{ "vulnerabilities": [ { "id": "SNYK-RHEL9-LIBACL-17712955", "cpes": [ "cpe:/a:redhat:enterprise_linux:9", "cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/a:redhat:enterprise_linux:9::crb", "cpe:/a:redhat:enterprise_linux:9::extensions", "cpe:/a:redhat:enterprise_linux:9::highavailability", "cpe:/a:redhat:enterprise_linux:9::nfv", "cpe:/a:redhat:enterprise_linux:9::realtime", "cpe:/a:redhat:enterprise_linux:9::resilientstorage", "cpe:/a:redhat:enterprise_linux:9::sap", "cpe:/a:redhat:enterprise_linux:9::sap_hana", "cpe:/a:redhat:enterprise_linux:9::supplementary", "cpe:/o:redhat:enterprise_linux:9", "cpe:/o:redhat:enterprise_linux:9::baseos" ], "title": "Time-of-check Time-of-use (TOCTOU)", "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "<0:2.4.0-1.el9_8" ] }, "exploit": "Not Defined", "fixedIn": [ "0:2.4.0-1.el9_8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 6.3, "malicious": false, "isDisputed": false, "references": [ { "url": "https://access.redhat.com/security/cve/CVE-2026-54370", "title": "https://access.redhat.com/security/cve/CVE-2026-54370" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1" }, { "url": "https://www.vulncheck.com/advisories/acl-toctou-symlink-traversal-via-getfacl-setfacl-chacl", "title": "https://www.vulncheck.com/advisories/acl-toctou-symlink-traversal-via-getfacl-setfacl-chacl" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-06-30T01:28:53.701682Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-06-30T06:28:04.210171Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-16T11:03:42.002066Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-06-30T06:28:04.210171Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:53.701682Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-16T11:03:42.002066Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libacl` package and not the `libacl` package as distributed by `RHEL`._\n_See `How to fix?` for `RHEL:9` relevant fixed versions and status._\n\nacl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.\n## Remediation\nUpgrade `RHEL:9` `libacl` to version 0:2.4.0-1.el9_8 or higher. \nThis issue was patched in `RHSA-2026:42736`.\n## References\n- [https://access.redhat.com/security/cve/CVE-2026-54370](https://access.redhat.com/security/cve/CVE-2026-54370)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1)\n- [https://www.vulncheck.com/advisories/acl-toctou-symlink-traversal-via-getfacl-setfacl-chacl](https://www.vulncheck.com/advisories/acl-toctou-symlink-traversal-via-getfacl-setfacl-chacl)\n", "epssDetails": { "percentile": "0.00371", "probability": "0.00088", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54370" ], "CWE": [ "CWE-367" ], "ALTERNATIVE": [] }, "nvdSeverity": "medium", "packageName": "libacl", "creationTime": "2026-06-30T14:21:09.172521Z", "disclosureTime": "2026-06-29T13:00:00Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "rhel:9", "publicationTime": "2026-06-30T14:21:09.175279Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-10-09T17:01:01.180882Z", "socialTrendAlert": false, "relativeImportance": "Important", "severityWithCritical": "high", "from": [ "docker-image|quay.io/minio/aistor/minio@RELEASE.2026-06-06T02-44-06Z", "libacl@2.3.1-4.el9" ], "upgradePath": [ false, "libacl@0:2.4.0-1.el9_8" ], "isUpgradable": true, "isPatchable": false, "name": "libacl", "version": "2.3.1-4.el9", "nearestFixedInVersion": "0:2.4.0-1.el9_8" }, { "id": "SNYK-RHEL9-LIBACL-17713920", "cpes": [ "cpe:/a:redhat:enterprise_linux:9", "cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/a:redhat:enterprise_linux:9::crb", "cpe:/a:redhat:enterprise_linux:9::extensions", "cpe:/a:redhat:enterprise_linux:9::highavailability", "cpe:/a:redhat:enterprise_linux:9::nfv", "cpe:/a:redhat:enterprise_linux:9::realtime", "cpe:/a:redhat:enterprise_linux:9::resilientstorage", "cpe:/a:redhat:enterprise_linux:9::sap", "cpe:/a:redhat:enterprise_linux:9::sap_hana", "cpe:/a:redhat:enterprise_linux:9::supplementary", "cpe:/o:redhat:enterprise_linux:9", "cpe:/o:redhat:enterprise_linux:9::baseos" ], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "<0:2.4.0-1.el9_8" ] }, "exploit": "Not Defined", "fixedIn": [ "0:2.4.0-1.el9_8" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://access.redhat.com/security/cve/CVE-2026-54369", "title": "https://access.redhat.com/security/cve/CVE-2026-54369" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1" }, { "url": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions", "title": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42736", "title": "https://access.redhat.com/errata/RHSA-2026:42736" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `libacl` package and not the `libacl` package as distributed by `RHEL`._\n_See `How to fix?` for `RHEL:9` relevant fixed versions and status._\n\nacl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.\n## Remediation\nUpgrade `RHEL:9` `libacl` to version 0:2.4.0-1.el9_8 or higher. \nThis issue was patched in `RHSA-2026:42736`.\n## References\n- [https://access.redhat.com/security/cve/CVE-2026-54369](https://access.redhat.com/security/cve/CVE-2026-54369)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1)\n- [https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions](https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions)\n- [https://access.redhat.com/errata/RHSA-2026:42736](https://access.redhat.com/errata/RHSA-2026:42736)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490277](https://bugzilla.redhat.com/show_bug.cgi?id=2490277)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json)\n", "epssDetails": { "percentile": "0.03798", "probability": "0.00153", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54369" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "libacl", "creationTime": "2026-06-30T14:21:25.671703Z", "disclosureTime": "2026-06-29T13:00:00Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "rhel:9", "publicationTime": "2026-06-30T14:21:25.675254Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-09-30T14:05:13.375092Z", "socialTrendAlert": false, "relativeImportance": "Important", "severityWithCritical": "high", "from": [ "docker-image|quay.io/minio/aistor/minio@RELEASE.2026-06-06T02-44-06Z", "libacl@2.3.1-4.el9" ], "upgradePath": [ false, "libacl@0:2.4.0-1.el9_8" ], "isUpgradable": true, "isPatchable": false, "name": "libacl", "version": "2.3.1-4.el9", "nearestFixedInVersion": "0:2.4.0-1.el9_8" } ], "ok": false, "dependencyCount": 21, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "rpm", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": { "os": { "prettyName": "Red Hat Enterprise Linux 9.8 (Plow)" } }, "summary": "2 high or critical severity vulnerable dependency paths", "severityThreshold": "high", "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 