Snyk test report

Time-of-check Time-of-use (TOCTOU)

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream libacl package and not the libacl package as distributed by RHEL. See How to fix? for RHEL:9 relevant fixed versions and status.

acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.

Remediation

Upgrade RHEL:9 libacl to version 0:2.4.0-1.el9_8 or higher.
This issue was patched in RHSA-2026:42736.

References

• https://access.redhat.com/security/cve/CVE-2026-54370
• https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5
• https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1
• https://www.vulncheck.com/advisories/acl-toctou-symlink-traversal-via-getfacl-setfacl-chacl

---

Link Following

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream libacl package and not the libacl package as distributed by RHEL. See How to fix? for RHEL:9 relevant fixed versions and status.

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.

Remediation

Upgrade RHEL:9 libacl to version 0:2.4.0-1.el9_8 or higher.
This issue was patched in RHSA-2026:42736.

References

• https://access.redhat.com/security/cve/CVE-2026-54369
• https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5
• https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1
• https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions
• https://access.redhat.com/errata/RHSA-2026:42736
• https://bugzilla.redhat.com/show_bug.cgi?id=2490277
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json

---

Allocation of Resources Without Limits or Throttling

---

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 DATA frame receive buffer handling, where each received fragment incurs per-fragment tracking and queue allocation overhead even while staying within the configured flow-control windows. An attacker can drive the process to an OutOfMemory condition or a runtime panic by opening gRPC streams and fragmenting payloads into millions of tiny HTTP/2 DATA frames, such as 1 byte each, across many concurrent multiplexed streams. This requires only the ability to establish gRPC stream connections to the server.

Remediation

Upgrade google.golang.org/grpc/mem to version 1.83.1 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR
• GitHub Release

---

Incorrect Authorization

---

Overview

Affected versions of this package are vulnerable to Incorrect Authorization in the processing of xDS RBAC policies and HTTP/2 transport handling. An attacker can gain unauthorized access to protected services or cause denial of service by exploiting improper handling of unsupported fields in policy matchers, bypassing rapid reset mitigations, or triggering server panics through crafted policy updates.

Note: This advisory refers to several vulnerabilities as aggregated by the maintainer. For an exact breakdown and affected code, see the Maintainer's referenced advisory and commit.

Workaround

This vulnerability can be mitigated by ensuring xDS management servers do not push RBAC policies with unsupported fields or NOT rules wrapping unhandled fields, and by configuring upstream reverse proxies or load balancers with strict HTTP/2 max_concurrent_streams limits and active rate limiting on RST_STREAM frequency per connection.

Remediation

Upgrade google.golang.org/grpc/internal/xds/rbac to version 1.82.1 or higher.

References

• GitHub Commit
• GitHub PR
• Maintainer's Advisory

---

Incorrect Authorization

---

Overview

Affected versions of this package are vulnerable to Incorrect Authorization in the processing of xDS RBAC policies and HTTP/2 transport handling. An attacker can gain unauthorized access to protected services or cause denial of service by exploiting improper handling of unsupported fields in policy matchers, bypassing rapid reset mitigations, or triggering server panics through crafted policy updates.

Note: This advisory refers to several vulnerabilities as aggregated by the maintainer. For an exact breakdown and affected code, see the Maintainer's referenced advisory and commit.

Workaround

This vulnerability can be mitigated by ensuring xDS management servers do not push RBAC policies with unsupported fields or NOT rules wrapping unhandled fields, and by configuring upstream reverse proxies or load balancers with strict HTTP/2 max_concurrent_streams limits and active rate limiting on RST_STREAM frequency per connection.

Remediation

Upgrade google.golang.org/grpc/internal/transport to version 1.82.1 or higher.

References

• GitHub Commit
• GitHub PR
• Maintainer's Advisory

---

Allocation of Resources Without Limits or Throttling

---

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 DATA frame receive buffer handling, where each received fragment incurs per-fragment tracking and queue allocation overhead even while staying within the configured flow-control windows. An attacker can drive the process to an OutOfMemory condition or a runtime panic by opening gRPC streams and fragmenting payloads into millions of tiny HTTP/2 DATA frames, such as 1 byte each, across many concurrent multiplexed streams. This requires only the ability to establish gRPC stream connections to the server.

