Vulnerability-Lookup

OPENSUSE-SU-2026:12270-1

Vulnerability from csaf_opensuse - Published: 2026-10-26 00:00 - Updated: 2026-10-27 13:13

Summary

flannel-0.28.10-1.1 on GA media

Severity

Moderate

Notes

Title of the patch: flannel-0.28.10-1.1 on GA media

Description of the patch: These are all security issues fixed in the flannel-0.28.10-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-12270

CVE-2024-51744

3.1 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:flannel-0:0.28.10-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:flannel-0:0.28.10-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:flannel-0:0.28.10-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:flannel-0:0.28.10-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-32241

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2024-51744

Threats

Impact important

CVE-2026-46600

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2024-51744

Threats

Impact moderate

CVE-2026-56852

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2024-51744

Threats

Impact moderate

References

15 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2024-51744/	self
https://www.suse.com/security/cve/CVE-2026-32241/	self
https://www.suse.com/security/cve/CVE-2026-46600/	self
https://www.suse.com/security/cve/CVE-2026-56852/	self
https://www.suse.com/security/cve/CVE-2024-51744	external
https://bugzilla.suse.com/1232936	external
https://www.suse.com/security/cve/CVE-2026-32241	external
https://bugzilla.suse.com/1261044	external
https://www.suse.com/security/cve/CVE-2026-46600	external
https://bugzilla.suse.com/1272415	external
https://www.suse.com/security/cve/CVE-2026-56852	external
https://bugzilla.suse.com/1271661	external
https://bugzilla.suse.com/1280553	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "flannel-0.28.10-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the flannel-0.28.10-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-12270",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12270-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-51744 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-51744/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-32241 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-32241/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-46600 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-46600/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56852 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56852/"
      }
    ],
    "title": "flannel-0.28.10-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-10-27T13:13:51Z",
      "generator": {
        "date": "2026-10-26T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:12270-1",
      "initial_release_date": "2026-10-26T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-10-26T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-10-27T13:13:51Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "flannel-0:0.28.10-1.1.aarch64",
                "product": {
                  "name": "flannel-0:0.28.10-1.1.aarch64",
                  "product_id": "flannel-0:0.28.10-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/flannel@0.28.10-1.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flannel-k8s-yaml-0:0.28.10-1.1.aarch64",
                "product": {
                  "name": "flannel-k8s-yaml-0:0.28.10-1.1.aarch64",
                  "product_id": "flannel-k8s-yaml-0:0.28.10-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/flannel-k8s-yaml@0.28.10-1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "flannel-0:0.28.10-1.1.ppc64le",
                "product": {
                  "name": "flannel-0:0.28.10-1.1.ppc64le",
                  "product_id": "flannel-0:0.28.10-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/flannel@0.28.10-1.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flannel-k8s-yaml-0:0.28.10-1.1.ppc64le",
                "product": {
                  "name": "flannel-k8s-yaml-0:0.28.10-1.1.ppc64le",
                  "product_id": "flannel-k8s-yaml-0:0.28.10-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/flannel-k8s-yaml@0.28.10-1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "flannel-0:0.28.10-1.1.s390x",
                "product": {
                  "name": "flannel-0:0.28.10-1.1.s390x",
                  "product_id": "flannel-0:0.28.10-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/flannel@0.28.10-1.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flannel-k8s-yaml-0:0.28.10-1.1.s390x",
                "product": {
                  "name": "flannel-k8s-yaml-0:0.28.10-1.1.s390x",
                  "product_id": "flannel-k8s-yaml-0:0.28.10-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/flannel-k8s-yaml@0.28.10-1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "flannel-0:0.28.10-1.1.x86_64",
                "product": {
                  "name": "flannel-0:0.28.10-1.1.x86_64",
                  "product_id": "flannel-0:0.28.10-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/flannel@0.28.10-1.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "flannel-k8s-yaml-0:0.28.10-1.1.x86_64",
                "product": {
                  "name": "flannel-k8s-yaml-0:0.28.10-1.1.x86_64",
                  "product_id": "flannel-k8s-yaml-0:0.28.10-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/flannel-k8s-yaml@0.28.10-1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flannel-0:0.28.10-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.aarch64"
        },
        "product_reference": "flannel-0:0.28.10-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flannel-0:0.28.10-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.ppc64le"
        },
        "product_reference": "flannel-0:0.28.10-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flannel-0:0.28.10-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.s390x"
        },
        "product_reference": "flannel-0:0.28.10-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flannel-0:0.28.10-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.x86_64"
        },
        "product_reference": "flannel-0:0.28.10-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flannel-k8s-yaml-0:0.28.10-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.aarch64"
        },
        "product_reference": "flannel-k8s-yaml-0:0.28.10-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flannel-k8s-yaml-0:0.28.10-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.ppc64le"
        },
        "product_reference": "flannel-k8s-yaml-0:0.28.10-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flannel-k8s-yaml-0:0.28.10-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.s390x"
        },
        "product_reference": "flannel-k8s-yaml-0:0.28.10-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "flannel-k8s-yaml-0:0.28.10-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.x86_64"
        },
        "product_reference": "flannel-k8s-yaml-0:0.28.10-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-51744",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-51744"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by `ParseWithClaims` return both error codes. If users only check for the `jwt.ErrTokenExpired ` using `error.Is`, they will ignore the embedded `jwt.ErrTokenSignatureInvalid` and thus potentially accept invalid tokens. A fix has been back-ported with the error handling logic from the `v5` branch to the `v4` branch. In this logic, the `ParseWithClaims` function will immediately return in \"dangerous\" situations (e.g., an invalid signature), limiting the combined errors only to situations where the signature is valid, but further validation failed (e.g., if the signature is valid, but is expired AND has the wrong audience). This fix is part of the 4.5.1 release. We are aware that this changes the behaviour of an established function and is not 100 % backwards compatible, so updating to 4.5.1 might break your code. In case you cannot update to 4.5.0, please make sure that you are properly checking for all errors (\"dangerous\" ones first), so that you are not running in the case detailed above.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.aarch64",
          "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.ppc64le",
          "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.s390x",