2, "projectName": "docker-image|quay.io/minio/aistor/minio", "platform": "linux/amd64", "hasUnknownVersions": false, "path": "quay.io/minio/aistor/minio:RELEASE.2026-06-06T02-44-06Z/minio/aistor/minio", "applications": [ { "vulnerabilities": [ { "id": "SNYK-GOLANG-GITHUBCOMAPACHETHRIFTLIBGOTHRIFT-16323410", "title": "Integer Overflow or Wraparound", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<0.24.0" ], "hashesRange": [ "=0.0.0" ], "hashesRange": [ ">=v0.0.0" ], "vulnerableHashes": [] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "golang", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "github.com/hamba/avro/v2", "references": [ { "url": "https://github.com/iskorotkov/avro/security/advisories/GHSA-w8j3-pq8g-8m7w", "title": "GitHub Advisory" }, { "url": "https://github.com/iskorotkov/avro/commit/a15911450bd430f3ecd995ba1f49425fcd28b692", "title": "GitHub Commit" }, { "url": "https://github.com/iskorotkov/avro/pull/4", "title": "GitHub PR" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-16T05:25:31.281301Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:00:40.104911Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:00:40.104911Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-16T05:25:31.281301Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Infinite loop through the `Avro Decoder` process. An attacker can exhaust CPU resources by providing a specially crafted payload with a large block-count value, causing the decoder to perform excessive iterations before propagating an error.\n## Remediation\nThere is no fixed version for `github.com/hamba/avro/v2`.\n## References\n- [GitHub Advisory](https://github.com/iskorotkov/avro/security/advisories/GHSA-w8j3-pq8g-8m7w)\n- [GitHub Commit](https://github.com/iskorotkov/avro/commit/a15911450bd430f3ecd995ba1f49425fcd28b692)\n- [GitHub PR](https://github.com/iskorotkov/avro/pull/4)\n", "epssDetails": { "percentile": "0.57371", "probability": "0.00882", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-46385" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-w8j3-pq8g-8m7w" ] }, "packageName": "github.com/hamba/avro/v2", "proprietary": false, "creationTime": "2026-06-02T12:21:33.978737Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-29T21:14:26.763000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-06-02T12:21:34.177442Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:00:40.104911Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/mc@*", "github.com/hamba/avro/v2@v2.31.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "github.com/hamba/avro/v2", "version": "v2.31.0" }, { "id": "SNYK-GOLANG-GITHUBCOMHAMBAAVROV2-17130851", "title": "Integer Overflow or Wraparound", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "klajok" ], "semver": { "vulnerable": [ ">=0.0.0" ], "hashesRange": [ ">=v0.0.0" ], "vulnerableHashes": [] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "golang", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "github.com/hamba/avro/v2", "references": [ { "url": "https://github.com/iskorotkov/avro/security/advisories/GHSA-mc57-h6j3-3hmv", "title": "GitHub Advisory" }, { "url": "https://github.com/iskorotkov/avro/commit/ffa371e4e135bd371ce9481c4738b56055a23cb6", "title": "GitHub Commit" }, { "url": "https://github.com/iskorotkov/avro/pull/9", "title": "GitHub PR" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-16T05:25:25.928886Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:00:40.105308Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:00:40.105308Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-16T05:25:25.928886Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound in the decoding process. An attacker can cause application crashes or bypass memory allocation limits by supplying specially crafted Avro data that exploits integer arithmetic errors during decoding operations. This can result in panics, memory allocation issues, or incorrect data processing.\n## Remediation\nThere is no fixed version for `github.com/hamba/avro/v2`.\n## References\n- [GitHub Advisory](https://github.com/iskorotkov/avro/security/advisories/GHSA-mc57-h6j3-3hmv)\n- [GitHub Commit](https://github.com/iskorotkov/avro/commit/ffa371e4e135bd371ce9481c4738b56055a23cb6)\n- [GitHub PR](https://github.com/iskorotkov/avro/pull/9)\n", "epssDetails": { "percentile": "0.59169", "probability": "0.00938", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-46384" ], "CWE": [ "CWE-190" ], "GHSA": [ "GHSA-mc57-h6j3-3hmv" ] }, "packageName": "github.com/hamba/avro/v2", "proprietary": false, "creationTime": "2026-06-02T12:25:33.248889Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-29T21:14:33.313000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-06-02T12:25:33.410961Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:00:40.105308Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/mc@*", "github.com/hamba/avro/v2@v2.31.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "github.com/hamba/avro/v2", "version": "v2.31.0" }, { "id": "SNYK-GOLANG-GITHUBCOMHAMBAAVROV2-18365711", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Ivan Korotkov", "Daniel Błażewicz" ], "semver": { "vulnerable": [ ">=0.0.0" ], "hashesRange": [ ">=v0.0.0" ], "vulnerableHashes": [] }, "exploit": "Proof of Concept", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "golang", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "github.com/hamba/avro/v2", "references": [ { "url": "https://github.com/iskorotkov/avro/security/advisories/GHSA-mx64-mj3q-7prj", "title": "GitHub Advisory" }, { "url": "https://github.com/iskorotkov/avro/commit/5192df96a158999344ac96ebcb1f7461d626f6d7", "title": "GitHub Commit" }, { "url": "https://pkg.go.dev/vuln/GO-2026-5048", "title": "Go Advisory" } ], "cvssDetails": [], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:00:40.105627Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:00:40.105627Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `mapDecoder.Decode` and `mapDecoderUnmarshaler.Decode` methods in `codec_map.go`, which use the attacker-controlled map block element count both to pre-size the destination map and as the read loop bound with no per-block or cumulative upper limit. An attacker can exhaust process memory and terminate the process with an out-of-memory error by supplying Avro data whose map block header declares a very large element count, or by splitting a large map across many small blocks that accumulate past any per-block threshold. Exploitation requires the application to decode untrusted Avro data containing map structures.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by decoding untrusted Avro in a memory-constrained child process or cgroup, bounding any oversized map allocation so it cannot exhaust the whole host.\n## Remediation\nThere is no fixed version for `github.com/hamba/avro/v2`.