RHSA-2026:51033

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation.

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have…

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

gRPC-Go is the Go language implementation of gRPC.

The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag.

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.

The net/url package does not set a limit on the number of query parameters in a query.

containerd is an open-source container runtime.

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint.

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service.

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

The RSA and DSA public key parsers did not enforce size limits on key parameters.

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.

Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity.

containerd is an open-source container runtime.

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.

containerd is an open-source container runtime.

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out.

Moby is an open source container framework.

On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root.

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened.

Billy is an interface filesystem abstraction for Go.

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a sec…

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate.