Summary
Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um erweiterte Privilegien zu erlangen, Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand zu verursachen.
Product
Go ist eine quelloffene Programmiersprache.
Vulnerabilities 21
-
Critical 10.0CVE-2026-46595 Public exploit
Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
-
Critical 9.6
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …
-
Critical 9.1
Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited glob…
-
Critical 9.1
Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware securit…
-
Critical 9.1
Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote…
-
Critical 9.1
Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKe…
-
Critical 9.1
Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses in…
-
Critical 9.1
Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.
-
High 7.5
Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh
The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by …
-
High 7.5
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
-
Medium 6.5
Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
-
Medium 6.5
Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh
An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connect…
-
Medium 6.3
Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil…
-
Medium 6.1
Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
-
Medium 6.1
Invoking duplicate attributes can cause XSS in golang.org/x/net/html
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
-
Medium 6.1
Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
-
Medium 6.1
Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
-
Medium 5.3
OOM from malicious IFD offset in golang.org/x/image/tiff
A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.
-
Medium 5.3
Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.
-
Medium 5.3
Panic when reading out of bound palette index in golang.org/x/image/bmp
Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image.
-
Medium 5.3
Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent
For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.
Revision history
-
#103
Neue Updates von Rocky Enterprise Software Foundation und Red Hat aufgenommen
-
#102
Neue Updates von Red Hat aufgenommen
-
#101
Neue Updates von Red Hat aufgenommen
-
#100
Neue Updates von Red Hat aufgenommen
-
#99
Neue Updates von Red Hat aufgenommen
-
#98
Neue Updates von Red Hat und Oracle Linux aufgenommen
-
#97
Neue Updates von Red Hat aufgenommen
-
#96
Neue Updates von Red Hat aufgenommen
-
#95
Neue Updates von Red Hat aufgenommen
-
#94
Neue Updates von Red Hat aufgenommen
-
#93
Neue Updates von Red Hat aufgenommen
-
#92
Neue Updates von Red Hat und SUSE aufgenommen
-
#91
Neue Updates von Red Hat und Fedora aufgenommen
-
#90
Neue Updates von Red Hat aufgenommen
-
#89
Neue Updates von Red Hat und Splunk-SVD aufgenommen
-
#88
Neue Updates von openSUSE aufgenommen
-
#87
Neue Updates von Ubuntu und Red Hat aufgenommen
-
#86
Neue Updates von Red Hat aufgenommen
-
#85
Neue Updates von Red Hat und IBM aufgenommen
-
#84
Neue Updates von Red Hat aufgenommen
-
#83
Neue Updates von Red Hat aufgenommen
-
#82
Neue Updates von Splunk-SVD und Red Hat aufgenommen
-
#81
Neue Updates von Red Hat und Ubuntu aufgenommen
-
#80
Neue Updates von IBM aufgenommen
-
#79
Neue Updates von Red Hat aufgenommen
References
-
Vulnerabilities in golang.org/x/net vom 2026-05-21
