From 416b58a60f72f9f845e4b01ada1a98a04e377a26 Mon Sep 17 00:00:00 2001 From: Manjesh Mogallapalli Date: Wed, 19 Aug 2026 14:52:39 -0500 Subject: [PATCH 1/9] 0.2 rc3 tested Signed-off-by: Manjesh Mogallapalli --- packages/nemo_evaluator_sdk/pyproject.toml | 2 +- packages/nemo_platform/pyproject.toml | 6 +- plugins/nemo-agents/pyproject.toml | 6 +- .../nemo_agents_plugin/fabric/translator.py | 10 +- .../tests/unit/test_fabric_translator.py | 107 +- pyproject.toml | 22 +- sdk/python/nemo-platform/pyproject.toml | 2 +- third_party/licenses.jsonl | 7 + third_party/osv-licenses-callouts.json | 4347 ++++--- third_party/osv-licenses-jobs-launcher.json | 861 ++ third_party/osv-licenses.json | 10441 ++++++++-------- third_party/requirements-main.txt | 54 +- uv.lock | 137 +- 13 files changed, 8740 insertions(+), 7262 deletions(-) diff --git a/packages/nemo_evaluator_sdk/pyproject.toml b/packages/nemo_evaluator_sdk/pyproject.toml index 7441fe268f..1b6090838c 100644 --- a/packages/nemo_evaluator_sdk/pyproject.toml +++ b/packages/nemo_evaluator_sdk/pyproject.toml @@ -34,7 +34,7 @@ dependencies = [ "ragas==0.4.3", "langchain-openai>=1.3.5", "langchain-nvidia-ai-endpoints>=1.4.3,<2.0.0", - "nemo-relay>=0.6.0,<0.7", + "nemo-relay>=0.7.2,<0.8", # Fabric's typed config surface (FabricConfig/RuntimeConfig/ModelConfig/the relay models) — what the # agent-eval runtimes compose against. The metapackage alone is ~2 MB / 3 packages; it requires # nemo-fabric-runtime unconditionally as of rc4, which is why the `runtime` extra it used to expose diff --git a/packages/nemo_platform/pyproject.toml b/packages/nemo_platform/pyproject.toml index 89335cf6d3..0bd40676de 100644 --- a/packages/nemo_platform/pyproject.toml +++ b/packages/nemo_platform/pyproject.toml @@ -245,8 +245,8 @@ nemo-agents-plugin = [ "pyyaml>=6.0", "anthropic>=0.88.0", "rich>=13.7.1", - "nemo-fabric[claude,codex,deepagents,relay]>=0.1.0,<0.3.0", - "nemo-fabric-adapters-hermes>=0.1.0,<0.3.0; python_version < '3.14'", + "nemo-fabric[claude,codex,deepagents,relay]>=0.2.0rc3,<0.3.0", + "nemo-fabric-adapters-hermes>=0.2.0rc3,<0.3.0; python_version < '3.14'", ] # Generated from [tool.bundle-package]; do not edit by hand. @@ -326,7 +326,7 @@ nemo-evaluator-sdk = [ "ragas==0.4.3", "langchain-openai>=1.3.5", "langchain-nvidia-ai-endpoints>=1.4.3,<2.0.0", - "nemo-relay>=0.6.0,<0.7", + "nemo-relay>=0.7.2,<0.8", "nemo-fabric>=0.1.1,<0.3.0", ] diff --git a/plugins/nemo-agents/pyproject.toml b/plugins/nemo-agents/pyproject.toml index 61aace2021..fcf5f803a5 100644 --- a/plugins/nemo-agents/pyproject.toml +++ b/plugins/nemo-agents/pyproject.toml @@ -35,13 +35,11 @@ dependencies = [ # improvement/ subpackage — agent-improvement workflow (POC). "anthropic>=0.88.0", "rich>=13.7.1", - # Floor stays at 0.1.0 so published wheels remain PyPI-resolvable (wheelcheck / consumers). - # Workspace uv.sources pins the mid-Aug main SHA (0.2.0 content) until PyPI ships 0.2.0. - "nemo-fabric[claude,codex,deepagents,relay]>=0.1.0,<0.3.0", + "nemo-fabric[claude,codex,deepagents,relay]>=0.2.0rc3,<0.3.0", # TODO(AIRCORE-952): Switch to the metapackage's `hermes-agent` extra once hermes-agent # relaxes its vulnerable exact dependency pins — that extra applies [harness], which # pins requests==2.33.0. - "nemo-fabric-adapters-hermes>=0.1.0,<0.3.0; python_version < '3.14'", + "nemo-fabric-adapters-hermes>=0.2.0rc3,<0.3.0; python_version < '3.14'", ] version = "0.0.0" diff --git a/plugins/nemo-agents/src/nemo_agents_plugin/fabric/translator.py b/plugins/nemo-agents/src/nemo_agents_plugin/fabric/translator.py index e510ad6bc5..2d57b4e8ff 100644 --- a/plugins/nemo-agents/src/nemo_agents_plugin/fabric/translator.py +++ b/plugins/nemo-agents/src/nemo_agents_plugin/fabric/translator.py @@ -6,10 +6,10 @@ from __future__ import annotations import os +from pathlib import Path from typing import Any -# CI type-checks this plugin via ty extra-paths without installing nemo-agents deps. -import nemo_fabric as fabric # ty: ignore[unresolved-import] +import nemo_fabric as fabric from nemo_agents_plugin.agent_config import AgentConfig, HarnessConfig, ModelConfig from nemo_agents_plugin.fabric.gateway_credentials import ( bind_platform_gateway_model_credential, @@ -133,7 +133,9 @@ def _instructions_config(config: AgentConfig) -> Any: def _skills_config(config: AgentConfig) -> Any: if config.skills is None: return None - return fabric.SkillConfig(paths=config.skills.paths) + paths: list[str | Path] = [] + paths.extend(config.skills.paths) + return fabric.SkillConfig(paths=paths) def _mcp_config(config: AgentConfig) -> Any: @@ -168,7 +170,7 @@ def _apply_telemetry(fabric_config: Any, config: AgentConfig, model: ModelConfig def _relay_observability_config(config: AgentConfig, model: ModelConfig) -> dict[str, Any]: telemetry = config.telemetry - observability: dict[str, Any] = {"version": 2} + observability: dict[str, Any] = {"version": 3} if telemetry.atif is not None: atif = dict(telemetry.atif) diff --git a/plugins/nemo-agents/tests/unit/test_fabric_translator.py b/plugins/nemo-agents/tests/unit/test_fabric_translator.py index fe0e3f0ee0..92ae791463 100644 --- a/plugins/nemo-agents/tests/unit/test_fabric_translator.py +++ b/plugins/nemo-agents/tests/unit/test_fabric_translator.py @@ -84,33 +84,49 @@ def test_repository_example_uses_current_codex_and_isolated_hermes_adapters(self deepagents_config = translate_agent_config(config, harness_name="deepagents") hermes_config = translate_agent_config(config, harness_name="hermes") - assert codex_config.harness.adapter_id == "nvidia.fabric.codex" - assert "skip_git_repo_check" not in codex_config.harness.settings - assert claude_config.harness.adapter_id == "nvidia.fabric.claude" - assert claude_config.harness.settings["permission_mode"] == "dontAsk" - assert deepagents_config.harness.adapter_id == "nvidia.fabric.langchain.deepagents" - assert deepagents_config.harness.settings["deepagents"] == {} - assert hermes_config.harness.adapter_id == "nvidia.fabric.hermes" - assert hermes_config.harness.settings["max_tokens"] == 512 + codex_harness = codex_config.harness + claude_harness = claude_config.harness + deepagents_harness = deepagents_config.harness + hermes_harness = hermes_config.harness + assert codex_harness is not None + assert claude_harness is not None + assert deepagents_harness is not None + assert hermes_harness is not None + assert codex_harness.adapter_id == "nvidia.fabric.codex" + assert "skip_git_repo_check" not in codex_harness.settings + assert claude_harness.adapter_id == "nvidia.fabric.claude" + assert claude_harness.settings["permission_mode"] == "dontAsk" + assert deepagents_harness.adapter_id == "nvidia.fabric.langchain.deepagents" + assert deepagents_harness.settings["deepagents"] == {} + assert hermes_harness.adapter_id == "nvidia.fabric.hermes" + assert hermes_harness.settings["max_tokens"] == 512 def test_translates_default_harness(self) -> None: config = AgentConfig.model_validate(_example_yaml_config()) fabric_config = translate_agent_config(config) + harness = fabric_config.harness + instructions = fabric_config.instructions + environment = fabric_config.environment + assert harness is not None + assert instructions is not None + system_instruction = instructions.system + assert system_instruction is not None + assert environment is not None assert fabric_config.metadata.name == "example-agent" assert fabric_config.metadata.description == "Example Agent" - assert fabric_config.harness.adapter_id == "nvidia.fabric.hermes" - assert fabric_config.harness.resolution == "preinstalled" - assert fabric_config.harness.settings["max_tokens"] == 512 - assert fabric_config.instructions.system.content == "You are a concise assistant." - assert fabric_config.instructions.system.mode == "replace" + assert harness.adapter_id == "nvidia.fabric.hermes" + assert harness.resolution == "preinstalled" + assert harness.settings["max_tokens"] == 512 + assert system_instruction.content == "You are a concise assistant." + assert system_instruction.mode == "replace" assert fabric_config.models["default"].provider == "nvidia" assert fabric_config.models["default"].model == "nvidia/nemotron-3-nano-30b-a3b" assert fabric_config.models["default"].base_url == "https://integrate.api.nvidia.com/v1" - assert fabric_config.environment.provider == "local" - assert fabric_config.environment.workspace == "./workspace" - assert fabric_config.environment.artifacts == "./artifacts" + assert environment.provider == "local" + assert environment.workspace == "./workspace" + assert environment.artifacts == "./artifacts" assert fabric_config.relay