TI-2026-58035 CVE-2026-84445 · GHSA-2v4p-qf9q-27wj
gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers
Priority MEDIUM 45
gRPC-Go is the Go language implementation of gRPC.
RHSA-2026:91646
osbuild-composer security update
Released 2026-10-28 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) osbuild-composer-134.1-13.el10_0, osbuild-composer-core-134.1-13.el10_0, osbuild-composer-worker-134.1-13.el10_0
Fixes 7 records
TI-2026-69840 CVE-2026-97031 · GHSA-hq7w-2xrq-wp2j
Memory exhaustion in Go crypto/tls via malformed ECH extensions
Priority MEDIUM 40
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references…
TI-2026-69833 CVE-2026-94440 · GHSA-874m-fcc5-9gqf
Memory limit bypass in Go net/textproto and mime/multipart parsing
Priority MEDIUM 40
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.
Priority MEDIUM 40
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
TI-2026-69827 CVE-2026-78667 · GHSA-f4xw-m386-m277
Excessive CPU use in Go net/http when parsing Range headers
Priority MEDIUM 40
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.
Priority LOW 32
On most platforms, Go uses the given system root certificates.
TI-2026-60056 CVE-2026-88031 · GHSA-gf3f-xg7m-h8wp
GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver
Priority LOW 28
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than a…