CVE-2026-78663
Double flow control refund on HTTP/2 server streams in net/http
CVE-2026-78663 is a critical vulnerability (CVSS 9.1) in Go Standard Library Net/http, published October 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.86%, the 58th percentile. Fixed in docker 29.9.0-r0.
- Severity
- 9.1 CriticalCVSS 3.1, CVE List
- Exploit chance
- 0.86%EPSS, 58th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
29.9.0-r0docker +299 more
Description
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dockerAlpine:v3.24 | before 29.9.0-r0 | 29.9.0-r0 |
goAlpine:v3.24 | before 1.26.9-r0 | 1.26.9-r0 |
go-toolsetAlmaLinux:10 From an advisory covering 15 CVEs | before 1.26.10-1.el10_2.alma.1 | 1.26.10-1.el10_2.alma.1 |
golangAlmaLinux:10 From an advisory covering 15 CVEs | before 1.26.10-1.el10_2.alma.1 | 1.26.10-1.el10_2.alma.1 |
golang-binAlmaLinux:10 From an advisory covering 15 CVEs | before 1.26.10-1.el10_2.alma.1 | 1.26.10-1.el10_2.alma.1 |
golang-docsAlmaLinux:10 From an advisory covering 15 CVEs | before 1.26.10-1.el10_2.alma.1 | 1.26.10-1.el10_2.alma.1 |
golang-miscAlmaLinux:10 From an advisory covering 15 CVEs | before 1.26.10-1.el10_2.alma.1 | 1.26.10-1.el10_2.alma.1 |
golang-raceAlmaLinux:10 From an advisory covering 15 CVEs | before 1.26.10-1.el10_2.alma.1 | 1.26.10-1.el10_2.alma.1 |
golang-srcAlmaLinux:10 From an advisory covering 15 CVEs | before 1.26.10-1.el10_2.alma.1 | 1.26.10-1.el10_2.alma.1 |
golang-testsAlmaLinux:10 From an advisory covering 15 CVEs | before 1.26.10-1.el10_2.alma.1 | 1.26.10-1.el10_2.alma.1 |
Show 290 moreShow less
| Package | Affected | Fixed |
|---|---|---|
go-toolsetAlmaLinux:9 From an advisory covering 15 CVEs | before 1.26.10-1.el9_8 | 1.26.10-1.el9_8 |
golangAlmaLinux:9 From an advisory covering 15 CVEs | before 1.26.10-1.el9_8 | 1.26.10-1.el9_8 |
golang-binAlmaLinux:9 From an advisory covering 15 CVEs | before 1.26.10-1.el9_8 | 1.26.10-1.el9_8 |
golang-docsAlmaLinux:9 From an advisory covering 15 CVEs | before 1.26.10-1.el9_8 | 1.26.10-1.el9_8 |
golang-miscAlmaLinux:9 From an advisory covering 15 CVEs | before 1.26.10-1.el9_8 | 1.26.10-1.el9_8 |
golang-raceAlmaLinux:9 From an advisory covering 15 CVEs | before 1.26.10-1.el9_8 | 1.26.10-1.el9_8 |
golang-srcAlmaLinux:9 From an advisory covering 15 CVEs | before 1.26.10-1.el9_8 | 1.26.10-1.el9_8 |
golang-testsAlmaLinux:9 From an advisory covering 15 CVEs | before 1.26.10-1.el9_8 | 1.26.10-1.el9_8 |
delveAlmaLinux:8 From an advisory covering 15 CVEs | before 1.26.1-1.module_el8.10.0+4307+6e4cbc60 | 1.26.1-1.module_el8.10.0+4307+6e4cbc60 |
go-toolsetAlmaLinux:8 From an advisory covering 15 CVEs | before 1.26.10-1.module_el8.10.0+4307+6e4cbc60 | 1.26.10-1.module_el8.10.0+4307+6e4cbc60 |
golangAlmaLinux:8 From an advisory covering 15 CVEs | before 1.26.10-1.module_el8.10.0+4307+6e4cbc60 | 1.26.10-1.module_el8.10.0+4307+6e4cbc60 |
golang-binAlmaLinux:8 From an advisory covering 15 CVEs | before 1.26.10-1.module_el8.10.0+4307+6e4cbc60 | 1.26.10-1.module_el8.10.0+4307+6e4cbc60 |
golang-docsAlmaLinux:8 From an advisory covering 15 CVEs | before 1.26.10-1.module_el8.10.0+4307+6e4cbc60 | 1.26.10-1.module_el8.10.0+4307+6e4cbc60 |
golang-miscAlmaLinux:8 From an advisory covering 15 CVEs | before 1.26.10-1.module_el8.10.0+4307+6e4cbc60 | 1.26.10-1.module_el8.10.0+4307+6e4cbc60 |
golang-raceAlmaLinux:8 From an advisory covering 15 CVEs | before 1.26.10-1.module_el8.10.0+4307+6e4cbc60 | 1.26.10-1.module_el8.10.0+4307+6e4cbc60 |
golang-srcAlmaLinux:8 From an advisory covering 15 CVEs | before 1.26.10-1.module_el8.10.0+4307+6e4cbc60 | 1.26.10-1.module_el8.10.0+4307+6e4cbc60 |
golang-testsAlmaLinux:8 From an advisory covering 15 CVEs | before 1.26.10-1.module_el8.10.0+4307+6e4cbc60 | 1.26.10-1.module_el8.10.0+4307+6e4cbc60 |
azl-otel-collectorAzure Linux:3 | through 0.127.0-1 | None known |
buildahAzure Linux:3 | through 1.43.1-3 | None known |
cri-oAzure Linux:3 | through 1.30.1-1 | None known |
kata-containers-previewAzure Linux:3 | through 3.27.0~preview2-2 | None known |
podmanAzure Linux:3 | through 5.6.1-10 | None known |
application-gateway-kubernetes-ingressAzure Linux:3 | through 1.7.7-6 | None known |
azcopyAzure Linux:3 | through 10.25.1-9 | None known |
azurelinux-image-toolsAzure Linux:3 | through 1.6.0-3 | None known |
cert-managerAzure Linux:3 | before 1.12.15-15 | 1.12.15-15 |
cf-cliAzure Linux:3 | through 8.7.11-9 | None known |
cloud-provider-kubevirtAzure Linux:3 | before 0.5.1-10 | 0.5.1-10 |
containerd2Azure Linux:3 | through 2.3.4-1 | None known |
containerized-data-importerAzure Linux:3 | before 1.62.0-9 | 1.62.0-9 |
corednsAzure Linux:3 | through 1.11.4-21 | None known |
cri-toolsAzure Linux:3 | through 1.32.0-8 | None known |
docker-buildxAzure Linux:3 | through 0.14.0-17 | None known |
docker-cliAzure Linux:3 | through 25.0.7-5 | None known |
docker-composeAzure Linux:3 | through 2.27.0-14 | None known |
etcdAzure Linux:3 | before 3.5.35-1 | 3.5.35-1 |
flannelAzure Linux:3 | through 0.24.2-32 | None known |
ghAzure Linux:3 | through 2.101.0-1 | None known |
git-lfsAzure Linux:3 | through 3.6.1-6 | None known |
ignition-flatcarAzure Linux:3 | through 2.22.0-6 | None known |
influxdbAzure Linux:3 | before 2.7.5-22 | 2.7.5-22 |
jxAzure Linux:3 | through 3.10.182-5 | None known |
kata-containersAzure Linux:3 | before 4.1.0.kata1-2 | 4.1.0.kata1-2 |
kata-containers-ccAzure Linux:3 | before 3.15.0.aks0-23 | 3.15.0.aks0-23 |
kedaAzure Linux:3 | through 2.14.1-19 | None known |
kube-vip-cloud-providerAzure Linux:3 | before 0.0.10-11 | 0.0.10-11 |
kubernetesAzure Linux:3 | before 1.30.10-32 | 1.30.10-32 |
kubevirtAzure Linux:3 | before 1.8.4-4 | 1.8.4-4 |
kuredAzure Linux:3 | through 1.15.0-6 | None known |
libcontainers-commonAzure Linux:3 | through 20240213-3 | None known |
moby-containerd-ccAzure Linux:3 | before 1.7.7-19 | 1.7.7-19 |
moby-engineAzure Linux:3 | through 25.0.18-2 | None known |
multusAzure Linux:3 | through 4.0.2-11 | None known |
opaAzure Linux:3 | before 0.63.0-6 | 0.63.0-6 |
packerAzure Linux:3 | through 1.9.5-21 | None known |
prometheus-adapterAzure Linux:3 | before 0.12.0-12 | 0.12.0-12 |
prometheus-node-exporterAzure Linux:3 | before 1.7.0-6 | 1.7.0-6 |