          "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.x86_64",
          "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.aarch64",
          "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.ppc64le",
          "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.s390x",
          "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-51744",
          "url": "https://www.suse.com/security/cve/CVE-2024-51744"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1232936 for CVE-2024-51744",
          "url": "https://bugzilla.suse.com/1232936"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.aarch64",
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.ppc64le",
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.s390x",
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.x86_64",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.aarch64",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.ppc64le",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.s390x",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.aarch64",
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.ppc64le",
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.s390x",
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.x86_64",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.aarch64",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.ppc64le",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.s390x",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-26T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-51744"
    },
    {
      "cve": "CVE-2026-32241",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-32241"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Flannel is a network fabric for containers, designed for Kubernetes. The Flannel project includes an experimental Extension backend that allows users to easily prototype new backend types. In versions of Flannel prior to 0.28.2, this Extension backend is vulnerable to a command injection  that allows an attacker who can set Kubernetes Node annotations to achieve root-level arbitrary command execution on every flannel node in the cluster. The Extension backend\u0027s SubnetAddCommand and SubnetRemoveCommand receive attacker-controlled data via stdin (from the `flannel.alpha.coreos.com/backend-data` Node annotation). The content of this annotation is unmarshalled and piped directly to a shell command without checks. Kubernetes clusters using Flannel with the Extension backend are affected by this vulnerability. Other backends such as vxlan and wireguard are unaffected. The vulnerability is fixed in version v0.28.2. As a workaround, use Flannel with another backend such as vxlan or wireguard.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.aarch64",
          "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.ppc64le",
          "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.s390x",
          "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.x86_64",
          "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.aarch64",
          "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.ppc64le",
          "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.s390x",
          "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-32241",
          "url": "https://www.suse.com/security/cve/CVE-2026-32241"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261044 for CVE-2026-32241",
          "url": "https://bugzilla.suse.com/1261044"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.aarch64",
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.ppc64le",
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.s390x",
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.x86_64",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.aarch64",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.ppc64le",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.s390x",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.aarch64",
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.ppc64le",
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.s390x",
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.x86_64",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.aarch64",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.ppc64le",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.s390x",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-26T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-32241"
    },
    {
      "cve": "CVE-2026-46600",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-46600"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.aarch64",
          "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.ppc64le",
          "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.s390x",
          "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.x86_64",
          "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.aarch64",
          "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.ppc64le",
          "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.s390x",
          "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-46600",
          "url": "https://www.suse.com/security/cve/CVE-2026-46600"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272415 for CVE-2026-46600",
          "url": "https://bugzilla.suse.com/1272415"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.aarch64",
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.ppc64le",
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.s390x",
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.x86_64",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.aarch64",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.ppc64le",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.s390x",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.aarch64",
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.ppc64le",
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.s390x",
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.x86_64",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.aarch64",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.ppc64le",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.s390x",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-26T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-46600"
    },
    {
      "cve": "CVE-2026-56852",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56852"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.aarch64",
          "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.ppc64le",
          "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.s390x",
          "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.x86_64",
          "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.aarch64",
          "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.ppc64le",
          "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.s390x",
          "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56852",
          "url": "https://www.suse.com/security/cve/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271661 for CVE-2026-56852",
          "url": "https://bugzilla.suse.com/1271661"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280553 for CVE-2026-56852",
          "url": "https://bugzilla.suse.com/1280553"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.aarch64",
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.ppc64le",
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.s390x",
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.x86_64",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.aarch64",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.ppc64le",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.s390x",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.aarch64",
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.ppc64le",
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.s390x",
            "openSUSE Tumbleweed:flannel-0:0.28.10-1.1.x86_64",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.aarch64",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.ppc64le",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.s390x",
            "openSUSE Tumbleweed:flannel-k8s-yaml-0:0.28.10-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-26T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-56852"
    }
  ]
}