Remediation

Upgrade google.golang.org/grpc/internal/transport to version 1.83.1 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR
• GitHub Release

---

Uncaught Exception

---

Overview

Affected versions of this package are vulnerable to Uncaught Exception through the HTTP/2 header processing path in internal/transport/http2_server.go and internal/xds/server/routing.go. An attacker can crash the server by sending a gRPC request that omits both the :authority and Host headers. In xds.NewGRPCServer() deployments, that malformed request reaches the xDS routing interceptor, which expects an authority value and then indexes into an empty header slice. The resulting panic terminates the server process, causing a complete outage for clients connected to that gRPC server.

Remediation

Upgrade google.golang.org/grpc/internal/transport to version 1.82.2, 1.83.2 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Issue
• GitHub PR
• GitHub PR
• GitHub PR
• Maintainer's Advisory

---

Allocation of Resources Without Limits or Throttling

---

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 DATA frame receive buffer handling, where each received fragment incurs per-fragment tracking and queue allocation overhead even while staying within the configured flow-control windows. An attacker can drive the process to an OutOfMemory condition or a runtime panic by opening gRPC streams and fragmenting payloads into millions of tiny HTTP/2 DATA frames, such as 1 byte each, across many concurrent multiplexed streams. This requires only the ability to establish gRPC stream connections to the server.

Remediation

Upgrade google.golang.org/grpc/internal/mem to version 1.83.1 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR
• GitHub Release

---

Allocation of Resources Without Limits or Throttling

---

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 DATA frame receive buffer handling, where each received fragment incurs per-fragment tracking and queue allocation overhead even while staying within the configured flow-control windows. An attacker can drive the process to an OutOfMemory condition or a runtime panic by opening gRPC streams and fragmenting payloads into millions of tiny HTTP/2 DATA frames, such as 1 byte each, across many concurrent multiplexed streams. This requires only the ability to establish gRPC stream connections to the server.

Remediation

Upgrade google.golang.org/grpc/internal/envconfig to version 1.83.1 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR
• GitHub Release

---

Allocation of Resources Without Limits or Throttling

---

Overview

golang.org/x/crypto/ssh is a SSH client and server

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in its connection multiplexing, reached through Dial, NewClientConn, NewControlClientConn, and NewServerConn, which buffers unhandled messages that fall outside the RFC 4254 channel and global-request handling instead of treating them as protocol errors. A malicious peer can deadlock the entire SSH connection by sending unexpected messages once a channel has been established. This requires a completed handshake and an open SSH channel with the attacker as the peer.

Remediation

Upgrade golang.org/x/crypto/ssh to version 0.56.0 or higher.

References

• Go Advisory
• Go Commit
• Go Issue
• Google Groups Forum

---

Allocation of Resources Without Limits or Throttling

---

Overview

golang.org/x/crypto/ssh is a SSH client and server

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the connection multiplexer's channel handling (the mux chanList), reached through Dial, NewClientConn, NewControlClientConn, and NewServerConn, where a channel that is registered but not yet established has its incomingRequests queue flooded without bound. A malicious peer can deadlock the entire SSH connection by flooding channel request packets for a channel before it becomes established. This requires the attacker to participate in an SSH connection with the victim over the library.

Remediation

Upgrade golang.org/x/crypto/ssh to version 0.56.0 or higher.

References

• Go Advisory
• Go Commit
• Go Issue
• Google Groups Forum

---

Open Redirect

---

Overview

Affected versions of this package are vulnerable to Open Redirect in the RedirectHandler function. An attacker can obtain sensitive information such as session cookies, proxy credentials, and API keys by inducing a cross-host or cross-scheme redirect, causing these headers to be forwarded to an attacker-controlled server.

Remediation

Upgrade github.com/microsoft/kiota-http-go to version 1.5.5 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit

---

Integer Overflow

---

Overview

Affected versions of this package are vulnerable to Integer Overflow leading to an out-of-bounds write in the s2.NewDict() function in s2/dict.go, which reads a uvarint and converts it to int without checking whether it exceeds MaxInt64. An attacker can crash the process with a segmentation fault by supplying S2 dictionary data whose repeat-index uvarint exceeds MaxInt64, which becomes a negative int that bypasses the index validation and drives out-of-bounds arithmetic through unsafe.Pointer in Dict.Encode(). Exploitation requires the application to build an S2 dictionary from attacker-controlled data with s2.NewDict() and then call Dict.Encode() on input of at least 32 bytes.

Remediation

Upgrade github.com/klauspost/compress/s2 to version 1.18.7 or higher.

References

• GitHub Advisory
• GitHub Commit
• Go Advisory

---

Integer Overflow or Wraparound

---

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the decoding process. An attacker can cause application crashes or bypass memory allocation limits by supplying specially crafted Avro data that exploits integer arithmetic errors during decoding operations. This can result in panics, memory allocation issues, or incorrect data processing.