prometheus-process-exporterAzure Linux:3 | before 0.8.2-6 | 0.8.2-6 |
skopeoAzure Linux:3 | through 1.14.4-13 | None known |
sriov-network-device-pluginAzure Linux:3 | through 3.7.0-8 | None known |
telegrafAzure Linux:3 | through 1.31.0-33 | None known |
vitessAzure Linux:3 | through 19.0.4-14 | None known |
golangAzure Linux:3 | through 1.26.11-1 | None known |
golangAzure Linux:3 | 1.27.0 to 1.27.4-1 | None known |
gccAzure Linux:3 | through 13.2.0-7 | None known |
python-tensorboardAzure Linux:3 | through 2.16.2-6 | None known |
buildahAlpaquita:23 | 1.28.0-r1 and later | None known |
containerdAlpaquita:23 | 1.6.10-r0 and later | None known |
dockerAlpaquita:23 | 20.10.21-r1 and later | None known |
goAlpaquita:23 | 1.19.7-r0 up to 1.26.9-r0 | 1.26.9-r0 |
podmanAlpaquita:23 | 4.3.1-r0 and later | None known |
runcAlpaquita:23 | 1.1.4-r3 and later | None known |
skopeoAlpaquita:23 | 1.10.0-r2 and later | None known |
buildahAlpaquita:25 | 1.40.0-r0 and later | None known |
calicoctlAlpaquita:25 | 3.31.3-r0 and later | None known |
cilium-cliAlpaquita:25 | 0.19.0-r12 and later | None known |
cni-pluginsAlpaquita:25 | 1.9.0-r2 and later | None known |
containerdAlpaquita:25 | 2.1.1-r0 and later | None known |
cri-toolsAlpaquita:25 | 1.35.0-r2 and later | None known |
dockerAlpaquita:25 | 28.2.1-r0 and later | None known |
docker-cli-buildxAlpaquita:25 | 0.24.0-r0 and later | None known |
etcdAlpaquita:25 | 3.6.4-r6 and later | None known |
goAlpaquita:25 | 1.24.3-r0 up to 1.26.9-r0 | 1.26.9-r0 |
google-guest-agentAlpaquita:25 | 20250521.00-r0 and later | None known |
helmAlpaquita:25 | 3.19.0-r4 and later | None known |
osv-scannerAlpaquita:25 | 2.1.0-r4 and later | None known |
podmanAlpaquita:25 | 5.5.0-r0 and later | None known |
rootlesskitAlpaquita:25 | 2.3.5-r0 and later | None known |
runcAlpaquita:25 | 1.3.0-r1 and later | None known |
skopeoAlpaquita:25 | 1.18.0-r2 and later | None known |
buildahAlpaquita:stream | 1.31.0-r0 and later | None known |
calicoctlAlpaquita:stream | 3.31.3-r0 and later | None known |
cilium-cliAlpaquita:stream | 0.19.0-r12 and later | None known |
cni-pluginsAlpaquita:stream | 1.9.0-r2 and later | None known |
containerdAlpaquita:stream | 1.7.2-r1 and later | None known |
cri-toolsAlpaquita:stream | 1.35.0-r2 and later | None known |
dockerAlpaquita:stream | 24.0.2-r0 up to 29.9.0-r0 | 29.9.0-r0 |
docker-cli-buildxAlpaquita:stream | 0.11.0-r0 and later | None known |
etcdAlpaquita:stream | 3.6.4-r6 and later | None known |
goAlpaquita:stream | 1.20.5-r2 up to 1.27.2-r0 | 1.27.2-r0 |
google-guest-agentAlpaquita:stream | 20250214.01-r0 and later | None known |
grypeAlpaquita:stream | 0.100.0-r0 and later | None known |
helmAlpaquita:stream | 3.19.0-r4 and later | None known |
osv-scannerAlpaquita:stream | 2.1.0-r2 and later | None known |
podmanAlpaquita:stream | 4.5.1-r1 and later | None known |
rootlesskitAlpaquita:stream | 2.1.0-r0 and later | None known |
runcAlpaquita:stream | 1.1.7-r1 and later | None known |
skopeoAlpaquita:stream | 1.13.0-r1 and later | None known |
goBellSoft Hardened Containers:23 | 1.19.7-r0 up to 1.26.9-r0 | 1.26.9-r0 |
goBellSoft Hardened Containers:25 | 1.24.3-r0 up to 1.26.9-r0 | 1.26.9-r0 |
goBellSoft Hardened Containers:stream | 1.20.5-r2 up to 1.27.2-r0 | 1.27.2-r0 |
golangBitnami | before 1.26.9, 1.27.0-0 up to 1.27.2 | 1.26.91.27.2 |
golang-1.19Debian:12 | All versions, plus listed versions 1.19.10-11.19.10-21.19.11-11.19.12-11.19.12-2 Show 7 moreShow less1.19.12-2~bpo11+11.19.12-2~bpo12+11.19.13-11.19.13-1~bpo11+11.19.13-1~bpo12+11.19.8-21.19.9-1 | None known |
golang-1.24Debian:13 | All versions, plus listed versions 1.24.12-11.24.13-11.24.13-21.24.4-11.24.4-2 Show 5 moreShow less1.24.4-31.24.4-41.24.7-11.24.8-11.24.9-1 | None known |
golang-1.26Debian:14 | before 1.26.9-1, plus listed versions 1.26.0-11.26.1-11.26.2-11.26.2-21.26.2-3 Show 18 moreShow less1.26.3-11.26.3-1~bpo13+11.26.3-21.26.3-2~bpo13+11.26.4-11.26.4-1~bpo13+11.26.5-11.26.5-1~bpo13+11.26.6-11.26.6-21.26.7-11.26.7-1~bpo13+11.26.8-11.26.8-1~bpo13+11.26.8-21.26~rc2-11.26~rc3-11.26~rc3-2 | 1.26.9-1 |
golang-1.27Debian:14 | before 1.27.2-1, plus listed versions 1.27.0-11.27.0-1~bpo13+11.27.1-11.27.1-21.27.1-2~bpo13+1 Show 4 moreShow less1.27.2-1~bpo13+11.27~rc1-11.27~rc2-11.27~rc3-1 | 1.27.2-1 |
golang-golang-x-netDebian:12 | All versions, plus listed versions 1:0.10.0-11:0.11.0-11:0.14.0-11:0.15.0-11:0.15.0-2 Show 23 moreShow less1:0.17.0+dfsg-11:0.19.0+dfsg-11:0.20.0+dfsg-11:0.21.0+dfsg-11:0.22.0+dfsg-11:0.23.0+dfsg-11:0.24.0+dfsg-11:0.25.0+dfsg-11:0.26.0+dfsg-11:0.26.0+dfsg-21:0.27.0-11:0.27.0-21:0.47.0-11:0.47.0-21:0.53.0-11:0.53.0-21:0.53.0-2~bpo13+11:0.55.0-11:0.56.0-11:0.57.0-11:0.58.0-11:0.60.0-11:0.7.0+dfsg-1 | None known |
golang-golang-x-netDebian:13 | All versions, plus listed versions 1:0.27.0-21:0.47.0-11:0.47.0-21:0.53.0-11:0.53.0-2 Show 6 moreShow less1:0.53.0-2~bpo13+11:0.55.0-11:0.56.0-11:0.57.0-11:0.58.0-11:0.60.0-1 | None known |
golang-golang-x-netDebian:14 | before 1:0.60.0-1, plus listed versions 1:0.27.0-21:0.47.0-11:0.47.0-21:0.53.0-11:0.53.0-2 Show 5 moreShow less1:0.53.0-2~bpo13+11:0.55.0-11:0.56.0-11:0.57.0-11:0.58.0-1 | 1:0.60.0-1 |
stdlibGo | before 1.26.9 | 1.26.9 |
stdlibGo | 1.27.0-0 up to 1.27.2 | 1.27.2 |
golang.org/x/netGo | before 0.60.0 | 0.60.0 |
golangMageia:10 From an advisory covering 14 CVEs | before 1.26.9-1.mga10 | 1.26.9-1.mga10 |
rcloneMageia:10 From an advisory covering 41 CVEs | before 1.75.2-2.mga10 | 1.75.2-2.mga10 |
golangopenEuler:24.03-LTS-SP3 From an advisory covering 7 CVEs | before 1.21.4-53.oe2403sp3 | 1.21.4-53.oe2403sp3 |
golangopenEuler:24.03-LTS-SP4 From an advisory covering 7 CVEs | before 1.21.4-55.oe2403sp4 | 1.21.4-55.oe2403sp4 |
golangopenEuler:22.03-LTS-SP4 From an advisory covering 6 CVEs | before 1.17.3-53.oe2203sp4 | 1.17.3-53.oe2203sp4 |
golangopenEuler:24.03-LTS-SP1 From an advisory covering 7 CVEs | before 1.21.4-50.oe2403sp1 | 1.21.4-50.oe2403sp1 |
go-toolsetRed Hat:enterprise_linux:10.2 From an advisory covering 15 CVEs | before 0:1.26.10-1.el10_2 | 0:1.26.10-1.el10_2 |