CVE-2024-51744 (GCVE-0-2024-51744)

Vulnerability from cvelistv5 – Published: 2024-11-04 21:47 – Updated: 2024-11-05 16:11

Title

Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt

Summary

golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by `ParseWithClaims` return both error codes. If users only check for the `jwt.ErrTokenExpired ` using `error.Is`, they will ignore the embedded `jwt.ErrTokenSignatureInvalid` and thus potentially accept invalid tokens. A fix has been back-ported with the error handling logic from the `v5` branch to the `v4` branch. In this logic, the `ParseWithClaims` function will immediately return in "dangerous" situations (e.g., an invalid signature), limiting the combined errors only to situations where the signature is valid, but further validation failed (e.g., if the signature is valid, but is expired AND has the wrong audience). This fix is part of the 4.5.1 release. We are aware that this changes the behaviour of an established function and is not 100 % backwards compatible, so updating to 4.5.1 might break your code. In case you cannot update to 4.5.0, please make sure that you are properly checking for all errors ("dangerous" ones first), so that you are not running in the case detailed above.

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-05 16:11 UTC

CWE

CWE-755 - Improper Handling of Exceptional Conditions

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8035 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/golang-jwt/jwt/security/adviso…	x_refsource_CONFIRM
https://github.com/golang-jwt/jwt/commit/7b1c1c00…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
golang-jwt	jwt	Affected: < 4.5.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-51744",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-05T16:11:29.522504Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-05T16:11:42.243Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jwt",
          "vendor": "golang-jwt",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.5.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by `ParseWithClaims` return both error codes. If users only check for the `jwt.ErrTokenExpired ` using `error.Is`, they will ignore the embedded `jwt.ErrTokenSignatureInvalid` and thus potentially accept invalid tokens. A fix has been back-ported with the error handling logic from the `v5` branch to the `v4` branch. In this logic, the `ParseWithClaims` function will immediately return in \"dangerous\" situations (e.g., an invalid signature), limiting the combined errors only to situations where the signature is valid, but further validation failed (e.g., if the signature is valid, but is expired AND has the wrong audience). This fix is part of the 4.5.1 release. We are aware that this changes the behaviour of an established function and is not 100 % backwards compatible, so updating to 4.5.1 might break your code. In case you cannot update to 4.5.0, please make sure that you are properly checking for all errors (\"dangerous\" ones first), so that you are not running in the case detailed above."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-755",
              "description": "CWE-755: Improper Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-04T21:47:12.170Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/golang-jwt/jwt/security/advisories/GHSA-29wx-vh33-7x7r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/golang-jwt/jwt/security/advisories/GHSA-29wx-vh33-7x7r"
        },
        {
          "name": "https://github.com/golang-jwt/jwt/commit/7b1c1c00a171c6c79bbdb40e4ce7d197060c1c2c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/golang-jwt/jwt/commit/7b1c1c00a171c6c79bbdb40e4ce7d197060c1c2c"
        }
      ],
      "source": {
        "advisory": "GHSA-29wx-vh33-7x7r",
        "discovery": "UNKNOWN"
      },
      "title": "Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-51744",
    "datePublished": "2024-11-04T21:47:12.170Z",
    "dateReserved": "2024-10-31T14:12:45.789Z",
    "dateUpdated": "2024-11-05T16:11:42.243Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-32241 (GCVE-0-2026-32241)

