu and allocations…

7.5Alta
CVE-2026-34986

Go JOSE affect by a panic in JWE decryption

go-jose go-jose; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JS…

7.5Alta
CVE-2026-32285

Denial of service in github.com/buger/jsonparser

github.com/buger/jsonparser github.com/buger/jsonparser; Red Hat Cluster Observability Operator 1.5.0; Red Hat Logging Subsystem for Red Hat OpenShift 6.4; Red Hat multicluster engine for Kubernetes 2.1

The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack.

9.1Crítica
CVE-2026-33186

gRPC-Go has an authorization bypass via missing leading slash in :path

grpc grpc-go; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests …

1.6%EPSS
8.2Alta
CVE-2026-32829

lz4_flex: Decompression can leak information from uninitialized memory or reused output buffer

PSeitz lz4_flex; Red Hat Logging Subsystem for Red Hat OpenShift 6.2; Red Hat Logging Subsystem for Red Hat OpenShift 6.4; Red Hat Logging Subsystem for Red Hat OpenShift 6.5

lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library …

8.7Alta
CVE-2026-31812

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

quinn-rs quinn; Red Hat Logging Subsystem for Red Hat OpenShift 6.4; Red Hat Red Hat Ansible Automation Platform 2.6; Red Hat Red Hat OpenShift AI 3.3

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial p…

7.5Alta
CVE-2026-25679

Incorrect parsing of IPv6 host literals in net/url

Go standard library net/url; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

7.5Alta
CVE-2026-27137

Incorrect enforcement of email constraints in crypto/x509

Go standard library crypto/x509; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 9

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be…

7.5Alta
CVE-2025-61726

Memory exhaustion in query parameter parsing in net/url

Go standard library net/url; Red Hat Cryostat 4 on RHEL 9; Red Hat HawtIO HawtIO 4.3.1; Red Hat HawtIO HawtIO 4.4.0

The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encode…

2.3%EPSS
7.5Alta
CVE-2024-12085

Rsync: info leak via uninitialized stack contents

rsync; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitializ…

8.6%EPSS