golangRed Hat:enterprise_linux:10.2 From an advisory covering 15 CVEs | before 0:1.26.10-1.el10_2 | 0:1.26.10-1.el10_2 |
golang-binRed Hat:enterprise_linux:10.2 From an advisory covering 15 CVEs | before 0:1.26.10-1.el10_2 | 0:1.26.10-1.el10_2 |
golang-docsRed Hat:enterprise_linux:10.2 From an advisory covering 15 CVEs | before 0:1.26.10-1.el10_2 | 0:1.26.10-1.el10_2 |
golang-miscRed Hat:enterprise_linux:10.2 From an advisory covering 15 CVEs | before 0:1.26.10-1.el10_2 | 0:1.26.10-1.el10_2 |
golang-raceRed Hat:enterprise_linux:10.2 From an advisory covering 15 CVEs | before 0:1.26.10-1.el10_2 | 0:1.26.10-1.el10_2 |
golang-srcRed Hat:enterprise_linux:10.2 From an advisory covering 15 CVEs | before 0:1.26.10-1.el10_2 | 0:1.26.10-1.el10_2 |
golang-testsRed Hat:enterprise_linux:10.2 From an advisory covering 15 CVEs | before 0:1.26.10-1.el10_2 | 0:1.26.10-1.el10_2 |
go-toolsetRed Hat:enterprise_linux:9::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.el9_8 | 0:1.26.10-1.el9_8 |
golangRed Hat:enterprise_linux:9::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.el9_8 | 0:1.26.10-1.el9_8 |
golang-binRed Hat:enterprise_linux:9::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.el9_8 | 0:1.26.10-1.el9_8 |
golang-docsRed Hat:enterprise_linux:9::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.el9_8 | 0:1.26.10-1.el9_8 |
golang-miscRed Hat:enterprise_linux:9::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.el9_8 | 0:1.26.10-1.el9_8 |
golang-raceRed Hat:enterprise_linux:9::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.el9_8 | 0:1.26.10-1.el9_8 |
golang-srcRed Hat:enterprise_linux:9::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.el9_8 | 0:1.26.10-1.el9_8 |
golang-testsRed Hat:enterprise_linux:9::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.el9_8 | 0:1.26.10-1.el9_8 |
delveRed Hat:enterprise_linux:8::appstream From an advisory covering 15 CVEs | before 0:1.26.1-1.module+el8.10.0+24516+40554724 | 0:1.26.1-1.module+el8.10.0+24516+40554724 |
delve-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 15 CVEs | before 0:1.26.1-1.module+el8.10.0+24516+40554724 | 0:1.26.1-1.module+el8.10.0+24516+40554724 |
delve-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 15 CVEs | before 0:1.26.1-1.module+el8.10.0+24516+40554724 | 0:1.26.1-1.module+el8.10.0+24516+40554724 |
go-toolsetRed Hat:enterprise_linux:8::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.module+el8.10.0+25107+6b50279c | 0:1.26.10-1.module+el8.10.0+25107+6b50279c |
golangRed Hat:enterprise_linux:8::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.module+el8.10.0+25107+6b50279c | 0:1.26.10-1.module+el8.10.0+25107+6b50279c |
golang-binRed Hat:enterprise_linux:8::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.module+el8.10.0+25107+6b50279c | 0:1.26.10-1.module+el8.10.0+25107+6b50279c |
golang-docsRed Hat:enterprise_linux:8::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.module+el8.10.0+25107+6b50279c | 0:1.26.10-1.module+el8.10.0+25107+6b50279c |
golang-miscRed Hat:enterprise_linux:8::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.module+el8.10.0+25107+6b50279c | 0:1.26.10-1.module+el8.10.0+25107+6b50279c |
golang-raceRed Hat:enterprise_linux:8::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.module+el8.10.0+25107+6b50279c | 0:1.26.10-1.module+el8.10.0+25107+6b50279c |
golang-srcRed Hat:enterprise_linux:8::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.module+el8.10.0+25107+6b50279c | 0:1.26.10-1.module+el8.10.0+25107+6b50279c |
golang-testsRed Hat:enterprise_linux:8::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.module+el8.10.0+25107+6b50279c | 0:1.26.10-1.module+el8.10.0+25107+6b50279c |
go-toolsetRed Hat:enterprise_linux_eus:10.0 From an advisory covering 15 CVEs | before 0:1.26.10-1.el10_0 | 0:1.26.10-1.el10_0 |
golangRed Hat:enterprise_linux_eus:10.0 From an advisory covering 15 CVEs | before 0:1.26.10-1.el10_0 | 0:1.26.10-1.el10_0 |
golang-binRed Hat:enterprise_linux_eus:10.0 From an advisory covering 15 CVEs | before 0:1.26.10-1.el10_0 | 0:1.26.10-1.el10_0 |
golang-docsRed Hat:enterprise_linux_eus:10.0 From an advisory covering 15 CVEs | before 0:1.26.10-1.el10_0 | 0:1.26.10-1.el10_0 |
golang-miscRed Hat:enterprise_linux_eus:10.0 From an advisory covering 15 CVEs | before 0:1.26.10-1.el10_0 | 0:1.26.10-1.el10_0 |
golang-raceRed Hat:enterprise_linux_eus:10.0 From an advisory covering 15 CVEs | before 0:1.26.10-1.el10_0 | 0:1.26.10-1.el10_0 |
golang-srcRed Hat:enterprise_linux_eus:10.0 From an advisory covering 15 CVEs | before 0:1.26.10-1.el10_0 | 0:1.26.10-1.el10_0 |
golang-testsRed Hat:enterprise_linux_eus:10.0 From an advisory covering 15 CVEs | before 0:1.26.10-1.el10_0 | 0:1.26.10-1.el10_0 |
go-toolsetRed Hat:rhel_e4s:9.2::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.el9_2 | 0:1.26.10-1.el9_2 |
golangRed Hat:rhel_e4s:9.2::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.el9_2 | 0:1.26.10-1.el9_2 |
golang-binRed Hat:rhel_e4s:9.2::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.el9_2 | 0:1.26.10-1.el9_2 |
golang-docsRed Hat:rhel_e4s:9.2::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.el9_2 | 0:1.26.10-1.el9_2 |
golang-miscRed Hat:rhel_e4s:9.2::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.el9_2 | 0:1.26.10-1.el9_2 |
golang-raceRed Hat:rhel_e4s:9.2::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.el9_2 | 0:1.26.10-1.el9_2 |
golang-srcRed Hat:rhel_e4s:9.2::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.el9_2 | 0:1.26.10-1.el9_2 |
golang-testsRed Hat:rhel_e4s:9.2::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.el9_2 | 0:1.26.10-1.el9_2 |
go-toolsetRed Hat:rhel_e4s:9.4::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.el9_4 | 0:1.26.10-1.el9_4 |
golangRed Hat:rhel_e4s:9.4::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.el9_4 | 0:1.26.10-1.el9_4 |
golang-binRed Hat:rhel_e4s:9.4::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.el9_4 | 0:1.26.10-1.el9_4 |
golang-docsRed Hat:rhel_e4s:9.4::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.el9_4 | 0:1.26.10-1.el9_4 |
golang-miscRed Hat:rhel_e4s:9.4::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.el9_4 | 0:1.26.10-1.el9_4 |
