TI-2026-29801 CVE-2026-41178 · GHSA-5wrp-cwcj-q835
OpenTelemetry-Go's baggage parsing no longer caps raw header length
Priority MEDIUM 63
OpenTelemetry-Go is the Go implementation of OpenTelemetry.
RHSA-2026:83597
RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release
Released 2026-10-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/fetch-tsa-certs-rhel9, registry.redhat.io/rhtas/gitsign-rhel9 +2
Fixes 5 records
TI-2026-58035 CVE-2026-84445 · GHSA-2v4p-qf9q-27wj
gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers
Priority MEDIUM 45
gRPC-Go is the Go language implementation of gRPC.
TI-2026-51612 CVE-2026-73500 · GHSA-6vch-q96h-7gc3
etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
Priority MEDIUM 44
etcd is a distributed key-value store for the data of a distributed system.
TI-2026-40994 CVE-2026-56854 · GHSA-gjhq-gjfw-99mq
Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
Priority LOW 39
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595.
TI-2026-50128 CVE-2026-71556 · GHSA-hc8v-wwc9-vgxm
go-git: Worktree operations may follow symlinks
Priority LOW 31
go-git is an extensible git implementation library written in pure Go.