Remediation

There is no fixed version for github.com/hamba/avro/v2/ocf.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR

---

Infinite loop

---

Overview

Affected versions of this package are vulnerable to Infinite loop through the Avro Decoder process. An attacker can exhaust CPU resources by providing a specially crafted payload with a large block-count value, causing the decoder to perform excessive iterations before propagating an error.

Remediation

There is no fixed version for github.com/hamba/avro/v2.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR

---

Integer Overflow or Wraparound

---

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the decoding process. An attacker can cause application crashes or bypass memory allocation limits by supplying specially crafted Avro data that exploits integer arithmetic errors during decoding operations. This can result in panics, memory allocation issues, or incorrect data processing.

Remediation

There is no fixed version for github.com/hamba/avro/v2.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR

---

Allocation of Resources Without Limits or Throttling

---

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the mapDecoder.Decode and mapDecoderUnmarshaler.Decode methods in codec_map.go, which use the attacker-controlled map block element count both to pre-size the destination map and as the read loop bound with no per-block or cumulative upper limit. An attacker can exhaust process memory and terminate the process with an out-of-memory error by supplying Avro data whose map block header declares a very large element count, or by splitting a large map across many small blocks that accumulate past any per-block threshold. Exploitation requires the application to decode untrusted Avro data containing map structures.

Workaround

This vulnerability can be avoided by decoding untrusted Avro in a memory-constrained child process or cgroup, bounding any oversized map allocation so it cannot exhaust the whole host.

Remediation

There is no fixed version for github.com/hamba/avro/v2.

References

• GitHub Advisory
• GitHub Commit
• Go Advisory

---

Integer Overflow or Wraparound

---

Overview

github.com/apache/thrift/lib/go/thrift is a Go implementation of the Apache Thrift library.

Affected versions of this package are vulnerable to Integer Overflow or Wraparound due to improper handling of integer values in the TFramedTransport() function on 32-bit architectures. An attacker can cause resource exhaustion or unexpected behavior by sending specially crafted input that triggers an integer overflow.

Note:

• As explained in fix PR Description, the initial fix, which was introduced in 0.23.0, was incomplete and could fail on 32-bit systems. While this version partially resolves the issue, we recommend using 0.24.0, which includes the complete patch.

Remediation

Upgrade github.com/apache/thrift/lib/go/thrift to version 0.24.0 or higher.

References

• Apache Mailing List
• GitHub Commit
• GitHub Commit (Issue introduced in)
• GitHub PR
• OSS Security Advisory
• Red Hat Bugzilla Bug

---

Improper Handling of Highly Compressed Data (Data Amplification)

---

Overview

github.com/apache/thrift/lib/go/thrift is a Go implementation of the Apache Thrift library.

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) via the TZlibTransport read paths in the C++, Java, Python, and Go bindings. An attacker can exhaust memory or trigger a denial of service by sending a small zlib-compressed payload that expands beyond the transport’s intended message-size limits during decompression. The vulnerable code reads decompressed bytes without consistently counting them against the configured maximum message size, so repeated reads through TZlibTransport can keep accepting output from a highly compressed stream even after the limit should have been exceeded. This breaks applications that rely on Thrift’s message-size enforcement to cap untrusted input before it is fully decompressed.

Notes

• In the Java and Go bindings, the vulnerable path is the stream-oriented read() behavior of TZlibTransport; applications that only write-through or otherwise avoid reading decompressed data are not exposed through this bug.
• The Python bindings expose an explicit decompressed-size limit parameter, and the default cap in Python tracks HARD_MAX_FRAME_SIZE; deployments that override those constructors may see a different effective ceiling.

Remediation

Upgrade github.com/apache/thrift/lib/go/thrift to version 0.24.0 or higher.

References

• Apache Security Advisory
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• OSS Security Advisory
• Red Hat Bugzilla Bug

---

Infinite loop

---

Overview

github.com/apache/thrift/lib/go/thrift is a Go implementation of the Apache Thrift library.

Affected versions of this package are vulnerable to Infinite loop in TCompactProtocol varint decoding, which reads continuation bytes without enforcing a maximum byte count. An attacker can hang the process deserializing a message by sending a TCompactProtocol varint whose continuation bit stays set across an unbounded run of bytes. This requires the application to deserialize attacker-controlled TCompactProtocol input.

Remediation

Upgrade github.com/apache/thrift/lib/go/thrift to version 0.24.0 or higher.

References

• Apache Mailing List
• GitHub Commit
• OSS Security Advisory

---