golang-raceRed Hat:rhel_e4s:9.4::appstream From an advisory covering 15 CVEs | before 0:1.26.10-1.el9_4 | 0:1.26.10-1.el9_4 |
go1.27SUSE:Linux Enterprise Server 16.0 From an advisory covering 15 CVEs | before 1.27.2-160000.1.1 | 1.27.2-160000.1.1 |
go1.27SUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 15 CVEs | before 1.27.2-160000.1.1 | 1.27.2-160000.1.1 |
go1.26SUSE:Linux Enterprise Server 16.0 From an advisory covering 3 CVEs | before 1.26.10-160000.1.1 | 1.26.10-160000.1.1 |
go1.26SUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 3 CVEs | before 1.26.10-160000.1.1 | 1.26.10-160000.1.1 |
google-guest-agentSUSE:Linux Micro 6.0 From an advisory covering 5 CVEs | before 20261022.00-159998.1.1 | 20261022.00-159998.1.1 |
google-guest-agentSUSE:Linux Micro 6.1 From an advisory covering 5 CVEs | before 20261022.00-slfo.1.1_1.1 | 20261022.00-slfo.1.1_1.1 |
google-cloud-sap-agentSUSE:Linux Enterprise Server 16.0 From an advisory covering 8 CVEs | before 3.15-160000.5.1 | 3.15-160000.5.1 |
google-cloud-sap-agentSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 8 CVEs | before 3.15-160000.5.1 | 3.15-160000.5.1 |
go1.27SUSE:Linux Enterprise Module for Development Tools 15 SP7 From an advisory covering 15 CVEs | before 1.27.2-150000.1.12.1 | 1.27.2-150000.1.12.1 |
go1.27SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 15 CVEs | before 1.27.2-150000.1.12.1 | 1.27.2-150000.1.12.1 |
go1.27SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 15 CVEs | before 1.27.2-150000.1.12.1 | 1.27.2-150000.1.12.1 |
go1.27SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 15 CVEs | before 1.27.2-150000.1.12.1 | 1.27.2-150000.1.12.1 |
go1.27SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 15 CVEs | before 1.27.2-150000.1.12.1 | 1.27.2-150000.1.12.1 |
go1.27SUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 15 CVEs | before 1.27.2-150000.1.12.1 | 1.27.2-150000.1.12.1 |
go1.27SUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 15 CVEs | before 1.27.2-150000.1.12.1 | 1.27.2-150000.1.12.1 |
go1.27SUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 15 CVEs | before 1.27.2-150000.1.12.1 | 1.27.2-150000.1.12.1 |
go1.27SUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 15 CVEs | before 1.27.2-150000.1.12.1 | 1.27.2-150000.1.12.1 |
go1.27SUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 15 CVEs | before 1.27.2-150000.1.12.1 | 1.27.2-150000.1.12.1 |
go1.27SUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 15 CVEs | before 1.27.2-150000.1.12.1 | 1.27.2-150000.1.12.1 |
go1.26SUSE:Linux Enterprise Module for Development Tools 15 SP7 From an advisory covering 3 CVEs | before 1.26.10-150000.1.36.1 | 1.26.10-150000.1.36.1 |
go1.26SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 3 CVEs | before 1.26.10-150000.1.36.1 | 1.26.10-150000.1.36.1 |
go1.26SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 3 CVEs | before 1.26.10-150000.1.36.1 | 1.26.10-150000.1.36.1 |
go1.26SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 3 CVEs | before 1.26.10-150000.1.36.1 | 1.26.10-150000.1.36.1 |
go1.26SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 3 CVEs | before 1.26.10-150000.1.36.1 | 1.26.10-150000.1.36.1 |
go1.26SUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 3 CVEs | before 1.26.10-150000.1.36.1 | 1.26.10-150000.1.36.1 |
go1.26SUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 3 CVEs | before 1.26.10-150000.1.36.1 | 1.26.10-150000.1.36.1 |
go1.26SUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 3 CVEs | before 1.26.10-150000.1.36.1 | 1.26.10-150000.1.36.1 |
go1.26SUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 3 CVEs | before 1.26.10-150000.1.36.1 | 1.26.10-150000.1.36.1 |
go1.26SUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 3 CVEs | before 1.26.10-150000.1.36.1 | 1.26.10-150000.1.36.1 |
go1.26SUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 3 CVEs | before 1.26.10-150000.1.36.1 | 1.26.10-150000.1.36.1 |
go1.26-opensslSUSE:Linux Enterprise Module for Development Tools 15 SP7 From an advisory covering 16 CVEs | before 1.26.10-150600.13.18.1 | 1.26.10-150600.13.18.1 |
go1.26-opensslSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 16 CVEs | before 1.26.10-150600.13.18.1 | 1.26.10-150600.13.18.1 |
go1.26-opensslSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 16 CVEs | before 1.26.10-150600.13.18.1 | 1.26.10-150600.13.18.1 |
go1.26-opensslSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 16 CVEs | before 1.26.10-150000.1.21.2 | 1.26.10-150000.1.21.2 |
go1.26-opensslSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 16 CVEs | before 1.26.10-150000.1.21.2 | 1.26.10-150000.1.21.2 |
go1.26-opensslSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 16 CVEs | before 1.26.10-150000.1.21.2 | 1.26.10-150000.1.21.2 |
go1.26-opensslSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 16 CVEs | before 1.26.10-150000.1.21.2 | 1.26.10-150000.1.21.2 |
go1.26-opensslSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 16 CVEs | before 1.26.10-150000.1.21.2 | 1.26.10-150000.1.21.2 |
go1.26-opensslSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 16 CVEs | before 1.26.10-150000.1.21.2 | 1.26.10-150000.1.21.2 |
go1.26-opensslSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 16 CVEs | before 1.26.10-150000.1.21.2 | 1.26.10-150000.1.21.2 |
go1.26-opensslSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 16 CVEs | before 1.26.10-150000.1.21.2 | 1.26.10-150000.1.21.2 |
kubevirtSUSE:Linux Enterprise Module for Containers 15 SP7 From an advisory covering 11 CVEs | before 1.7.4-150700.3.42.1 | 1.7.4-150700.3.42.1 |
golang-1.10Ubuntu:14.04:LTS | All versions, plus listed versions 1.10.4-2ubuntu1~14.04.1 | None known |
golang-1.10Ubuntu:16.04:LTS | All versions, plus listed versions 1.10.4-2ubuntu1~16.04.11.10.4-2ubuntu1~16.04.2 | None known |
golang-1.6Ubuntu:16.04:LTS | All versions, plus listed versions 1.6-0ubuntu11.6-0ubuntu21.6-0ubuntu31.6-0ubuntu41.6-0ubuntu5 Show 5 moreShow less1.6.1-0ubuntu11.6.2-0ubuntu5~16.041.6.2-0ubuntu5~16.04.21.6.2-0ubuntu5~16.04.31.6.2-0ubuntu5~16.04.4 | None known |
golang-golang-x-net-devUbuntu:Pro:16.04:LTS | All versions, plus listed versions 0.0+git20150226.3d87fd6-30.0+git20151007.b846920+dfsg-11:0.0+git20150817.66f0418-11:0.0+git20160110.4fd4a9f-11:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm11:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2 | None known |
juju-coreUbuntu:Pro:16.04:LTS | All versions, plus listed versions 1.24.6-0ubuntu31.25.0-0ubuntu11.25.0-0ubuntu21.25.0-0ubuntu32.0~beta4-0ubuntu2 Show 12 moreShow less2.0~beta6-0ubuntu1.16.04.12.0~beta7-0ubuntu1.16.04.12.0~beta12-0ubuntu1.16.04.12.0~beta15-0ubuntu2.16.04.12.0.0-0ubuntu0.16.04.22.0.2-0ubuntu0.16.04.12.0.2-0ubuntu0.16.04.22.3.1-0ubuntu0.16.04.12.3.2-0ubuntu0.16.04.12.3.7-0ubuntu0.16.04.12.3.7-0ubuntu0.16.04.1+esm12.3.7-0ubuntu0.16.04.1+esm2 | None known |
lxdUbuntu:Pro:16.04:LTS | All versions, plus listed versions 0.20-0ubuntu40.21-0ubuntu30.21-0ubuntu50.22-0ubuntu10.22-0ubuntu2 Show 45 moreShow less0.23-0ubuntu10.23-0ubuntu20.23-0ubuntu30.24-0ubuntu20.24-0ubuntu30.24-0ubuntu40.25-0ubuntu10.26-0ubuntu20.26-0ubuntu30.27-0ubuntu10.27-0ubuntu22.0.0~beta1-0ubuntu32.0.0~beta1-0ubuntu42.0.0~beta2-0ubuntu12.0.0~beta2-0ubuntu22.0.0~beta3-0ubuntu12.0.0~beta3-0ubuntu22.0.0~beta3-0ubuntu32.0.0~beta3-0ubuntu42.0.0~beta4-0ubuntu12.0.0~beta4-0ubuntu22.0.0~beta4-0ubuntu32.0.0~beta4-0ubuntu42.0.0~beta4-0ubuntu52.0.0~beta4-0ubuntu62.0.0~beta4-0ubuntu72.0.0~rc1-0ubuntu12.0.0~rc1-0ubuntu22.0.0~rc1-0ubuntu32.0.0~rc2-0ubuntu22.0.0~rc2-0ubuntu32.0.0~rc3-0ubuntu12.0.0~rc3-0ubuntu22.0.0~rc3-0ubuntu32.0.0~rc3-0ubuntu42.0.0~rc4-0ubuntu12.0.0~rc5-0ubuntu12.0.0~rc6-0ubuntu12.0.0~rc6-0ubuntu22.0.0~rc7-0ubuntu12.0.0~rc7-0ubuntu22.0.0~rc8-0ubuntu12.0.0~rc8-0ubuntu22.0.0~rc8-0ubuntu32.0.0~rc8-0ubuntu5 | None known |
containerdUbuntu:Pro:16.04:LTS | All versions, plus listed versions 0.2.1-0ubuntu4~16.040.2.3-0ubuntu1~16.040.2.5-0ubuntu1~16.04.11.2.6-0ubuntu1~16.04.21.2.6-0ubuntu1~16.04.3 Show 9 moreShow less1.2.6-0ubuntu1~16.04.41.2.6-0ubuntu1~16.04.51.2.6-0ubuntu1~16.04.61.2.6-0ubuntu1~16.04.6+esm11.2.6-0ubuntu1~16.04.6+esm21.2.6-0ubuntu1~16.04.6+esm41.2.6-0ubuntu1~16.04.6+esm51.2.6-0ubuntu1~16.04.6+esm61.2.6-0ubuntu1~16.04.6+esm7 | None known |
golang-1.13Ubuntu:Pro:16.04:LTS | All versions, plus listed versions 1.13.8-1ubuntu1~16.04.21.13.8-1ubuntu1~16.04.31.13.8-1ubuntu1~16.04.3+esm21.13.8-1ubuntu1~16.04.3+esm3 | None known |
golang-1.18Ubuntu:Pro:16.04:LTS | All versions, plus listed versions 1.18.1-1ubuntu1~16.04.61.18.1-1ubuntu1~16.04.6+esm1 | None known |
google-guest-agentUbuntu:Pro:16.04:LTS | All versions, plus listed versions 20201217.02-0ubuntu1~16.04.020230426.00-0ubuntu2~16.04.320231004.02-0ubuntu1~16.04.120231004.02-0ubuntu1~16.04.220240716.00-0ubuntu1~16.04.020240716.00-0ubuntu1~16.04.0+esm120240716.00-0ubuntu1~16.04.0+esm220240716.00-0ubuntu1~16.04.0+esm3 | None known |
google-osconfig-agentUbuntu:Pro:16.04:LTS | All versions, plus listed versions 20210219.00-0ubuntu1~16.04.020230504.00-0ubuntu1~16.04.020240320.00-0ubuntu1~16.04.020240524.03-0ubuntu2~16.04.020251028.00-0ubuntu2~16.04.1 | None known |
golang-1.10Ubuntu:18.04:LTS | All versions, plus listed versions 1.10~rc1-11.10~rc1-1ubuntu11.10~rc1-2ubuntu11.10~rc2-1ubuntu11.10-1ubuntu11.10.1-1ubuntu21.10.4-2ubuntu1~18.04.11.10.4-2ubuntu1~18.04.2 | None known |
lxdUbuntu:Pro:18.04:LTS | All versions, plus listed versions 2.18-0ubuntu62.19-0ubuntu12.20-0ubuntu32.20-0ubuntu42.21-0ubuntu1 Show 18 moreShow less2.21-0ubuntu22.21-0ubuntu32.21-0ubuntu43.0.0~beta2-0ubuntu33.0.0~beta3-0ubuntu33.0.0~beta5-0ubuntu23.0.0~beta7-0ubuntu13.0.0-0ubuntu13.0.0-0ubuntu23.0.0-0ubuntu33.0.0-0ubuntu43.0.1-0ubuntu1~18.04.13.0.2-0ubuntu1~18.04.13.0.3-0ubuntu1~18.04.13.0.3-0ubuntu1~18.04.23.0.3-0ubuntu1~18.04.2+esm13.0.3-0ubuntu1~18.04.2+esm23.0.3-0ubuntu1~18.04.2+esm3 | None known |
containerdUbuntu:Pro:18.04:LTS | All versions, plus listed versions 0.2.5-0ubuntu21.2.6-0ubuntu1~18.04.11.2.6-0ubuntu1~18.04.21.3.3-0ubuntu1~18.04.11.3.3-0ubuntu1~18.04.2 Show 15 moreShow less1.3.3-0ubuntu1~18.04.31.3.3-0ubuntu1~18.04.41.4.4-0ubuntu1~18.04.21.5.2-0ubuntu1~18.04.11.5.2-0ubuntu1~18.04.21.5.2-0ubuntu1~18.04.31.5.5-0ubuntu3~18.04.11.5.5-0ubuntu3~18.04.21.5.9-0ubuntu1~18.04.11.5.9-0ubuntu1~18.04.21.6.12-0ubuntu1~18.04.11.6.12-0ubuntu1~18.04.1+esm11.6.12-0ubuntu1~18.04.1+esm21.6.12-0ubuntu1~18.04.1+esm31.6.12-0ubuntu1~18.04.1+esm4 | None known |
golang-1.13Ubuntu:Pro:18.04:LTS | All versions, plus listed versions 1.13.8-1ubuntu1~18.04.21.13.8-1ubuntu1~18.04.31.13.8-1ubuntu1~18.04.41.13.8-1ubuntu1~18.04.4+esm1 | None known |
golang-1.16Ubuntu:Pro:18.04:LTS | All versions, plus listed versions 1.16.2-0ubuntu1~18.04.21.16.2-0ubuntu1~18.04.2+esm1 | None known |
golang-1.18Ubuntu:Pro:18.04:LTS | All versions, plus listed versions 1.18.1-1ubuntu1~18.04.31.18.1-1ubuntu1~18.04.41.18.1-1ubuntu1~18.04.4+esm1 | None known |
golang-1.8Ubuntu:18.04:LTS | All versions, plus listed versions 1.8.3-2ubuntu11.8.3-2ubuntu1.18.04.1 | None known |
golang-1.9Ubuntu:18.04:LTS | All versions, plus listed versions 1.9.1-2ubuntu11.9.2-1ubuntu11.9.2-3ubuntu11.9.3-1ubuntu11.9.4-1ubuntu1 | None known |
golang-golang-x-net-devUbuntu:Pro:18.04:LTS | All versions, plus listed versions 1:0.0+git20170629.c81e7f2+dfsg-1ubuntu11:0.0+git20170629.c81e7f2+dfsg-1ubuntu21:0.0+git20170629.c81e7f2+dfsg-21:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm11:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm21:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm3 | None known |
google-guest-agentUbuntu:Pro:18.04:LTS | All versions, plus listed versions 20201217.02-0ubuntu1~18.04.020210414.00-0ubuntu1~18.04.020210629.00-0ubuntu1~18.04.120220622.00-0ubuntu2~18.04.020220622.00-0ubuntu2~18.04.1 Show 8 moreShow less20230426.00-0ubuntu2~18.04.020231004.02-0ubuntu1~18.04.220231004.02-0ubuntu1~18.04.320240716.00-0ubuntu1~18.04.020241011.01-0ubuntu1~18.04.020241011.01-0ubuntu1~18.04.0+esm120241011.01-0ubuntu1~18.04.0+esm220241011.01-0ubuntu1~18.04.0+esm3 | None known |
google-osconfig-agentUbuntu:Pro:18.04:LTS | All versions, plus listed versions 20210219.00-0ubuntu1~18.04.020210608.1-0ubuntu1~18.04.120210608.1-0ubuntu1~18.04.220220824.00-0ubuntu1~18.04.120230504.00-0ubuntu1~18.04.0 Show 4 moreShow less20240320.00-0ubuntu1~18.04.020240524.03-0ubuntu2~18.04.020240926.03-0ubuntu1~18.04.020251028.00-0ubuntu2~18.04.0 | None known |
