RHSA-2026:17598

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have…

gRPC-Go is the Go language implementation of gRPC.

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.

Immutable.js provides many Persistent Immutable data structures.

spdystream is a Go library for multiplexing streams over SPDY connections.

The net/url package does not set a limit on the number of query parameters in a query.

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content.

A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters.

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened.