{ "vulnerabilities": [ { "id": "SNYK-UBUNTU2004-GNUPG2-14849558", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<2.2.19-3ubuntu2.5+esm1" ] }, "exploit": "Not Defined", "fixedIn": [ "2.2.19-3ubuntu2.5+esm1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-68973", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-68973" }, { "url": "https://github.com/gpg/gnupg/blob/ff30683418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c%23L1305-L1306", "title": "https://github.com/gpg/gnupg/blob/ff30683418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c%23L1305-L1306" }, { "url": "https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9", "title": "https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9" }, { "url": "https://github.com/gpg/gnupg/compare/gnupg-2.2.50...gnupg-2.2.51", "title": "https://github.com/gpg/gnupg/compare/gnupg-2.2.50...gnupg-2.2.51" }, { "url": "https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i", "title": "https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i" }, { "url": "https://news.ycombinator.com/item?id=46403200", "title": "https://news.ycombinator.com/item?id=46403200" }, { "url": "https://www.openwall.com/lists/oss-security/2025/12/28/5", "title": "https://www.openwall.com/lists/oss-security/2025/12/28/5" }, { "url": "http://www.openwall.com/lists/oss-security/2025/12/29/11", "title": "http://www.openwall.com/lists/oss-security/2025/12/29/11" }, { "url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00008.html", "title": "https://lists.debian.org/debian-lts-announce/2026/01/msg00008.html" }, { "url": "https://gpg.fail/memcpy", "title": "https://gpg.fail/memcpy" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7, "modificationTime": "2026-01-08T01:13:40.939606Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "cvssV3BaseScore": 7.8, "modificationTime": "2025-12-29T14:46:40.772482Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "cvssV3BaseScore": 8, "modificationTime": "2026-01-22T11:06:21.998547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7, "cvssVersion": "3.1", "modificationTime": "2026-01-08T01:13:40.939606Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2025-12-29T14:46:40.772482Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "assigner": "SUSE", "severity": "high", "baseScore": 8, "cvssVersion": "3.1", "modificationTime": "2026-01-22T11:06:21.998547Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnupg2` package and not the `gnupg2` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIn GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)\n## Remediation\nUpgrade `Ubuntu:20.04` `gnupg2` to version 2.2.19-3ubuntu2.5+esm1 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-68973](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-68973)\n- [https://github.com/gpg/gnupg/blob/ff30683418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c#L1305-L1306](https://github.com/gpg/gnupg/blob/ff30683418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c#L1305-L1306)\n- [https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9](https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9)\n- [https://github.com/gpg/gnupg/compare/gnupg-2.2.50...gnupg-2.2.51](https://github.com/gpg/gnupg/compare/gnupg-2.2.50...gnupg-2.2.51)\n- [https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i](https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i)\n- [https://news.ycombinator.com/item?id=46403200](https://news.ycombinator.com/item?id=46403200)\n- [https://www.openwall.com/lists/oss-security/2025/12/28/5](https://www.openwall.com/lists/oss-security/2025/12/28/5)\n- [http://www.openwall.com/lists/oss-security/2025/12/29/11](http://www.openwall.com/lists/oss-security/2025/12/29/11)\n- [https://lists.debian.org/debian-lts-announce/2026/01/msg00008.html](https://lists.debian.org/debian-lts-announce/2026/01/msg00008.html)\n- [https://gpg.fail/memcpy](https://gpg.fail/memcpy)\n", "epssDetails": { "percentile": "0.03905", "probability": "0.00152", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2025-68973" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "gnupg2", "creationTime": "2026-01-03T03:10:17.281065Z", "disclosureTime": "2025-12-28T17:16:01.500000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-01-09T06:51:19.911169Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-10-15T14:03:23.591084Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "gnupg2/gpgv@2.2.19-3ubuntu2.5" ], "upgradePath": [ false, "gnupg2/gpgv@2.2.19-3ubuntu2.5+esm1" ], "isUpgradable": true, "isPatchable": false, "name": "gnupg2/gpgv", "version": "2.2.19-3ubuntu2.5", "nearestFixedInVersion": "2.2.19-3ubuntu2.5+esm1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-GNUPG2-14849558", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<2.2.19-3ubuntu2.5+esm1" ] }, "exploit": "Not Defined", "fixedIn": [ "2.2.19-3ubuntu2.5+esm1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-68973", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-68973" }, { "url": "https://github.com/gpg/gnupg/blob/ff30683418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c%23L1305-L1306", "title": "https://github.com/gpg/gnupg/blob/ff30683418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c%23L1305-L1306" }, { "url": "https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9", "title": "https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9" }, { "url": "https://github.com/gpg/gnupg/compare/gnupg-2.2.50...gnupg-2.2.51", "title": "https://github.com/gpg/gnupg/compare/gnupg-2.2.50...gnupg-2.2.51" }, { "url": "https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i", "title": "https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i" }, { "url": "https://news.ycombinator.com/item?id=46403200", "title": "https://news.ycombinator.com/item?id=46403200" }, { "url": "https://www.openwall.com/lists/oss-security/2025/12/28/5", "title": "https://www.openwall.com/lists/oss-security/2025/12/28/5" }, { "url": "http://www.openwall.com/lists/oss-security/2025/12/29/11", "title": "http://www.openwall.com/lists/oss-security/2025/12/29/11" }, { "url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00008.html", "title": "https://lists.debian.org/debian-lts-announce/2026/01/msg00008.html" }, { "url": "https://gpg.fail/memcpy", "title": "https://gpg.fail/memcpy" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7, "modificationTime": "2026-01-08T01:13:40.939606Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "cvssV3BaseScore": 7.8, "modificationTime": "2025-12-29T14:46:40.772482Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "cvssV3BaseScore": 8, "modificationTime": "2026-01-22T11:06:21.998547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7, "cvssVersion": "3.1", "modificationTime": "2026-01-08T01:13:40.939606Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2025-12-29T14:46:40.772482Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "assigner": "SUSE", "severity": "high", "baseScore": 8, "cvssVersion": "3.1", "modificationTime": "2026-01-22T11:06:21.998547Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnupg2` package and not the `gnupg2` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIn GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)\n## Remediation\nUpgrade `Ubuntu:20.04` `gnupg2` to version 2.2.19-3ubuntu2.5+esm1 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-68973](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-68973)\n- [https://github.com/gpg/gnupg/blob/ff30683418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c#L1305-L1306](https://github.com/gpg/gnupg/blob/ff30683418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c#L1305-L1306)\n- [https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9](https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9)\n- [https://github.com/gpg/gnupg/compare/gnupg-2.2.50...gnupg-2.2.51](https://github.com/gpg/gnupg/compare/gnupg-2.2.50...gnupg-2.2.51)\n- [https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i](https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i)\n- [https://news.ycombinator.com/item?id=46403200](https://news.ycombinator.com/item?id=46403200)\n- [https://www.openwall.com/lists/oss-security/2025/12/28/5](https://www.openwall.com/lists/oss-security/2025/12/28/5)\n- [http://www.openwall.com/lists/oss-security/2025/12/29/11](http://www.openwall.com/lists/oss-security/2025/12/29/11)\n- [https://lists.debian.org/debian-lts-announce/2026/01/msg00008.html](https://lists.debian.org/debian-lts-announce/2026/01/msg00008.html)\n- [https://gpg.fail/memcpy](https://gpg.fail/memcpy)\n", "epssDetails": { "percentile": "0.03905", "probability": "0.00152", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2025-68973" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "gnupg2", "creationTime": "2026-01-03T03:10:17.281065Z", "disclosureTime": "2025-12-28T17:16:01.500000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-01-09T06:51:19.911169Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-10-15T14:03:23.591084Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "apt@2.0.11", "gnupg2/gpgv@2.2.19-3ubuntu2.5" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "gnupg2/gpgv", "version": "2.2.19-3ubuntu2.5", "nearestFixedInVersion": "2.2.19-3ubuntu2.5+esm1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-GNUPG2-14849558", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<2.2.19-3ubuntu2.5+esm1" ] }, "exploit": "Not Defined", "fixedIn": [ "2.2.19-3ubuntu2.5+esm1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-68973", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-68973" }, { "url": "https://github.com/gpg/gnupg/blob/ff30683418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c%23L1305-L1306", "title": "https://github.com/gpg/gnupg/blob/ff30683418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c%23L1305-L1306" }, { "url": "https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9", "title": "https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9" }, { "url": "https://github.com/gpg/gnupg/compare/gnupg-2.2.50...gnupg-2.2.51", "title": "https://github.com/gpg/gnupg/compare/gnupg-2.2.50...gnupg-2.2.51" }, { "url": "https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i", "title": "https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i" }, { "url": "https://news.ycombinator.com/item?id=46403200", "title": "https://news.ycombinator.com/item?id=46403200" }, { "url": "https://www.openwall.com/lists/oss-security/2025/12/28/5", "title": "https://www.openwall.com/lists/oss-security/2025/12/28/5" }, { "url": "http://www.openwall.com/lists/oss-security/2025/12/29/11", "title": "http://www.openwall.com/lists/oss-security/2025/12/29/11" }, { "url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00008.html", "title": "https://lists.debian.org/debian-lts-announce/2026/01/msg00008.html" }, { "url": "https://gpg.fail/memcpy", "title": "https://gpg.fail/memcpy" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7, "modificationTime": "2026-01-08T01:13:40.939606Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "cvssV3BaseScore": 7.8, "modificationTime": "2025-12-29T14:46:40.772482Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "cvssV3BaseScore": 8, "modificationTime": "2026-01-22T11:06:21.998547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7, "cvssVersion": "3.1", "modificationTime": "2026-01-08T01:13:40.939606Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2025-12-29T14:46:40.772482Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "assigner": "SUSE", "severity": "high", "baseScore": 8, "cvssVersion": "3.1", "modificationTime": "2026-01-22T11:06:21.998547Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnupg2` package and not the `gnupg2` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIn GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)\n## Remediation\nUpgrade `Ubuntu:20.04` `gnupg2` to version 2.2.19-3ubuntu2.5+esm1 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-68973](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-68973)\n- [https://github.com/gpg/gnupg/blob/ff30683418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c#L1305-L1306](https://github.com/gpg/gnupg/blob/ff30683418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c#L1305-L1306)\n- [https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9](https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9)\n- [https://github.com/gpg/gnupg/compare/gnupg-2.2.50...gnupg-2.2.51](https://github.com/gpg/gnupg/compare/gnupg-2.2.50...gnupg-2.2.51)\n- [https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i](https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i)\n- [https://news.ycombinator.com/item?id=46403200](https://news.ycombinator.com/item?id=46403200)\n- [https://www.openwall.com/lists/oss-security/2025/12/28/5](https://www.openwall.com/lists/oss-security/2025/12/28/5)\n- [http://www.openwall.com/lists/oss-security/2025/12/29/11](http://www.openwall.com/lists/oss-security/2025/12/29/11)\n- [https://lists.debian.org/debian-lts-announce/2026/01/msg00008.html](https://lists.debian.org/debian-lts-announce/2026/01/msg00008.html)\n- [https://gpg.fail/memcpy](https://gpg.fail/memcpy)\n", "epssDetails": { "percentile": "0.03905", "probability": "0.00152", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2025-68973" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "gnupg2", "creationTime": "2026-01-03T03:10:17.281065Z", "disclosureTime": "2025-12-28T17:16:01.500000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-01-09T06:51:19.911169Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-10-15T14:03:23.591084Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "gnupg2/gpg@2.2.19-3ubuntu2.5", "gnupg2/gpgconf@2.2.19-3ubuntu2.5" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "gnupg2/gpgconf", "version": "2.2.19-3ubuntu2.5", "nearestFixedInVersion": "2.2.19-3ubuntu2.5+esm1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-GNUPG2-14849558", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<2.2.19-3ubuntu2.5+esm1" ] }, "exploit": "Not Defined", "fixedIn": [ "2.2.19-3ubuntu2.5+esm1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-68973", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-68973" }, { "url": "https://github.com/gpg/gnupg/blob/ff30683418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c%23L1305-L1306", "title": "https://github.com/gpg/gnupg/blob/ff30683418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c%23L1305-L1306" }, { "url": "https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9", "title": "https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9" }, { "url": "https://github.com/gpg/gnupg/compare/gnupg-2.2.50...gnupg-2.2.51", "title": "https://github.com/gpg/gnupg/compare/gnupg-2.2.50...gnupg-2.2.51" }, { "url": "https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i", "title": "https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i" }, { "url": "https://news.ycombinator.com/item?id=46403200", "title": "https://news.ycombinator.com/item?id=46403200" }, { "url": "https://www.openwall.com/lists/oss-security/2025/12/28/5", "title": "https://www.openwall.com/lists/oss-security/2025/12/28/5" }, { "url": "http://www.openwall.com/lists/oss-security/2025/12/29/11", "title": "http://www.openwall.com/lists/oss-security/2025/12/29/11" }, { "url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00008.html", "title": "https://lists.debian.org/debian-lts-announce/2026/01/msg00008.html" }, { "url": "https://gpg.fail/memcpy", "title": "https://gpg.fail/memcpy" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7, "modificationTime": "2026-01-08T01:13:40.939606Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "cvssV3BaseScore": 7.8, "modificationTime": "2025-12-29T14:46:40.772482Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "cvssV3BaseScore": 8, "modificationTime": "2026-01-22T11:06:21.998547Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7, "cvssVersion": "3.1", "modificationTime": "2026-01-08T01:13:40.939606Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2025-12-29T14:46:40.772482Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "assigner": "SUSE", "severity": "high", "baseScore": 8, "cvssVersion": "3.1", "modificationTime": "2026-01-22T11:06:21.998547Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gnupg2` package and not the `gnupg2` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIn GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)\n## Remediation\nUpgrade `Ubuntu:20.04` `gnupg2` to version 2.2.19-3ubuntu2.5+esm1 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-68973](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-68973)\n- [https://github.com/gpg/gnupg/blob/ff30683418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c#L1305-L1306](https://github.com/gpg/gnupg/blob/ff30683418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c#L1305-L1306)\n- [https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9](https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9)\n- [https://github.com/gpg/gnupg/compare/gnupg-2.2.50...gnupg-2.2.51](https://github.com/gpg/gnupg/compare/gnupg-2.2.50...gnupg-2.2.51)\n- [https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i](https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i)\n- [https://news.ycombinator.com/item?id=46403200](https://news.ycombinator.com/item?id=46403200)\n- [https://www.openwall.com/lists/oss-security/2025/12/28/5](https://www.openwall.com/lists/oss-security/2025/12/28/5)\n- [http://www.openwall.com/lists/oss-security/2025/12/29/11](http://www.openwall.com/lists/oss-security/2025/12/29/11)\n- [https://lists.debian.org/debian-lts-announce/2026/01/msg00008.html](https://lists.debian.org/debian-lts-announce/2026/01/msg00008.html)\n- [https://gpg.fail/memcpy](https://gpg.fail/memcpy)\n", "epssDetails": { "percentile": "0.03905", "probability": "0.00152", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2025-68973" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "gnupg2", "creationTime": "2026-01-03T03:10:17.281065Z", "disclosureTime": "2025-12-28T17:16:01.500000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-01-09T06:51:19.911169Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-10-15T14:03:23.591084Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "gnupg2/gpg@2.2.19-3ubuntu2.5" ], "upgradePath": [ false, "gnupg2/gpg@2.2.19-3ubuntu2.5+esm1" ], "isUpgradable": true, "isPatchable": false, "name": "gnupg2/gpg", "version": "2.2.19-3ubuntu2.5", "nearestFixedInVersion": "2.2.19-3ubuntu2.5+esm1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-OPENSSL-17268972", "cpes": [], "title": "CVE-2026-45447", "CVSSv3": null, "credit": [ "" ], "semver": { "vulnerable": [ "<1.1.1f-1ubuntu2.24+esm4" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.1f-1ubuntu2.24+esm4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": null, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447" }, { "url": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://openssl-library.org/news/secadv/20260609.txt", "title": "https://openssl-library.org/news/secadv/20260609.txt" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25237", "title": "https://access.redhat.com/errata/RHSA-2026:25237" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25239", "title": "https://access.redhat.com/errata/RHSA-2026:25239" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26275", "title": "https://access.redhat.com/errata/RHSA-2026:26275" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34102", "title": "https://access.redhat.com/errata/RHSA-2026:34102" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35869", "title": "https://access.redhat.com/errata/RHSA-2026:35869" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36215", "title": "https://access.redhat.com/errata/RHSA-2026:36215" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36217", "title": "https://access.redhat.com/errata/RHSA-2026:36217" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39009", "title": "https://access.redhat.com/errata/RHSA-2026:39009" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39012", "title": "https://access.redhat.com/errata/RHSA-2026:39012" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39981", "title": "https://access.redhat.com/errata/RHSA-2026:39981" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-45447", "title": "https://access.redhat.com/security/cve/CVE-2026-45447" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44438", "title": "https://access.redhat.com/errata/RHSA-2026:44438" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47735", "title": "https://access.redhat.com/errata/RHSA-2026:47735" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47737", "title": "https://access.redhat.com/errata/RHSA-2026:47737" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58563", "title": "https://access.redhat.com/errata/RHSA-2026:58563" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66524", "title": "https://access.redhat.com/errata/RHSA-2026:66524" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "cvssSources": [ { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIssue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Ubuntu:20.04` `openssl` to version 1.1.1f-1ubuntu2.24+esm4 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447)\n- [https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://openssl-library.org/news/secadv/20260609.txt](https://openssl-library.org/news/secadv/20260609.txt)\n- [https://access.redhat.com/errata/RHSA-2026:25237](https://access.redhat.com/errata/RHSA-2026:25237)\n- [https://access.redhat.com/errata/RHSA-2026:25239](https://access.redhat.com/errata/RHSA-2026:25239)\n- [https://access.redhat.com/errata/RHSA-2026:26275](https://access.redhat.com/errata/RHSA-2026:26275)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:34102](https://access.redhat.com/errata/RHSA-2026:34102)\n- [https://access.redhat.com/errata/RHSA-2026:35869](https://access.redhat.com/errata/RHSA-2026:35869)\n- [https://access.redhat.com/errata/RHSA-2026:36215](https://access.redhat.com/errata/RHSA-2026:36215)\n- [https://access.redhat.com/errata/RHSA-2026:36217](https://access.redhat.com/errata/RHSA-2026:36217)\n- [https://access.redhat.com/errata/RHSA-2026:39009](https://access.redhat.com/errata/RHSA-2026:39009)\n- [https://access.redhat.com/errata/RHSA-2026:39012](https://access.redhat.com/errata/RHSA-2026:39012)\n- [https://access.redhat.com/errata/RHSA-2026:39981](https://access.redhat.com/errata/RHSA-2026:39981)\n- [https://access.redhat.com/security/cve/CVE-2026-45447](https://access.redhat.com/security/cve/CVE-2026-45447)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2481898](https://bugzilla.redhat.com/show_bug.cgi?id=2481898)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json)\n- [https://access.redhat.com/errata/RHSA-2026:44438](https://access.redhat.com/errata/RHSA-2026:44438)\n- [https://access.redhat.com/errata/RHSA-2026:47735](https://access.redhat.com/errata/RHSA-2026:47735)\n- [https://access.redhat.com/errata/RHSA-2026:47737](https://access.redhat.com/errata/RHSA-2026:47737)\n- [https://access.redhat.com/errata/RHSA-2026:58563](https://access.redhat.com/errata/RHSA-2026:58563)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:66524](https://access.redhat.com/errata/RHSA-2026:66524)\n", "epssDetails": { "percentile": "0.90162", "probability": "0.04002", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45447" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": null, "packageName": "openssl", "creationTime": "2026-06-10T02:46:35.681626Z", "disclosureTime": "2026-06-09T17:17:19.277000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-06-10T02:46:35.683596Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-09-25T21:42:07.339995Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "cyrus-sasl2/libsasl2-modules@2.1.27+dfsg-2ubuntu0.1", "openssl/libssl1.1@1.1.1f-1ubuntu2.24" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl1.1", "version": "1.1.1f-1ubuntu2.24", "nearestFixedInVersion": "1.1.1f-1ubuntu2.24+esm4", "dockerfileInstruction": "apt-get -y install libsasl2-2 openssl libksba8 libssl1.1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-OPENSSL-20267065", "cpes": [], "title": "CVE-2026-84782", "CVSSv3": null, "credit": [ "" ], "semver": { "vulnerable": [ "<1.1.1f-1ubuntu2.24+esm6" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.1f-1ubuntu2.24+esm6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": null, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782" }, { "url": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "title": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943" }, { "url": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "title": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628" }, { "url": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "title": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58" }, { "url": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "title": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c" }, { "url": "https://openssl-library.org/news/secadv/20260929.txt", "title": "https://openssl-library.org/news/secadv/20260929.txt" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-30T05:53:20.212801Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-10-03T11:01:35.528611Z" } ], "cvssSources": [ { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-30T05:53:20.212801Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-10-03T11:01:35.528611Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIssue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.\n## Remediation\nUpgrade `Ubuntu:20.04` `openssl` to version 1.1.1f-1ubuntu2.24+esm6 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782)\n- [https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943](https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943)\n- [https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628](https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628)\n- [https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58](https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58)\n- [https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c](https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c)\n- [https://openssl-library.org/news/secadv/20260929.txt](https://openssl-library.org/news/secadv/20260929.txt)\n", "epssDetails": { "percentile": "0.30690", "probability": "0.00390", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-84782" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": null, "packageName": "openssl", "creationTime": "2026-09-30T03:05:01.849874Z", "disclosureTime": "2026-09-29T16:17:12.500000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-09-30T14:53:19.895500Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-10-03T11:01:36.153603Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "cyrus-sasl2/libsasl2-modules@2.1.27+dfsg-2ubuntu0.1", "openssl/libssl1.1@1.1.1f-1ubuntu2.24" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl1.1", "version": "1.1.1f-1ubuntu2.24", "nearestFixedInVersion": "1.1.1f-1ubuntu2.24+esm6", "dockerfileInstruction": "apt-get -y install libsasl2-2 openssl libksba8 libssl1.1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-OPENSSL-17268972", "cpes": [], "title": "CVE-2026-45447", "CVSSv3": null, "credit": [ "" ], "semver": { "vulnerable": [ "<1.1.1f-1ubuntu2.24+esm4" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.1f-1ubuntu2.24+esm4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": null, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447" }, { "url": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://openssl-library.org/news/secadv/20260609.txt", "title": "https://openssl-library.org/news/secadv/20260609.txt" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25237", "title": "https://access.redhat.com/errata/RHSA-2026:25237" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25239", "title": "https://access.redhat.com/errata/RHSA-2026:25239" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26275", "title": "https://access.redhat.com/errata/RHSA-2026:26275" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34102", "title": "https://access.redhat.com/errata/RHSA-2026:34102" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35869", "title": "https://access.redhat.com/errata/RHSA-2026:35869" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36215", "title": "https://access.redhat.com/errata/RHSA-2026:36215" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36217", "title": "https://access.redhat.com/errata/RHSA-2026:36217" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39009", "title": "https://access.redhat.com/errata/RHSA-2026:39009" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39012", "title": "https://access.redhat.com/errata/RHSA-2026:39012" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39981", "title": "https://access.redhat.com/errata/RHSA-2026:39981" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-45447", "title": "https://access.redhat.com/security/cve/CVE-2026-45447" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44438", "title": "https://access.redhat.com/errata/RHSA-2026:44438" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47735", "title": "https://access.redhat.com/errata/RHSA-2026:47735" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47737", "title": "https://access.redhat.com/errata/RHSA-2026:47737" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58563", "title": "https://access.redhat.com/errata/RHSA-2026:58563" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66524", "title": "https://access.redhat.com/errata/RHSA-2026:66524" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "cvssSources": [ { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIssue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Ubuntu:20.04` `openssl` to version 1.1.1f-1ubuntu2.24+esm4 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447)\n- [https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://openssl-library.org/news/secadv/20260609.txt](https://openssl-library.org/news/secadv/20260609.txt)\n- [https://access.redhat.com/errata/RHSA-2026:25237](https://access.redhat.com/errata/RHSA-2026:25237)\n- [https://access.redhat.com/errata/RHSA-2026:25239](https://access.redhat.com/errata/RHSA-2026:25239)\n- [https://access.redhat.com/errata/RHSA-2026:26275](https://access.redhat.com/errata/RHSA-2026:26275)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:34102](https://access.redhat.com/errata/RHSA-2026:34102)\n- [https://access.redhat.com/errata/RHSA-2026:35869](https://access.redhat.com/errata/RHSA-2026:35869)\n- [https://access.redhat.com/errata/RHSA-2026:36215](https://access.redhat.com/errata/RHSA-2026:36215)\n- [https://access.redhat.com/errata/RHSA-2026:36217](https://access.redhat.com/errata/RHSA-2026:36217)\n- [https://access.redhat.com/errata/RHSA-2026:39009](https://access.redhat.com/errata/RHSA-2026:39009)\n- [https://access.redhat.com/errata/RHSA-2026:39012](https://access.redhat.com/errata/RHSA-2026:39012)\n- [https://access.redhat.com/errata/RHSA-2026:39981](https://access.redhat.com/errata/RHSA-2026:39981)\n- [https://access.redhat.com/security/cve/CVE-2026-45447](https://access.redhat.com/security/cve/CVE-2026-45447)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2481898](https://bugzilla.redhat.com/show_bug.cgi?id=2481898)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json)\n- [https://access.redhat.com/errata/RHSA-2026:44438](https://access.redhat.com/errata/RHSA-2026:44438)\n- [https://access.redhat.com/errata/RHSA-2026:47735](https://access.redhat.com/errata/RHSA-2026:47735)\n- [https://access.redhat.com/errata/RHSA-2026:47737](https://access.redhat.com/errata/RHSA-2026:47737)\n- [https://access.redhat.com/errata/RHSA-2026:58563](https://access.redhat.com/errata/RHSA-2026:58563)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:66524](https://access.redhat.com/errata/RHSA-2026:66524)\n", "epssDetails": { "percentile": "0.90162", "probability": "0.04002", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45447" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": null, "packageName": "openssl", "creationTime": "2026-06-10T02:46:35.681626Z", "disclosureTime": "2026-06-09T17:17:19.277000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-06-10T02:46:35.683596Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-09-25T21:42:07.339995Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "mariadb-10.7/mariadb-backup@1:10.7.8+maria~ubu2004", "openssl/libssl1.1@1.1.1f-1ubuntu2.24" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl1.1", "version": "1.1.1f-1ubuntu2.24", "nearestFixedInVersion": "1.1.1f-1ubuntu2.24+esm4", "dockerfileInstruction": "apt-get -y install libsasl2-2 openssl libksba8 libssl1.1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-OPENSSL-20267065", "cpes": [], "title": "CVE-2026-84782", "CVSSv3": null, "credit": [ "" ], "semver": { "vulnerable": [ "<1.1.1f-1ubuntu2.24+esm6" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.1f-1ubuntu2.24+esm6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": null, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782" }, { "url": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "title": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943" }, { "url": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "title": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628" }, { "url": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "title": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58" }, { "url": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "title": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c" }, { "url": "https://openssl-library.org/news/secadv/20260929.txt", "title": "https://openssl-library.org/news/secadv/20260929.txt" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-30T05:53:20.212801Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-10-03T11:01:35.528611Z" } ], "cvssSources": [ { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-30T05:53:20.212801Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-10-03T11:01:35.528611Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIssue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.