Red Hat Security Advisory

RHSA-2026:80764

goose security update

Released 2026-10-12 · Red Hat rating Important · View on Red Hat →

Fixed in

TI-2026-63063 CVE-2026-93599 · GHSA-g42g-9vm4-7gfj

HIGH 77

rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00346 Published 2026-09-18 Partial fix · 0.103.13, 0.104.0-alpha.7 CWE-191

TI-2026-45065 CVE-2026-63127 · GHSA-33f5-2c5q-wgwj

HIGH 69

RMCP is an official Rust SDK for the Model Context Protocol.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00195 Published 2026-09-16 Partial fix · 2.0.0 CWE-345

TI-2026-50953 CVE-2026-72718

HIGH 66

goose is general-purpose AI agent that runs on your machine.

CVSS 4.0HIGH 7.0 Local Low privileges User interaction EPSS 0.00216 Published 2026-08-10 Fixed in 1.44.0 CWE-94

TI-2026-45066 CVE-2026-63128 · GHSA-9pj6-vhgr-3mwh

HIGH 66

RMCP is an official Rust SDK for the Model Context Protocol.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00535 Published 2026-09-16 Partial fix · 2.0.0 CWE-400