Summary
[1.2.11-3]
- Rebuild for CVE-2026-111943
- Resolves: RHEL-287608
[1.2.11-2]
- rebuild with golang to fix CVE-2026-33811
- Resolves: RHEL-187133
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | oci-seccomp-bpf-hook | 0:1.2.11-3.el10_2 |
Vulnerabilities 3
-
High 7.5
Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.
-
High 7.5
Lack of limit on size of parsed Range headers in net/http
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.
-
Medium 6.8CVE-2026-111943 Public exploit
Distrust compromised intermediate certificates in crypto/x509
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in cr…