is None def test_selected_harness_uses_default_model(self, monkeypatch: pytest.MonkeyPatch) -> None: @@ -121,8 +137,12 @@ def test_selected_harness_uses_default_model(self, monkeypatch: pytest.MonkeyPat fabric_config = translate_agent_config(config, harness_name="codex") - assert fabric_config.harness.adapter_id == "nvidia.fabric.codex" - assert fabric_config.harness.settings["sandbox"] == "workspace-write" + harness = fabric_config.harness + environment = fabric_config.environment + assert harness is not None + assert environment is not None + assert harness.adapter_id == "nvidia.fabric.codex" + assert harness.settings["sandbox"] == "workspace-write" assert fabric_config.models["default"].provider == "openai" assert fabric_config.models["default"].model == "openai/gpt-5.4" assert ( @@ -130,7 +150,7 @@ def test_selected_harness_uses_default_model(self, monkeypatch: pytest.MonkeyPat == "http://platform:8080/apis/inference-gateway/v2/workspaces/default/openai/-/v1" ) assert fabric_config.models["default"].api_key_env == PLATFORM_IGW_API_KEY_ENV - assert fabric_config.environment.env == {PLATFORM_IGW_API_KEY_ENV: PLATFORM_IGW_API_KEY_PLACEHOLDER} + assert environment.env == {PLATFORM_IGW_API_KEY_ENV: PLATFORM_IGW_API_KEY_PLACEHOLDER} assert config.models["default"].api_key_env is None def test_forwards_platform_runtime_environment_to_child_tools(self, monkeypatch: pytest.MonkeyPatch) -> None: @@ -141,7 +161,9 @@ def test_forwards_platform_runtime_environment_to_child_tools(self, monkeypatch: fabric_config = translate_agent_config(config, harness_name="codex") - assert fabric_config.environment.env == { + environment = fabric_config.environment + assert environment is not None + assert environment.env == { "NEMO_BASE_URL": "http://command-platform:8080", "NMP_BASE_URL": "http://shared-platform:8080", "NMP_WORKSPACE": "request-workspace", @@ -182,11 +204,17 @@ def test_translates_shared_capability_sections(self) -> None: fabric_config = translate_agent_config(config) - assert fabric_config.skills.paths == ["skills/review"] - assert fabric_config.mcp.servers["repo"].transport == "stdio" - assert fabric_config.mcp.servers["repo"].url == "repo-mcp --root ." - assert fabric_config.mcp.servers["repo"].exposure == "fabric_managed" - assert fabric_config.tools.blocked == ["shell", "browser"] + skills = fabric_config.skills + mcp = fabric_config.mcp + tools = fabric_config.tools + assert skills is not None + assert mcp is not None + assert tools is not None + assert skills.paths == ["skills/review"] + assert mcp.servers["repo"].transport == "stdio" + assert mcp.servers["repo"].url == "repo-mcp --root ." + assert mcp.servers["repo"].exposure == "fabric_managed" + assert tools.blocked == ["shell", "browser"] def test_top_level_prompts_rejected_until_shared_prompt_contract_exists(self) -> None: payload = copy.deepcopy(_example_yaml_config()) @@ -217,7 +245,9 @@ def test_supported_harness_kinds_translate_to_adapter_ids( fabric_config = translate_agent_config(config) - assert fabric_config.harness.adapter_id == adapter_id + harness = fabric_config.harness + assert harness is not None + assert harness.adapter_id == adapter_id def test_unknown_selected_harness_rejected(self) -> None: config = AgentConfig.model_validate(_example_yaml_config()) @@ -250,11 +280,20 @@ def test_relay_telemetry_uses_latest_fabric_shape(self) -> None: fabric_config = translate_agent_config(config) - assert fabric_config.telemetry.providers["relay"].config is None - assert fabric_config.relay.project == "example-agent" - assert fabric_config.relay.output_dir == "./artifacts/relay" - assert fabric_config.relay.observability.model_dump(exclude_none=True) == { - "version": 2, + telemetry = fabric_config.telemetry + assert telemetry is not None + relay_provider = telemetry.providers["relay"] + assert not isinstance(relay_provider, dict) + relay = fabric_config.relay + assert relay is not None + observability = relay.observability + assert observability is not None + assert relay_provider.config is None + assert relay.project == "example-agent" + assert relay.output_dir == "./artifacts/relay" + assert observability.model_dump(exclude_none=True) == { + "version": 3, + "enable_full_payloads": False, "atif": { "enabled": True, "filename_template": "trajectory-{session_id}.atif.json", @@ -292,7 +331,11 @@ def test_relay_atof_endpoint_sinks_translate_to_stream_sinks(self) -> None: fabric_config = translate_agent_config(config) - assert fabric_config.relay.observability.model_dump(exclude_none=True)["atof"]["sinks"] == [ + relay = fabric_config.relay + assert relay is not None + observability = relay.observability + assert observability is not None + assert observability.model_dump(exclude_none=True)["atof"]["sinks"] == [ { "type": "file", "output_directory": "./artifacts/relay", diff --git a/pyproject.toml b/pyproject.toml index 62676be44b..20abf7706f 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -308,6 +308,13 @@ constraint-dependencies = [ "mistune>=3.3.2", "mcp>=1.28.1", "msgpack>=1.2.1", + "nemo-fabric-adapter-contract>=0.2.0rc3,<0.3.0", + "nemo-fabric-adapters-claude>=0.2.0rc3,<0.3.0", + "nemo-fabric-adapters-codex>=0.2.0rc3,<0.3.0", + "nemo-fabric-adapters-common>=0.2.0rc3,<0.3.0", + "nemo-fabric-adapters-deepagents>=0.2.0rc3,<0.3.0", + "nemo-fabric-adapters-hermes>=0.2.0rc3,<0.3.0", + "nemo-fabric-runtime>=0.2.0rc3,<0.3.0", "nbconvert>=7.17.1", "nltk>=3.10.0", "pillow>=12.3.0", @@ -397,21 +404,6 @@ nemo-insights-plugin = { workspace = true } nemo-eval-author-plugin = { workspace = true } nemo-experimentalist-plugin = { workspace = true } -# Temporary until Fabric 0.2.0 publishes (mid-Aug): pin the monorepo SHA that lands -# FABRIC-167 (Hermes MCP discover + preserve mcp.servers.*.env). Override every -# package — git subdirectory sources do not inherit Fabric's own path mappings, -# and the metapackage pins runtime/adapters to ==0.2.0. -# Declared dep floors stay >=0.1.0 so wheelcheck / PyPI installs of the published -# wheel still resolve (uv.sources do not apply outside this workspace). -# Remove these entries once PyPI has 0.2.0. -nemo-fabric = { git = "https://github.com/NVIDIA/NeMo-Fabric.git", rev = "e7353383024523179be6a009ef16dea223bea8c0" } -nemo-fabric-runtime = { git = "https://github.com/NVIDIA/NeMo-Fabric.git", rev = "e7353383024523179be6a009ef16dea223bea8c0", subdirectory = "python" } -nemo-fabric-adapters-common = { git = "https://github.com/NVIDIA/NeMo-Fabric.git", rev = "e7353383024523179be6a009ef16dea223bea8c0", subdirectory = "adapters/common" } -nemo-fabric-adapters-claude = { git = "https://github.com/NVIDIA/NeMo-Fabric.git", rev = "e7353383024523179be6a009ef16dea223bea8c0", subdirectory = "adapters/claude" } -nemo-fabric-adapters-codex = { git = "https://github.com/NVIDIA/NeMo-Fabric.git", rev = "e7353383024523179be6a009ef16dea223bea8c0", subdirectory = "adapters/codex" } -nemo-fabric-adapters-deepagents = { git = "https://github.com/NVIDIA/NeMo-Fabric.git", rev = "e7353383024523179be6a009ef16dea223bea8c0", subdirectory = "adapters/deepagents" } -nemo-fabric-adapters-hermes = { git = "https://github.com/NVIDIA/NeMo-Fabric.git", rev = "e7353383024523179be6a009ef16dea223bea8c0", subdirectory = "adapters/hermes" } - nemo-evaluator-plugin = { workspace = true } nemo-guardrails-plugin = { workspace = true } nemo-auditor-plugin = { workspace = true } diff --git a/sdk/python/nemo-platform/pyproject.toml b/sdk/python/nemo-platform/pyproject.toml index a8abf0ac54..61fbd61f82 100644 --- a/sdk/python/nemo-platform/pyproject.toml +++ b/sdk/python/nemo-platform/pyproject.toml @@ -63,7 +63,7 @@ nemo-evaluator-sdk = [ "ragas==0.4.3", "langchain-openai>=1.3.5", "langchain-nvidia-ai-endpoints>=1.4.3,<2.0.0", - "nemo-relay>=0.6.0,<0.7", + "nemo-relay>=0.7.2,<0.8", "nemo-fabric>=0.1.1,<0.3.0", ] diff --git a/third_party/licenses.jsonl b/third_party/licenses.jsonl index 703400bc46..09a73f6dad 100644 --- a/third_party/licenses.jsonl +++ b/third_party/licenses.jsonl @@ -218,8 +218,15 @@ {"name": "mypy-extensions", "license": "MIT", "compatible": true} {"name": "nemo-anonymizer", "license": "APACHE-2.0", "compatible": true} {"name": "nemo-fabric", "license": "APACHE-2.0", "compatible": true} +{"name": "nemo-fabric-adapter-contract", "license": "APACHE-2.0", "compatible": true} +{"name": "nemo-fabric-adapters-claude", "license": "APACHE-2.0", "compatible": true} +{"name": "nemo-fabric-adapters-codex", "license": "APACHE-2.0", "compatible": true} +{"name": "nemo-fabric-adapters-common", "license": "APACHE-2.0", "compatible": true} +{"name": "nemo-fabric-adapters-deepagents", "license": "APACHE-2.0", "compatible": true} +{"name": "nemo-fabric-adapters-hermes", "license": "APACHE-2.0", "compatible": true} {"name": "nemo-fabric-runtime", "license": "APACHE-2.0", "compatible": true} {"name": "nemo-relay", "license": "APACHE-2.0", "compatible": true} +{"name": "nemo-relay-cli-bin", "license": "APACHE-2.0", "compatible": true} {"name": "nemo-safe-synthesizer", "license": "APACHE-2.0", "compatible": true} {"name": "nemoguardrails", "license": "APACHE-2.0", "compatible": true} {"name": "nest-asyncio", "license": "BSD-3-CLAUSE", "compatible": true} diff --git a/third_party/osv-licenses-callouts.json b/third_party/osv-licenses-callouts.json index 7fa535be3e..a666bdea95 100644 --- a/third_party/osv-licenses-callouts.json +++ b/third_party/osv-licenses-callouts.json @@ -404,72 +404,31 @@ "version": "0.38.0", "ecosystem": "Go" }, - "vulnerabilities": [ + "groups": [ { - "modified": "2026-08-07T10:42:58Z", - "published": "2026-07-14T17:29:56Z", - "schema_version": "1.7.5", - "id": "GO-2026-5970", - "aliases": [ - "CVE-2026-56852" + "ids": [ + "GO-2026-5970" ], - "related": [ - "CGA-jjqc-qfr4-frh9", - "RHSA-2026:40964", - "RHSA-2026:41020", - "RHSA-2026:42083", - "RHSA-2026:42230", - "RHSA-2026:42241", - "RHSA-2026:43015", - "RHSA-2026:43119", - "RHSA-2026:43311", - "RHSA-2026:43554", - "RHSA-2026:43581", - "RHSA-2026:43716", - "RHSA-2026:43797", - "RHSA-2026:43799", - "RHSA-2026:43801", - "RHSA-2026:43803", - "RHSA-2026:43852", - "RHSA-2026:43866", - "RHSA-2026:43873", - "RHSA-2026:43906", - "RHSA-2026:44151", - "RHSA-2026:44152", - "RHSA-2026:44162", - "RHSA-2026:44430", - "RHSA-2026:44451", - "RHSA-2026:44479", - "RHSA-2026:46953", - "RHSA-2026:46960", - "RHSA-2026:46988", - "RHSA-2026:48306", - "RHSA-2026:49317", - "RHSA-2026:49360", - "RHSA-2026:51065" + "aliases": [ + "CVE-2026-56852", + "GO-2026-5970" ], - "summary": "Infinite loop on invalid input in golang.org/x/text", - "details": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.", + "experimental_analysis": { + "GO-2026-5970": { + "called": false, + "unimportant": false + } + }, + "max_severity": "" + } + ], + "licenses": [ + "BSD-3-Clause" + ], + "vulnerabilities": [ + { "affected": [ { - "package": { - "ecosystem": "Go", - "name": "golang.org/x/text", - "purl": "pkg:golang/golang.org/x/text" - }, - "ranges": [ - { - "type": "SEMVER", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "0.39.0" - } - ] - } - ], "database_specific": { "source": "https://vuln.go.dev/ID/GO-2026-5970.json" }, @@ -506,9 +465,43 @@ ] } ] - } + }, + "package": { + "ecosystem": "Go", + "name": "golang.org/x/text", + "purl": "pkg:golang/golang.org/x/text" + }, + "ranges": [ + { + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.39.0" + } + ], + "type": "SEMVER" + } + ] + } + ], + "aliases": [ + "CVE-2026-56852" + ], + "credits": [ + { + "name": "Viky Choi (\"vikychoi\" on GitHub)" } ], + "database_specific": { + "review_status": "REVIEWED", + "url": "https://pkg.go.dev/vuln/GO-2026-5970" + }, + "details": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.", + "id": "GO-2026-5970", + "modified": "2026-08-14T10:42:20.494473428Z", + "published": "2026-07-14T17:29:56Z", "references": [ { "type": "REPORT", @@ -519,32 +512,47 @@ "url": "https://go.dev/cl/794100" } ], - "database_specific": { - "review_status": "REVIEWED", - "url": "https://pkg.go.dev/vuln/GO-2026-5970" - } - } - ], - "groups": [ - { - "ids": [ - "GO-2026-5970" - ], - "aliases": [ - "CVE-2026-56852", - "GO-2026-5970" + "related": [ + "CGA-jjqc-qfr4-frh9", + "RHSA-2026:40964", + "RHSA-2026:41020", + "RHSA-2026:42083", + "RHSA-2026:42230", + "RHSA-2026:42241", + "RHSA-2026:43015", + "RHSA-2026:43119", + "RHSA-2026:43311", + "RHSA-2026:43554", + "RHSA-2026:43581", + "RHSA-2026:43716", + "RHSA-2026:43797", + "RHSA-2026:43799", + "RHSA-2026:43801", + "RHSA-2026:43803", + "RHSA-2026:43852", + "RHSA-2026:43866", + "RHSA-2026:43873", + "RHSA-2026:43906", + "RHSA-2026:44151", + "RHSA-2026:44152", + "RHSA-2026:44162", + "RHSA-2026:44430", + "RHSA-2026:44451", + "RHSA-2026:44479", + "RHSA-2026:46953", + "RHSA-2026:46960", + "RHSA-2026:46988", + "RHSA-2026:48306", + "RHSA-2026:49317", + "RHSA-2026:49360", + "RHSA-2026:51065", + "RHSA-2026:52912", + "RHSA-2026:54364", + "RHSA-2026:54549" ], - "experimental_analysis": { - "GO-2026-5970": { - "called": false, - "unimportant": false - } - }, - "max_severity": "" + "schema_version": "1.8.0", + "summary": "Infinite loop on invalid input in golang.org/x/text" } - ], - "licenses": [ - "BSD-3-Clause" ] }, { @@ -616,103 +624,1084 @@ "version": "1.25.8", "ecosystem": "Go" }, - "vulnerabilities": [ + "groups": [ { - "modified": "2026-08-03T10:45:58Z", - "published": "2026-04-07T22:53:49Z", - "schema_version": "1.7.5", - "id": "GO-2026-4864", + "ids": [ + "GO-2026-4864" + ], "aliases": [ "BIT-golang-2026-32282", - "CVE-2026-32282" - ], - "related": [ - "CGA-3x3m-j3x7-3f6w", - "RHSA-2026:10217", - "RHSA-2026:10219", - "RHSA-2026:10704", - "RHSA-2026:11507", - "RHSA-2026:11514", - "RHSA-2026:11704", - "RHSA-2026:11711", - "RHSA-2026:11712", - "RHSA-2026:11863", - "RHSA-2026:14200", - "RHSA-2026:15980", - "RHSA-2026:16021", - "RHSA-2026:16024", - "RHSA-2026:16101", - "RHSA-2026:16875", - "RHSA-2026:17075", - "RHSA-2026:17084", - "RHSA-2026:18027", - "RHSA-2026:18032", - "RHSA-2026:19132", - "RHSA-2026:19133", - "RHSA-2026:19134", - "RHSA-2026:19135", - "RHSA-2026:19136", - "RHSA-2026:19144", - "RHSA-2026:19156", - "RHSA-2026:19350", - "RHSA-2026:19351", - "RHSA-2026:19352", - "RHSA-2026:19353", - "RHSA-2026:19369", - "RHSA-2026:19450", - "RHSA-2026:19550", - "RHSA-2026:19714", - "RHSA-2026:19715", - "RHSA-2026:19719", - "RHSA-2026:19720", - "RHSA-2026:19721", - "RHSA-2026:19722", - "RHSA-2026:19750", - "RHSA-2026:19839", - "RHSA-2026:20556", - "RHSA-2026:22141", - "RHSA-2026:22326", - "RHSA-2026:22450", - "RHSA-2026:22709", - "RHSA-2026:22713", - "RHSA-2026:22714", - "RHSA-2026:22937", - "RHSA-2026:23228", - "RHSA-2026:24337", - "RHSA-2026:24716", - "RHSA-2026:24761", - "RHSA-2026:24762", - "RHSA-2026:25999", - "RHSA-2026:27076", - "RHSA-2026:27732", - "RHSA-2026:28038", - "RHSA-2026:28046", - "RHSA-2026:28047", - "RHSA-2026:28385", - "RHSA-2026:34365", - "RHSA-2026:34366", - "RHSA-2026:34368", - "RHSA-2026:36796", - "RHSA-2026:39810", - "RHSA-2026:41019", - "RHSA-2026:47712", - "RHSA-2026:47714", - "RHSA-2026:47716", - "RHSA-2026:47719", - "RHSA-2026:47721", - "RHSA-2026:47722", - "RHSA-2026:47910", - "RHSA-2026:48036", - "RHSA-2026:48790", - "RHSA-2026:49509", - "RHSA-2026:49600", - "RHSA-2026:7291", - "RHSA-2026:7385" + "CVE-2026-32282", + "GO-2026-4864" ], - "summary": "TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix", - "details": "On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root.\n\nThe Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.", + "experimental_analysis": { + "GO-2026-4864": { + "called": false, + "unimportant": false + } + }, + "max_severity": "" + }, + { + "ids": [ + "GO-2026-4865" + ], + "aliases": [ + "BIT-golang-2026-32289", + "CVE-2026-32289", + "GO-2026-4865" + ], + "experimental_analysis": { + "GO-2026-4865": { + "called": true, + "unimportant": false + } + }, + "max_severity": "" + }, + { + "ids": [ + "GO-2026-4869" + ], + "aliases": [ + "BIT-golang-2026-32288", + "CVE-2026-32288", + "GO-2026-4869" + ], + "experimental_analysis": { + "GO-2026-4869": { + "called": false, + "unimportant": false + } + }, + "max_severity": "" + }, + { + "ids": [ + "GO-2026-4870" + ], + "aliases": [ + "BIT-golang-2026-32283", + "CVE-2026-32283", + "GO-2026-4870" + ], + "experimental_analysis": { + "GO-2026-4870": { + "called": true, + "unimportant": false + } + }, + "max_severity": "" + }, + { + "ids": [ + "GO-2026-4918" + ], + "aliases": [ + "BIT-golang-2026-33814", + "CVE-2026-33814", + "GO-2026-4918" + ], + "experimental_analysis": { + "GO-2026-4918": { + "called": true, + "unimportant": false + } + }, + "max_severity": "" + }, + { + "ids": [ + "GO-2026-4946" + ], + "aliases": [ + "BIT-golang-2026-32281", + "CVE-2026-32281", + "GO-2026-4946" + ], + "experimental_analysis": { + "GO-2026-4946": { + "called": true, + "unimportant": false + } + }, + "max_severity": "" + }, + { + "ids": [ + "GO-2026-4947" + ], + "aliases": [ + "BIT-golang-2026-32280", + "CVE-2026-32280", + "GO-2026-4947" + ], + "experimental_analysis": { + "GO-2026-4947": { + "called": true, + "unimportant": false + } + }, + "max_severity": "" + }, + { + "ids": [ + "GO-2026-4970" + ], + "aliases": [ + "BIT-golang-2026-39822", + "CVE-2026-39822", + "GO-2026-4970" + ], + "experimental_analysis": { + "GO-2026-4970": { + "called": false, + "unimportant": false + } + }, + "max_severity": "" + }, + { + "ids": [ + "GO-2026-4971" + ], + "aliases": [ + "BIT-golang-2026-39836", + "CVE-2026-39836", + "GO-2026-4971" + ], + "experimental_analysis": { + "GO-2026-4971": { + "called": true, + "unimportant": false + } + }, + "max_severity": "" + }, + { + "ids": [ + "GO-2026-4976" + ], + "aliases": [ + "BIT-golang-2026-39825", + "CVE-2026-39825", + "GO-2026-4976" + ], + "experimental_analysis": { + "GO-2026-4976": { + "called": false, + "unimportant": false + } + }, + "max_severity": "" + }, + { + "ids": [ + "GO-2026-4977" + ], + "aliases": [ + "BIT-golang-2026-42499", + "CVE-2026-42499", + "GO-2026-4977" + ], + "experimental_analysis": { + "GO-2026-4977": { + "called": false, + "unimportant": false + } + }, + "max_severity": "" + }, + { + "ids": [ + "GO-2026-4980" + ], + "aliases": [ + "BIT-golang-2026-39826", + "CVE-2026-39826", + "GO-2026-4980" + ], + "experimental_analysis": { + "GO-2026-4980": { + "called": true, + "unimportant": false + } + }, + "max_severity": "" + }, + { + "ids": [ + "GO-2026-4981" + ], + "aliases": [ + "BIT-golang-2026-33811", + "CVE-2026-33811", + "GO-2026-4981" + ], + "experimental_analysis": { + "GO-2026-4981": { + "called": false, + "unimportant": false + } + }, + "max_severity": "" + }, + { + "ids": [ + "GO-2026-4982" + ], + "aliases": [ + "BIT-golang-2026-39823", + "CVE-2026-39823", + "GO-2026-4982" + ], + "experimental_analysis": { + "GO-2026-4982": { + "called": true, + "unimportant": false + } + }, + "max_severity": "" + }, + { + "ids": [ + "GO-2026-4986" + ], + "aliases": [ + "BIT-golang-2026-39820", + "CVE-2026-39820", + "GO-2026-4986" + ], + "experimental_analysis": { + "GO-2026-4986": { + "called": false, + "unimportant": false + } + }, + "max_severity": "" + }, + { + "ids": [ + "GO-2026-5026" + ], + "aliases": [ + "CVE-2026-39821", + "GO-2026-5026" + ], + "experimental_analysis": { + "GO-2026-5026": { + "called": true, + "unimportant": false + } + }, + "max_severity": "" + }, + { + "ids": [ + "GO-2026-5037" + ], + "aliases": [ + "BIT-golang-2026-27145", + "CVE-2026-27145", + "GO-2026-5037" + ], + "experimental_analysis": { + "GO-2026-5037": { + "called": true, + "unimportant": false + } + }, + "max_severity": "" + }, + { + "ids": [ + "GO-2026-5038" + ], + "aliases": [ + "BIT-golang-2026-42504", + "CVE-2026-42504", + "GO-2026-5038" + ], + "experimental_analysis": { + "GO-2026-5038": { + "called": false, + "unimportant": false + } + }, + "max_severity": "" + }, + { + "ids": [ + "GO-2026-5039" + ], + "aliases": [ + "BIT-golang-2026-42507", + "CVE-2026-42507", + "GO-2026-5039" + ], + "experimental_analysis": { + "GO-2026-5039": { + "called": true, + "unimportant": false + } + }, + "max_severity": "" + }, + { + "ids": [ + "GO-2026-5856" + ], + "aliases": [ + "BIT-golang-2026-42505", + "CVE-2026-42505", + "GO-2026-5856" + ], + "experimental_analysis": { + "GO-2026-5856": { + "called": true, + "unimportant": false + } + }, + "max_severity": "" + }, + { + "ids": [ + "GO-2026-5972" + ], + "aliases": [ + "BIT-golang-2026-33818", + "CVE-2026-33818", + "GO-2026-5972" + ], + "experimental_analysis": { + "GO-2026-5972": { + "called": true, + "unimportant": false + } + }, + "max_severity": "" + }, + { + "ids": [ + "GO-2026-6088" + ], + "aliases": [ + "BIT-golang-2026-56859", + "CVE-2026-56859", + "GO-2026-6088" + ], + "experimental_analysis": { + "GO-2026-6088": { + "called": false, + "unimportant": false + } + }, + "max_severity": "" + }, + { + "ids": [ + "GO-2026-6089" + ], + "aliases": [ + "BIT-golang-2026-56853", + "CVE-2026-56853", + "GO-2026-6089" + ], + "experimental_analysis": { + "GO-2026-6089": { + "called": true, + "unimportant": false + } + }, + "max_severity": "" + }, + { + "ids": [ + "GO-2026-6090" + ], + "aliases": [ + "BIT-golang-2026-56862", + "CVE-2026-56862", + "GO-2026-6090" + ], + "experimental_analysis": { + "GO-2026-6090": { + "called": true, + "unimportant": false + } + }, + "max_severity": "" + }, + { + "ids": [ + "GO-2026-6091" + ], + "aliases": [ + "BIT-golang-2026-56858", + "CVE-2026-56858", + "GO-2026-6091" + ], + "experimental_analysis": { + "GO-2026-6091": { + "called": true, + "unimportant": false + } + }, + "max_severity": "" + }, + { + "ids": [ + "GO-2026-6218" + ], + "aliases": [ + "BIT-golang-2026-56860", + "CVE-2026-56860", + "GO-2026-6218" + ], + "experimental_analysis": { + "GO-2026-6218": { + "called": true, + "unimportant": false + } + }, + "max_severity": "" + } + ], + "licenses": [ + "UNKNOWN" + ], + "vulnerabilities": [ + { + "affected": [ + { + "database_specific": { + "source": "https://vuln.go.dev/ID/GO-2026-4864.json" + }, + "ecosystem_specific": { + "imports": [ + { + "goos": [ + "linux" + ], + "path": "internal/syscall/unix", + "symbols": [ + "Fchmodat" + ] + } + ] + }, + "package": { + "ecosystem": "Go", + "name": "stdlib", + "purl": "pkg:golang/stdlib" + }, + "ranges": [ + { + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.25.9" + }, + { + "introduced": "1.26.0-0" + }, + { + "fixed": "1.26.2" + } + ], + "type": "SEMVER" + } + ] + } + ], + "aliases": [ + "BIT-golang-2026-32282", + "CVE-2026-32282" + ], + "credits": [ + { + "name": "Uuganbayar Lkhamsuren (https://github.com/uug4na)" + } + ], + "database_specific": { + "review_status": "REVIEWED", + "url": "https://pkg.go.dev/vuln/GO-2026-4864" + }, + "details": "On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root.\n\nThe Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.", + "id": "GO-2026-4864", + "modified": "2026-08-14T10:42:12.639761490Z", + "published": "2026-04-07T22:53:49Z", + "references": [ + { + "type": "FIX", + "url": "https://go.dev/cl/763761" + }, + { + "type": "REPORT", + "url": "https://go.dev/issue/78293" + }, + { + "type": "WEB", + "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU" + } + ], + "related": [ + "CGA-3x3m-j3x7-3f6w", + "RHSA-2026:10217", + "RHSA-2026:10219", + "RHSA-2026:10704", + "RHSA-2026:11507", + "RHSA-2026:11514", + "RHSA-2026:11704", + "RHSA-2026:11711", + "RHSA-2026:11712", + "RHSA-2026:11863", + "RHSA-2026:14200", + "RHSA-2026:15980", + "RHSA-2026:16021", + "RHSA-2026:16024", + "RHSA-2026:16101", + "RHSA-2026:16875", + "RHSA-2026:17075", + "RHSA-2026:17084", + "RHSA-2026:18027", + "RHSA-2026:18032", + "RHSA-2026:19132", + "RHSA-2026:19133", + "RHSA-2026:19134", + "RHSA-2026:19135", + "RHSA-2026:19136", + "RHSA-2026:19144", + "RHSA-2026:19156", + "RHSA-2026:19350", + "RHSA-2026:19351", + "RHSA-2026:19352", + "RHSA-2026:19353", + "RHSA-2026:19369", + "RHSA-2026:19450", + "RHSA-2026:19550", + "RHSA-2026:19714", + "RHSA-2026:19715", + "RHSA-2026:19719", + "RHSA-2026:19720", + "RHSA-2026:19721", + "RHSA-2026:19722", + "RHSA-2026:19750", + "RHSA-2026:19839", + "RHSA-2026:20556", + "RHSA-2026:22141", + "RHSA-2026:22326", + "RHSA-2026:22450", + "RHSA-2026:22709", + "RHSA-2026:22713", + "RHSA-2026:22714", + "RHSA-2026:22937", + "RHSA-2026:23228", + "RHSA-2026:24337", + "RHSA-2026:24716", + "RHSA-2026:24761", + "RHSA-2026:24762", + "RHSA-2026:25999", + "RHSA-2026:27076", + "RHSA-2026:27732", + "RHSA-2026:28038", + "RHSA-2026:28046", + "RHSA-2026:28047", + "RHSA-2026:28385", + "RHSA-2026:34365", + "RHSA-2026:34366", + "RHSA-2026:34368", + "RHSA-2026:36796", + "RHSA-2026:39810", + "RHSA-2026:41019", + "RHSA-2026:47712", + "RHSA-2026:47714", + "RHSA-2026:47716", + "RHSA-2026:47719", + "RHSA-2026:47721", + "RHSA-2026:47722", + "RHSA-2026:47910", + "RHSA-2026:48036", + "RHSA-2026:48790", + "RHSA-2026:49509", + "RHSA-2026:49600", + "RHSA-2026:54191", + "RHSA-2026:54757", + "RHSA-2026:7291", + "RHSA-2026:7385" + ], + "schema_version": "1.7.5", + "summary": "TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix" + }, + { + "affected": [ + { + "database_specific": { + "source": "https://vuln.go.dev/ID/GO-2026-4865.json" + }, + "ecosystem_specific": { + "imports": [ + { + "path": "html/template", + "symbols": [ + "Error.Error", + "HTMLEscaper", + "JSEscape", + "JSEscapeString", + "JSEscaper", + "ParseFS", + "ParseFiles", + "ParseGlob", + "Template.AddParseTree", + "Template.Clone", + "Template.DefinedTemplates", + "Template.Execute", + "Template.ExecuteTemplate", + "Template.Funcs", + "Template.Parse", + "Template.ParseFS", + "Template.ParseFiles", + "Template.ParseGlob", + "URLQueryEscaper", + "context.String", + "context.mangle", + "escaper.escapeBranch" + ] + } + ] + }, + "package": { + "ecosystem": "Go", + "name": "stdlib", + "purl": "pkg:golang/stdlib" + }, + "ranges": [ + { + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.25.9" + }, + { + "introduced": "1.26.0-0" + }, + { + "fixed": "1.26.2" + } + ], + "type": "SEMVER" + } + ] + } + ], + "aliases": [ + "BIT-golang-2026-32289", + "CVE-2026-32289" + ], + "database_specific": { + "review_status": "REVIEWED", + "url": "https://pkg.go.dev/vuln/GO-2026-4865" + }, + "details": "Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied.\n\nThese issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.", + "id": "GO-2026-4865", + "modified": "2026-07-10T10:44:23.724783758Z", + "published": "2026-04-07T22:53:49Z", + "references": [ + { + "type": "FIX", + "url": "https://go.dev/cl/763762" + }, + { + "type": "REPORT", + "url": "https://go.dev/issue/78331" + }, + { + "type": "WEB", + "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU" + } + ], + "related": [ + "CGA-w5jp-g3cv-wvfm", + "RHSA-2026:19181", + "RHSA-2026:7291", + "RHSA-2026:7385" + ], + "schema_version": "1.7.5", + "summary": "JsBraceDepth Context Tracking Bugs (XSS) in html/template" + }, + { + "affected": [ + { + "database_specific": { + "source": "https://vuln.go.dev/ID/GO-2026-4869.json" + }, + "ecosystem_specific": { + "imports": [ + { + "path": "archive/tar", + "symbols": [ + "Reader.Next", + "Reader.readOldGNUSparseMap", + "readGNUSparseMap1x0" + ] + } + ] + }, + "package": { + "ecosystem": "Go", + "name": "stdlib", + "purl": "pkg:golang/stdlib" + }, + "ranges": [ + { + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.25.9" + }, + { + "introduced": "1.26.0-0" + }, + { + "fixed": "1.26.2" + } + ], + "type": "SEMVER" + } + ] + } + ], + "aliases": [ + "BIT-golang-2026-32288", + "CVE-2026-32288" + ], + "credits": [ + { + "name": "Colin Walters (walters@verbum.org)" + }, + { + "name": "Uuganbayar Lkhamsuren (https://github.com/uug4na)" + }, + { + "name": "Jakub Ciolek" + } + ], + "database_specific": { + "review_status": "REVIEWED", + "url": "https://pkg.go.dev/vuln/GO-2026-4869" + }, + "details": "tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the \"old GNU sparse map\" format.", + "id": "GO-2026-4869", + "modified": "2026-05-15T10:59:23.054049848Z", + "published": "2026-04-07T22:53:49Z", + "references": [ + { + "type": "FIX", + "url": "https://go.dev/cl/763766" + }, + { + "type": "REPORT", + "url": "https://go.dev/issue/78301" + }, + { + "type": "WEB", + "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU" + } + ], + "related": [ + "CGA-6f85-jvrm-qq3w", + "RHSA-2026:7291", + "RHSA-2026:7385" + ], + "schema_version": "1.7.5", + "summary": "Unbounded allocation for old GNU sparse in archive/tar" + }, + { + "affected": [ + { + "database_specific": { + "source": "https://vuln.go.dev/ID/GO-2026-4870.json" + }, + "ecosystem_specific": { + "imports": [ + { + "path": "crypto/tls", + "symbols": [ + "Conn.Handshake", + "Conn.HandshakeContext", + "Conn.Read", + "Conn.Write", + "Conn.handleKeyUpdate", + "Dial", + "DialWithDialer", + "Dialer.Dial", + "Dialer.DialContext", + "QUICConn.HandleData", + "QUICConn.Start", + "clientHandshakeStateTLS13.establishHandshakeKeys", + "clientHandshakeStateTLS13.readServerFinished", + "serverHandshakeStateTLS13.readClientFinished", + "serverHandshakeStateTLS13.sendServerParameters" + ] + } + ] + }, + "package": { + "ecosystem": "Go", + "name": "stdlib", + "purl": "pkg:golang/stdlib" + }, + "ranges": [ + { + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.25.9" + }, + { + "introduced": "1.26.0-0" + }, + { + "fixed": "1.26.2" + } + ], + "type": "SEMVER" + } + ] + } + ], + "aliases": [ + "BIT-golang-2026-32283", + "CVE-2026-32283" + ], + "credits": [ + { + "name": "Jakub Ciolek - https://ciolek.dev/" + } + ], + "database_specific": { + "review_status": "REVIEWED", + "url": "https://pkg.go.dev/vuln/GO-2026-4870" + }, + "details": "If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service.\n\nThis only affects TLS 1.3.", + "id": "GO-2026-4870", + "modified": "2026-08-18T10:44:11.352332310Z", + "published": "2026-04-07T22:53:49Z", + "references": [ + { + "type": "FIX", + "url": "https://go.dev/cl/763767" + }, + { + "type": "REPORT", + "url": "https://go.dev/issue/78334" + }, + { + "type": "WEB", + "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU" + } + ], + "related": [ + "CGA-w7vv-7vph-696h", + "RHSA-2026:10217", + "RHSA-2026:10219", + "RHSA-2026:10704", + "RHSA-2026:11507", + "RHSA-2026:11514", + "RHSA-2026:11704", + "RHSA-2026:11711", + "RHSA-2026:11712", + "RHSA-2026:11863", + "RHSA-2026:11881", + "RHSA-2026:14200", + "RHSA-2026:15980", + "RHSA-2026:16021", + "RHSA-2026:16024", + "RHSA-2026:16101", + "RHSA-2026:16102", + "RHSA-2026:16875", + "RHSA-2026:17075", + "RHSA-2026:17084", + "RHSA-2026:17287", + "RHSA-2026:18027", + "RHSA-2026:18032", + "RHSA-2026:19126", + "RHSA-2026:19132", + "RHSA-2026:19133", + "RHSA-2026:19134", + "RHSA-2026:19135", + "RHSA-2026:19136", + "RHSA-2026:19137", + "RHSA-2026:19139", + "RHSA-2026:19144", + "RHSA-2026:19156", + "RHSA-2026:19350", + "RHSA-2026:19351", + "RHSA-2026:19352", + "RHSA-2026:19353", + "RHSA-2026:19369", + "RHSA-2026:19450", + "RHSA-2026:19550", + "RHSA-2026:19634", + "RHSA-2026:19714", + "RHSA-2026:19715", + "RHSA-2026:19719", + "RHSA-2026:19720", + "RHSA-2026:19721", + "RHSA-2026:19722", + "RHSA-2026:19750", + "RHSA-2026:19839", + "RHSA-2026:20556", + "RHSA-2026:20569", + "RHSA-2026:20570", + "RHSA-2026:20571", + "RHSA-2026:20607", + "RHSA-2026:20608", + "RHSA-2026:20609", + "RHSA-2026:22450", + "RHSA-2026:22709", + "RHSA-2026:22713", + "RHSA-2026:22714", + "RHSA-2026:22937", + "RHSA-2026:23102", + "RHSA-2026:23103", + "RHSA-2026:23228", + "RHSA-2026:24337", + "RHSA-2026:24470", + "RHSA-2026:24761", + "RHSA-2026:24762", + "RHSA-2026:25248", + "RHSA-2026:25250", + "RHSA-2026:25251", + "RHSA-2026:25252", + "RHSA-2026:26447", + "RHSA-2026:27076", + "RHSA-2026:28038", + "RHSA-2026:28047", + "RHSA-2026:28074", + "RHSA-2026:29035", + "RHSA-2026:29195", + "RHSA-2026:29455", + "RHSA-2026:29703", + "RHSA-2026:33722", + "RHSA-2026:34192", + "RHSA-2026:34196", + "RHSA-2026:34197", + "RHSA-2026:34365", + "RHSA-2026:36796", + "RHSA-2026:39810", + "RHSA-2026:41019", + "RHSA-2026:47712", + "RHSA-2026:47714", + "RHSA-2026:47716", + "RHSA-2026:47719", + "RHSA-2026:47721", + "RHSA-2026:47722", + "RHSA-2026:47910", + "RHSA-2026:48036", + "RHSA-2026:48790", + "RHSA-2026:49509", + "RHSA-2026:49600", + "RHSA-2026:49944", + "RHSA-2026:51288", + "RHSA-2026:54191", + "RHSA-2026:54757", + "RHSA-2026:7291", + "RHSA-2026:7385" + ], + "schema_version": "1.7.5", + "summary": "Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls" + }, + { "affected": [ { + "database_specific": { + "source": "https://vuln.go.dev/ID/GO-2026-4918.json" + }, + "ecosystem_specific": { + "imports": [ + { + "path": "golang.org/x/net/http2", + "symbols": [ + "Transport.NewClientConn", + "Transport.RoundTrip", + "Transport.RoundTripOpt", + "clientConnPool.GetClientConn", + "clientConnReadLoop.processSettingsNoWrite", + "noDialClientConnPool.GetClientConn", + "noDialH2RoundTripper.NewClientConn", + "noDialH2RoundTripper.RoundTrip", + "unencryptedTransport.RoundTrip" + ] + } + ] + }, + "package": { + "ecosystem": "Go", + "name": "golang.org/x/net", + "purl": "pkg:golang/golang.org/x/net" + }, + "ranges": [ + { + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.53.0" + } + ], + "type": "SEMVER" + } + ] + }, + { + "database_specific": { + "source": "https://vuln.go.dev/ID/GO-2026-4918.json" + }, + "ecosystem_specific": { + "imports": [ + { + "path": "net/http", + "symbols": [ + "Client.CloseIdleConnections", + "Client.Do", + "Client.Get", + "Client.Head", + "Client.Post", + "Client.PostForm", + "ClientConn.Close", + "ClientConn.RoundTrip", + "Get", + "Head", + "Post", + "PostForm", + "Transport.CloseIdleConnections", + "Transport.NewClientConn", + "Transport.RoundTrip", + "http1ClientConn.Close", + "http1ClientConn.RoundTrip", + "http2Transport.NewClientConn", + "http2Transport.RoundTrip", + "http2Transport.RoundTripOpt", + "http2clientConnPool.GetClientConn", + "http2clientConnReadLoop.processSettingsNoWrite", + "http2noDialClientConnPool.GetClientConn", + "http2noDialH2RoundTripper.NewClientConn", + "http2noDialH2RoundTripper.RoundTrip", + "http2unencryptedTransport.RoundTrip" + ] + } + ] + }, "package": { "ecosystem": "Go", "name": "stdlib", @@ -720,84 +1709,85 @@ }, "ranges": [ { - "type": "SEMVER", "events": [ { "introduced": "0" }, { - "fixed": "1.25.9" + "fixed": "1.25.10" }, { "introduced": "1.26.0-0" }, { - "fixed": "1.26.2" + "fixed": "1.26.3" } - ] + ], + "type": "SEMVER" } - ], - "database_specific": { - "source": "https://vuln.go.dev/ID/GO-2026-4864.json" - }, - "ecosystem_specific": { - "imports": [ - { - "goos": [ - "linux" - ], - "path": "internal/syscall/unix", - "symbols": [ - "Fchmodat" - ] - } - ] - } + ] + } + ], + "aliases": [ + "BIT-golang-2026-33814", + "CVE-2026-33814" + ], + "credits": [ + { + "name": "Marwan Atia (marwansamir688@gmail.com)" } ], + "database_specific": { + "review_status": "REVIEWED", + "url": "https://pkg.go.dev/vuln/GO-2026-4918" + }, + "details": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.", + "id": "GO-2026-4918", + "modified": "2026-06-27T10:44:20.771417746Z", + "published": "2026-05-07T19:21:40Z", "references": [ { "type": "FIX", - "url": "https://go.dev/cl/763761" + "url": "https://go.dev/cl/761581" + }, + { + "type": "FIX", + "url": "https://go.dev/cl/761640" }, { "type": "REPORT", - "url": "https://go.dev/issue/78293" + "url": "https://go.dev/issue/78476" }, { "type": "WEB", - "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU" + "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M" } ], - "credits": [ - { - "name": "Uuganbayar Lkhamsuren (https://github.com/uug4na)" - } + "related": [ + "CGA-v7v4-9r6p-x7fc", + "RHSA-2026:23262", + "RHSA-2026:23264" ], - "database_specific": { - "review_status": "REVIEWED", - "url": "https://pkg.go.dev/vuln/GO-2026-4864" - } + "schema_version": "1.7.5", + "summary": "Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net" }, { - "modified": "2026-07-10T10:44:23Z", - "published": "2026-04-07T22:53:49Z", - "schema_version": "1.7.5", - "id": "GO-2026-4865", - "aliases": [ - "BIT-golang-2026-32289", - "CVE-2026-32289" - ], - "related": [ - "CGA-w5jp-g3cv-wvfm", - "RHSA-2026:19181", - "RHSA-2026:7291", - "RHSA-2026:7385" - ], - "summary": "JsBraceDepth Context Tracking Bugs (XSS) in html/template", - "details": "Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied.\n\nThese issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.", "affected": [ { + "database_specific": { + "source": "https://vuln.go.dev/ID/GO-2026-4946.json" + }, + "ecosystem_specific": { + "imports": [ + { + "path": "crypto/x509", + "symbols": [ + "Certificate.Verify", + "policiesValid" + ] + } + ] + }, "package": { "ecosystem": "Go", "name": "stdlib", @@ -805,7 +1795,6 @@ }, "ranges": [ { - "type": "SEMVER", "events": [ { "introduced": "0" @@ -819,82 +1808,138 @@ { "fixed": "1.26.2" } - ] + ], + "type": "SEMVER" } - ], - "database_specific": { - "source": "https://vuln.go.dev/ID/GO-2026-4865.json" - }, - "ecosystem_specific": { - "imports": [ - { - "path": "html/template", - "symbols": [ - "Error.Error", - "HTMLEscaper", - "JSEscape", - "JSEscapeString", - "JSEscaper", - "ParseFS", - "ParseFiles", - "ParseGlob", - "Template.AddParseTree", - "Template.Clone", - "Template.DefinedTemplates", - "Template.Execute", - "Template.ExecuteTemplate", - "Template.Funcs", - "Template.Parse", - "Template.ParseFS", - "Template.ParseFiles", - "Template.ParseGlob", - "URLQueryEscaper", - "context.String", - "context.mangle", - "escaper.escapeBranch" - ] - } - ] - } + ] + } + ], + "aliases": [ + "BIT-golang-2026-32281", + "CVE-2026-32281" + ], + "credits": [ + { + "name": "Jakub Ciolek - https://ciolek.dev" } ], + "database_specific": { + "review_status": "REVIEWED", + "url": "https://pkg.go.dev/vuln/GO-2026-4946" + }, + "details": "Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.\n\nThis only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.", + "id": "GO-2026-4946", + "modified": "2026-08-18T10:44:11.281425070Z", + "published": "2026-04-07T22:53:49Z", "references": [ { "type": "FIX", - "url": "https://go.dev/cl/763762" + "url": "https://go.dev/cl/758061" }, { "type": "REPORT", - "url": "https://go.dev/issue/78331" + "url": "https://go.dev/issue/78281" }, { "type": "WEB", "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU" } ], - "database_specific": { - "review_status": "REVIEWED", - "url": "https://pkg.go.dev/vuln/GO-2026-4865" - } - }, - { - "modified": "2026-05-15T10:59:23Z", - "published": "2026-04-07T22:53:49Z", - "schema_version": "1.7.5", - "id": "GO-2026-4869", - "aliases": [ - "BIT-golang-2026-32288", - "CVE-2026-32288" - ], "related": [ - "CGA-6f85-jvrm-qq3w", + "CGA-mhq6-cw97-rcc6", + "RHSA-2026:10217", + "RHSA-2026:10219", + "RHSA-2026:16021", + "RHSA-2026:16024", + "RHSA-2026:16101", + "RHSA-2026:17287", + "RHSA-2026:18027", + "RHSA-2026:18032", + "RHSA-2026:19135", + "RHSA-2026:19353", + "RHSA-2026:19450", + "RHSA-2026:19719", + "RHSA-2026:19720", + "RHSA-2026:19721", + "RHSA-2026:19839", + "RHSA-2026:20556", + "RHSA-2026:20569", + "RHSA-2026:20570", + "RHSA-2026:20571", + "RHSA-2026:20607", + "RHSA-2026:20608", + "RHSA-2026:20609", + "RHSA-2026:22141", + "RHSA-2026:22309", + "RHSA-2026:22713", + "RHSA-2026:23102", + "RHSA-2026:23103", + "RHSA-2026:24337", + "RHSA-2026:24470", + "RHSA-2026:24716", + "RHSA-2026:25248", + "RHSA-2026:25250", + "RHSA-2026:25251", + "RHSA-2026:25252", + "RHSA-2026:26054", + "RHSA-2026:26447", + "RHSA-2026:27076", + "RHSA-2026:27711", + "RHSA-2026:27740", + "RHSA-2026:28074", + "RHSA-2026:29035", + "RHSA-2026:29195", + "RHSA-2026:29455", + "RHSA-2026:29702", + "RHSA-2026:29703", + "RHSA-2026:33722", + "RHSA-2026:34192", + "RHSA-2026:34196", + "RHSA-2026:34197", + "RHSA-2026:34365", + "RHSA-2026:36796", + "RHSA-2026:39810", + "RHSA-2026:41019", + "RHSA-2026:42078", + "RHSA-2026:42079", + "RHSA-2026:47712", + "RHSA-2026:47714", + "RHSA-2026:47716", + "RHSA-2026:47719", + "RHSA-2026:47721", + "RHSA-2026:47722", + "RHSA-2026:47910", + "RHSA-2026:48036", + "RHSA-2026:49509", + "RHSA-2026:49526", + "RHSA-2026:49600", + "RHSA-2026:49838", + "RHSA-2026:49944", + "RHSA-2026:51288", + "RHSA-2026:54757", "RHSA-2026:7291", "RHSA-2026:7385" ], - "summary": "Unbounded allocation for old GNU sparse in archive/tar", - "details": "tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the \"old GNU sparse map\" format.", + "schema_version": "1.7.5", + "summary": "Inefficient policy validation in crypto/x509" + }, + { "affected": [ { + "database_specific": { + "source": "https://vuln.go.dev/ID/GO-2026-4947.json" + }, + "ecosystem_specific": { + "imports": [ + { + "path": "crypto/x509", + "symbols": [ + "Certificate.Verify", + "Certificate.buildChains" + ] + } + ] + }, "package": { "ecosystem": "Go", "name": "stdlib", @@ -902,7 +1947,6 @@ }, "ranges": [ { - "type": "SEMVER", "events": [ { "introduced": "0" @@ -916,104 +1960,65 @@ { "fixed": "1.26.2" } - ] + ], + "type": "SEMVER" } - ], - "database_specific": { - "source": "https://vuln.go.dev/ID/GO-2026-4869.json" - }, - "ecosystem_specific": { - "imports": [ - { - "path": "archive/tar", - "symbols": [ - "Reader.Next", - "Reader.readOldGNUSparseMap", - "readGNUSparseMap1x0" - ] - } - ] - } + ] + } + ], + "aliases": [ + "BIT-golang-2026-32280", + "CVE-2026-32280" + ], + "credits": [ + { + "name": "Jakub Ciolek - https://ciolek.dev" } ], + "database_specific": { + "review_status": "REVIEWED", + "url": "https://pkg.go.dev/vuln/GO-2026-4947" + }, + "details": "During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.", + "id": "GO-2026-4947", + "modified": "2026-08-18T10:44:11.213360963Z", + "published": "2026-04-07T22:53:49Z", "references": [ { "type": "FIX", - "url": "https://go.dev/cl/763766" + "url": "https://go.dev/cl/758320" }, { "type": "REPORT", - "url": "https://go.dev/issue/78301" + "url": "https://go.dev/issue/78282" }, { "type": "WEB", "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU" } ], - "credits": [ - { - "name": "Colin Walters (walters@verbum.org)" - }, - { - "name": "Uuganbayar Lkhamsuren (https://github.com/uug4na)" - }, - { - "name": "Jakub Ciolek" - } - ], - "database_specific": { - "review_status": "REVIEWED", - "url": "https://pkg.go.dev/vuln/GO-2026-4869" - } - }, - { - "modified": "2026-08-07T10:42:58Z", - "published": "2026-04-07T22:53:49Z", - "schema_version": "1.7.5", - "id": "GO-2026-4870", - "aliases": [ - "BIT-golang-2026-32283", - "CVE-2026-32283" - ], "related": [ - "CGA-w7vv-7vph-696h", + "CGA-crmm-287q-6v8j", "RHSA-2026:10217", "RHSA-2026:10219", "RHSA-2026:10704", "RHSA-2026:11507", "RHSA-2026:11514", - "RHSA-2026:11704", - "RHSA-2026:11711", - "RHSA-2026:11712", - "RHSA-2026:11863", - "RHSA-2026:11881", "RHSA-2026:14200", "RHSA-2026:15980", "RHSA-2026:16021", "RHSA-2026:16024", "RHSA-2026:16101", - "RHSA-2026:16102", "RHSA-2026:16875", - "RHSA-2026:17075", "RHSA-2026:17084", "RHSA-2026:17287", "RHSA-2026:18027", "RHSA-2026:18032", - "RHSA-2026:19126", - "RHSA-2026:19132", "RHSA-2026:19133", - "RHSA-2026:19134", "RHSA-2026:19135", - "RHSA-2026:19136", - "RHSA-2026:19137", - "RHSA-2026:19139", "RHSA-2026:19144", - "RHSA-2026:19156", "RHSA-2026:19350", - "RHSA-2026:19351", - "RHSA-2026:19352", "RHSA-2026:19353", - "RHSA-2026:19369", "RHSA-2026:19450", "RHSA-2026:19550", "RHSA-2026:19634", @@ -1032,28 +2037,40 @@ "RHSA-2026:20607", "RHSA-2026:20608", "RHSA-2026:20609", - "RHSA-2026:22450", + "RHSA-2026:21655", + "RHSA-2026:22130", + "RHSA-2026:22141", + "RHSA-2026:22309", "RHSA-2026:22709", "RHSA-2026:22713", - "RHSA-2026:22714", - "RHSA-2026:22937", "RHSA-2026:23102", "RHSA-2026:23103", - "RHSA-2026:23228", + "RHSA-2026:23244", "RHSA-2026:24337", "RHSA-2026:24470", + "RHSA-2026:24716", "RHSA-2026:24761", "RHSA-2026:24762", + "RHSA-2026:25180", + "RHSA-2026:25248", + "RHSA-2026:25250", + "RHSA-2026:25251", + "RHSA-2026:25252", + "RHSA-2026:25253", "RHSA-2026:26447", "RHSA-2026:27076", "RHSA-2026:28038", "RHSA-2026:28047", "RHSA-2026:28074", + "RHSA-2026:28886", + "RHSA-2026:28961", "RHSA-2026:29035", "RHSA-2026:29195", "RHSA-2026:29455", + "RHSA-2026:29702", "RHSA-2026:29703", "RHSA-2026:33722", + "RHSA-2026:34097", "RHSA-2026:34192", "RHSA-2026:34196", "RHSA-2026:34197", @@ -1071,16 +2088,174 @@ "RHSA-2026:48036", "RHSA-2026:48790", "RHSA-2026:49509", + "RHSA-2026:49526", "RHSA-2026:49600", + "RHSA-2026:49838", "RHSA-2026:49944", "RHSA-2026:51288", - "RHSA-2026:7291", - "RHSA-2026:7385" + "RHSA-2026:54191", + "RHSA-2026:54757" ], - "summary": "Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls", - "details": "If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service.\n\nThis only affects TLS 1.3.", + "schema_version": "1.7.5", + "summary": "Unexpected work during chain building in crypto/x509" + }, + { + "affected": [ + { + "database_specific": { + "source": "https://vuln.go.dev/ID/GO-2026-4970.json" + }, + "ecosystem_specific": { + "imports": [ + { + "path": "os", + "symbols": [ + "OpenInRoot", + "Root.Create", + "Root.Open", + "Root.OpenFile", + "Root.OpenRoot", + "Root.ReadFile", + "Root.WriteFile", + "openRootInRoot", + "rootFS.Open", + "rootFS.ReadDir", + "rootFS.ReadFile", + "rootOpenFileNolog" + ] + } + ] + }, + "package": { + "ecosystem": "Go", + "name": "stdlib", + "purl": "pkg:golang/stdlib" + }, + "ranges": [ + { + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.25.12" + }, + { + "introduced": "1.26.0-0" + }, + { + "fixed": "1.26.5" + }, + { + "introduced": "1.27.0-0" + }, + { + "fixed": "1.27.0-rc.2" + } + ], + "type": "SEMVER" + } + ] + } + ], + "aliases": [ + "BIT-golang-2026-39822", + "CVE-2026-39822" + ], + "credits": [ + { + "name": "Mundur (https://github.com/M0nd0R)" + } + ], + "database_specific": { + "review_status": "REVIEWED", + "url": "https://pkg.go.dev/vuln/GO-2026-4970" + }, + "details": "On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.\n\nFor example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root.", + "id": "GO-2026-4970", + "modified": "2026-07-16T10:29:37.935192329Z", + "published": "2026-07-07T21:34:47Z", + "references": [ + { + "type": "REPORT", + "url": "https://go.dev/issue/79005" + }, + { + "type": "WEB", + "url": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc" + }, + { + "type": "FIX", + "url": "https://go.dev/cl/797880" + } + ], + "related": [ + "CGA-8r5h-83c2-4rxw", + "RHSA-2026:36477", + "RHSA-2026:36510", + "RHSA-2026:37435", + "RHSA-2026:37436", + "RHSA-2026:38493", + "RHSA-2026:38494", + "RHSA-2026:38495", + "RHSA-2026:38878", + "RHSA-2026:38995" + ], + "schema_version": "1.7.5", + "summary": "Root escape via symlink plus trailing slash in os" + }, + { "affected": [ { + "database_specific": { + "source": "https://vuln.go.dev/ID/GO-2026-4971.json" + }, + "ecosystem_specific": { + "imports": [ + { + "path": "net", + "symbols": [ + "Dial", + "DialTimeout", + "Dialer.Dial", + "Dialer.DialContext", + "Listen", + "ListenConfig.Listen", + "ListenConfig.ListenPacket", + "ListenPacket", + "LookupAddr", + "LookupCNAME", + "LookupHost", + "LookupIP", + "LookupMX", + "LookupNS", + "LookupPort", + "LookupSRV", + "LookupTXT", + "ResolveIPAddr", + "ResolveTCPAddr", + "ResolveUDPAddr", + "Resolver.LookupAddr", + "Resolver.LookupCNAME", + "Resolver.LookupHost", + "Resolver.LookupIP", + "Resolver.LookupIPAddr", + "Resolver.LookupMX", + "Resolver.LookupNS", + "Resolver.LookupNetIP", + "Resolver.LookupPort", + "Resolver.LookupSRV", + "Resolver.LookupTXT", + "Resolver.lookupAddr", + "Resolver.lookupMX", + "Resolver.lookupNS", + "Resolver.lookupPort", + "Resolver.lookupSRV", + "Resolver.lookupTXT" + ] + } + ] + }, "package": { "ecosystem": "Go", "name": "stdlib", @@ -1088,135 +2263,76 @@ }, "ranges": [ { - "type": "SEMVER", "events": [ { "introduced": "0" }, { - "fixed": "1.25.9" + "fixed": "1.25.10" }, { "introduced": "1.26.0-0" }, { - "fixed": "1.26.2" + "fixed": "1.26.3" } - ] + ], + "type": "SEMVER" } - ], - "database_specific": { - "source": "https://vuln.go.dev/ID/GO-2026-4870.json" - }, - "ecosystem_specific": { - "imports": [ - { - "path": "crypto/tls", - "symbols": [ - "Conn.Handshake", - "Conn.HandshakeContext", - "Conn.Read", - "Conn.Write", - "Conn.handleKeyUpdate", - "Dial", - "DialWithDialer", - "Dialer.Dial", - "Dialer.DialContext", - "QUICConn.HandleData", - "QUICConn.Start", - "clientHandshakeStateTLS13.establishHandshakeKeys", - "clientHandshakeStateTLS13.readServerFinished", - "serverHandshakeStateTLS13.readClientFinished", - "serverHandshakeStateTLS13.sendServerParameters" - ] - } - ] - } + ] } ], + "aliases": [ + "BIT-golang-2026-39836", + "CVE-2026-39836" + ], + "database_specific": { + "review_status": "REVIEWED", + "url": "https://pkg.go.dev/vuln/GO-2026-4971" + }, + "details": "The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).", + "id": "GO-2026-4971", + "modified": "2026-08-01T10:44:51.653864484Z", + "published": "2026-05-07T19:21:40Z", "references": [ - { - "type": "FIX", - "url": "https://go.dev/cl/763767" - }, { "type": "REPORT", - "url": "https://go.dev/issue/78334" + "url": "https://go.dev/issue/79006" }, { "type": "WEB", - "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU" - } - ], - "credits": [ + "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M" + }, { - "name": "Jakub Ciolek - https://ciolek.dev/" + "type": "FIX", + "url": "https://go.dev/cl/775320" } ], - "database_specific": { - "review_status": "REVIEWED", - "url": "https://pkg.go.dev/vuln/GO-2026-4870" - } - }, - { - "modified": "2026-06-27T10:44:20Z", - "published": "2026-05-07T19:21:40Z", - "schema_version": "1.7.5", - "id": "GO-2026-4918", - "aliases": [ - "BIT-golang-2026-33814", - "CVE-2026-33814" - ], "related": [ - "CGA-v7v4-9r6p-x7fc", + "CGA-g4vf-wmcj-mwwf", "RHSA-2026:23262", "RHSA-2026:23264" ], - "summary": "Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net", - "details": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.", + "schema_version": "1.7.5", + "summary": "Panic in Dial and LookupPort when handling NUL byte on Windows in net" + }, + { "affected": [ { - "package": { - "ecosystem": "Go", - "name": "golang.org/x/net", - "purl": "pkg:golang/golang.org/x/net" - }, - "ranges": [ - { - "type": "SEMVER", - "events": [ - { - "introduced": "0" - }, - { - "fixed": "0.53.0" - } - ] - } - ], "database_specific": { - "source": "https://vuln.go.dev/ID/GO-2026-4918.json" + "source": "https://vuln.go.dev/ID/GO-2026-4976.json" }, "ecosystem_specific": { "imports": [ { - "path": "golang.org/x/net/http2", + "path": "net/http/httputil", "symbols": [ - "Transport.NewClientConn", - "Transport.RoundTrip", - "Transport.RoundTripOpt", - "clientConnPool.GetClientConn", - "clientConnReadLoop.processSettingsNoWrite", - "noDialClientConnPool.GetClientConn", - "noDialH2RoundTripper.NewClientConn", - "noDialH2RoundTripper.RoundTrip", - "unencryptedTransport.RoundTrip" + "ReverseProxy.ServeHTTP", + "cleanQueryParams" ] } ] - } - }, - { + }, "package": { "ecosystem": "Go", "name": "stdlib", @@ -1224,7 +2340,6 @@ }, "ranges": [ { - "type": "SEMVER", "events": [ { "introduced": "0" @@ -1238,156 +2353,67 @@ { "fixed": "1.26.3" } - ] + ], + "type": "SEMVER" } - ], - "database_specific": { - "source": "https://vuln.go.dev/ID/GO-2026-4918.json" - }, - "ecosystem_specific": { - "imports": [ - { - "path": "net/http", - "symbols": [ - "Client.CloseIdleConnections", - "Client.Do", - "Client.Get", - "Client.Head", - "Client.Post", - "Client.PostForm", - "ClientConn.Close", - "ClientConn.RoundTrip", - "Get", - "Head", - "Post", - "PostForm", - "Transport.CloseIdleConnections", - "Transport.NewClientConn", - "Transport.RoundTrip", - "http1ClientConn.Close", - "http1ClientConn.RoundTrip", - "http2Transport.NewClientConn", - "http2Transport.RoundTrip", - "http2Transport.RoundTripOpt", - "http2clientConnPool.GetClientConn", - "http2clientConnReadLoop.processSettingsNoWrite", - "http2noDialClientConnPool.GetClientConn", - "http2noDialH2RoundTripper.NewClientConn", - "http2noDialH2RoundTripper.RoundTrip", - "http2unencryptedTransport.RoundTrip" - ] - } - ] - } + ] } ], + "aliases": [ + "BIT-golang-2026-39825", + "CVE-2026-39825" + ], + "database_specific": { + "review_status": "REVIEWED", + "url": "https://pkg.go.dev/vuln/GO-2026-4976" + }, + "details": "ReverseProxy can forward queries containing parameters not visible to Rewrite functions.