adsysUbuntu:Pro:20.04:LTS | All versions, plus listed versions 0.8~22.040.9.2~20.040.9.2~20.04.10.9.2~20.04.20.9.2~20.04.2ubuntu0.10.9.2~20.04.2ubuntu0.1+esm10.9.2~20.04.2ubuntu0.1+esm2 | None known |
containerdUbuntu:Pro:20.04:LTS | All versions, plus listed versions 1.2.10-0ubuntu11.3.2-0ubuntu11.3.3-0ubuntu11.3.3-0ubuntu21.3.3-0ubuntu2.1 Show 20 moreShow less1.3.3-0ubuntu2.21.3.3-0ubuntu2.31.4.4-0ubuntu1~20.04.21.5.2-0ubuntu1~20.04.11.5.2-0ubuntu1~20.04.21.5.2-0ubuntu1~20.04.31.5.5-0ubuntu3~20.04.11.5.5-0ubuntu3~20.04.21.5.9-0ubuntu1~20.04.11.5.9-0ubuntu1~20.04.41.5.9-0ubuntu1~20.04.51.5.9-0ubuntu1~20.04.61.6.12-0ubuntu1~20.04.11.6.12-0ubuntu1~20.04.31.6.12-0ubuntu1~20.04.51.6.12-0ubuntu1~20.04.61.6.12-0ubuntu1~20.04.71.6.12-0ubuntu1~20.04.81.6.12-0ubuntu1~20.04.8+esm11.6.12-0ubuntu1~20.04.8+esm2 | None known |
golang-1.13Ubuntu:20.04:LTS | All versions, plus listed versions 1.13.1-1ubuntu11.13.3-1ubuntu11.13.4-1ubuntu11.13.5-1ubuntu11.13.6-1ubuntu1 Show 5 moreShow less1.13.6-2ubuntu11.13.7-1ubuntu11.13.8-1ubuntu11.13.8-1ubuntu1.11.13.8-1ubuntu1.2 | None known |
golang-1.14Ubuntu:20.04:LTS | All versions, plus listed versions 1.14~beta1-11.14~beta1-21.14~rc1-11.14-11.14.1-1 Show 4 moreShow less1.14.2-11.14.2-1ubuntu11.14.3-2ubuntu2~20.04.11.14.3-2ubuntu2~20.04.2 | None known |
google-guest-agentUbuntu:Pro:20.04:LTS | All versions, plus listed versions 20201217.02-0ubuntu1~20.04.020210414.00-0ubuntu1~20.04.020210629.00-0ubuntu1~20.04.020220622.00-0ubuntu2~20.04.020220622.00-0ubuntu2~20.04.2 Show 11 moreShow less20230426.00-0ubuntu2~20.04.020231004.02-0ubuntu1~20.04.120231004.02-0ubuntu1~20.04.220231004.02-0ubuntu1~20.04.320231004.02-0ubuntu1~20.04.420240716.00-0ubuntu1~20.04.020241011.01-0ubuntu1~20.04.120250116.00-0ubuntu1~20.04.020250116.00-0ubuntu1~20.04.0+esm120250116.00-0ubuntu1~20.04.0+esm220250116.00-0ubuntu1~20.04.0+esm3 | None known |
golang-1.16Ubuntu:Pro:20.04:LTS | All versions, plus listed versions 1.16.2-0ubuntu1~20.041.16.2-0ubuntu1~20.04.11.16.2-0ubuntu1~20.04.1+esm1 | None known |
golang-1.18Ubuntu:20.04:LTS | All versions, plus listed versions 1.18.1-1ubuntu1~20.04.11.18.1-1ubuntu1~20.04.21.18.1-1ubuntu1~20.04.3 | None known |
golang-1.20Ubuntu:20.04:LTS | All versions, plus listed versions 1.20.3-1ubuntu0.1~20.041.20.3-1ubuntu0.1~20.04.1 | None known |
golang-1.21Ubuntu:20.04:LTS | All versions, plus listed versions 1.21.1-1~ubuntu20.04.11.21.1-1~ubuntu20.04.21.21.1-1~ubuntu20.04.3 | None known |
golang-golang-x-net-devUbuntu:Pro:20.04:LTS | All versions, plus listed versions 1:0.0+git20190811.74dc4d7+dfsg-11:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm11:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm21:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm3 | None known |
google-osconfig-agentUbuntu:Pro:20.04:LTS | All versions, plus listed versions 20210219.00-0ubuntu1~20.04.020210608.1-0ubuntu1~20.04.020210608.1-0ubuntu1~20.04.120220824.00-0ubuntu1~20.04.120230504.00-0ubuntu1~20.04.0 Show 6 moreShow less20240320.00-0ubuntu1~20.04.020240320.00-0ubuntu1~20.04.120240524.03-0ubuntu2~20.04.020240926.03-0ubuntu1~20.04.020250115.01-0ubuntu1~20.04.020251028.00-0ubuntu2~20.04.0 | None known |
lxdUbuntu:20.04:LTS | All versions, plus listed versions 1:0.71:0.81:0.91:0.10 | None known |
adsysUbuntu:22.04:LTS | All versions, plus listed versions 0.7.10.7.1build10.80.8ubuntu10.8.1 Show 15 moreShow less0.8.20.8.30.8.40.8.5~22.040.9.2~22.040.9.2~22.04.10.9.2~22.04.20.14.1~22.040.14.2~22.040.14.2~22.04ubuntu0.10.14.3~22.040.14.3~22.04ubuntu0.10.16.3~22.04.10.16.3~22.04.20.16.3~22.04.2ubuntu0.22.04.1 | None known |
containerdUbuntu:22.04:LTS | All versions, plus listed versions 1.5.5-0ubuntu31.5.9-0ubuntu11.5.9-0ubuntu21.5.9-0ubuntu31.5.9-0ubuntu3.1 Show 9 moreShow less1.6.12-0ubuntu1~22.04.11.6.12-0ubuntu1~22.04.31.6.12-0ubuntu1~22.04.51.6.12-0ubuntu1~22.04.61.6.12-0ubuntu1~22.04.71.6.12-0ubuntu1~22.04.81.6.12-0ubuntu1~22.04.91.6.12-0ubuntu1~22.04.101.6.12-0ubuntu1~22.04.11 | None known |
golang-1.17Ubuntu:22.04:LTS | All versions, plus listed versions 1.17-1ubuntu21.17.3-1ubuntu11.17.3-1ubuntu21.17.13-3ubuntu11.17.13-3ubuntu1.21.17.13-3ubuntu1.3 | None known |
golang-1.18Ubuntu:22.04:LTS | All versions, plus listed versions 1.18~beta1-0ubuntu11.18~beta2-1ubuntu11.18~beta2-1ubuntu21.18~rc1-1ubuntu11.18-1ubuntu1 Show 4 moreShow less1.18.1-1ubuntu11.18.1-1ubuntu1.11.18.1-1ubuntu1.21.18.1-1ubuntu1.3 | None known |
golang-1.20Ubuntu:22.04:LTS | All versions, plus listed versions 1.20.3-1ubuntu0.1~22.041.20.3-1ubuntu0.1~22.04.1 | None known |
golang-1.21Ubuntu:22.04:LTS | All versions, plus listed versions 1.21.1-1~ubuntu22.04.11.21.1-1~ubuntu22.04.21.21.1-1~ubuntu22.04.31.21.1-1~ubuntu22.04.4 | None known |
golang-1.22Ubuntu:22.04:LTS | before 1.22.2-2~22.04.4, plus listed versions 1.22.2-2~22.041.22.2-2~22.04.11.22.2-2~22.04.21.22.2-2~22.04.3 | 1.22.2-2~22.04.4 |
golang-1.23Ubuntu:22.04:LTS | All versions, plus listed versions 1.23.1-1~22.041.23.1-1~22.04.21.23.1-1~22.04.3 | None known |
golang-1.24Ubuntu:22.04:LTS | All versions, plus listed versions 1.24.4-1ubuntu1~22.04.11.24.4-1ubuntu1~22.04.21.24.13-2~22.04.11.24.13-2~22.04.2 | None known |
golang-1.25Ubuntu:22.04:LTS | All versions, plus listed versions 1.25.14-1~ubuntu0.22.04.1 | None known |
golang-1.26Ubuntu:22.04:LTS | All versions, plus listed versions 1.26.8-1~ubuntu0.22.04.2 | None known |
google-guest-agentUbuntu:22.04:LTS | All versions, plus listed versions 20210629.00-0ubuntu120210629.00-0ubuntu220220104.00-0ubuntu120220104.00-0ubuntu220220622.00-0ubuntu2~22.04.0 Show 14 moreShow less20220622.00-0ubuntu2~22.04.120230426.00-0ubuntu2~22.04.020231004.02-0ubuntu1~22.04.120231004.02-0ubuntu1~22.04.220231004.02-0ubuntu1~22.04.320231004.02-0ubuntu1~22.04.420231004.02-0ubuntu1~22.04.520240716.00-0ubuntu1~22.04.020241011.01-0ubuntu1~22.04.020250116.00-0ubuntu1~22.04.020250116.00-0ubuntu1~22.04.120250116.00-0ubuntu1~22.04.220250116.00-0ubuntu1~22.04.320250116.00-0ubuntu1~22.04.4 | None known |