\n## Remediation\nUpgrade `Ubuntu:20.04` `openssl` to version 1.1.1f-1ubuntu2.24+esm6 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782)\n- [https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943](https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943)\n- [https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628](https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628)\n- [https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58](https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58)\n- [https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c](https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c)\n- [https://openssl-library.org/news/secadv/20260929.txt](https://openssl-library.org/news/secadv/20260929.txt)\n", "epssDetails": { "percentile": "0.30690", "probability": "0.00390", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-84782" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": null, "packageName": "openssl", "creationTime": "2026-09-30T03:05:01.849874Z", "disclosureTime": "2026-09-29T16:17:12.500000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-09-30T14:53:19.895500Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-10-03T11:01:36.153603Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "mariadb-10.7/mariadb-backup@1:10.7.8+maria~ubu2004", "openssl/libssl1.1@1.1.1f-1ubuntu2.24" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl1.1", "version": "1.1.1f-1ubuntu2.24", "nearestFixedInVersion": "1.1.1f-1ubuntu2.24+esm6", "dockerfileInstruction": "apt-get -y install libsasl2-2 openssl libksba8 libssl1.1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-OPENSSL-17268972", "cpes": [], "title": "CVE-2026-45447", "CVSSv3": null, "credit": [ "" ], "semver": { "vulnerable": [ "<1.1.1f-1ubuntu2.24+esm4" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.1f-1ubuntu2.24+esm4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": null, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447" }, { "url": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://openssl-library.org/news/secadv/20260609.txt", "title": "https://openssl-library.org/news/secadv/20260609.txt" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25237", "title": "https://access.redhat.com/errata/RHSA-2026:25237" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25239", "title": "https://access.redhat.com/errata/RHSA-2026:25239" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26275", "title": "https://access.redhat.com/errata/RHSA-2026:26275" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34102", "title": "https://access.redhat.com/errata/RHSA-2026:34102" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35869", "title": "https://access.redhat.com/errata/RHSA-2026:35869" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36215", "title": "https://access.redhat.com/errata/RHSA-2026:36215" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36217", "title": "https://access.redhat.com/errata/RHSA-2026:36217" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39009", "title": "https://access.redhat.com/errata/RHSA-2026:39009" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39012", "title": "https://access.redhat.com/errata/RHSA-2026:39012" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39981", "title": "https://access.redhat.com/errata/RHSA-2026:39981" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-45447", "title": "https://access.redhat.com/security/cve/CVE-2026-45447" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44438", "title": "https://access.redhat.com/errata/RHSA-2026:44438" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47735", "title": "https://access.redhat.com/errata/RHSA-2026:47735" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47737", "title": "https://access.redhat.com/errata/RHSA-2026:47737" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58563", "title": "https://access.redhat.com/errata/RHSA-2026:58563" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66524", "title": "https://access.redhat.com/errata/RHSA-2026:66524" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "cvssSources": [ { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIssue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Ubuntu:20.04` `openssl` to version 1.1.1f-1ubuntu2.24+esm4 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447)\n- [https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://openssl-library.org/news/secadv/20260609.txt](https://openssl-library.org/news/secadv/20260609.txt)\n- [https://access.redhat.com/errata/RHSA-2026:25237](https://access.redhat.com/errata/RHSA-2026:25237)\n- [https://access.redhat.com/errata/RHSA-2026:25239](https://access.redhat.com/errata/RHSA-2026:25239)\n- [https://access.redhat.com/errata/RHSA-2026:26275](https://access.redhat.com/errata/RHSA-2026:26275)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:34102](https://access.redhat.com/errata/RHSA-2026:34102)\n- [https://access.redhat.com/errata/RHSA-2026:35869](https://access.redhat.com/errata/RHSA-2026:35869)\n- [https://access.redhat.com/errata/RHSA-2026:36215](https://access.redhat.com/errata/RHSA-2026:36215)\n- [https://access.redhat.com/errata/RHSA-2026:36217](https://access.redhat.com/errata/RHSA-2026:36217)\n- [https://access.redhat.com/errata/RHSA-2026:39009](https://access.redhat.com/errata/RHSA-2026:39009)\n- [https://access.redhat.com/errata/RHSA-2026:39012](https://access.redhat.com/errata/RHSA-2026:39012)\n- [https://access.redhat.com/errata/RHSA-2026:39981](https://access.redhat.com/errata/RHSA-2026:39981)\n- [https://access.redhat.com/security/cve/CVE-2026-45447](https://access.redhat.com/security/cve/CVE-2026-45447)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2481898](https://bugzilla.redhat.com/show_bug.cgi?id=2481898)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json)\n- [https://access.redhat.com/errata/RHSA-2026:44438](https://access.redhat.com/errata/RHSA-2026:44438)\n- [https://access.redhat.com/errata/RHSA-2026:47735](https://access.redhat.com/errata/RHSA-2026:47735)\n- [https://access.redhat.com/errata/RHSA-2026:47737](https://access.redhat.com/errata/RHSA-2026:47737)\n- [https://access.redhat.com/errata/RHSA-2026:58563](https://access.redhat.com/errata/RHSA-2026:58563)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:66524](https://access.redhat.com/errata/RHSA-2026:66524)\n", "epssDetails": { "percentile": "0.90162", "probability": "0.04002", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45447" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": null, "packageName": "openssl", "creationTime": "2026-06-10T02:46:35.681626Z", "disclosureTime": "2026-06-09T17:17:19.277000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-06-10T02:46:35.683596Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-09-25T21:42:07.339995Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "ca-certificates@20240203~20.04.1", "openssl@1.1.1f-1ubuntu2.24", "openssl/libssl1.1@1.1.1f-1ubuntu2.24" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl1.1", "version": "1.1.1f-1ubuntu2.24", "nearestFixedInVersion": "1.1.1f-1ubuntu2.24+esm4", "dockerfileInstruction": "apt-get -y install libsasl2-2 openssl libksba8 libssl1.1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-OPENSSL-20267065", "cpes": [], "title": "CVE-2026-84782", "CVSSv3": null, "credit": [ "" ], "semver": { "vulnerable": [ "<1.1.1f-1ubuntu2.24+esm6" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.1f-1ubuntu2.24+esm6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": null, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782" }, { "url": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "title": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943" }, { "url": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "title": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628" }, { "url": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "title": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58" }, { "url": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "title": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c" }, { "url": "https://openssl-library.org/news/secadv/20260929.txt", "title": "https://openssl-library.org/news/secadv/20260929.txt" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-30T05:53:20.212801Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-10-03T11:01:35.528611Z" } ], "cvssSources": [ { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-30T05:53:20.212801Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-10-03T11:01:35.528611Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIssue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.\n## Remediation\nUpgrade `Ubuntu:20.04` `openssl` to version 1.1.1f-1ubuntu2.24+esm6 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782)\n- [https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943](https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943)\n- [https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628](https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628)\n- [https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58](https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58)\n- [https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c](https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c)\n- [https://openssl-library.org/news/secadv/20260929.txt](https://openssl-library.org/news/secadv/20260929.txt)\n", "epssDetails": { "percentile": "0.30690", "probability": "0.00390", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-84782" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": null, "packageName": "openssl", "creationTime": "2026-09-30T03:05:01.849874Z", "disclosureTime": "2026-09-29T16:17:12.500000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-09-30T14:53:19.895500Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-10-03T11:01:36.153603Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "ca-certificates@20240203~20.04.1", "openssl@1.1.1f-1ubuntu2.24", "openssl/libssl1.1@1.1.1f-1ubuntu2.24" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl1.1", "version": "1.1.1f-1ubuntu2.24", "nearestFixedInVersion": "1.1.1f-1ubuntu2.24+esm6", "dockerfileInstruction": "apt-get -y install libsasl2-2 openssl libksba8 libssl1.1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-OPENSSL-17268972", "cpes": [], "title": "CVE-2026-45447", "CVSSv3": null, "credit": [ "" ], "semver": { "vulnerable": [ "<1.1.1f-1ubuntu2.24+esm4" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.1f-1ubuntu2.24+esm4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": null, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447" }, { "url": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://openssl-library.org/news/secadv/20260609.txt", "title": "https://openssl-library.org/news/secadv/20260609.txt" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25237", "title": "https://access.redhat.com/errata/RHSA-2026:25237" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25239", "title": "https://access.redhat.com/errata/RHSA-2026:25239" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26275", "title": "https://access.redhat.com/errata/RHSA-2026:26275" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34102", "title": "https://access.redhat.com/errata/RHSA-2026:34102" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35869", "title": "https://access.redhat.com/errata/RHSA-2026:35869" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36215", "title": "https://access.redhat.com/errata/RHSA-2026:36215" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36217", "title": "https://access.redhat.com/errata/RHSA-2026:36217" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39009", "title": "https://access.redhat.com/errata/RHSA-2026:39009" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39012", "title": "https://access.redhat.com/errata/RHSA-2026:39012" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39981", "title": "https://access.redhat.com/errata/RHSA-2026:39981" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-45447", "title": "https://access.redhat.com/security/cve/CVE-2026-45447" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44438", "title": "https://access.redhat.com/errata/RHSA-2026:44438" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47735", "title": "https://access.redhat.com/errata/RHSA-2026:47735" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47737", "title": "https://access.redhat.com/errata/RHSA-2026:47737" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58563", "title": "https://access.redhat.com/errata/RHSA-2026:58563" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66524", "title": "https://access.redhat.com/errata/RHSA-2026:66524" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "cvssSources": [ { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIssue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Ubuntu:20.04` `openssl` to version 1.1.1f-1ubuntu2.24+esm4 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447)\n- [https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://openssl-library.org/news/secadv/20260609.txt](https://openssl-library.org/news/secadv/20260609.txt)\n- [https://access.redhat.com/errata/RHSA-2026:25237](https://access.redhat.com/errata/RHSA-2026:25237)\n- [https://access.redhat.com/errata/RHSA-2026:25239](https://access.redhat.com/errata/RHSA-2026:25239)\n- [https://access.redhat.com/errata/RHSA-2026:26275](https://access.redhat.com/errata/RHSA-2026:26275)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:34102](https://access.redhat.com/errata/RHSA-2026:34102)\n- [https://access.redhat.com/errata/RHSA-2026:35869](https://access.redhat.com/errata/RHSA-2026:35869)\n- [https://access.redhat.com/errata/RHSA-2026:36215](https://access.redhat.com/errata/RHSA-2026:36215)\n- [https://access.redhat.com/errata/RHSA-2026:36217](https://access.redhat.com/errata/RHSA-2026:36217)\n- [https://access.redhat.com/errata/RHSA-2026:39009](https://access.redhat.com/errata/RHSA-2026:39009)\n- [https://access.redhat.com/errata/RHSA-2026:39012](https://access.redhat.com/errata/RHSA-2026:39012)\n- [https://access.redhat.com/errata/RHSA-2026:39981](https://access.redhat.com/errata/RHSA-2026:39981)\n- [https://access.redhat.com/security/cve/CVE-2026-45447](https://access.redhat.com/security/cve/CVE-2026-45447)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2481898](https://bugzilla.redhat.com/show_bug.cgi?id=2481898)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json)\n- [https://access.redhat.com/errata/RHSA-2026:44438](https://access.redhat.com/errata/RHSA-2026:44438)\n- [https://access.redhat.com/errata/RHSA-2026:47735](https://access.redhat.com/errata/RHSA-2026:47735)\n- [https://access.redhat.com/errata/RHSA-2026:47737](https://access.redhat.com/errata/RHSA-2026:47737)\n- [https://access.redhat.com/errata/RHSA-2026:58563](https://access.redhat.com/errata/RHSA-2026:58563)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:66524](https://access.redhat.com/errata/RHSA-2026:66524)\n", "epssDetails": { "percentile": "0.90162", "probability": "0.04002", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45447" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": null, "packageName": "openssl", "creationTime": "2026-06-10T02:46:35.681626Z", "disclosureTime": "2026-06-09T17:17:19.277000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-06-10T02:46:35.683596Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-09-25T21:42:07.339995Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "mariadb-10.7/mariadb-backup@1:10.7.8+maria~ubu2004", "mariadb-10.7/mariadb-client-core-10.7@1:10.7.8+maria~ubu2004", "openssl/libssl1.1@1.1.1f-1ubuntu2.24" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl1.1", "version": "1.1.1f-1ubuntu2.24", "nearestFixedInVersion": "1.1.1f-1ubuntu2.24+esm4", "dockerfileInstruction": "apt-get -y install libsasl2-2 openssl libksba8 libssl1.1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-OPENSSL-20267065", "cpes": [], "title": "CVE-2026-84782", "CVSSv3": null, "credit": [ "" ], "semver": { "vulnerable": [ "<1.1.1f-1ubuntu2.24+esm6" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.1f-1ubuntu2.24+esm6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": null, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782" }, { "url": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "title": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943" }, { "url": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "title": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628" }, { "url": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "title": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58" }, { "url": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "title": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c" }, { "url": "https://openssl-library.org/news/secadv/20260929.txt", "title": "https://openssl-library.org/news/secadv/20260929.txt" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-30T05:53:20.212801Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-10-03T11:01:35.528611Z" } ], "cvssSources": [ { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-30T05:53:20.212801Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-10-03T11:01:35.528611Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIssue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.