\n\nWhen used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function.\n\nFor example, the query \"a1=x&a2=x&...&a10000=x&hidden=y\" can forward the parameter \"hidden=y\" while hiding it from the proxy's Rewrite function.", + "id": "GO-2026-4976", + "modified": "2026-06-27T10:44:21.221469613Z", + "published": "2026-05-07T19:21:40Z", "references": [ { "type": "FIX", - "url": "https://go.dev/cl/761581" - }, - { - "type": "FIX", - "url": "https://go.dev/cl/761640" + "url": "https://go.dev/cl/770541" }, { "type": "REPORT", - "url": "https://go.dev/issue/78476" + "url": "https://go.dev/issue/78948" }, { "type": "WEB", "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M" } ], - "credits": [ - { - "name": "Marwan Atia (marwansamir688@gmail.com)" - } + "related": [ + "CGA-hgj8-xv45-c75x", + "RHSA-2026:23262", + "RHSA-2026:23264" ], - "database_specific": { - "review_status": "REVIEWED", - "url": "https://pkg.go.dev/vuln/GO-2026-4918" - } + "schema_version": "1.7.5", + "summary": "ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil" }, { - "modified": "2026-08-07T10:42:58Z", - "published": "2026-04-07T22:53:49Z", - "schema_version": "1.7.5", - "id": "GO-2026-4946", - "aliases": [ - "BIT-golang-2026-32281", - "CVE-2026-32281" - ], - "related": [ - "CGA-mhq6-cw97-rcc6", - "RHSA-2026:10217", - "RHSA-2026:10219", - "RHSA-2026:16021", - "RHSA-2026:16024", - "RHSA-2026:16101", - "RHSA-2026:18027", - "RHSA-2026:18032", - "RHSA-2026:19135", - "RHSA-2026:19353", - "RHSA-2026:19450", - "RHSA-2026:19719", - "RHSA-2026:19720", - "RHSA-2026:19721", - "RHSA-2026:19839", - "RHSA-2026:20556", - "RHSA-2026:20569", - "RHSA-2026:20570", - "RHSA-2026:20571", - "RHSA-2026:22141", - "RHSA-2026:22309", - "RHSA-2026:22713", - "RHSA-2026:23102", - "RHSA-2026:23103", - "RHSA-2026:24337", - "RHSA-2026:24470", - "RHSA-2026:24716", - "RHSA-2026:26054", - "RHSA-2026:26447", - "RHSA-2026:27076", - "RHSA-2026:27711", - "RHSA-2026:27740", - "RHSA-2026:28074", - "RHSA-2026:29035", - "RHSA-2026:29195", - "RHSA-2026:29455", - "RHSA-2026:29702", - "RHSA-2026:29703", - "RHSA-2026:33722", - "RHSA-2026:34192", - "RHSA-2026:34196", - "RHSA-2026:34197", - "RHSA-2026:34365", - "RHSA-2026:36796", - "RHSA-2026:39810", - "RHSA-2026:41019", - "RHSA-2026:42078", - "RHSA-2026:42079", - "RHSA-2026:47712", - "RHSA-2026:47714", - "RHSA-2026:47716", - "RHSA-2026:47719", - "RHSA-2026:47721", - "RHSA-2026:47722", - "RHSA-2026:47910", - "RHSA-2026:48036", - "RHSA-2026:49509", - "RHSA-2026:49526", - "RHSA-2026:49600", - "RHSA-2026:49838", - "RHSA-2026:49944", - "RHSA-2026:51288", - "RHSA-2026:7291", - "RHSA-2026:7385" - ], - "summary": "Inefficient policy validation in crypto/x509", - "details": "Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.\n\nThis only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.", "affected": [ { + "database_specific": { + "source": "https://vuln.go.dev/ID/GO-2026-4977.json" + }, + "ecosystem_specific": { + "imports": [ + { + "path": "net/mail", + "symbols": [ + "AddressParser.Parse", + "AddressParser.ParseList", + "Header.AddressList", + "ParseAddress", + "ParseAddressList", + "addrParser.consumePhrase" + ] + } + ] + }, "package": { "ecosystem": "Go", "name": "stdlib", @@ -1395,168 +2421,77 @@ }, "ranges": [ { - "type": "SEMVER", "events": [ { "introduced": "0" }, { - "fixed": "1.25.9" + "fixed": "1.25.10" }, { "introduced": "1.26.0-0" }, { - "fixed": "1.26.2" + "fixed": "1.26.3" } - ] + ], + "type": "SEMVER" } - ], - "database_specific": { - "source": "https://vuln.go.dev/ID/GO-2026-4946.json" - }, - "ecosystem_specific": { - "imports": [ - { - "path": "crypto/x509", - "symbols": [ - "Certificate.Verify", - "policiesValid" - ] - } - ] - } + ] } ], + "aliases": [ + "BIT-golang-2026-42499", + "CVE-2026-42499" + ], + "database_specific": { + "review_status": "REVIEWED", + "url": "https://pkg.go.dev/vuln/GO-2026-4977" + }, + "details": "Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.", + "id": "GO-2026-4977", + "modified": "2026-07-16T10:29:36.746311235Z", + "published": "2026-05-07T19:21:40Z", "references": [ { - "type": "FIX", - "url": "https://go.dev/cl/758061" + "type": "REPORT", + "url": "https://go.dev/issue/78987" }, { - "type": "REPORT", - "url": "https://go.dev/issue/78281" + "type": "FIX", + "url": "https://go.dev/cl/771520" }, { "type": "WEB", - "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU" + "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M" } ], - "credits": [ - { - "name": "Jakub Ciolek - https://ciolek.dev" - } + "related": [ + "CGA-m28j-j59g-3rp3", + "RHSA-2026:17713", + "RHSA-2026:17714" ], - "database_specific": { - "review_status": "REVIEWED", - "url": "https://pkg.go.dev/vuln/GO-2026-4946" - } + "schema_version": "1.7.5", + "summary": "Quadratic string concatenation in consumePhrase in net/mail" }, { - "modified": "2026-08-07T10:42:57Z", - "published": "2026-04-07T22:53:49Z", - "schema_version": "1.7.5", - "id": "GO-2026-4947", - "aliases": [ - "BIT-golang-2026-32280", - "CVE-2026-32280" - ], - "related": [ - "CGA-crmm-287q-6v8j", - "RHSA-2026:10217", - "RHSA-2026:10219", - "RHSA-2026:10704", - "RHSA-2026:11507", - "RHSA-2026:11514", - "RHSA-2026:14200", - "RHSA-2026:15980", - "RHSA-2026:16021", - "RHSA-2026:16024", - "RHSA-2026:16101", - "RHSA-2026:16875", - "RHSA-2026:17084", - "RHSA-2026:17287", - "RHSA-2026:18027", - "RHSA-2026:18032", - "RHSA-2026:19133", - "RHSA-2026:19135", - "RHSA-2026:19144", - "RHSA-2026:19350", - "RHSA-2026:19353", - "RHSA-2026:19450", - "RHSA-2026:19550", - "RHSA-2026:19634", - "RHSA-2026:19714", - "RHSA-2026:19715", - "RHSA-2026:19719", - "RHSA-2026:19720", - "RHSA-2026:19721", - "RHSA-2026:19722", - "RHSA-2026:19750", - "RHSA-2026:19839", - "RHSA-2026:20556", - "RHSA-2026:20569", - "RHSA-2026:20570", - "RHSA-2026:20571", - "RHSA-2026:20607", - "RHSA-2026:20608", - "RHSA-2026:20609", - "RHSA-2026:21655", - "RHSA-2026:22130", - "RHSA-2026:22141", - "RHSA-2026:22309", - "RHSA-2026:22709", - "RHSA-2026:22713", - "RHSA-2026:23102", - "RHSA-2026:23103", - "RHSA-2026:23244", - "RHSA-2026:24337", - "RHSA-2026:24470", - "RHSA-2026:24716", - "RHSA-2026:24761", - "RHSA-2026:24762", - "RHSA-2026:25180", - "RHSA-2026:26447", - "RHSA-2026:27076", - "RHSA-2026:28038", - "RHSA-2026:28047", - "RHSA-2026:28074", - "RHSA-2026:28886", - "RHSA-2026:28961", - "RHSA-2026:29035", - "RHSA-2026:29195", - "RHSA-2026:29455", - "RHSA-2026:29702", - "RHSA-2026:29703", - "RHSA-2026:33722", - "RHSA-2026:34097", - "RHSA-2026:34192", - "RHSA-2026:34196", - "RHSA-2026:34197", - "RHSA-2026:34365", - "RHSA-2026:36796", - "RHSA-2026:39810", - "RHSA-2026:41019", - "RHSA-2026:47712", - "RHSA-2026:47714", - "RHSA-2026:47716", - "RHSA-2026:47719", - "RHSA-2026:47721", - "RHSA-2026:47722", - "RHSA-2026:47910", - "RHSA-2026:48036", - "RHSA-2026:48790", - "RHSA-2026:49509", - "RHSA-2026:49526", - "RHSA-2026:49600", - "RHSA-2026:49838", - "RHSA-2026:49944", - "RHSA-2026:51288" - ], - "summary": "Unexpected work during chain building in crypto/x509", - "details": "During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.", "affected": [ { + "database_specific": { + "source": "https://vuln.go.dev/ID/GO-2026-4980.json" + }, + "ecosystem_specific": { + "imports": [ + { + "path": "html/template", + "symbols": [ + "Template.Execute", + "Template.ExecuteTemplate", + "isJSType" + ] + } + ] + }, "package": { "ecosystem": "Go", "name": "stdlib", @@ -1564,88 +2499,82 @@ }, "ranges": [ { - "type": "SEMVER", "events": [ { "introduced": "0" }, { - "fixed": "1.25.9" + "fixed": "1.25.10" }, { "introduced": "1.26.0-0" }, { - "fixed": "1.26.2" + "fixed": "1.26.3" } - ] + ], + "type": "SEMVER" } - ], - "database_specific": { - "source": "https://vuln.go.dev/ID/GO-2026-4947.json" - }, - "ecosystem_specific": { - "imports": [ - { - "path": "crypto/x509", - "symbols": [ - "Certificate.Verify", - "Certificate.buildChains" - ] - } - ] - } + ] + } + ], + "aliases": [ + "BIT-golang-2026-39826", + "CVE-2026-39826" + ], + "credits": [ + { + "name": "Mundur (https://github.com/M0nd0R)" } ], + "database_specific": { + "review_status": "REVIEWED", + "url": "https://pkg.go.dev/vuln/GO-2026-4980" + }, + "details": "If a trusted template author were to write a