Skip to content
OpenAdvisories
High RHSA-2026:80765 4 CVEs

Red Hat Security Advisory: goose security update

Published Oct 14, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.2 goose 0:1.45.0-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 goose-debuginfo 0:1.45.0-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 goose-debugsource 0:1.45.0-1.el10_2

Vulnerabilities 4

  • High 8.2
    CVE-2026-63127

    RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery

    RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discover_oauth_server_via_resource…

    Model Context Protocol rust-sdk rmcp crates.io
  • High 7.5
    CVE-2026-63128

    RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service

    RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's stateful Streamable HTTP server in crates/rmcp/src/transport/streamable_http_server/tower.rs allows an unauthenticated client to send a well-formed JSON-RPC POST tha…

    Model Context Protocol rust-sdk rmcp crates.io
  • High 7.5
    CVE-2026-93599

    rustls-webpki before 0.103.13 Panic via empty BIT STRING

    rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero padding bits and no…

    rustls webpki rust kata-containers-cc Debian Ubuntu Azure Linux crates.io
  • High 7.0
    CVE-2026-72718

    goose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor

    goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the `goose review` command runs the system `git` executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose `.git…

    aaif-goose goose

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://issues.redhat.com/browse/RHEL-254954
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80765.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-63127
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2535503
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63127
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63127
  • article
    https://github.com/modelcontextprotocol/rust-sdk/commit/c1a8b29ff2cc45e7820b900dae42cbb4958089ec
  • article
    https://github.com/modelcontextprotocol/rust-sdk/pull/937
  • article
    https://github.com/modelcontextprotocol/rust-sdk/releases/tag/rmcp-v2.0.0
  • article
    https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-33f5-2c5q-wgwj
  • report
    https://access.redhat.com/security/cve/CVE-2026-63128
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2535485
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63128
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63128
  • article
    https://github.com/modelcontextprotocol/rust-sdk/commit/dfa7fd6f9309deab60bea230b041be9a3fcda846
  • article
    https://github.com/modelcontextprotocol/rust-sdk/pull/934
  • article
    https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-9pj6-vhgr-3mwh
  • report
    https://access.redhat.com/security/cve/CVE-2026-72718
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2513538
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-72718
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-72718
  • article
    https://github.com/aaif-goose/goose/commit/f8b5b7ba1fe6d006ccf6942f6b85a1bae985a2de
  • article
    https://github.com/aaif-goose/goose/releases/tag/v1.44.0
  • article
    https://github.com/aaif-goose/goose/security/advisories/GHSA-r5pp-p5r8-466r
  • report
    https://access.redhat.com/security/cve/CVE-2026-93599
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2538431
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-93599
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-93599
  • article
    https://github.com/rustls/webpki/security/advisories/GHSA-82j2-j2ch-gfr8
  • article
    https://www.vulncheck.com/advisories/rustls-webpki-before-0.103.13-panic-via-empty-bit-string