google-osconfig-agentUbuntu:22.04:LTS | All versions, plus listed versions 20210608.1-0ubuntu120210608.1-0ubuntu220210608.1-0ubuntu320220824.00-0ubuntu1~22.04.120220824.00-0ubuntu1~22.04.2 Show 10 moreShow less20230504.00-0ubuntu1~22.04.020230504.00-0ubuntu1~22.04.120240320.00-0ubuntu1~22.04.020240320.00-0ubuntu1~22.04.120240524.03-0ubuntu2~22.04.020240524.03-0ubuntu2~22.04.120240926.03-0ubuntu1~22.04.020250115.01-0ubuntu1~22.04.020251028.00-0ubuntu2~22.04.020251028.00-0ubuntu2~22.04.1 | None known |
golang-1.13Ubuntu:Pro:22.04:LTS | All versions, plus listed versions 1.13.8-1ubuntu21.13.8-1ubuntu2.22.04.11.13.8-1ubuntu2.22.04.1+esm11.13.8-1ubuntu2.22.04.2 | None known |
golang-golang-x-netUbuntu:22.04:LTS | All versions, plus listed versions 1:0.0+git20210119.5f4716e+dfsg-41:0.0+git20210805.aaa1db6+dfsg-11:0.0+git20211209.491a49a+dfsg-11:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm11:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm21:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm31:0.0+git20211209.491a49a+dfsg-1ubuntu0.1 | None known |
go1.27openSUSE:Tumbleweed From an advisory covering 15 CVEs | before 1.27.2-1.1 | 1.27.2-1.1 |
rcloneopenSUSE:Tumbleweed From an advisory covering 16 CVEs | before 1.75.2-1.1 | 1.75.2-1.1 |
vexctlopenSUSE:Tumbleweed From an advisory covering 5 CVEs | before 0.4.4+git106.aa6ffc8-1.1 | 0.4.4+git106.aa6ffc8-1.1 |
go1.26openSUSE:Tumbleweed From an advisory covering 3 CVEs | before 1.26.10-1.1 | 1.26.10-1.1 |
kyvernoopenSUSE:Tumbleweed From an advisory covering 3 CVEs | before 1.19.2-1.1 | 1.19.2-1.1 |
git-bugopenSUSE:Tumbleweed From an advisory covering 13 CVEs | before 0.11.0-3.1 | 0.11.0-3.1 |
amazon-cloudwatch-agentopenSUSE:Tumbleweed From an advisory covering 2 CVEs | before 1.300073.2-2.1 | 1.300073.2-2.1 |
azure-storage-azcopyopenSUSE:Tumbleweed From an advisory covering 2 CVEs | before 10.34.1-1.1 | 10.34.1-1.1 |
distributionopenSUSE:Tumbleweed From an advisory covering 4 CVEs | before 3.1.2-3.1 | 3.1.2-3.1 |
google-guest-agentopenSUSE:Tumbleweed From an advisory covering 2 CVEs | before 20261022.00-1.1 | 20261022.00-1.1 |
google-osconfig-agentopenSUSE:Tumbleweed From an advisory covering 2 CVEs | before 20261022.00-1.1 | 20261022.00-1.1 |
hugoopenSUSE:Tumbleweed | before 0.168.0-3.1 | 0.168.0-3.1 |
timoniopenSUSE:Tumbleweed From an advisory covering 14 CVEs | before 0.36.0-1.1 | 0.36.0-1.1 |
cadvisoropenSUSE:Tumbleweed From an advisory covering 2 CVEs | before 0.60.6-5.1 | 0.60.6-5.1 |
helmopenSUSE:Tumbleweed From an advisory covering 5 CVEs | before 4.3.1-3.1 | 4.3.1-3.1 |
amazon-ssm-agentopenSUSE:Tumbleweed | before 3.3.5708.0-1.1 | 3.3.5708.0-1.1 |
alloyopenSUSE:Tumbleweed From an advisory covering 7 CVEs | before 1.21.3-1.1 | 1.21.3-1.1 |
go1.27openSUSE:Leap 16.0 From an advisory covering 15 CVEs | before 1.27.2-160000.1.1 | 1.27.2-160000.1.1 |
go1.26openSUSE:Leap 16.0 From an advisory covering 3 CVEs | before 1.26.10-160000.1.1 | 1.26.10-160000.1.1 |
kubevirt1.9openSUSE:Leap 16.0 From an advisory covering 6 CVEs | before 1.9.1-160000.1.1 | 1.9.1-160000.1.1 |
cadvisoropenSUSE:Leap 16.0 From an advisory covering 2 CVEs | before 0.60.6-bp160.4.1 | 0.60.6-bp160.4.1 |
google-cloud-sap-agentopenSUSE:Leap 16.0 From an advisory covering 8 CVEs | before 3.15-160000.5.1 | 3.15-160000.5.1 |
What each source reports
CVE List Score used
Double flow control refund on HTTP/2 server streams in net/http
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
CVE-2026-78663- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-675
- Updated
- 2026-11-02
EUVDEUVD-2026-95427
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
EUVD-2026-95427- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
NVD
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
CVE-2026-78663- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-675
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-78663
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
ALPINE-CVE-2026-78663- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-03
OSVBELL-CVE-2026-78663
- Record
BELL-CVE-2026-78663- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-78663
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
DEBIAN-CVE-2026-78663- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
Show 47 moreShow less
OSVOESA-2026-4768
golang security update
.
Security Fix(es):
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.(CVE-2026-32280)
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.(CVE-2026-78659)
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.(CVE-2026-78663)
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.(CVE-2026-78669)
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.(CVE-2026-94439)
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.(CVE-2026-94447)
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.(CVE-2026-97032)
- Record
OESA-2026-4768- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-11
OSVOESA-2026-4769
golang security update
.
Security Fix(es):
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.(CVE-2026-32280)
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.(CVE-2026-78659)
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.(CVE-2026-78663)
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.(CVE-2026-78669)
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.(CVE-2026-94439)
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.(CVE-2026-94447)
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.(CVE-2026-97032)
- Record
OESA-2026-4769- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-11
OSVOESA-2026-4770
golang security update
.
Security Fix(es):
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.(CVE-2026-32280)
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.(CVE-2026-78659)
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.(CVE-2026-78663)
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.(CVE-2026-78669)
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.(CVE-2026-94439)
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.(CVE-2026-97032)
- Record
OESA-2026-4770- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-11
OSVOESA-2026-4771
golang security update
.