\n## References\n- [GitHub Advisory](https://github.com/iskorotkov/avro/security/advisories/GHSA-mx64-mj3q-7prj)\n- [GitHub Commit](https://github.com/iskorotkov/avro/commit/5192df96a158999344ac96ebcb1f7461d626f6d7)\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-5048)\n", "epssDetails": null, "identifiers": { "GO": [ "GO-2026-5048" ], "CVE": [], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mx64-mj3q-7prj" ] }, "packageName": "github.com/hamba/avro/v2", "proprietary": false, "creationTime": "2026-07-28T15:17:51.158785Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-27T16:16:22Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-07-28T15:23:01.121517Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:00:40.105627Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/mc@*", "github.com/hamba/avro/v2@v2.31.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "github.com/hamba/avro/v2", "version": "v2.31.0" }, { "id": "SNYK-GOLANG-GITHUBCOMHAMBAAVROV2OCF-17130852", "title": "Integer Overflow or Wraparound", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "klajok" ], "semver": { "vulnerable": [ ">=0.0.0" ], "hashesRange": [ ">=v0.0.0" ], "vulnerableHashes": [] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "golang", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "github.com/hamba/avro/v2/ocf", "references": [ { "url": "https://github.com/iskorotkov/avro/security/advisories/GHSA-mc57-h6j3-3hmv", "title": "GitHub Advisory" }, { "url": "https://github.com/iskorotkov/avro/commit/ffa371e4e135bd371ce9481c4738b56055a23cb6", "title": "GitHub Commit" }, { "url": "https://github.com/iskorotkov/avro/pull/9", "title": "GitHub PR" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-16T05:25:25.928886Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:00:37.912329Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:00:37.912329Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-16T05:25:25.928886Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound in the decoding process. An attacker can cause application crashes or bypass memory allocation limits by supplying specially crafted Avro data that exploits integer arithmetic errors during decoding operations. This can result in panics, memory allocation issues, or incorrect data processing.\n## Remediation\nThere is no fixed version for `github.com/hamba/avro/v2/ocf`.\n## References\n- [GitHub Advisory](https://github.com/iskorotkov/avro/security/advisories/GHSA-mc57-h6j3-3hmv)\n- [GitHub Commit](https://github.com/iskorotkov/avro/commit/ffa371e4e135bd371ce9481c4738b56055a23cb6)\n- [GitHub PR](https://github.com/iskorotkov/avro/pull/9)\n", "epssDetails": { "percentile": "0.59169", "probability": "0.00938", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-46384" ], "CWE": [ "CWE-190" ], "GHSA": [ "GHSA-mc57-h6j3-3hmv" ] }, "packageName": "github.com/hamba/avro/v2/ocf", "proprietary": false, "creationTime": "2026-06-02T12:25:33.433861Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-29T21:14:33.313000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-06-02T12:25:33.592444Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:00:37.912329Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/mc@*", "github.com/hamba/avro/v2/ocf@v2.31.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "github.com/hamba/avro/v2/ocf", "version": "v2.31.0" }, { "id": "SNYK-GOLANG-GITHUBCOMKLAUSPOSTCOMPRESSS2-18343256", "title": "Integer Overflow", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Christopher Linke" ], "semver": { "vulnerable": [ ">=1.16.0 <1.18.7" ], "hashesRange": [ ">=v1.16.0 =1.83.0 <1.83.2" ], "hashesRange": [ "=v1.83.0 =1.83.0 <1.83.2" ], "hashesRange": [ "=v1.83.0 =1.26.0-0 <1.26.3" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\n\nA malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go command will download and execute a toolchain provided by the module proxy. A malicious module proxy can bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it, so fixed versions will refuse to execute any cached, altered versions of the toolchain. The go tool trusts go.sum files to contain accurate hashes of the current module's dependencies. A malicious proxy exploiting this vulnerability to serve an altered module will have caused an incorrect hash to be recorded in the go.sum. Users who have configured a non-trusted GOPROXY can determine if they have been affected by running \"rm go.sum ; go mod tidy ; go mod verify\", which will revalidate all dependencies of the current module. The specific flaw in more detail: The go command consults the checksum database to validate downloaded modules, when a module is not listed in the go.sum file. It verifies that the module hash reported by the checksum database matches the hash of the downloaded module. If, however, the checksum database returns a successful response that contains no entry for the module, the go command incorrectly permitted validation to succeed. A module proxy may mirror or proxy the checksum database, in which case the go command will not connect to the checksum database directly. Checksums reported by the checksum database are cryptographically signed, so a malicious proxy cannot alter the reported checksum for a module. However, a proxy which returns an empty checksum response, or a checksum response for an unrelated module, could cause the go command to proceed as if a downloaded module has been validated.\n## Remediation\nUpgrade `std/cmd/go` to version 1.25.10, 1.26.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4984)\n- [Go Commit](https://go.dev/cl/775321)\n- [Go Issue](https://go.dev/issue/79070)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/qcCIEXso47M)\n", "epssDetails": { "percentile": "0.18640", "probability": "0.00285", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4984" ], "CVE": [ "CVE-2026-42501" ], "CWE": [ "CWE-494" ] }, "packageName": "std/cmd/go", "proprietary": false, "creationTime": "2026-05-08T08:12:58.815590Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-07T19:21:40Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-05-08T08:12:59.048045Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:15:11.668672Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/mc@*", "stdlib@1.26.2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.26.2" }, { "id": "SNYK-GOLANG-STDCMDGO-16535174", "title": "Directory Traversal", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Harshit Gupta" ], "semver": { "vulnerable": [ "<1.25.10", ">=1.26.0-0 <1.26.3" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\n\nThe \"go tool pack\" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the \"pack\" subcommand can write files to arbitrary locations on the filesystem.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `std/cmd/go` to version 1.25.10, 1.26.