Vulnerability from cvelistv5 – Published: 2026-03-27 19:31 – Updated: 2026-03-31 18:54

Title

Flannel vulnerable to cross-node remote code execution via extension backend BackendData injection

Summary

Flannel is a network fabric for containers, designed for Kubernetes. The Flannel project includes an experimental Extension backend that allows users to easily prototype new backend types. In versions of Flannel prior to 0.28.2, this Extension backend is vulnerable to a command injection that allows an attacker who can set Kubernetes Node annotations to achieve root-level arbitrary command execution on every flannel node in the cluster. The Extension backend's SubnetAddCommand and SubnetRemoveCommand receive attacker-controlled data via stdin (from the `flannel.alpha.coreos.com/backend-data` Node annotation). The content of this annotation is unmarshalled and piped directly to a shell command without checks. Kubernetes clusters using Flannel with the Extension backend are affected by this vulnerability. Other backends such as vxlan and wireguard are unaffected. The vulnerability is fixed in version v0.28.2. As a workaround, use Flannel with another backend such as vxlan or wireguard.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-31 18:51 UTC

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8035 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/flannel-io/flannel/security/ad…	x_refsource_CONFIRM
https://github.com/flannel-io/flannel/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
flannel-io	flannel	Affected: < 0.28.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32241",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-31T18:51:18.552973Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-31T18:54:30.192Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "flannel",
          "vendor": "flannel-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.28.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Flannel is a network fabric for containers, designed for Kubernetes. The Flannel project includes an experimental Extension backend that allows users to easily prototype new backend types. In versions of Flannel prior to 0.28.2, this Extension backend is vulnerable to a command injection  that allows an attacker who can set Kubernetes Node annotations to achieve root-level arbitrary command execution on every flannel node in the cluster. The Extension backend\u0027s SubnetAddCommand and SubnetRemoveCommand receive attacker-controlled data via stdin (from the `flannel.alpha.coreos.com/backend-data` Node annotation). The content of this annotation is unmarshalled and piped directly to a shell command without checks. Kubernetes clusters using Flannel with the Extension backend are affected by this vulnerability. Other backends such as vxlan and wireguard are unaffected. The vulnerability is fixed in version v0.28.2. As a workaround, use Flannel with another backend such as vxlan or wireguard."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-27T19:31:48.276Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/flannel-io/flannel/security/advisories/GHSA-vchx-5pr6-ffx2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/flannel-io/flannel/security/advisories/GHSA-vchx-5pr6-ffx2"
        },
        {
          "name": "https://github.com/flannel-io/flannel/releases/tag/v0.28.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/flannel-io/flannel/releases/tag/v0.28.2"
        }
      ],
      "source": {
        "advisory": "GHSA-vchx-5pr6-ffx2",
        "discovery": "UNKNOWN"
      },
      "title": "Flannel vulnerable to cross-node remote code execution via extension backend BackendData injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-32241",
    "datePublished": "2026-03-27T19:31:48.276Z",
    "dateReserved": "2026-03-11T14:47:05.684Z",
    "dateUpdated": "2026-03-31T18:54:30.192Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46600 (GCVE-0-2026-46600)

Vulnerability from cvelistv5 – Published: 2026-07-21 19:18 – Updated: 2026-08-14 15:46

Title

Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Summary

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-23 15:00 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 76 records in the last 180 days details

References

4 references

URL	Tags
https://go.dev/cl/786345
https://go.dev/issue/79795
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-5942

Impacted products

2 products

Vendor	Product	Version
Go standard library	net	Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)
golang.org/x/net	golang.org/x/net/dns/dnsmessage	Affected: 0 , < 0.56.0 (semver)