\n## Remediation\nUpgrade `Ubuntu:20.04` `openssl` to version 1.1.1f-1ubuntu2.24+esm6 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782)\n- [https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943](https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943)\n- [https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628](https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628)\n- [https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58](https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58)\n- [https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c](https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c)\n- [https://openssl-library.org/news/secadv/20260929.txt](https://openssl-library.org/news/secadv/20260929.txt)\n", "epssDetails": { "percentile": "0.30690", "probability": "0.00390", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-84782" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": null, "packageName": "openssl", "creationTime": "2026-09-30T03:05:01.849874Z", "disclosureTime": "2026-09-29T16:17:12.500000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-09-30T14:53:19.895500Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-10-03T11:01:36.153603Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "mariadb-10.7/mariadb-backup@1:10.7.8+maria~ubu2004", "mariadb-10.7/mariadb-client-core-10.7@1:10.7.8+maria~ubu2004", "openssl/libssl1.1@1.1.1f-1ubuntu2.24" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl1.1", "version": "1.1.1f-1ubuntu2.24", "nearestFixedInVersion": "1.1.1f-1ubuntu2.24+esm6", "dockerfileInstruction": "apt-get -y install libsasl2-2 openssl libksba8 libssl1.1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-OPENSSL-17268972", "cpes": [], "title": "CVE-2026-45447", "CVSSv3": null, "credit": [ "" ], "semver": { "vulnerable": [ "<1.1.1f-1ubuntu2.24+esm4" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.1f-1ubuntu2.24+esm4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": null, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447" }, { "url": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://openssl-library.org/news/secadv/20260609.txt", "title": "https://openssl-library.org/news/secadv/20260609.txt" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25237", "title": "https://access.redhat.com/errata/RHSA-2026:25237" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25239", "title": "https://access.redhat.com/errata/RHSA-2026:25239" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26275", "title": "https://access.redhat.com/errata/RHSA-2026:26275" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34102", "title": "https://access.redhat.com/errata/RHSA-2026:34102" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35869", "title": "https://access.redhat.com/errata/RHSA-2026:35869" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36215", "title": "https://access.redhat.com/errata/RHSA-2026:36215" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36217", "title": "https://access.redhat.com/errata/RHSA-2026:36217" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39009", "title": "https://access.redhat.com/errata/RHSA-2026:39009" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39012", "title": "https://access.redhat.com/errata/RHSA-2026:39012" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39981", "title": "https://access.redhat.com/errata/RHSA-2026:39981" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-45447", "title": "https://access.redhat.com/security/cve/CVE-2026-45447" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44438", "title": "https://access.redhat.com/errata/RHSA-2026:44438" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47735", "title": "https://access.redhat.com/errata/RHSA-2026:47735" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47737", "title": "https://access.redhat.com/errata/RHSA-2026:47737" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58563", "title": "https://access.redhat.com/errata/RHSA-2026:58563" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66524", "title": "https://access.redhat.com/errata/RHSA-2026:66524" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "cvssSources": [ { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIssue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Ubuntu:20.04` `openssl` to version 1.1.1f-1ubuntu2.24+esm4 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447)\n- [https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://openssl-library.org/news/secadv/20260609.txt](https://openssl-library.org/news/secadv/20260609.txt)\n- [https://access.redhat.com/errata/RHSA-2026:25237](https://access.redhat.com/errata/RHSA-2026:25237)\n- [https://access.redhat.com/errata/RHSA-2026:25239](https://access.redhat.com/errata/RHSA-2026:25239)\n- [https://access.redhat.com/errata/RHSA-2026:26275](https://access.redhat.com/errata/RHSA-2026:26275)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:34102](https://access.redhat.com/errata/RHSA-2026:34102)\n- [https://access.redhat.com/errata/RHSA-2026:35869](https://access.redhat.com/errata/RHSA-2026:35869)\n- [https://access.redhat.com/errata/RHSA-2026:36215](https://access.redhat.com/errata/RHSA-2026:36215)\n- [https://access.redhat.com/errata/RHSA-2026:36217](https://access.redhat.com/errata/RHSA-2026:36217)\n- [https://access.redhat.com/errata/RHSA-2026:39009](https://access.redhat.com/errata/RHSA-2026:39009)\n- [https://access.redhat.com/errata/RHSA-2026:39012](https://access.redhat.com/errata/RHSA-2026:39012)\n- [https://access.redhat.com/errata/RHSA-2026:39981](https://access.redhat.com/errata/RHSA-2026:39981)\n- [https://access.redhat.com/security/cve/CVE-2026-45447](https://access.redhat.com/security/cve/CVE-2026-45447)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2481898](https://bugzilla.redhat.com/show_bug.cgi?id=2481898)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json)\n- [https://access.redhat.com/errata/RHSA-2026:44438](https://access.redhat.com/errata/RHSA-2026:44438)\n- [https://access.redhat.com/errata/RHSA-2026:47735](https://access.redhat.com/errata/RHSA-2026:47735)\n- [https://access.redhat.com/errata/RHSA-2026:47737](https://access.redhat.com/errata/RHSA-2026:47737)\n- [https://access.redhat.com/errata/RHSA-2026:58563](https://access.redhat.com/errata/RHSA-2026:58563)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:66524](https://access.redhat.com/errata/RHSA-2026:66524)\n", "epssDetails": { "percentile": "0.90162", "probability": "0.04002", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45447" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": null, "packageName": "openssl", "creationTime": "2026-06-10T02:46:35.681626Z", "disclosureTime": "2026-06-09T17:17:19.277000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-06-10T02:46:35.683596Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-09-25T21:42:07.339995Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "mariadb-10.7/mariadb-server@1:10.7.8+maria~ubu2004", "mariadb-10.7/mariadb-server-10.7@1:10.7.8+maria~ubu2004", "openssl/libssl1.1@1.1.1f-1ubuntu2.24" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl1.1", "version": "1.1.1f-1ubuntu2.24", "nearestFixedInVersion": "1.1.1f-1ubuntu2.24+esm4", "dockerfileInstruction": "apt-get -y install libsasl2-2 openssl libksba8 libssl1.1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-OPENSSL-20267065", "cpes": [], "title": "CVE-2026-84782", "CVSSv3": null, "credit": [ "" ], "semver": { "vulnerable": [ "<1.1.1f-1ubuntu2.24+esm6" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.1f-1ubuntu2.24+esm6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": null, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782" }, { "url": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "title": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943" }, { "url": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "title": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628" }, { "url": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "title": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58" }, { "url": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "title": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c" }, { "url": "https://openssl-library.org/news/secadv/20260929.txt", "title": "https://openssl-library.org/news/secadv/20260929.txt" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-30T05:53:20.212801Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-10-03T11:01:35.528611Z" } ], "cvssSources": [ { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-30T05:53:20.212801Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-10-03T11:01:35.528611Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIssue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.\n## Remediation\nUpgrade `Ubuntu:20.04` `openssl` to version 1.1.1f-1ubuntu2.24+esm6 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782)\n- [https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943](https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943)\n- [https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628](https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628)\n- [https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58](https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58)\n- [https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c](https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c)\n- [https://openssl-library.org/news/secadv/20260929.txt](https://openssl-library.org/news/secadv/20260929.txt)\n", "epssDetails": { "percentile": "0.30690", "probability": "0.00390", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-84782" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": null, "packageName": "openssl", "creationTime": "2026-09-30T03:05:01.849874Z", "disclosureTime": "2026-09-29T16:17:12.500000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-09-30T14:53:19.895500Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-10-03T11:01:36.153603Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "mariadb-10.7/mariadb-server@1:10.7.8+maria~ubu2004", "mariadb-10.7/mariadb-server-10.7@1:10.7.8+maria~ubu2004", "openssl/libssl1.1@1.1.1f-1ubuntu2.24" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl1.1", "version": "1.1.1f-1ubuntu2.24", "nearestFixedInVersion": "1.1.1f-1ubuntu2.24+esm6", "dockerfileInstruction": "apt-get -y install libsasl2-2 openssl libksba8 libssl1.1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-OPENSSL-17268972", "cpes": [], "title": "CVE-2026-45447", "CVSSv3": null, "credit": [ "" ], "semver": { "vulnerable": [ "<1.1.1f-1ubuntu2.24+esm4" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.1f-1ubuntu2.24+esm4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": null, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447" }, { "url": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://openssl-library.org/news/secadv/20260609.txt", "title": "https://openssl-library.org/news/secadv/20260609.txt" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25237", "title": "https://access.redhat.com/errata/RHSA-2026:25237" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25239", "title": "https://access.redhat.com/errata/RHSA-2026:25239" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26275", "title": "https://access.redhat.com/errata/RHSA-2026:26275" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34102", "title": "https://access.redhat.com/errata/RHSA-2026:34102" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35869", "title": "https://access.redhat.com/errata/RHSA-2026:35869" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36215", "title": "https://access.redhat.com/errata/RHSA-2026:36215" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36217", "title": "https://access.redhat.com/errata/RHSA-2026:36217" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39009", "title": "https://access.redhat.com/errata/RHSA-2026:39009" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39012", "title": "https://access.redhat.com/errata/RHSA-2026:39012" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39981", "title": "https://access.redhat.com/errata/RHSA-2026:39981" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-45447", "title": "https://access.redhat.com/security/cve/CVE-2026-45447" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44438", "title": "https://access.redhat.com/errata/RHSA-2026:44438" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47735", "title": "https://access.redhat.com/errata/RHSA-2026:47735" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47737", "title": "https://access.redhat.com/errata/RHSA-2026:47737" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58563", "title": "https://access.redhat.com/errata/RHSA-2026:58563" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66524", "title": "https://access.redhat.com/errata/RHSA-2026:66524" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "cvssSources": [ { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIssue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Ubuntu:20.04` `openssl` to version 1.1.1f-1ubuntu2.24+esm4 