RHSA-2025:11749

Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by atta…

The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines.

golang-jwt is a Go implementation of JSON Web Tokens.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed.

Moby is an open-source project created by Docker to enable software containerization.

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.