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4979)\n- [Go Commit](https://go.dev/cl/767520)\n- [Go Issue](https://go.dev/issue/78778)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/qcCIEXso47M)\n", "epssDetails": { "percentile": "0.04652", "probability": "0.00162", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4979" ], "CVE": [ "CVE-2026-39817" ], "CWE": [ "CWE-22" ] }, "packageName": "std/cmd/go", "proprietary": false, "creationTime": "2026-05-08T08:16:15.517586Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-07T19:21:40Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-05-08T08:16:15.756357Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:05:24.048199Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/mc@*", "stdlib@1.26.2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.26.2" }, { "id": "SNYK-GOLANG-STDCRYPTOTLS-18858453", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Qi Deng of Aurascape.ai" ], "semver": { "vulnerable": [ "<1.25.13", ">=1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `std/crypto/tls` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-6090)\n- [Go Code Review](https://go.dev/cl/804261)\n- [Go Issue](https://go.dev/issue/80528)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.44650", "probability": "0.00568", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-6090" ], "CVE": [ "CVE-2026-56862" ], "CWE": [ "CWE-400" ] }, "packageName": "std/crypto/tls", "proprietary": false, "creationTime": "2026-08-16T13:30:25.367479Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-13T21:43:54Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:30:25.586356Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-10T02:00:45.946419Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/mc@*", "stdlib@1.26.2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.26.2" }, { "id": "SNYK-GOLANG-STDCRYPTOX509-17135840", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Jakub Ciolek" ], "semver": { "vulnerable": [ "<1.25.11", ">=1.26.0-0 <1.26.4" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\n\n(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.\n## Remediation\nUpgrade `std/crypto/x509` to version 1.25.11, 1.26.4 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-5037)\n- [Go Commit](https://go.dev/cl/783621)\n- [Go Issue](https://go.dev/issue/79694)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw)\n", "epssDetails": { "percentile": "0.46081", "probability": "0.00591", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-5037" ], "CVE": [ "CVE-2026-27145" ], "CWE": [ "CWE-770" ] }, "packageName": "std/crypto/x509", "proprietary": false, "creationTime": "2026-06-03T10:36:09.094050Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-02T21:39:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-06-03T10:36:09.279699Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-27T02:00:38.121971Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/mc@*", "stdlib@1.26.2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.26.2" }, { "id": "SNYK-GOLANG-STDENCODINGASN1-18858463", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Marwan Atia" ], "semver": { "vulnerable": [ "<1.25.13", ">=1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.\n## Remediation\nUpgrade `std/encoding/asn1` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-5972)\n- [Go Code Review](https://go.dev/cl/814980)\n- [Go Issue](https://go.dev/issue/80405)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.44468", "probability": "0.00568", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-5972" ], "CVE": [ "CVE-2026-33818" ], "CWE": [ "CWE-674" ] }, "packageName": "std/encoding/asn1", "proprietary": false, "creationTime": "2026-08-16T13:31:49.649800Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-13T21:43:54Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:31:49.810065Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-10T02:00:45.337609Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/mc@*", "stdlib@1.26.2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.26.2" }, { "id": "SNYK-GOLANG-STDENCODINGXML-18858455", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.25.13", ">=1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.\n## Remediation\nUpgrade `std/encoding/xml` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-6088)\n- [Go Code Review](https://go.dev/cl/803320)\n- [Go Issue](https://go.dev/issue/80481)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.44468", "probability": "0.00568", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-6088" ], "CVE": [ "CVE-2026-56859" ], "CWE": [ "CWE-674" ] }, "packageName": "std/encoding/xml", "proprietary": false, "creationTime": "2026-08-16T13:30:41.577448Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-13T21:43:54Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:30:41.759190Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-10T02:00:45.639999Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/mc@*", "stdlib@1.26.2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.26.2" }, { "id": "SNYK-GOLANG-STDMIME-17135844", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "p4p3r" ], "semver": { "vulnerable": [ "<1.25.11", ">=1.26.0-0 <1.26.4" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\n\nDecoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.\n## Remediation\nUpgrade `std/mime` to version 1.25.11, 1.26.4 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-5038)\n- [Go Commit](https://go.dev/cl/774481)\n- [Go Issue](https://go.dev/issue/79217)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw)\n", "epssDetails": { "percentile": "0.42188", "probability": "0.00560", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-5038" ], "CVE": [ "CVE-2026-42504" ], "CWE": [ "CWE-770" ] }, "packageName": "std/mime", "proprietary": false, "creationTime": "2026-06-03T10:42:37.184395Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-02T21:39:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-06-03T10:42:37.356366Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-11T15:26:21.503952Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/mc@*", "stdlib@1.26.2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.26.2" }, { "id": "SNYK-GOLANG-STDNET-16535159", "title": "Double Free", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "hamayanhamayan" ], "semver": { "vulnerable": [ "<1.25.10", ">=1.26.0-0 <1.26.3" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\r\n\r\nWhen using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.\n## Remediation\nUpgrade `std/net` to version 1.25.10, 1.26.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4981)\n- [Go Commit](https://go.dev/cl/767860)\n- [Go Issue](https://go.dev/issue/78803)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/qcCIEXso47M)\n", "epssDetails": { "percentile": "0.55328", "probability": "0.00813", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4981" ], "CVE": [ "CVE-2026-33811" ], "CWE": [ "CWE-415" ] }, "packageName": "std/net", "proprietary": false, "creationTime": "2026-05-08T07:47:55.531293Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-07T19:21:40Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-05-08T07:47:55.737831Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T02:00:29.793319Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/mc@*", "stdlib@1.26.2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.26.2" }, { "id": "SNYK-GOLANG-STDNET-16535161", "title": "Uncaught Exception", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.25.10", ">=1.26.0-0 <1.26.3" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\n\nThe Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).\n## Remediation\nUpgrade `std/net` to version 1.25.10, 1.26.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4971)\n- [Go Commit](https://go.dev/cl/775320)\n- [Go Issue](https://go.dev/issue/79006)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/qcCIEXso47M)\n", "epssDetails": { "percentile": "0.47398", "probability": "0.00620", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4971" ], "CVE": [ "CVE-2026-39836" ], "CWE": [ "CWE-248" ] }, "packageName": "std/net", "proprietary": false, "creationTime": "2026-05-08T07:50:03.529718Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-07T19:21:40Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-05-08T07:50:03.729144Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:00:42.458847Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/mc@*", "stdlib@1.26.2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.26.2" }, { "id": "SNYK-GOLANG-STDNET-18858450", "title": "Uncaught Exception", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Mundur" ], "semver": { "vulnerable": [ ">=1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ ">=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.\n## Remediation\nUpgrade `std/net` to version 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-5942)\n- [Go Code Review](https://go.dev/cl/786345)\n- [Go Issue](https://go.dev/issue/79795)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.44322", "probability": "0.00549", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-5942" ], "CVE": [ "CVE-2026-46600" ], "CWE": [ "CWE-248" ] }, "packageName": "std/net", "proprietary": false, "creationTime": "2026-08-16T13:29:52.132717Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-14T17:29:16Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:29:52.316607Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:04.849623Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/mc@*", "stdlib@1.26.2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.26.2" }, { "id": "SNYK-GOLANG-STDNETHTTP-16535158", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Marwan Atia" ], "semver": { "vulnerable": [ "<1.25.10", ">=1.26.0-0 <1.26.3" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\n\nWhen processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a `SETTINGS_MAX_FRAME_SIZE` with a value of 0.\n## Remediation\nUpgrade `std/net/http` to version 1.25.10, 1.26.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4918)\n- [Go Commit](https://go.dev/cl/761581)\n- [Go Commit](https://go.dev/cl/761640)\n- [Go Issue](https://go.dev/issue/78476)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/qcCIEXso47M)\n", "epssDetails": { "percentile": "0.54175", "probability": "0.00781", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4918" ], "CVE": [ "CVE-2026-33814" ], "CWE": [ "CWE-835" ] }, "packageName": "std/net/http", "proprietary": false, "creationTime": "2026-05-08T07:35:59.608372Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-07T19:21:40Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-05-08T07:35:59.838416Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-27T02:00:38.361656Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/mc@*", "stdlib@1.26.2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.26.2" }, { "id": "SNYK-GOLANG-STDNETHTTP-18858429", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.25.13", ">=1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `std/net/http` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-6089)\n- [Go Code Review](https://go.dev/cl/795540)\n- [Go Issue](https://go.dev/issue/80205)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.44468", "probability": "0.00568", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-6089" ], "CVE": [ "CVE-2026-56853" ], "CWE": [ "CWE-400" ] }, "packageName": "std/net/http", "proprietary": false, "creationTime": "2026-08-16T13:28:12.349185Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-13T21:43:54Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:28:12.649447Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-10T02:00:46.191702Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/mc@*", "stdlib@1.26.2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.26.2" }, { "id": "SNYK-GOLANG-STDNETMAIL-16535166", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "thatnealpatel" ], "semver": { "vulnerable": [ "<1.25.10", ">=1.26.0-0 <1.26.3" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\r\n\r\nWell-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.\n## Remediation\nUpgrade `std/net/mail` to version 1.25.10, 1.26.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4986)\n- [Go Commit](https://go.dev/cl/759940)\n- [Go Issue](https://go.dev/issue/78566)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/qcCIEXso47M)\n", "epssDetails": { "percentile": "0.54463", "probability": "0.00784", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4986" ], "CVE": [ "CVE-2026-39820" ], "CWE": [ "CWE-770" ] }, "packageName": "std/net/mail", "proprietary": false, "creationTime": "2026-05-08T08:04:44.554244Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-07T19:21:40Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-05-08T08:04:44.821365Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-03T02:00:40.967914Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/mc@*", "stdlib@1.26.2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.26.2" }, { "id": "SNYK-GOLANG-STDNETURL-18858438", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.25.13", ">=1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `std/net/url` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-6218)\n- [Go Code Review](https://go.dev/cl/803681)\n- [Go Issue](https://go.dev/issue/80494)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.43587", "probability": "0.00550", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-6218" ], "CVE": [ "CVE-2026-56860" ], "CWE": [ "CWE-400" ] }, "packageName": "std/net/url", "proprietary": false, "creationTime": "2026-08-16T13:28:43.607348Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-13T21:43:54Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:28:43.780899Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:00:42.599966Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/mc@*", "stdlib@1.26.2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.26.2" }, { "id": "SNYK-GOLANG-STDOS-17905377", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "Mundur" ], "semver": { "vulnerable": [ "<1.25.12", ">=1.26.0-0 <1.26.5", ">=1.27.0-0 <1.27.0-rc.2" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root.\n## Remediation\nUpgrade `std/os` to version 1.25.12, 1.26.5, 1.27.0-rc.2 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4970)\n- [Go Code Review](https://go.dev/cl/797880)\n- [Go Issue](https://go.dev/issue/79005)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc)\n", "epssDetails": { "percentile": "0.12762", "probability": "0.00232", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4970" ], "CVE": [ "CVE-2026-39822" ], "CWE": [ "CWE-59" ] }, "packageName": "std/os", "proprietary": false, "creationTime": "2026-07-09T11:52:28.124727Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-07T21:34:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-07-09T11:52:28.309070Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T14:05:23.087760Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/mc@*", "stdlib@1.26.2" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.26.2" } ], "ok": false, "dependencyCount": 787, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "gomodules", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "34 high or critical severity vulnerable dependency paths", "severityThreshold": "high", "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 34, "targetFile": "/usr/bin/mc", "projectName": "github.com/minio/mc", "displayTargetFile": "/usr/bin/mc", "hasUnknownVersions": false, "path": "quay.io/minio/aistor/minio:RELEASE.2026-06-06T02-44-06Z/minio/mc" }, { "vulnerabilities": [ { "id": "SNYK-GOLANG-GITHUBCOMAPACHETHRIFTLIBGOTHRIFT-16323410", "title": "Integer Overflow or Wraparound", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<0.24.0" ], "hashesRange": [ "=0.0.0" ], "hashesRange": [ ">=v0.0.0" ], "vulnerableHashes": [] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "golang", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "github.com/hamba/avro/v2", "references": [ { "url": "https://github.com/iskorotkov/avro/security/advisories/GHSA-w8j3-pq8g-8m7w", "title": "GitHub Advisory" }, { "url": "https://github.com/iskorotkov/avro/commit/a15911450bd430f3ecd995ba1f49425fcd28b692", "title": "GitHub Commit" }, { "url": "https://github.com/iskorotkov/avro/pull/4", "title": "GitHub PR" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-16T05:25:31.281301Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:00:40.104911Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:00:40.104911Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-16T05:25:31.281301Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Infinite loop through the `Avro Decoder` process. An attacker can exhaust CPU resources by providing a specially crafted payload with a large block-count value, causing the decoder to perform excessive iterations before propagating an error.\n## Remediation\nThere is no fixed version for `github.com/hamba/avro/v2`.\n## References\n- [GitHub Advisory](https://github.com/iskorotkov/avro/security/advisories/GHSA-w8j3-pq8g-8m7w)\n- [GitHub Commit](https://github.com/iskorotkov/avro/commit/a15911450bd430f3ecd995ba1f49425fcd28b692)\n- [GitHub PR](https://github.com/iskorotkov/avro/pull/4)\n", "epssDetails": { "percentile": "0.57371", "probability": "0.00882", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-46385" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-w8j3-pq8g-8m7w" ] }, "packageName": "github.com/hamba/avro/v2", "proprietary": false, "creationTime": "2026-06-02T12:21:33.978737Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-29T21:14:26.763000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-06-02T12:21:34.177442Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:00:40.104911Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/minio@*", "github.com/hamba/avro/v2@v2.31.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "github.com/hamba/avro/v2", "version": "v2.31.0" }, { "id": "SNYK-GOLANG-GITHUBCOMHAMBAAVROV2-17130851", "title": "Integer Overflow or Wraparound", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "klajok" ], "semver": { "vulnerable": [ ">=0.0.0" ], "hashesRange": [ ">=v0.0.0" ], "vulnerableHashes": [] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "golang", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "github.com/hamba/avro/v2", "references": [ { "url": "https://github.com/iskorotkov/avro/security/advisories/GHSA-mc57-h6j3-3hmv", "title": "GitHub Advisory" }, { "url": "https://github.com/iskorotkov/avro/commit/ffa371e4e135bd371ce9481c4738b56055a23cb6", "title": "GitHub Commit" }, { "url": "https://github.com/iskorotkov/avro/pull/9", "title": "GitHub PR" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-16T05:25:25.928886Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:00:40.105308Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:00:40.105308Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-16T05:25:25.928886Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound in the decoding process. An attacker can cause application crashes or bypass memory allocation limits by supplying specially crafted Avro data that exploits integer arithmetic errors during decoding operations. This can result in panics, memory allocation issues, or incorrect data processing.\n## Remediation\nThere is no fixed version for `github.com/hamba/avro/v2`.\n## References\n- [GitHub Advisory](https://github.com/iskorotkov/avro/security/advisories/GHSA-mc57-h6j3-3hmv)\n- [GitHub Commit](https://github.com/iskorotkov/avro/commit/ffa371e4e135bd371ce9481c4738b56055a23cb6)\n- [GitHub PR](https://github.com/iskorotkov/avro/pull/9)\n", "epssDetails": { "percentile": "0.59169", "probability": "0.00938", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-46384" ], "CWE": [ "CWE-190" ], "GHSA": [ "GHSA-mc57-h6j3-3hmv" ] }, "packageName": "github.com/hamba/avro/v2", "proprietary": false, "creationTime": "2026-06-02T12:25:33.248889Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-29T21:14:33.313000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-06-02T12:25:33.410961Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:00:40.105308Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/minio@*", "github.com/hamba/avro/v2@v2.31.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "github.com/hamba/avro/v2", "version": "v2.31.0" }, { "id": "SNYK-GOLANG-GITHUBCOMHAMBAAVROV2-18365711", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "credit": [ "Ivan Korotkov", "Daniel Błażewicz" ], "semver": { "vulnerable": [ ">=0.0.0" ], "hashesRange": [ ">=v0.0.0" ], "vulnerableHashes": [] }, "exploit": "Proof of Concept", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "golang", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "github.com/hamba/avro/v2", "references": [ { "url": "https://github.com/iskorotkov/avro/security/advisories/GHSA-mx64-mj3q-7prj", "title": "GitHub Advisory" }, { "url": "https://github.com/iskorotkov/avro/commit/5192df96a158999344ac96ebcb1f7461d626f6d7", "title": "GitHub Commit" }, { "url": "https://pkg.go.dev/vuln/GO-2026-5048", "title": "Go Advisory" } ], "cvssDetails": [], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:00:40.105627Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:00:40.105627Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `mapDecoder.Decode` and `mapDecoderUnmarshaler.Decode` methods in `codec_map.go`, which use the attacker-controlled map block element count both to pre-size the destination map and as the read loop bound with no per-block or cumulative upper limit. An attacker can exhaust process memory and terminate the process with an out-of-memory error by supplying Avro data whose map block header declares a very large element count, or by splitting a large map across many small blocks that accumulate past any per-block threshold. Exploitation requires the application to decode untrusted Avro data containing map structures.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by decoding untrusted Avro in a memory-constrained child process or cgroup, bounding any oversized map allocation so it cannot exhaust the whole host.\n## Remediation\nThere is no fixed version for `github.com/hamba/avro/v2`.\n## References\n- [GitHub Advisory](https://github.com/iskorotkov/avro/security/advisories/GHSA-mx64-mj3q-7prj)\n- [GitHub Commit](https://github.com/iskorotkov/avro/commit/5192df96a158999344ac96ebcb1f7461d626f6d7)\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-5048)\n", "epssDetails": null, "identifiers": { "GO": [ "GO-2026-5048" ], "CVE": [], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-mx64-mj3q-7prj" ] }, "packageName": "github.com/hamba/avro/v2", "proprietary": false, "creationTime": "2026-07-28T15:17:51.158785Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-27T16:16:22Z", "exploitDetails": { "sources": [ "Snyk" ], "maturityLevels": [ { "type": "secondary", "level": "Proof of Concept", "format": "CVSSv3" }, { "type": "primary", "level": "Proof of Concept", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-07-28T15:23:01.121517Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:00:40.105627Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/minio@*", "github.com/hamba/avro/v2@v2.31.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "github.com/hamba/avro/v2", "version": "v2.31.0" }, { "id": "SNYK-GOLANG-GITHUBCOMHAMBAAVROV2OCF-17130852", "title": "Integer Overflow or Wraparound", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "klajok" ], "semver": { "vulnerable": [ ">=0.0.0" ], "hashesRange": [ ">=v0.0.0" ], "vulnerableHashes": [] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "golang", "severity": "high", "cvssScore": 8.7, "functions": [], "malicious": false, "isDisputed": false, "moduleName": "github.com/hamba/avro/v2/ocf", "references": [ { "url": "https://github.com/iskorotkov/avro/security/advisories/GHSA-mc57-h6j3-3hmv", "title": "GitHub Advisory" }, { "url": "https://github.com/iskorotkov/avro/commit/ffa371e4e135bd371ce9481c4738b56055a23cb6", "title": "GitHub Commit" }, { "url": "https://github.com/iskorotkov/avro/pull/9", "title": "GitHub PR" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-16T05:25:25.928886Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "assigner": "Snyk", "severity": "high", "baseScore": 8.7, "cvssVersion": "4.0", "modificationTime": "2026-09-25T02:00:37.912329Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Snyk", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-25T02:00:37.912329Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-16T05:25:25.928886Z" } ], "description": "## Overview\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound in the decoding process. An attacker can cause application crashes or bypass memory allocation limits by supplying specially crafted Avro data that exploits integer arithmetic errors during decoding operations. This can result in panics, memory allocation issues, or incorrect data processing.\n## Remediation\nThere is no fixed version for `github.com/hamba/avro/v2/ocf`.\n## References\n- [GitHub Advisory](https://github.com/iskorotkov/avro/security/advisories/GHSA-mc57-h6j3-3hmv)\n- [GitHub Commit](https://github.com/iskorotkov/avro/commit/ffa371e4e135bd371ce9481c4738b56055a23cb6)\n- [GitHub PR](https://github.com/iskorotkov/avro/pull/9)\n", "epssDetails": { "percentile": "0.59169", "probability": "0.00938", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-46384" ], "CWE": [ "CWE-190" ], "GHSA": [ "GHSA-mc57-h6j3-3hmv" ] }, "packageName": "github.com/hamba/avro/v2/ocf", "proprietary": false, "creationTime": "2026-06-02T12:25:33.433861Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-29T21:14:33.313000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-06-02T12:25:33.592444Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:00:37.912329Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/minio@*", "github.com/hamba/avro/v2/ocf@v2.31.0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "github.com/hamba/avro/v2/ocf", "version": "v2.31.0" }, { "id": "SNYK-GOLANG-GITHUBCOMKLAUSPOSTCOMPRESSS2-18343256", "title": "Integer Overflow", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Christopher Linke" ], "semver": { "vulnerable": [ ">=1.16.0 <1.18.7" ], "hashesRange": [ ">=v1.16.0 =1.83.0 <1.83.2" ], "hashesRange": [ "=v1.83.0 =1.83.0 <1.83.2" ], "hashesRange": [ "=v1.83.0 =1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `std/crypto/tls` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-6090)\n- [Go Code Review](https://go.dev/cl/804261)\n- [Go Issue](https://go.dev/issue/80528)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.44650", "probability": "0.00568", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-6090" ], "CVE": [ "CVE-2026-56862" ], "CWE": [ "CWE-400" ] }, "packageName": "std/crypto/tls", "proprietary": false, "creationTime": "2026-08-16T13:30:25.367479Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-13T21:43:54Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:30:25.586356Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-10T02:00:45.946419Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/minio@*", "stdlib@1.26.4" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.26.4" }, { "id": "SNYK-GOLANG-STDENCODINGASN1-18858463", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Marwan Atia" ], "semver": { "vulnerable": [ "<1.25.13", ">=1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.