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447)\n- [https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://openssl-library.org/news/secadv/20260609.txt](https://openssl-library.org/news/secadv/20260609.txt)\n- [https://access.redhat.com/errata/RHSA-2026:25237](https://access.redhat.com/errata/RHSA-2026:25237)\n- [https://access.redhat.com/errata/RHSA-2026:25239](https://access.redhat.com/errata/RHSA-2026:25239)\n- [https://access.redhat.com/errata/RHSA-2026:26275](https://access.redhat.com/errata/RHSA-2026:26275)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:34102](https://access.redhat.com/errata/RHSA-2026:34102)\n- [https://access.redhat.com/errata/RHSA-2026:35869](https://access.redhat.com/errata/RHSA-2026:35869)\n- [https://access.redhat.com/errata/RHSA-2026:36215](https://access.redhat.com/errata/RHSA-2026:36215)\n- [https://access.redhat.com/errata/RHSA-2026:36217](https://access.redhat.com/errata/RHSA-2026:36217)\n- [https://access.redhat.com/errata/RHSA-2026:39009](https://access.redhat.com/errata/RHSA-2026:39009)\n- [https://access.redhat.com/errata/RHSA-2026:39012](https://access.redhat.com/errata/RHSA-2026:39012)\n- [https://access.redhat.com/errata/RHSA-2026:39981](https://access.redhat.com/errata/RHSA-2026:39981)\n- [https://access.redhat.com/security/cve/CVE-2026-45447](https://access.redhat.com/security/cve/CVE-2026-45447)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2481898](https://bugzilla.redhat.com/show_bug.cgi?id=2481898)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json)\n- [https://access.redhat.com/errata/RHSA-2026:44438](https://access.redhat.com/errata/RHSA-2026:44438)\n- [https://access.redhat.com/errata/RHSA-2026:47735](https://access.redhat.com/errata/RHSA-2026:47735)\n- [https://access.redhat.com/errata/RHSA-2026:47737](https://access.redhat.com/errata/RHSA-2026:47737)\n- [https://access.redhat.com/errata/RHSA-2026:58563](https://access.redhat.com/errata/RHSA-2026:58563)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:66524](https://access.redhat.com/errata/RHSA-2026:66524)\n", "epssDetails": { "percentile": "0.90162", "probability": "0.04002", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45447" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": null, "packageName": "openssl", "creationTime": "2026-06-10T02:46:35.681626Z", "disclosureTime": "2026-06-09T17:17:19.277000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-06-10T02:46:35.683596Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-09-25T21:42:07.339995Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "mariadb-10.7/mariadb-backup@1:10.7.8+maria~ubu2004", "mariadb-10.7/mariadb-client-core-10.7@1:10.7.8+maria~ubu2004", "mariadb-10.7/libmariadb3@1:10.7.8+maria~ubu2004", "openssl/libssl1.1@1.1.1f-1ubuntu2.24" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl1.1", "version": "1.1.1f-1ubuntu2.24", "nearestFixedInVersion": "1.1.1f-1ubuntu2.24+esm4", "dockerfileInstruction": "apt-get -y install libsasl2-2 openssl libksba8 libssl1.1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-OPENSSL-20267065", "cpes": [], "title": "CVE-2026-84782", "CVSSv3": null, "credit": [ "" ], "semver": { "vulnerable": [ "<1.1.1f-1ubuntu2.24+esm6" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.1f-1ubuntu2.24+esm6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": null, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782" }, { "url": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "title": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943" }, { "url": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "title": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628" }, { "url": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "title": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58" }, { "url": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "title": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c" }, { "url": "https://openssl-library.org/news/secadv/20260929.txt", "title": "https://openssl-library.org/news/secadv/20260929.txt" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-30T05:53:20.212801Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-10-03T11:01:35.528611Z" } ], "cvssSources": [ { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-30T05:53:20.212801Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-10-03T11:01:35.528611Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIssue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.\n## Remediation\nUpgrade `Ubuntu:20.04` `openssl` to version 1.1.1f-1ubuntu2.24+esm6 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782)\n- [https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943](https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943)\n- [https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628](https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628)\n- [https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58](https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58)\n- [https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c](https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c)\n- [https://openssl-library.org/news/secadv/20260929.txt](https://openssl-library.org/news/secadv/20260929.txt)\n", "epssDetails": { "percentile": "0.30690", "probability": "0.00390", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-84782" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": null, "packageName": "openssl", "creationTime": "2026-09-30T03:05:01.849874Z", "disclosureTime": "2026-09-29T16:17:12.500000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-09-30T14:53:19.895500Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-10-03T11:01:36.153603Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "mariadb-10.7/mariadb-backup@1:10.7.8+maria~ubu2004", "mariadb-10.7/mariadb-client-core-10.7@1:10.7.8+maria~ubu2004", "mariadb-10.7/libmariadb3@1:10.7.8+maria~ubu2004", "openssl/libssl1.1@1.1.1f-1ubuntu2.24" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl1.1", "version": "1.1.1f-1ubuntu2.24", "nearestFixedInVersion": "1.1.1f-1ubuntu2.24+esm6", "dockerfileInstruction": "apt-get -y install libsasl2-2 openssl libksba8 libssl1.1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-OPENSSL-17268972", "cpes": [], "title": "CVE-2026-45447", "CVSSv3": null, "credit": [ "" ], "semver": { "vulnerable": [ "<1.1.1f-1ubuntu2.24+esm4" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.1f-1ubuntu2.24+esm4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": null, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447" }, { "url": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://openssl-library.org/news/secadv/20260609.txt", "title": "https://openssl-library.org/news/secadv/20260609.txt" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25237", "title": "https://access.redhat.com/errata/RHSA-2026:25237" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25239", "title": "https://access.redhat.com/errata/RHSA-2026:25239" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26275", "title": "https://access.redhat.com/errata/RHSA-2026:26275" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34102", "title": "https://access.redhat.com/errata/RHSA-2026:34102" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35869", "title": "https://access.redhat.com/errata/RHSA-2026:35869" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36215", "title": "https://access.redhat.com/errata/RHSA-2026:36215" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36217", "title": "https://access.redhat.com/errata/RHSA-2026:36217" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39009", "title": "https://access.redhat.com/errata/RHSA-2026:39009" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39012", "title": "https://access.redhat.com/errata/RHSA-2026:39012" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39981", "title": "https://access.redhat.com/errata/RHSA-2026:39981" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-45447", "title": "https://access.redhat.com/security/cve/CVE-2026-45447" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44438", "title": "https://access.redhat.com/errata/RHSA-2026:44438" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47735", "title": "https://access.redhat.com/errata/RHSA-2026:47735" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47737", "title": "https://access.redhat.com/errata/RHSA-2026:47737" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58563", "title": "https://access.redhat.com/errata/RHSA-2026:58563" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66524", "title": "https://access.redhat.com/errata/RHSA-2026:66524" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "cvssSources": [ { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIssue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Ubuntu:20.04` `openssl` to version 1.1.1f-1ubuntu2.24+esm4 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447)\n- [https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://openssl-library.org/news/secadv/20260609.txt](https://openssl-library.org/news/secadv/20260609.txt)\n- [https://access.redhat.com/errata/RHSA-2026:25237](https://access.redhat.com/errata/RHSA-2026:25237)\n- [https://access.redhat.com/errata/RHSA-2026:25239](https://access.redhat.com/errata/RHSA-2026:25239)\n- [https://access.redhat.com/errata/RHSA-2026:26275](https://access.redhat.com/errata/RHSA-2026:26275)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:34102](https://access.redhat.com/errata/RHSA-2026:34102)\n- [https://access.redhat.com/errata/RHSA-2026:35869](https://access.redhat.com/errata/RHSA-2026:35869)\n- [https://access.redhat.com/errata/RHSA-2026:36215](https://access.redhat.com/errata/RHSA-2026:36215)\n- [https://access.redhat.com/errata/RHSA-2026:36217](https://access.redhat.com/errata/RHSA-2026:36217)\n- [https://access.redhat.com/errata/RHSA-2026:39009](https://access.redhat.com/errata/RHSA-2026:39009)\n- [https://access.redhat.com/errata/RHSA-2026:39012](https://access.redhat.com/errata/RHSA-2026:39012)\n- [https://access.redhat.com/errata/RHSA-2026:39981](https://access.redhat.com/errata/RHSA-2026:39981)\n- [https://access.redhat.com/security/cve/CVE-2026-45447](https://access.redhat.com/security/cve/CVE-2026-45447)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2481898](https://bugzilla.redhat.com/show_bug.cgi?id=2481898)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json)\n- [https://access.redhat.com/errata/RHSA-2026:44438](https://access.redhat.com/errata/RHSA-2026:44438)\n- [https://access.redhat.com/errata/RHSA-2026:47735](https://access.redhat.com/errata/RHSA-2026:47735)\n- [https://access.redhat.com/errata/RHSA-2026:47737](https://access.redhat.com/errata/RHSA-2026:47737)\n- [https://access.redhat.com/errata/RHSA-2026:58563](https://access.redhat.com/errata/RHSA-2026:58563)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:66524](https://access.redhat.com/errata/RHSA-2026:66524)\n", "epssDetails": { "percentile": "0.90162", "probability": "0.04002", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45447" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": null, "packageName": "openssl", "creationTime": "2026-06-10T02:46:35.681626Z", "disclosureTime": "2026-06-09T17:17:19.277000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-06-10T02:46:35.683596Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-09-25T21:42:07.339995Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "mariadb-10.7/mariadb-server@1:10.7.8+maria~ubu2004", "mariadb-10.7/mariadb-server-10.7@1:10.7.8+maria~ubu2004", "galera-4@26.4.14-ubu2004", "openssl/libssl1.1@1.1.1f-1ubuntu2.24" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl1.1", "version": "1.1.1f-1ubuntu2.24", "nearestFixedInVersion": "1.1.1f-1ubuntu2.24+esm4", "dockerfileInstruction": "apt-get -y install libsasl2-2 openssl libksba8 libssl1.1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-OPENSSL-20267065", "cpes": [], "title": "CVE-2026-84782", "CVSSv3": null, "credit": [ "" ], "semver": { "vulnerable": [ "<1.1.1f-1ubuntu2.24+esm6" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.1f-1ubuntu2.24+esm6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": null, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782" }, { "url": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "title": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943" }, { "url": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "title": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628" }, { "url": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "title": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58" }, { "url": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "title": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c" }, { "url": "https://openssl-library.org/news/secadv/20260929.txt", "title": "https://openssl-library.org/news/secadv/20260929.txt" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-30T05:53:20.212801Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-10-03T11:01:35.528611Z" } ], "cvssSources": [ { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-30T05:53:20.212801Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-10-03T11:01:35.528611Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIssue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.\n## Remediation\nUpgrade `Ubuntu:20.04` `openssl` to version 1.1.1f-1ubuntu2.24+esm6 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782)\n- [https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943](https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943)\n- [https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628](https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628)\n- [https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58](https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58)\n- [https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c](https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c)\n- [https://openssl-library.org/news/secadv/20260929.txt](https://openssl-library.org/news/secadv/20260929.txt)\n", "epssDetails": { "percentile": "0.30690", "probability": "0.00390", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-84782" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": null, "packageName": "openssl", "creationTime": "2026-09-30T03:05:01.849874Z", "disclosureTime": "2026-09-29T16:17:12.500000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-09-30T14:53:19.895500Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-10-03T11:01:36.153603Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "mariadb-10.7/mariadb-server@1:10.7.8+maria~ubu2004", "mariadb-10.7/mariadb-server-10.7@1:10.7.8+maria~ubu2004", "galera-4@26.4.14-ubu2004", "openssl/libssl1.1@1.1.1f-1ubuntu2.24" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl1.1", "version": "1.1.1f-1ubuntu2.24", "nearestFixedInVersion": "1.1.1f-1ubuntu2.24+esm6", "dockerfileInstruction": "apt-get -y install libsasl2-2 openssl libksba8 libssl1.1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-OPENSSL-17268972", "cpes": [], "title": "CVE-2026-45447", "CVSSv3": null, "credit": [ "" ], "semver": { "vulnerable": [ "<1.1.1f-1ubuntu2.24+esm4" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.1f-1ubuntu2.24+esm4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": null, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447" }, { "url": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://openssl-library.org/news/secadv/20260609.txt", "title": "https://openssl-library.org/news/secadv/20260609.txt" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25237", "title": "https://access.redhat.com/errata/RHSA-2026:25237" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25239", "title": "https://access.redhat.com/errata/RHSA-2026:25239" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26275", "title": "https://access.redhat.com/errata/RHSA-2026:26275" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34102", "title": "https://access.redhat.com/errata/RHSA-2026:34102" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35869", "title": "https://access.redhat.com/errata/RHSA-2026:35869" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36215", "title": "https://access.redhat.com/errata/RHSA-2026:36215" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36217", "title": "https://access.redhat.com/errata/RHSA-2026:36217" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39009", "title": "https://access.redhat.com/errata/RHSA-2026:39009" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39012", "title": "https://access.redhat.com/errata/RHSA-2026:39012" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39981", "title": "https://access.redhat.com/errata/RHSA-2026:39981" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-45447", "title": "https://access.redhat.com/security/cve/CVE-2026-45447" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44438", "title": "https://access.redhat.com/errata/RHSA-2026:44438" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47735", "title": "https://access.redhat.com/errata/RHSA-2026:47735" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47737", "title": "https://access.redhat.com/errata/RHSA-2026:47737" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58563", "title": "https://access.redhat.com/errata/RHSA-2026:58563" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66524", "title": "https://access.redhat.com/errata/RHSA-2026:66524" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "cvssSources": [ { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIssue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Ubuntu:20.04` `openssl` to version 1.1.1f-1ubuntu2.24+esm4 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447)\n- [https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://openssl-library.org/news/secadv/20260609.txt](https://openssl-library.org/news/secadv/20260609.txt)\n- [https://access.redhat.com/errata/RHSA-2026:25237](https://access.redhat.com/errata/RHSA-2026:25237)\n- [https://access.redhat.com/errata/RHSA-2026:25239](https://access.redhat.com/errata/RHSA-2026:25239)\n- [https://access.redhat.com/errata/RHSA-2026:26275](https://access.redhat.com/errata/RHSA-2026:26275)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:34102](https://access.redhat.com/errata/RHSA-2026:34102)\n- [https://access.redhat.com/errata/RHSA-2026:35869](https://access.redhat.com/errata/RHSA-2026:35869)\n- [https://access.redhat.com/errata/RHSA-2026:36215](https://access.redhat.com/errata/RHSA-2026:36215)\n- [https://access.redhat.com/errata/RHSA-2026:36217](https://access.redhat.com/errata/RHSA-2026:36217)\n- [https://access.redhat.com/errata/RHSA-2026:39009](https://access.redhat.com/errata/RHSA-2026:39009)\n- [https://access.redhat.com/errata/RHSA-2026:39012](https://access.redhat.com/errata/RHSA-2026:39012)\n- [https://access.redhat.com/errata/RHSA-2026:39981](https://access.redhat.com/errata/RHSA-2026:39981)\n- [https://access.redhat.com/security/cve/CVE-2026-45447](https://access.redhat.com/security/cve/CVE-2026-45447)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2481898](https://bugzilla.redhat.com/show_bug.cgi?id=2481898)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json)\n- [https://access.redhat.com/errata/RHSA-2026:44438](https://access.redhat.com/errata/RHSA-2026:44438)\n- [https://access.redhat.com/errata/RHSA-2026:47735](https://access.redhat.com/errata/RHSA-2026:47735)\n- [https://access.redhat.com/errata/RHSA-2026:47737](https://access.redhat.com/errata/RHSA-2026:47737)\n- [https://access.redhat.com/errata/RHSA-2026:58563](https://access.redhat.com/errata/RHSA-2026:58563)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:66524](https://access.redhat.com/errata/RHSA-2026:66524)\n", "epssDetails": { "percentile": "0.90162", "probability": "0.04002", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45447" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": null, "packageName": "openssl", "creationTime": "2026-06-10T02:46:35.681626Z", "disclosureTime": "2026-06-09T17:17:19.277000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-06-10T02:46:35.683596Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-09-25T21:42:07.339995Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "mariadb-10.7/mariadb-server@1:10.7.8+maria~ubu2004", "mariadb-10.7/mariadb-server-10.7@1:10.7.8+maria~ubu2004", "mariadb-10.7/mariadb-client-10.7@1:10.7.8+maria~ubu2004", "openssl/libssl1.1@1.1.1f-1ubuntu2.24" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl1.1", "version": "1.1.1f-1ubuntu2.24", "nearestFixedInVersion": "1.1.1f-1ubuntu2.24+esm4", "dockerfileInstruction": "apt-get -y install libsasl2-2 openssl libksba8 libssl1.1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-OPENSSL-20267065", "cpes": [], "title": "CVE-2026-84782", "CVSSv3": null, "credit": [ "" ], "semver": { "vulnerable": [ "<1.1.1f-1ubuntu2.24+esm6" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.1f-1ubuntu2.24+esm6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": null, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782" }, { "url": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "title": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943" }, { "url": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "title": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628" }, { "url": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "title": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58" }, { "url": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "title": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c" }, { "url": "https://openssl-library.org/news/secadv/20260929.txt", "title": "https://openssl-library.org/news/secadv/20260929.txt" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-30T05:53:20.212801Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-10-03T11:01:35.528611Z" } ], "cvssSources": [ { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-30T05:53:20.212801Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-10-03T11:01:35.528611Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIssue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.\n## Remediation\nUpgrade `Ubuntu:20.04` `openssl` to version 1.1.1f-1ubuntu2.24+esm6 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782)\n- [https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943](https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943)\n- [https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628](https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628)\n- [https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58](https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58)\n- [https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c](https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c)\n- [https://openssl-library.org/news/secadv/20260929.txt](https://openssl-library.org/news/secadv/20260929.txt)\n", "epssDetails": { "percentile": "0.30690", "probability": "0.00390", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-84782" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": null, "packageName": "openssl", "creationTime": "2026-09-30T03:05:01.849874Z", "disclosureTime": "2026-09-29T16:17:12.500000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-09-30T14:53:19.895500Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-10-03T11:01:36.153603Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "mariadb-10.7/mariadb-server@1:10.7.8+maria~ubu2004", "mariadb-10.7/mariadb-server-10.7@1:10.7.8+maria~ubu2004", "mariadb-10.7/mariadb-client-10.7@1:10.7.8+maria~ubu2004", "openssl/libssl1.1@1.1.1f-1ubuntu2.24" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl1.1", "version": "1.1.1f-1ubuntu2.24", "nearestFixedInVersion": "1.1.1f-1ubuntu2.24+esm6", "dockerfileInstruction": "apt-get -y install libsasl2-2 openssl libksba8 libssl1.1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-OPENSSL-17268972", "cpes": [], "title": "CVE-2026-45447", "CVSSv3": null, "credit": [ "" ], "semver": { "vulnerable": [ "<1.1.1f-1ubuntu2.24+esm4" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.1f-1ubuntu2.24+esm4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": null, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447" }, { "url": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://openssl-library.org/news/secadv/20260609.txt", "title": "https://openssl-library.org/news/secadv/20260609.txt" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25237", "title": "https://access.redhat.com/errata/RHSA-2026:25237" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25239", "title": "https://access.redhat.com/errata/RHSA-2026:25239" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26275", "title": "https://access.redhat.com/errata/RHSA-2026:26275" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34102", "title": "https://access.redhat.com/errata/RHSA-2026:34102" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35869", "title": "https://access.redhat.com/errata/RHSA-2026:35869" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36215", "title": "https://access.redhat.com/errata/RHSA-2026:36215" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36217", "title": "https://access.redhat.com/errata/RHSA-2026:36217" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39009", "title": "https://access.redhat.com/errata/RHSA-2026:39009" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39012", "title": "https://access.redhat.com/errata/RHSA-2026:39012" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39981", "title": "https://access.redhat.com/errata/RHSA-2026:39981" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-45447", "title": "https://access.redhat.com/security/cve/CVE-2026-45447" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44438", "title": "https://access.redhat.com/errata/RHSA-2026:44438" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47735", "title": "https://access.redhat.com/errata/RHSA-2026:47735" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47737", "title": "https://access.redhat.com/errata/RHSA-2026:47737" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58563", "title": "https://access.redhat.com/errata/RHSA-2026:58563" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66524", "title": "https://access.redhat.com/errata/RHSA-2026:66524" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "cvssSources": [ { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIssue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Ubuntu:20.04` `openssl` to version 1.1.1f-1ubuntu2.24+esm4 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447)\n- [https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://openssl-library.org/news/secadv/20260609.txt](https://openssl-library.org/news/secadv/20260609.txt)\n- [https://access.redhat.com/errata/RHSA-2026:25237](https://access.redhat.com/errata/RHSA-2026:25237)\n- [https://access.redhat.com/errata/RHSA-2026:25239](https://access.redhat.com/errata/RHSA-2026:25239)\n- [https://access.redhat.com/errata/RHSA-2026:26275](https://access.redhat.com/errata/RHSA-2026:26275)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:34102](https://access.redhat.com/errata/RHSA-2026:34102)\n- [https://access.redhat.com/errata/RHSA-2026:35869](https://access.redhat.com/errata/RHSA-2026:35869)\n- [https://access.redhat.com/errata/RHSA-2026:36215](https://access.redhat.com/errata/RHSA-2026:36215)\n- [https://access.redhat.com/errata/RHSA-2026:36217](https://access.redhat.com/errata/RHSA-2026:36217)\n- [https://access.redhat.com/errata/RHSA-2026:39009](https://access.redhat.com/errata/RHSA-2026:39009)\n- [https://access.redhat.com/errata/RHSA-2026:39012](https://access.redhat.com/errata/RHSA-2026:39012)\n- [https://access.redhat.com/errata/RHSA-2026:39981](https://access.redhat.com/errata/RHSA-2026:39981)\n- [https://access.redhat.com/security/cve/CVE-2026-45447](https://access.redhat.com/security/cve/CVE-2026-45447)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2481898](https://bugzilla.redhat.com/show_bug.cgi?id=2481898)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json)\n- [https://access.redhat.com/errata/RHSA-2026:44438](https://access.redhat.com/errata/RHSA-2026:44438)\n- [https://access.redhat.com/errata/RHSA-2026:47735](https://access.redhat.com/errata/RHSA-2026:47735)\n- [https://access.redhat.com/errata/RHSA-2026:47737](https://access.redhat.com/errata/RHSA-2026:47737)\n- [https://access.redhat.com/errata/RHSA-2026:58563](https://access.redhat.com/errata/RHSA-2026:58563)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:66524](https://access.redhat.com/errata/RHSA-2026:66524)\n", "epssDetails": { "percentile": "0.90162", "probability": "0.04002", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45447" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": null, "packageName": "openssl", "creationTime": "2026-06-10T02:46:35.681626Z", "disclosureTime": "2026-06-09T17:17:19.277000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-06-10T02:46:35.683596Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-09-25T21:42:07.339995Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "mariadb-10.7/mariadb-server@1:10.7.8+maria~ubu2004", "mariadb-10.7/mariadb-server-10.7@1:10.7.8+maria~ubu2004", "mariadb-10.7/mariadb-server-core-10.7@1:10.7.8+maria~ubu2004", "openssl/libssl1.1@1.1.1f-1ubuntu2.24" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl1.1", "version": "1.1.1f-1ubuntu2.24", "nearestFixedInVersion": "1.1.1f-1ubuntu2.24+esm4", "dockerfileInstruction": "apt-get -y install libsasl2-2 openssl libksba8 libssl1.1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-OPENSSL-20267065", "cpes": [], "title": "CVE-2026-84782", "CVSSv3": null, "credit": [ "" ], "semver": { "vulnerable": [ "<1.1.1f-1ubuntu2.24+esm6" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.1f-1ubuntu2.24+esm6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": null, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782" }, { "url": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "title": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943" }, { "url": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "title": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628" }, { "url": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "title": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58" }, { "url": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "title": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c" }, { "url": "https://openssl-library.org/news/secadv/20260929.txt", "title": "https://openssl-library.org/news/secadv/20260929.txt" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-30T05:53:20.212801Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-10-03T11:01:35.528611Z" } ], "cvssSources": [ { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-30T05:53:20.212801Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-10-03T11:01:35.528611Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIssue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.\n## Remediation\nUpgrade `Ubuntu:20.04` `openssl` to version 1.1.1f-1ubuntu2.24+esm6 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782)\n- [https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943](https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943)\n- [https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628](https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628)\n- [https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58](https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58)\n- [https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c](https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c)\n- [https://openssl-library.org/news/secadv/20260929.txt](https://openssl-library.org/news/secadv/20260929.txt)\n", "epssDetails": { "percentile": "0.30690", "probability": "0.00390", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-84782" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": null, "packageName": "openssl", "creationTime": "2026-09-30T03:05:01.849874Z", "disclosureTime": "2026-09-29T16:17:12.500000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-09-30T14:53:19.895500Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-10-03T11:01:36.153603Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "mariadb-10.7/mariadb-server@1:10.7.8+maria~ubu2004", "mariadb-10.7/mariadb-server-10.7@1:10.7.8+maria~ubu2004", "mariadb-10.7/mariadb-server-core-10.7@1:10.7.8+maria~ubu2004", "openssl/libssl1.1@1.1.1f-1ubuntu2.24" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl1.1", "version": "1.1.1f-1ubuntu2.24", "nearestFixedInVersion": "1.1.1f-1ubuntu2.24+esm6", "dockerfileInstruction": "apt-get -y install libsasl2-2 openssl libksba8 libssl1.1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-OPENSSL-17268972", "cpes": [], "title": "CVE-2026-45447", "CVSSv3": null, "credit": [ "" ], "semver": { "vulnerable": [ "<1.1.1f-1ubuntu2.24+esm4" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.1f-1ubuntu2.24+esm4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": null, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447" }, { "url": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://openssl-library.org/news/secadv/20260609.txt", "title": "https://openssl-library.org/news/secadv/20260609.txt" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25237", "title": "https://access.redhat.com/errata/RHSA-2026:25237" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25239", "title": "https://access.redhat.com/errata/RHSA-2026:25239" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26275", "title": "https://access.redhat.com/errata/RHSA-2026:26275" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34102", "title": "https://access.redhat.com/errata/RHSA-2026:34102" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35869", "title": "https://access.redhat.com/errata/RHSA-2026:35869" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36215", "title": "https://access.redhat.com/errata/RHSA-2026:36215" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36217", "title": "https://access.redhat.com/errata/RHSA-2026:36217" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39009", "title": "https://access.redhat.com/errata/RHSA-2026:39009" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39012", "title": "https://access.redhat.com/errata/RHSA-2026:39012" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39981", "title": "https://access.redhat.com/errata/RHSA-2026:39981" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-45447", "title": "https://access.redhat.com/security/cve/CVE-2026-45447" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44438", "title": "https://access.redhat.com/errata/RHSA-2026:44438" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47735", "title": "https://access.redhat.com/errata/RHSA-2026:47735" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47737", "title": "https://access.redhat.com/errata/RHSA-2026:47737" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58563", "title": "https://access.redhat.com/errata/RHSA-2026:58563" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66524", "title": "https://access.redhat.com/errata/RHSA-2026:66524" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "cvssSources": [ { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIssue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Ubuntu:20.04` `openssl` to version 1.1.1f-1ubuntu2.24+esm4 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447)\n- [https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://openssl-library.org/news/secadv/20260609.txt](https://openssl-library.org/news/secadv/20260609.txt)\n- [https://access.redhat.com/errata/RHSA-2026:25237](https://access.redhat.com/errata/RHSA-2026:25237)\n- [https://access.redhat.com/errata/RHSA-2026:25239](https://access.redhat.com/errata/RHSA-2026:25239)\n- [https://access.redhat.com/errata/RHSA-2026:26275](https://access.redhat.com/errata/RHSA-2026:26275)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:34102](https://access.redhat.com/errata/RHSA-2026:34102)\n- [https://access.redhat.com/errata/RHSA-2026:35869](https://access.redhat.com/errata/RHSA-2026:35869)\n- [https://access.redhat.com/errata/RHSA-2026:36215](https://access.redhat.com/errata/RHSA-2026:36215)\n- [https://access.redhat.com/errata/RHSA-2026:36217](https://access.redhat.com/errata/RHSA-2026:36217)\n- [https://access.redhat.com/errata/RHSA-2026:39009](https://access.redhat.com/errata/RHSA-2026:39009)\n- [https://access.redhat.com/errata/RHSA-2026:39012](https://access.redhat.com/errata/RHSA-2026:39012)\n- [https://access.redhat.com/errata/RHSA-2026:39981](https://access.redhat.com/errata/RHSA-2026:39981)\n- [https://access.redhat.com/security/cve/CVE-2026-45447](https://access.redhat.com/security/cve/CVE-2026-45447)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2481898](https://bugzilla.redhat.com/show_bug.cgi?id=2481898)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json)\n- [https://access.redhat.com/errata/RHSA-2026:44438](https://access.redhat.com/errata/RHSA-2026:44438)\n- [https://access.redhat.com/errata/RHSA-2026:47735](https://access.redhat.com/errata/RHSA-2026:47735)\n- [https://access.redhat.com/errata/RHSA-2026:47737](https://access.redhat.com/errata/RHSA-2026:47737)\n- [https://access.redhat.com/errata/RHSA-2026:58563](https://access.redhat.com/errata/RHSA-2026:58563)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:66524](https://access.redhat.com/errata/RHSA-2026:66524)\n", "epssDetails": { "percentile": "0.90162", "probability": "0.04002", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45447" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": null, "packageName": "openssl", "creationTime": "2026-06-10T02:46:35.681626Z", "disclosureTime": "2026-06-09T17:17:19.277000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-06-10T02:46:35.683596Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-09-25T21:42:07.339995Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "mariadb-10.7/mariadb-server@1:10.7.8+maria~ubu2004", "mariadb-10.7/mariadb-server-10.7@1:10.7.8+maria~ubu2004", "socat@1.7.3.3-2", "openssl/libssl1.1@1.1.1f-1ubuntu2.24" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl1.1", "version": "1.1.1f-1ubuntu2.24", "nearestFixedInVersion": "1.1.1f-1ubuntu2.24+esm4", "dockerfileInstruction": "apt-get -y install libsasl2-2 openssl libksba8 libssl1.1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-OPENSSL-20267065", "cpes": [], "title": "CVE-2026-84782", "CVSSv3": null, "credit": [ "" ], "semver": { "vulnerable": [ "<1.1.1f-1ubuntu2.24+esm6" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.1f-1ubuntu2.24+esm6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": null, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782" }, { "url": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "title": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943" }, { "url": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "title": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628" }, { "url": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "title": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58" }, { "url": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "title": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c" }, { "url": "https://openssl-library.org/news/secadv/20260929.txt", "title": "https://openssl-library.org/news/secadv/20260929.txt" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-30T05:53:20.212801Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-10-03T11:01:35.528611Z" } ], "cvssSources": [ { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-30T05:53:20.212801Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-10-03T11:01:35.528611Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIssue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.\n## Remediation\nUpgrade `Ubuntu:20.04` `openssl` to version 1.1.1f-1ubuntu2.24+esm6 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782)\n- [https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943](https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943)\n- [https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628](https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628)\n- [https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58](https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58)\n- [https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c](https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c)\n- [https://openssl-library.org/news/secadv/20260929.txt](https://openssl-library.org/news/secadv/20260929.txt)\n", "epssDetails": { "percentile": "0.30690", "probability": "0.00390", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-84782" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": null, "packageName": "openssl", "creationTime": "2026-09-30T03:05:01.849874Z", "disclosureTime": "2026-09-29T16:17:12.500000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-09-30T14:53:19.895500Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-10-03T11:01:36.153603Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "mariadb-10.7/mariadb-server@1:10.7.8+maria~ubu2004", "mariadb-10.7/mariadb-server-10.7@1:10.7.8+maria~ubu2004", "socat@1.7.3.3-2", "openssl/libssl1.1@1.1.1f-1ubuntu2.24" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl/libssl1.1", "version": "1.1.1f-1ubuntu2.24", "nearestFixedInVersion": "1.1.1f-1ubuntu2.24+esm6", "dockerfileInstruction": "apt-get -y install libsasl2-2 openssl libksba8 libssl1.1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-OPENSSL-17268972", "cpes": [], "title": "CVE-2026-45447", "CVSSv3": null, "credit": [ "" ], "semver": { "vulnerable": [ "<1.1.1f-1ubuntu2.24+esm4" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.1f-1ubuntu2.24+esm4" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": null, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447" }, { "url": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "title": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c" }, { "url": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "title": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8" }, { "url": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "title": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54" }, { "url": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "title": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c" }, { "url": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "title": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e" }, { "url": "https://openssl-library.org/news/secadv/20260609.txt", "title": "https://openssl-library.org/news/secadv/20260609.txt" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25237", "title": "https://access.redhat.com/errata/RHSA-2026:25237" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25239", "title": "https://access.redhat.com/errata/RHSA-2026:25239" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26275", "title": "https://access.redhat.com/errata/RHSA-2026:26275" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26319", "title": "https://access.redhat.com/errata/RHSA-2026:26319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34102", "title": "https://access.redhat.com/errata/RHSA-2026:34102" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35869", "title": "https://access.redhat.com/errata/RHSA-2026:35869" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36215", "title": "https://access.redhat.com/errata/RHSA-2026:36215" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36217", "title": "https://access.redhat.com/errata/RHSA-2026:36217" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39009", "title": "https://access.redhat.com/errata/RHSA-2026:39009" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39012", "title": "https://access.redhat.com/errata/RHSA-2026:39012" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39981", "title": "https://access.redhat.com/errata/RHSA-2026:39981" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-45447", "title": "https://access.redhat.com/security/cve/CVE-2026-45447" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44438", "title": "https://access.redhat.com/errata/RHSA-2026:44438" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47735", "title": "https://access.redhat.com/errata/RHSA-2026:47735" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47737", "title": "https://access.redhat.com/errata/RHSA-2026:47737" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58563", "title": "https://access.redhat.com/errata/RHSA-2026:58563" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59831", "title": "https://access.redhat.com/errata/RHSA-2026:59831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66524", "title": "https://access.redhat.com/errata/RHSA-2026:66524" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "cvssSources": [ { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-06-11T05:27:17.177297Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-06-16T11:02:09.225251Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIssue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nUpgrade `Ubuntu:20.04` `openssl` to version 1.1.1f-1ubuntu2.24+esm4 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447)\n- [https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://openssl-library.org/news/secadv/20260609.txt](https://openssl-library.org/news/secadv/20260609.txt)\n- [https://access.redhat.com/errata/RHSA-2026:25237](https://access.redhat.com/errata/RHSA-2026:25237)\n- [https://access.redhat.com/errata/RHSA-2026:25239](https://access.redhat.com/errata/RHSA-2026:25239)\n- [https://access.redhat.com/errata/RHSA-2026:26275](https://access.redhat.com/errata/RHSA-2026:26275)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:34102](https://access.redhat.com/errata/RHSA-2026:34102)\n- [https://access.redhat.com/errata/RHSA-2026:35869](https://access.redhat.com/errata/RHSA-2026:35869)\n- [https://access.redhat.com/errata/RHSA-2026:36215](https://access.redhat.com/errata/RHSA-2026:36215)\n- [https://access.redhat.com/errata/RHSA-2026:36217](https://access.redhat.com/errata/RHSA-2026:36217)\n- [https://access.redhat.com/errata/RHSA-2026:39009](https://access.redhat.com/errata/RHSA-2026:39009)\n- [https://access.redhat.com/errata/RHSA-2026:39012](https://access.redhat.com/errata/RHSA-2026:39012)\n- [https://access.redhat.com/errata/RHSA-2026:39981](https://access.redhat.com/errata/RHSA-2026:39981)\n- [https://access.redhat.com/security/cve/CVE-2026-45447](https://access.redhat.com/security/cve/CVE-2026-45447)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2481898](https://bugzilla.redhat.com/show_bug.cgi?id=2481898)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json)\n- [https://access.redhat.com/errata/RHSA-2026:44438](https://access.redhat.com/errata/RHSA-2026:44438)\n- [https://access.redhat.com/errata/RHSA-2026:47735](https://access.redhat.com/errata/RHSA-2026:47735)\n- [https://access.redhat.com/errata/RHSA-2026:47737](https://access.redhat.com/errata/RHSA-2026:47737)\n- [https://access.redhat.com/errata/RHSA-2026:58563](https://access.redhat.com/errata/RHSA-2026:58563)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n- [https://access.redhat.com/errata/RHSA-2026:66524](https://access.redhat.com/errata/RHSA-2026:66524)\n", "epssDetails": { "percentile": "0.90162", "probability": "0.04002", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-45447" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": null, "packageName": "openssl", "creationTime": "2026-06-10T02:46:35.681626Z", "disclosureTime": "2026-06-09T17:17:19.277000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-06-10T02:46:35.683596Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-09-25T21:42:07.339995Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "ca-certificates@20240203~20.04.1", "openssl@1.1.1f-1ubuntu2.24" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "1.1.1f-1ubuntu2.24", "nearestFixedInVersion": "1.1.1f-1ubuntu2.24+esm4", "dockerfileInstruction": "apt-get -y install libsasl2-2 openssl libksba8 libssl1.1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-OPENSSL-20267065", "cpes": [], "title": "CVE-2026-84782", "CVSSv3": null, "credit": [ "" ], "semver": { "vulnerable": [ "<1.1.1f-1ubuntu2.24+esm6" ] }, "exploit": "Not Defined", "fixedIn": [ "1.1.1f-1ubuntu2.24+esm6" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": null, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782" }, { "url": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "title": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943" }, { "url": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "title": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628" }, { "url": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "title": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58" }, { "url": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "title": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c" }, { "url": "https://openssl-library.org/news/secadv/20260929.txt", "title": "https://openssl-library.org/news/secadv/20260929.txt" } ], "cvssDetails": [ { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-30T05:53:20.212801Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-10-03T11:01:35.528611Z" } ], "cvssSources": [ { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-30T05:53:20.212801Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-10-03T11:01:35.528611Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nIssue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.