TI-2026-40198 CVE-2026-55677 · GHSA-vfp3-v2gw-7wfq
Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files
Priority HIGH 72
Echo is a Go web framework.
RHSA-2026:91958
osbuild-composer security update
Released 2026-10-28 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream E4S (v.9.4) osbuild-composer-101.3-4.el9_4.7, osbuild-composer-core-101.3-4.el9_4.7, osbuild-composer-worker-101.3-4.el9_4.7
Fixes 9 records
TI-2026-29801 CVE-2026-41178 · GHSA-5wrp-cwcj-q835
OpenTelemetry-Go's baggage parsing no longer caps raw header length
Priority MEDIUM 63
OpenTelemetry-Go is the Go implementation of OpenTelemetry.
TI-2026-58035 CVE-2026-84445 · GHSA-2v4p-qf9q-27wj
gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers
Priority MEDIUM 45
gRPC-Go is the Go language implementation of gRPC.
TI-2026-69840 CVE-2026-97031 · GHSA-hq7w-2xrq-wp2j
Memory exhaustion in Go crypto/tls via malformed ECH extensions
Priority MEDIUM 40
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references…
TI-2026-69833 CVE-2026-94440 · GHSA-874m-fcc5-9gqf
Memory limit bypass in Go net/textproto and mime/multipart parsing
Priority MEDIUM 40
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.
Priority MEDIUM 40
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
TI-2026-69827 CVE-2026-78667 · GHSA-f4xw-m386-m277
Excessive CPU use in Go net/http when parsing Range headers
Priority MEDIUM 40
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.
TI-2026-30787 CVE-2026-42504 · GHSA-h524-452v-82p9
Quadratic complexity in WordDecoder.DecodeHeader in mime
Priority MEDIUM 40
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
Priority LOW 32
On most platforms, Go uses the given system root certificates.