Credits

Mundur (https://github.com/M0nd0R)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-46600",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T15:00:27.171241Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T15:00:35.473Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net",
          "product": "net",
          "programRoutines": [
            {
              "name": "cgoResSearch"
            },
            {
              "name": "LookupCNAME"
            },
            {
              "name": "Resolver.LookupCNAME"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/net/dns/dnsmessage",
          "product": "golang.org/x/net/dns/dnsmessage",
          "programRoutines": [
            {
              "name": "unpackSVCBResource"
            },
            {
              "name": "Message.Unpack"
            },
            {
              "name": "Parser.Additional"
            },
            {
              "name": "Parser.AllAdditionals"
            },
            {
              "name": "Parser.AllAnswers"
            },
            {
              "name": "Parser.AllAuthorities"
            },
            {
              "name": "Parser.Answer"
            },
            {
              "name": "Parser.Authority"
            },
            {
              "name": "Parser.HTTPSResource"
            },
            {
              "name": "Parser.SVCBResource"
            }
          ],
          "vendor": "golang.org/x/net",
          "versions": [
            {
              "lessThan": "0.56.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mundur (https://github.com/M0nd0R)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-14T15:46:12.894Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/786345"
        },
        {
          "url": "https://go.dev/issue/79795"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-5942"
        }
      ],
      "title": "Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-46600",
    "datePublished": "2026-07-21T19:18:59.755Z",
    "dateReserved": "2026-05-15T17:35:00.814Z",
    "dateUpdated": "2026-08-14T15:46:12.894Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56852 (GCVE-0-2026-56852)

Vulnerability from cvelistv5 – Published: 2026-07-21 19:18 – Updated: 2026-08-10 22:57

Title

Infinite loop on invalid input in golang.org/x/text

Summary

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-23 13:26 UTC

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 76 records in the last 180 days details

References

3 references

URL	Tags
https://go.dev/issue/80142
https://go.dev/cl/794100
https://pkg.go.dev/vuln/GO-2026-5970

Impacted products

1 product

Vendor	Product	Version
golang.org/x/text	golang.org/x/text/unicode/norm	Affected: 0 , < 0.39.0 (semver)

Credits

Viky Choi ("vikychoi" on GitHub)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56852",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T13:26:14.918983Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-835",
                "description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T13:26:20.232Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/text/unicode/norm",
          "product": "golang.org/x/text/unicode/norm",
          "programRoutines": [
            {
              "name": "nextComposed"
            },
            {
              "name": "Form.Append"
            },
            {
              "name": "Form.AppendString"
            },
            {
              "name": "Form.Bytes"
            },
            {
              "name": "Form.FirstBoundary"
            },
            {
              "name": "Form.FirstBoundaryInString"
            },
            {
              "name": "Form.IsNormal"
            },
            {
              "name": "Form.IsNormalString"
            },
            {
              "name": "Form.LastBoundary"
            },
            {
              "name": "Form.NextBoundary"
            },
            {
              "name": "Form.NextBoundaryInString"
            },
            {
              "name": "Form.Properties"
            },
            {
              "name": "Form.PropertiesString"
            },
            {
              "name": "Form.QuickSpan"
            },
            {
              "name": "Form.QuickSpanString"
            },
            {
              "name": "Form.Span"
            },
            {
              "name": "Form.SpanString"
            },
            {
              "name": "Form.String"
            },
            {
              "name": "Form.Transform"
            },
            {
              "name": "Iter.Init"
            },
            {
              "name": "Iter.InitString"
            },
            {
              "name": "Iter.Next"
            },
            {
              "name": "Iter.Seek"
            },
            {
              "name": "normReader.Read"
            },
            {
              "name": "normWriter.Write"
            }
          ],
          "vendor": "golang.org/x/text",
          "versions": [
            {
              "lessThan": "0.39.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Viky Choi (\"vikychoi\" on GitHub)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T22:57:54.703Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80142"
        },
        {
          "url": "https://go.dev/cl/794100"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-5970"
        }
      ],
      "title": "Infinite loop on invalid input in golang.org/x/text"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56852",
    "datePublished": "2026-07-21T19:18:59.951Z",
    "dateReserved": "2026-06-23T15:10:49.352Z",
    "dateUpdated": "2026-08-10T22:57:54.703Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2026:12270-1

CVE-2024-51744 (GCVE-0-2024-51744)

CVE-2026-32241 (GCVE-0-2026-32241)

CVE-2026-46600 (GCVE-0-2026-46600)

CVE-2026-56852 (GCVE-0-2026-56852)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour