nova

3 results · Clear filters · Feed

• Critical 9.1
  CVE-2026-78663

  Double flow control refund on HTTP/2 server streams in net/http

  The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 8, 2026
• Critical 9.6
  CVE-2026-39821

  Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

  The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …

  Go standard library golang.org/x/net net/http net/http/internal/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 22, 2026
• Critical 9.1
  CVE-2025-68121

  Unexpected session resumption in crypto/tls

  During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user ca…

  Go standard library crypto/tls langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Feb 5, 2026