https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
-
Vulnerabilities in golang.org/x/image vom 2026-05-21
https://groups.google.com/g/golang-announce/c/uhYX90BlBvI
-
Vulnerabilities in golang.org/x/crypto vom 2026-05-21
https://groups.google.com/g/golang-announce/c/a082jnz-LvI
-
openSUSE Security Update OPENSUSE-SU-2026:10842-1 vom 2026-05-24
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RA6PKGM4RN2T2DFSXXNZRPYQVODGU2NO/
-
openSUSE Security Update OPENSUSE-SU-2026:10845-1 vom 2026-05-24
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHOGVSQU7PY2NM3HOJ74FFNGCKPQAWFO/
-
openSUSE Security Update OPENSUSE-SU-2026:10908-1 vom 2026-06-02
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2VIBP73YHEJH5M2ITECIJTBYUZ4FOZFU/
-
openSUSE Security Update OPENSUSE-SU-2026:20854-1 vom 2026-06-02
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/J65AQ42VT55IOXXFWFYBKROOWSYNGFDE/
-
openSUSE Security Update OPENSUSE-SU-2026:10933-1 vom 2026-06-06
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NPIJMUPYT3P56R7MSRBUIOZYCB6ZO65J/
-
openSUSE Security Update OPENSUSE-SU-2026:10949-1 vom 2026-06-07
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HNXJU75M7TWJ7VROUNL3W5GKG5NO4PWW/
-
openSUSE Security Update OPENSUSE-SU-2026:10941-1 vom 2026-06-07
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZSXJ5ATZVALMBIFYBSJ3K2EL4SD2BAUM/
-
openSUSE Security Update OPENSUSE-SU-2026:10923-1 vom 2026-06-05
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RZPD6LKSJ4W7P4HDPG2WAORVZ6FW66HB/
-
openSUSE Security Update OPENSUSE-SU-2026:20902-1 vom 2026-06-05
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WRX7QSYY4H3GAFKW4L37MDF543ZQRKHS/
-
SUSE Security Update SUSE-SU-2026:2285-1 vom 2026-06-05
https://lists.suse.com/pipermail/sle-security-updates/2026-June/026599.html
-
openSUSE Security Update OPENSUSE-SU-2026:10921-1 vom 2026-06-05
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EFQITHNC7L7OCGIHU3ZTM3PZFHVW3KHV/
-
Amazon Linux Security Advisory ALAS2DOCKER-2026-126 vom 2026-06-08
https://alas.aws.amazon.com/AL2/ALAS2DOCKER-2026-126.html
-
Amazon Linux Security Advisory ALAS2DOCKER-2026-127 vom 2026-06-08
https://alas.aws.amazon.com/AL2/ALAS2DOCKER-2026-127.html
-
Amazon Linux Security Advisory ALAS2-2026-3334 vom 2026-06-09
https://alas.aws.amazon.com/AL2/ALAS2-2026-3334.html
-
Red Hat Security Advisory RHSA-2026:23264 vom 2026-06-08
https://access.redhat.com/errata/RHSA-2026:23264
-
Red Hat Security Advisory RHSA-2026:23262 vom 2026-06-08
https://access.redhat.com/errata/RHSA-2026:23262
-
Amazon Linux Security Advisory ALAS2NITRO-ENCLAVES-2026-109 vom 2026-06-08
https://alas.aws.amazon.com/AL2/ALAS2NITRO-ENCLAVES-2026-109.html
-
Amazon Linux Security Advisory ALAS2NITRO-ENCLAVES-2026-108 vom 2026-06-08
https://alas.aws.amazon.com/AL2/ALAS2NITRO-ENCLAVES-2026-108.html
-
openSUSE Security Update OPENSUSE-SU-2026:0195-1 vom 2026-06-09
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3KY4XRJ2VHJF7MAZ7RPSSNU5NESAI7IN/
-
Amazon Linux Security Advisory ALAS2-2026-3348 vom 2026-06-09
https://alas.aws.amazon.com/AL2/ALAS2-2026-3348.html
-
Amazon Linux Security Advisory ALAS2DOCKER-2026-128 vom 2026-06-08
https://alas.aws.amazon.com/AL2/ALAS2DOCKER-2026-128.html
-
Ubuntu Security Notice USN-8416-1 vom 2026-06-09
https://ubuntu.com/security/notices/USN-8416-1
-
Amazon Linux Security Advisory ALAS2NITRO-ENCLAVES-2026-110 vom 2026-06-12
