TI-2026-58035 CVE-2026-84445 · GHSA-2v4p-qf9q-27wj
gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers
Priority MEDIUM 45
gRPC-Go is the Go language implementation of gRPC.
RHSA-2026:91587
osbuild-composer security update
Released 2026-10-28 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream EUS (v.9.6) osbuild-composer-132.2-13.el9_6, osbuild-composer-core-132.2-13.el9_6, osbuild-composer-worker-132.2-13.el9_6
Fixes 7 records
TI-2026-69840 CVE-2026-97031 · GHSA-hq7w-2xrq-wp2j
Memory exhaustion in Go crypto/tls via malformed ECH extensions
Priority MEDIUM 40
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references…
TI-2026-69833 CVE-2026-94440 · GHSA-874m-fcc5-9gqf
Memory limit bypass in Go net/textproto and mime/multipart parsing
Priority MEDIUM 40
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.
Priority MEDIUM 40
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
TI-2026-69827 CVE-2026-78667 · GHSA-f4xw-m386-m277
Excessive CPU use in Go net/http when parsing Range headers
Priority MEDIUM 40
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.
TI-2026-30787 CVE-2026-42504 · GHSA-h524-452v-82p9
Quadratic complexity in WordDecoder.DecodeHeader in mime
Priority MEDIUM 40
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
Priority LOW 32
On most platforms, Go uses the given system root certificates.