RHSA-2026:61314

js-yaml is a JavaScript YAML parser and dumper.

Echo is a Go web framework.

The Delete function fails to properly validate offsets when processing malformed JSON input.

OpenTelemetry-Go is the Go implementation of OpenTelemetry.

OpenTelemetry-Go is the Go implementation of OpenTelemetry.

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation.

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request.

The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag.

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.

spdystream is a Go library for multiplexing streams over SPDY connections.

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs.

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

The RSA and DSA public key parsers did not enforce size limits on key parameters.

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries.

Billy is an interface filesystem abstraction for Go.