\n## Remediation\nUpgrade `std/encoding/asn1` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-5972)\n- [Go Code Review](https://go.dev/cl/814980)\n- [Go Issue](https://go.dev/issue/80405)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.44468", "probability": "0.00568", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-5972" ], "CVE": [ "CVE-2026-33818" ], "CWE": [ "CWE-674" ] }, "packageName": "std/encoding/asn1", "proprietary": false, "creationTime": "2026-08-16T13:31:49.649800Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-13T21:43:54Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:31:49.810065Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-10T02:00:45.337609Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/minio@*", "stdlib@1.26.4" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.26.4" }, { "id": "SNYK-GOLANG-STDENCODINGXML-18858455", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.25.13", ">=1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.\n## Remediation\nUpgrade `std/encoding/xml` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-6088)\n- [Go Code Review](https://go.dev/cl/803320)\n- [Go Issue](https://go.dev/issue/80481)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.44468", "probability": "0.00568", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-6088" ], "CVE": [ "CVE-2026-56859" ], "CWE": [ "CWE-674" ] }, "packageName": "std/encoding/xml", "proprietary": false, "creationTime": "2026-08-16T13:30:41.577448Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-13T21:43:54Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:30:41.759190Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-10T02:00:45.639999Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/minio@*", "stdlib@1.26.4" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.26.4" }, { "id": "SNYK-GOLANG-STDNET-18858450", "title": "Uncaught Exception", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Mundur" ], "semver": { "vulnerable": [ ">=1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ ">=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.\n## Remediation\nUpgrade `std/net` to version 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-5942)\n- [Go Code Review](https://go.dev/cl/786345)\n- [Go Issue](https://go.dev/issue/79795)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.44322", "probability": "0.00549", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-5942" ], "CVE": [ "CVE-2026-46600" ], "CWE": [ "CWE-248" ] }, "packageName": "std/net", "proprietary": false, "creationTime": "2026-08-16T13:29:52.132717Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-14T17:29:16Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:29:52.316607Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-10T17:47:04.849623Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/minio@*", "stdlib@1.26.4" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.26.4" }, { "id": "SNYK-GOLANG-STDNETHTTP-18858429", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.25.13", ">=1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `std/net/http` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-6089)\n- [Go Code Review](https://go.dev/cl/795540)\n- [Go Issue](https://go.dev/issue/80205)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.44468", "probability": "0.00568", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-6089" ], "CVE": [ "CVE-2026-56853" ], "CWE": [ "CWE-400" ] }, "packageName": "std/net/http", "proprietary": false, "creationTime": "2026-08-16T13:28:12.349185Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-13T21:43:54Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:28:12.649447Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-10T02:00:46.191702Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/minio@*", "stdlib@1.26.4" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.26.4" }, { "id": "SNYK-GOLANG-STDNETURL-18858438", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.25.13", ">=1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `std/net/url` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-6218)\n- [Go Code Review](https://go.dev/cl/803681)\n- [Go Issue](https://go.dev/issue/80494)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.43587", "probability": "0.00550", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-6218" ], "CVE": [ "CVE-2026-56860" ], "CWE": [ "CWE-400" ] }, "packageName": "std/net/url", "proprietary": false, "creationTime": "2026-08-16T13:28:43.607348Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-13T21:43:54Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:28:43.780899Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:00:42.599966Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/minio@*", "stdlib@1.26.4" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.26.4" }, { "id": "SNYK-GOLANG-STDOS-17905377", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "Mundur" ], "semver": { "vulnerable": [ "<1.25.12", ">=1.26.0-0 <1.26.5", ">=1.27.0-0 <1.27.0-rc.2" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root.\n## Remediation\nUpgrade `std/os` to version 1.25.12, 1.26.5, 1.27.0-rc.2 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4970)\n- [Go Code Review](https://go.dev/cl/797880)\n- [Go Issue](https://go.dev/issue/79005)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc)\n", "epssDetails": { "percentile": "0.12762", "probability": "0.00232", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4970" ], "CVE": [ "CVE-2026-39822" ], "CWE": [ "CWE-59" ] }, "packageName": "std/os", "proprietary": false, "creationTime": "2026-07-09T11:52:28.124727Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-07T21:34:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-07-09T11:52:28.309070Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T14:05:23.087760Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/minio/minio@*", "stdlib@1.26.4" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.26.4" } ], "ok": false, "dependencyCount": 1534, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "gomodules", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "29 high or critical severity vulnerable dependency paths", "severityThreshold": "high", "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 29, "targetFile": "/usr/bin/minio", "projectName": "github.com/minio/minio", "displayTargetFile": "/usr/bin/minio", "hasUnknownVersions": false, "path": "quay.io/minio/aistor/minio:RELEASE.2026-06-06T02-44-06Z/minio/minio" } ] }