https://alas.aws.amazon.com/AL2/ALAS2NITRO-ENCLAVES-2026-110.html
-
openSUSE Security Update OPENSUSE-SU-2026:10997-1 vom 2026-06-12
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/AFG7LYGSM4JNTUPVSGEMSQSFAA2SMB3B/
-
openSUSE Security Update OPENSUSE-SU-2026:11013-1 vom 2026-06-14
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GBPTN7BB3YBP52ECSPUJAHVS4JQQGALP/
-
Amazon Linux Security Advisory ALAS2DOCKER-2026-129 vom 2026-06-12
https://alas.aws.amazon.com/AL2/ALAS2DOCKER-2026-129.html
-
openSUSE Security Update OPENSUSE-SU-2026:20956-1 vom 2026-06-15
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VGRGQER42WVFTNZZJL62SACZXFSX5BVN/
-
openSUSE Security Update OPENSUSE-SU-2026:0205-1 vom 2026-06-15
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KAMR743637XPHFU6XF5AS6KHDIB7FGL5/
-
openSUSE Security Update OPENSUSE-SU-2026:20963-1 vom 2026-06-15
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UKSKFYSZSILUAXRFPZ5H7HLMGOAIDNMM/
-
Red Hat Security Advisory RHSA-2026:26546 vom 2026-06-17
https://access.redhat.com/errata/RHSA-2026:26546
-
Red Hat Security Advisory RHSA-2026:26547 vom 2026-06-17
https://access.redhat.com/errata/RHSA-2026:26547
-
IBM Security Bulletin 7277096 vom 2026-06-19
https://www.ibm.com/support/pages/node/7277096
-
Fedora Security Advisory FEDORA-2026-0FEB6E4967 vom 2026-06-19
https://bodhi.fedoraproject.org/updates/FEDORA-2026-0feb6e4967
-
Amazon Linux Security Advisory ALAS2ECS-2026-122 vom 2026-06-22
https://alas.aws.amazon.com/AL2/ALAS2ECS-2026-122.html
-
Amazon Linux Security Advisory ALAS2-2026-3389 vom 2026-06-22
https://alas.aws.amazon.com/AL2/ALAS2-2026-3389.html
-
Amazon Linux Security Advisory ALAS2DOCKER-2026-130 vom 2026-06-22
https://alas.aws.amazon.com/AL2/ALAS2DOCKER-2026-130.html
-
Amazon Linux Security Advisory ALAS2DOCKER-2026-131 vom 2026-06-22
https://alas.aws.amazon.com/AL2/ALAS2DOCKER-2026-131.html
-
Amazon Linux Security Advisory ALAS2DOCKER-2026-132 vom 2026-06-22
https://alas.aws.amazon.com/AL2/ALAS2DOCKER-2026-132.html
-
Amazon Linux Security Advisory ALAS2-2026-3385 vom 2026-06-22
https://alas.aws.amazon.com/AL2/ALAS2-2026-3385.html
-
Ubuntu Security Notice USN-8447-2 vom 2026-06-22
https://ubuntu.com/security/notices/USN-8447-2
-
Amazon Linux Security Advisory ALAS2-2026-3386 vom 2026-06-22
https://alas.aws.amazon.com/AL2/ALAS2-2026-3386.html
-
Amazon Linux Security Advisory ALAS2-2026-3384 vom 2026-06-22
https://alas.aws.amazon.com/AL2/ALAS2-2026-3384.html
-
Amazon Linux Security Advisory ALAS2NITRO-ENCLAVES-2026-111 vom 2026-06-22
https://alas.aws.amazon.com/AL2/ALAS2NITRO-ENCLAVES-2026-111.html
-
Red Hat Security Advisory RHSA-2026:29455 vom 2026-06-25
https://access.redhat.com/errata/RHSA-2026:29455
-
Oracle Linux Security Advisory ELSA-2026-29455 vom 2026-06-26
http://linux.oracle.com/errata/ELSA-2026-29455.html
-
SUSE Security Update SUSE-SU-2026:2636-1 vom 2026-06-25
https://lists.suse.com/pipermail/sle-security-updates/2026-June/027003.html
-
Red Hat Security Advisory RHSA-2026:30651 vom 2026-06-28
https://access.redhat.com/errata/RHSA-2026:30651
-
SUSE Security Update SUSE-SU-2026:2640-1 vom 2026-06-26
https://lists.suse.com/pipermail/sle-security-updates/2026-June/027009.html
-
Red Hat Security Advisory RHSA-2026:30650 vom 2026-06-28
https://access.redhat.com/errata/RHSA-2026:30650
-
SUSE Security Update SUSE-SU-2026:2639-1 vom 2026-06-26
https://lists.suse.com/pipermail/sle-security-updates/2026-June/027010.html