Security Fix(es):
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.(CVE-2026-32280)
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.(CVE-2026-78659)
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.(CVE-2026-78663)
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.(CVE-2026-78669)
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.(CVE-2026-94439)
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.(CVE-2026-94447)
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.(CVE-2026-97032)
- Record
OESA-2026-4771- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-11
OSVRHSA-2026:86093
Red Hat Security Advisory: golang security, bug fix, and enhancement update
- Record
RHSA-2026:86093- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-14
OSVRHSA-2026:86196
Red Hat Security Advisory: golang security, bug fix, and enhancement update
- Record
RHSA-2026:86196- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-14
OSVRHSA-2026:86203
Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update
- Record
RHSA-2026:86203- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-14
OSVRHSA-2026:87040
Red Hat Security Advisory: golang security, bug fix, and enhancement update
- Record
RHSA-2026:87040- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVRHSA-2026:87041
Red Hat Security Advisory: golang security, bug fix, and enhancement update
- Record
RHSA-2026:87041- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-14
OSVRHSA-2026:87042
Red Hat Security Advisory: golang security, bug fix, and enhancement update
- Record
RHSA-2026:87042- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-14
OSVRHSA-2026:87043
Red Hat Security Advisory: golang security, bug fix, and enhancement update
- Record
RHSA-2026:87043- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-14
OSVRHSA-2026:87245
Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update
- Record
RHSA-2026:87245- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L - Updated
- 2026-11-13
OSVRHSA-2026:87246
Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update
- Record
RHSA-2026:87246- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L - Updated
- 2026-11-13
OSVRHSA-2026:90994
Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update
- Record
RHSA-2026:90994- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L - Updated
- 2026-11-13
OSVUBUNTU-CVE-2026-78663
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
UBUNTU-CVE-2026-78663- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2026:86093No score
Important: golang security, bug fix, and enhancement update
The golang packages provide the Go programming language compiler.
Security Fix(es):
- net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
- crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
- net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
- golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)
Bug Fix(es) and Enhancement(s):
- Update Go to version 1.26.10+1 [almalinux-10.2.z] (JIRA:AlmaLinux-287191)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:86093- Updated
- 2026-11-02
OSVALSA-2026:86196No score
Important: golang security, bug fix, and enhancement update
The golang packages provide the Go programming language compiler.
Security Fix(es):
- net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
- crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
- net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
- golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)
Bug Fix(es) and Enhancement(s):
- Update Go to version 1.26.10+1 [almalinux-9.8.z] (JIRA:AlmaLinux-287192)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:86196- Updated
- 2026-11-02
OSVALSA-2026:86203No score
Important: go-toolset:rhel8 security, bug fix, and enhancement update
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.
Security Fix(es):
- net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
- crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
- net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
- golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)
Bug Fix(es) and Enhancement(s):
- Update Go to version 1.26.10+1 [almalinux-8.10.z] (JIRA:AlmaLinux-287193)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:86203- Updated
- 2026-11-02
OSVAZL-107024No score
CVE-2026-78663 affecting package azl-otel-collector 0.127.0-1
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107024- Updated
- 2026-11-05
OSVAZL-107051No score
CVE-2026-78663 affecting package buildah 1.43.1-3
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107051- Updated
- 2026-11-05
OSVAZL-107066No score
CVE-2026-78663 affecting package cri-o 1.30.1-1
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107066- Updated
- 2026-11-05
OSVAZL-107093No score
CVE-2026-78663 affecting package kata-containers-preview 3.27.0~preview2-2
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107093- Updated
- 2026-11-05
OSVAZL-107120No score
CVE-2026-78663 affecting package podman 5.6.1-10
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107120- Updated
- 2026-11-05
OSVAZL-107147No score
CVE-2026-78663 affecting package application-gateway-kubernetes-ingress 1.7.7-6
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107147- Updated
- 2026-11-02
OSVAZL-107162No score
CVE-2026-78663 affecting package azcopy 10.25.1-9
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107162- Updated
- 2026-11-02
OSVAZL-107168No score
CVE-2026-78663 affecting package azurelinux-image-tools 1.6.0-3
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107168- Updated
- 2026-11-02
OSVAZL-107192No score
CVE-2026-78663 affecting package cert-manager for versions less than 1.12.15-15
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107192- Updated
- 2026-11-05
OSVAZL-107207No score
CVE-2026-78663 affecting package cf-cli 8.7.11-9
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107207- Updated
- 2026-11-02
OSVAZL-107219No score
CVE-2026-78663 affecting package cloud-provider-kubevirt for versions less than 0.5.1-10
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107219- Updated
- 2026-11-05
OSVAZL-107246No score
CVE-2026-78663 affecting package containerd2 2.3.4-1
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107246- Updated
- 2026-11-02
OSVAZL-107264No score
CVE-2026-78663 affecting package containerized-data-importer for versions less than 1.62.0-9
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107264- Updated
- 2026-11-05
OSVAZL-107276No score
CVE-2026-78663 affecting package coredns 1.11.4-21
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107276- Updated
- 2026-11-02
OSVAZL-107294No score
CVE-2026-78663 affecting package cri-tools 1.32.0-8
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107294- Updated
- 2026-11-02
OSVAZL-107318No score
CVE-2026-78663 affecting package docker-buildx 0.14.0-17
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107318- Updated
- 2026-11-02
OSVAZL-107330No score
CVE-2026-78663 affecting package docker-cli 25.0.7-5
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107330- Updated
- 2026-11-02
OSVAZL-107363No score
CVE-2026-78663 affecting package docker-compose 2.27.0-14
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107363- Updated
- 2026-11-02
OSVAZL-107366No score
CVE-2026-78663 affecting package etcd for versions less than 3.5.35-1
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107366- Updated
- 2026-11-06
OSVAZL-107384No score
CVE-2026-78663 affecting package flannel 0.24.2-32
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107384- Updated
- 2026-11-02
OSVAZL-107412No score
CVE-2026-78663 affecting package gh 2.101.0-1
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107412- Updated
- 2026-11-02
OSVAZL-107427No score
CVE-2026-78663 affecting package git-lfs 3.6.1-6
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107427- Updated
- 2026-11-02
OSVAZL-107508No score
CVE-2026-78663 affecting package ignition-flatcar 2.22.0-6
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107508- Updated
- 2026-11-02
OSVAZL-107523No score
CVE-2026-78663 affecting package influxdb for versions less than 2.7.5-22
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107523- Updated
- 2026-11-05
OSVAZL-107541No score
CVE-2026-78663 affecting package jx 3.10.182-5
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107541- Updated
- 2026-11-02
OSVAZL-107567No score
CVE-2026-78663 affecting package kata-containers for versions less than 4.1.0.kata1-2
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107567- Updated
- 2026-11-05
OSVAZL-107592No score
CVE-2026-78663 affecting package kata-containers-cc for versions less than 3.15.0.aks0-23
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107592- Updated
- 2026-11-05
OSVAZL-107616No score
CVE-2026-78663 affecting package keda 2.14.1-19
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107616- Updated
- 2026-11-02
OSVAZL-107628No score
CVE-2026-78663 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.
- Record
AZL-107628- Updated
- 2026-11-05
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, aliases_more, references | OSV | |
| affected | OSV | |
| affected, aliases | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases | ||
| affected, aliases, references | OSV | |
| affected | OSV | |
| affected | ||
| affected, aliases | OSV |
Show 6 moreShow less
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected, aliases, facts, references | OSV | |
| affected, aliases, references | OSV | |
| aliases | ||
| affected, affected_more, aliases, aliases_more, references | ||
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
go.dev/cl/847187
groups.google.com/g/golang-announce/c/U2fTuyDJznI
pkg.go.dev/vuln/GO-2026-6612
Show 194 moreShow less
security.alpinelinux.org/vuln/CVE-2026-78663
access.redhat.com/errata/RHSA-2026:86093
bugzilla.redhat.com/2548334
errata.almalinux.org/10/ALSA-2026-86093.html
redhat.com/security/data/cve/CVE-2026-56866.html
nvd.nist.gov/vuln/detail/CVE-2026-78663
docs.bell-sw.com/security/cves/CVE-2026-78663
security-tracker.debian.org/tracker/CVE-2026-78663
advisories.mageia.org/MGASA-2026-0497.html
bugs.mageia.org/show_bug.cgi?id=36481
openwall.com/lists/oss-security/2026/10/08/9
rclone.org/changelog
github.com/rclone/rclone/security/advisories/GHSA-hvpr-p4pv-4f46
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4768
issues.redhat.com/browse/RHEL-287191
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_86093.json
cve.org/CVERecord?id=CVE-2026-56866
suse.com/support/update/announcement/2026/suse-su-202624237-1
bugzilla.suse.com/1272545
ubuntu.com/security/CVE-2026-78663
Left out here: 108 package rows, 26 versions and 293 references. The JSON record has them. Also not on the record: 10 aliases. ID and package lookups still check them. Left out on purpose, here and in the API, to keep responses small: 59 source records.