-
SUSE Security Update SUSE-SU-2026:2665-1 vom 2026-06-26
https://lists.suse.com/pipermail/sle-security-updates/2026-June/027019.html
-
Rocky Linux Security Advisory RLSA-2026:29455 vom 2026-06-26
https://errata.build.resf.org/RLSA-2026:29455
-
SUSE Security Update SUSE-SU-2026:2643-1 vom 2026-06-26
https://lists.suse.com/pipermail/sle-security-updates/2026-June/027016.html
-
Red Hat Security Advisory RHSA-2026:30855 vom 2026-06-29
https://access.redhat.com/errata/RHSA-2026:30855
-
Red Hat Security Advisory RHSA-2026:33155 vom 2026-06-29
https://access.redhat.com/errata/RHSA-2026:33155
-
Red Hat Security Advisory RHSA-2026:33160 vom 2026-06-29
https://access.redhat.com/errata/RHSA-2026:33160
-
Red Hat Security Advisory RHSA-2026:33163 vom 2026-06-29
https://access.redhat.com/errata/RHSA-2026:33163
-
Oracle Linux Security Advisory ELSA-2026-30853 vom 2026-06-29
https://linux.oracle.com/errata/ELSA-2026-30853.html
-
SUSE Security Update SUSE-SU-2026:2682-1 vom 2026-06-29
https://lists.suse.com/pipermail/sle-security-updates/2026-June/027070.html
-
Red Hat Security Advisory RHSA-2026:33183 vom 2026-06-29
https://access.redhat.com/errata/RHSA-2026:33183
-
Red Hat Security Advisory RHSA-2026:33173 vom 2026-06-30
https://access.redhat.com/errata/RHSA-2026:33173
-
SUSE Security Update SUSE-SU-2026:2683-1 vom 2026-06-29
https://lists.suse.com/pipermail/sle-security-updates/2026-June/027069.html
-
SUSE Security Update SUSE-SU-2026:22285-1 vom 2026-06-29
https://lists.suse.com/pipermail/sle-security-updates/2026-June/027039.html
-
openSUSE Security Update OPENSUSE-SU-2026:21069-1 vom 2026-06-30
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/D5MDP37ERV3TY4IQ2HNB4OK75YZBCPU2/
-
openSUSE Security Update OPENSUSE-SU-2026:21079-1 vom 2026-06-30
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/AFOVNL5466LSOBZHTPXUE54JU57XX2HM/
-
openSUSE Security Update OPENSUSE-SU-2026:21084-1 vom 2026-06-30
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RZHG3TJINIWSB5HJXEF7YBQYH2L4V7UO/
-
openSUSE Security Update OPENSUSE-SU-2026:21157-1 vom 2026-06-30
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UH3VTSIKWPFJKKGKSFZ4RE2OT5FBCXZ6/
-
Oracle Linux Security Advisory ELSA-2026-30854 vom 2026-06-30
https://linux.oracle.com/errata/ELSA-2026-30854.html
-
SUSE Security Update SUSE-SU-2026:2706-1 vom 2026-06-30
https://lists.suse.com/pipermail/sle-security-updates/2026-June/027081.html
-
Red Hat Security Advisory RHSA-2026:33531 vom 2026-06-30
https://access.redhat.com/errata/RHSA-2026:33531
-
SUSE Security Update SUSE-SU-2026:2715-1 vom 2026-06-30
https://lists.suse.com/pipermail/sle-security-updates/2026-June/027075.html
-
Rocky Linux Security Advisory RLSA-2026:30853 vom 2026-07-01
https://errata.build.resf.org/RLSA-2026:30853
-
SUSE Security Update SUSE-SU-2026:2693-1 vom 2026-06-30
https://lists.suse.com/pipermail/sle-security-updates/2026-June/027091.html
-
Red Hat Security Advisory RHSA-2026:33524 vom 2026-06-30
https://access.redhat.com/errata/RHSA-2026:33524
-
SUSE Security Update SUSE-SU-2026:2692-1 vom 2026-06-30
https://lists.suse.com/pipermail/sle-security-updates/2026-June/027092.html
-
SUSE Security Update SUSE-SU-2026:22328-1 vom 2026-07-01
https://lists.suse.com/pipermail/sle-security-updates/2026-July/027143.html
-
Red Hat Security Advisory RHSA-2026:34364 vom 2026-07-01
https://access.redhat.com/errata/RHSA-2026:34364