\n## Remediation\nUpgrade `Ubuntu:20.04` `openssl` to version 1.1.1f-1ubuntu2.24+esm6 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-84782)\n- [https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943](https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943)\n- [https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628](https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628)\n- [https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58](https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58)\n- [https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c](https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c)\n- [https://openssl-library.org/news/secadv/20260929.txt](https://openssl-library.org/news/secadv/20260929.txt)\n", "epssDetails": { "percentile": "0.30690", "probability": "0.00390", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-84782" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": null, "packageName": "openssl", "creationTime": "2026-09-30T03:05:01.849874Z", "disclosureTime": "2026-09-29T16:17:12.500000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-09-30T14:53:19.895500Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-10-03T11:01:36.153603Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "ca-certificates@20240203~20.04.1", "openssl@1.1.1f-1ubuntu2.24" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "openssl", "version": "1.1.1f-1ubuntu2.24", "nearestFixedInVersion": "1.1.1f-1ubuntu2.24+esm6", "dockerfileInstruction": "apt-get -y install libsasl2-2 openssl libksba8 libssl1.1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-RSYNC-16777015", "cpes": [], "title": "Time-of-check Time-of-use (TOCTOU)", "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.1.3-8ubuntu0.9+esm1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.3-8ubuntu0.9+esm1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-29518", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-29518" }, { "url": "https://github.com/RsyncProject/rsync/pull/895/changes/8471fdd1561049ef5f58df44a1811a50bd9a531d", "title": "https://github.com/RsyncProject/rsync/pull/895/changes/8471fdd1561049ef5f58df44a1811a50bd9a531d" }, { "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.4.3", "title": "https://github.com/RsyncProject/rsync/releases/tag/v3.4.3" }, { "url": "https://www.vulncheck.com/advisories/rsync-toctou-race-condition-allows-symlink-based-arbitrary-file-write", "title": "https://www.vulncheck.com/advisories/rsync-toctou-race-condition-allows-symlink-based-arbitrary-file-write" }, { "url": "https://michael.stapelberg.ch/posts/2026-05-24-minimal-memory-safe-go-rsync-vulns/", "title": "https://michael.stapelberg.ch/posts/2026-05-24-minimal-memory-safe-go-rsync-vulns/" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26332", "title": "https://access.redhat.com/errata/RHSA-2026:26332" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26408", "title": "https://access.redhat.com/errata/RHSA-2026:26408" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26410", "title": "https://access.redhat.com/errata/RHSA-2026:26410" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-29518", "title": "https://access.redhat.com/security/cve/CVE-2026-29518" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2469055", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2469055" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29518.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29518.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54769", "title": "https://access.redhat.com/errata/RHSA-2026:54769" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7, "modificationTime": "2026-05-21T01:24:59.853845Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-05-23T05:26:25.925818Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7, "modificationTime": "2026-05-22T11:03:02.489257Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7, "cvssVersion": "3.1", "modificationTime": "2026-05-21T01:24:59.853845Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-05-23T05:26:25.925818Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7, "cvssVersion": "3.1", "modificationTime": "2026-05-22T11:03:02.489257Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `rsync` package and not the `rsync` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nRsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.\n## Remediation\nUpgrade `Ubuntu:20.04` `rsync` to version 3.1.3-8ubuntu0.9+esm1 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-29518](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-29518)\n- [https://github.com/RsyncProject/rsync/pull/895/changes/8471fdd1561049ef5f58df44a1811a50bd9a531d](https://github.com/RsyncProject/rsync/pull/895/changes/8471fdd1561049ef5f58df44a1811a50bd9a531d)\n- [https://github.com/RsyncProject/rsync/releases/tag/v3.4.3](https://github.com/RsyncProject/rsync/releases/tag/v3.4.3)\n- [https://www.vulncheck.com/advisories/rsync-toctou-race-condition-allows-symlink-based-arbitrary-file-write](https://www.vulncheck.com/advisories/rsync-toctou-race-condition-allows-symlink-based-arbitrary-file-write)\n- [https://michael.stapelberg.ch/posts/2026-05-24-minimal-memory-safe-go-rsync-vulns/](https://michael.stapelberg.ch/posts/2026-05-24-minimal-memory-safe-go-rsync-vulns/)\n- [https://access.redhat.com/errata/RHSA-2026:26332](https://access.redhat.com/errata/RHSA-2026:26332)\n- [https://access.redhat.com/errata/RHSA-2026:26408](https://access.redhat.com/errata/RHSA-2026:26408)\n- [https://access.redhat.com/errata/RHSA-2026:26410](https://access.redhat.com/errata/RHSA-2026:26410)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/security/cve/CVE-2026-29518](https://access.redhat.com/security/cve/CVE-2026-29518)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2469055](https://bugzilla.redhat.com/show_bug.cgi?id=2469055)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29518.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29518.json)\n- [https://access.redhat.com/errata/RHSA-2026:54769](https://access.redhat.com/errata/RHSA-2026:54769)\n", "epssDetails": { "percentile": "0.02742", "probability": "0.00140", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-29518" ], "CWE": [ "CWE-367" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "rsync", "creationTime": "2026-05-20T14:48:25.560865Z", "disclosureTime": "2026-05-20T13:16:17.040000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-06-01T14:34:55.749604Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-09-24T14:11:23.216489Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "mariadb-10.7/mariadb-server@1:10.7.8+maria~ubu2004", "mariadb-10.7/mariadb-server-10.7@1:10.7.8+maria~ubu2004", "rsync@3.1.3-8ubuntu0.9" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "rsync", "version": "3.1.3-8ubuntu0.9", "nearestFixedInVersion": "3.1.3-8ubuntu0.9+esm1", "dockerBaseImage": "ubuntu:focal-20230412" }, { "id": "SNYK-UBUNTU2004-RSYNC-16777154", "cpes": [], "title": "Out-of-bounds Read", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.1.3-8ubuntu0.9+esm1" ] }, "exploit": "Not Defined", "fixedIn": [ "3.1.3-8ubuntu0.9+esm1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.1, "malicious": false, "isDisputed": false, "references": [ { "url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-43618", "title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-43618" }, { "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.4.3", "title": "https://github.com/RsyncProject/rsync/releases/tag/v3.4.3" }, { "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-g37v-g3gj-pmwq", "title": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-g37v-g3gj-pmwq" }, { "url": "https://www.vulncheck.com/advisories/rsync-integer-overflow-information-disclosure", "title": "https://www.vulncheck.com/advisories/rsync-integer-overflow-information-disclosure" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26332", "title": "https://access.redhat.com/errata/RHSA-2026:26332" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26408", "title": "https://access.redhat.com/errata/RHSA-2026:26408" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26410", "title": "https://access.redhat.com/errata/RHSA-2026:26410" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29197", "title": "https://access.redhat.com/errata/RHSA-2026:29197" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-43618", "title": "https://access.redhat.com/security/cve/CVE-2026-43618" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2469054", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2469054" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43618.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43618.json" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-05-20T13:18:15.636289Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-05-23T05:26:26.103063Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-05-22T11:03:06.461619Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-05-20T13:18:15.636289Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-05-23T05:26:26.103063Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-05-22T11:03:06.461619Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `rsync` package and not the `rsync` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:20.04` relevant fixed versions and status._\n\nRsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.\n## Remediation\nUpgrade `Ubuntu:20.04` `rsync` to version 3.1.3-8ubuntu0.9+esm1 or higher.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-43618](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-43618)\n- [https://github.com/RsyncProject/rsync/releases/tag/v3.4.3](https://github.com/RsyncProject/rsync/releases/tag/v3.4.3)\n- [https://github.com/RsyncProject/rsync/security/advisories/GHSA-g37v-g3gj-pmwq](https://github.com/RsyncProject/rsync/security/advisories/GHSA-g37v-g3gj-pmwq)\n- [https://www.vulncheck.com/advisories/rsync-integer-overflow-information-disclosure](https://www.vulncheck.com/advisories/rsync-integer-overflow-information-disclosure)\n- [https://access.redhat.com/errata/RHSA-2026:26332](https://access.redhat.com/errata/RHSA-2026:26332)\n- [https://access.redhat.com/errata/RHSA-2026:26408](https://access.redhat.com/errata/RHSA-2026:26408)\n- [https://access.redhat.com/errata/RHSA-2026:26410](https://access.redhat.com/errata/RHSA-2026:26410)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/security/cve/CVE-2026-43618](https://access.redhat.com/security/cve/CVE-2026-43618)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2469054](https://bugzilla.redhat.com/show_bug.cgi?id=2469054)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43618.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43618.json)\n", "epssDetails": { "percentile": "0.54856", "probability": "0.00805", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-43618" ], "CWE": [ "CWE-125", "CWE-190" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "rsync", "creationTime": "2026-05-20T14:48:37.419998Z", "disclosureTime": "2026-05-20T02:16:36.410000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "ubuntu:20.04", "publicationTime": "2026-06-01T14:34:57.747120Z", "severityBasedOn": "Relative Importance", "modificationTime": "2026-09-24T14:14:31.673504Z", "socialTrendAlert": false, "relativeImportance": "high", "severityWithCritical": "high", "from": [ "docker-image|docker.io/scopear/docker-db@1.5.15_ddb76b9.88", "mariadb-10.7/mariadb-server@1:10.7.8+maria~ubu2004", "mariadb-10.7/mariadb-server-10.7@1:10.7.8+maria~ubu2004", "rsync@3.1.3-8ubuntu0.9" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "rsync", "version": "3.1.3-8ubuntu0.9", "nearestFixedInVersion": "3.1.3-8ubuntu0.9+esm1", "dockerBaseImage": "ubuntu:focal-20230412" } ], "ok": false, "dependencyCount": 146, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "deb", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": { "baseImage": "ubuntu:focal-20230412", "baseImageRemediation": { "code": "REMEDIATION_AVAILABLE", "advice": [ { "message": "Base Image Vulnerabilities Severity\nubuntu:focal-20230412 105 0 critical, 1 high, 82 medium, 22 low\n" }, { "message": "Recommendations for base image upgrade:\n", "bold": true }, { "message": "Minor upgrades", "bold": true }, { "message": "Base Image Vulnerabilities Severity\nubuntu:20.04 81 0 critical, 1 high, 64 medium, 16 low\n" }, { "message": "Major upgrades", "bold": true }, { "message": "Base Image Vulnerabilities Severity\nubuntu:25.10 6 0 critical, 0 high, 5 medium, 1 low\n" } ] }, "os": { "prettyName": "Ubuntu 20.04.6 LTS" } }, "summary": "28 high or critical severity vulnerable dependency paths", "severityThreshold": "high", "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 5, "projectName": "docker-image|docker.io/scopear/docker-db", "platform": "linux/amd64", "hasUnknownVersions": false, "path": "docker.io/scopear/docker-db:1.5.15_ddb76b9.88/scopear/docker-db", "applications": [ { "vulnerabilities": [ { "id": "SNYK-GOLANG-GITHUBCOMOPENCONTAINERSRUNCLIBCONTAINERSYSTEM-13843132", "title": "Race Condition Enabling Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "credit": [ "Lei Wang", "lfbzhm", "Aleksa Sarai" ], "semver": { "vulnerable": [ "<1.2.8", ">=1.3.0-rc.1 <1.3.3", ">=1.4.0-rc.1 <1.4.0-rc.3" ], "hashesRange": [ "=v1.3.0-rc.1 =v1.4.0-rc.1 =1.3.0-rc.1 <1.3.3", ">=1.4.0-rc.1 <1.4.0-rc.3" ], "hashesRange": [ "=v1.3.0-rc.1 =v1.4.0-rc.1 =1.19.0-0 <1.19.2" ], "hashesRange": [ "=go1.19.0-0
**Go Vulnerability Report:**
\r\nvia the `Reader.Read` function. An attacker can cause excessive memory allocation and trigger resource exhaustion or application panics by supplying a specially crafted archive with oversized file headers.\n## Remediation\nUpgrade `std/archive/tar` to version 1.18.7, 1.19.2 or higher.\n## References\n- [GitHub Commit](https://github.com/vbatts/tar-split/commit/a4bd92b3344321e1bd6d08ddd68f7c402d05c614)\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2022-1037)\n- [Go Commit](https://go.dev/cl/439355)\n- [Go Issue](https://go.dev/issue/54853)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/xtuG5faxtaU)\n", "epssDetails": { "percentile": "0.80268", "probability": "0.02006", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2022-1037" ], "CVE": [ "CVE-2022-2879" ], "CWE": [ "CWE-770" ] }, "packageName": "std/archive/tar", "proprietary": false, "creationTime": "2025-12-24T12:55:28.203451Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2022-10-06T16:26:05Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T13:06:51.843278Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-12T02:00:36.565759Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDARCHIVEZIP-14564382", "title": "Uncaught Exception", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "OSS-Fuzz Project", "Emmanuel Odeke" ], "semver": { "vulnerable": [ "<1.16.8", ">=1.17.0-0 <1.17.1" ], "hashesRange": [ "=go1.17.0-0
**Go Vulnerability Report:**
\r\nvia the `NewReader` or `OpenReader` functions when processing an archive that specifies an unusually large number of files. An attacker can trigger a panic or cause an unrecoverable fatal error by supplying a crafted archive with manipulated file count metadata.\n## Remediation\nUpgrade `std/archive/zip` to version 1.16.8, 1.17.1 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2022-0273)\n- [Go Commit](https://go.dev/cl/343434)\n- [Go Issue](https://go.dev/issue/47801)\n- [Google Commit](https://go.googlesource.com/go/+/bacbc33439b124ffd7392c91a5f5d96eca8c0c0b)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/dx9d7IOseHw)\n", "epssDetails": { "percentile": "0.93259", "probability": "0.06934", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2022-0273" ], "CVE": [ "CVE-2021-39293" ], "CWE": [ "CWE-248" ] }, "packageName": "std/archive/zip", "proprietary": false, "creationTime": "2025-12-24T13:03:59.235167Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2022-05-18T18:23:31Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T13:07:48.421046Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-07T02:00:24.633093Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDARCHIVEZIP-14564418", "title": "Uncaught Exception", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Colin Arnott", "Noah Santschi-Cooney" ], "semver": { "vulnerable": [ "<1.16.10", ">=1.17.0-0 <1.17.3" ], "hashesRange": [ "=go1.17.0-0
**Go Vulnerability Report:**
\r\nvia the `Open` function in the `archive/zip` package when processing zip files containing entries with names composed solely of slash characters or \"..\" path elements, or when an empty string is provided as an argument. An attacker can cause a panic and potentially disrupt application availability by crafting a malicious zip file with such entries.\n## Remediation\nUpgrade `std/archive/zip` to version 1.16.10, 1.17.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2021-0264)\n- [Go Commit](https://go.dev/cl/349770)\n- [Go Commit](https://go.googlesource.com/go/+/b24687394b55a93449e2be4e6892ead58ea9a10f)\n- [Go Issue](https://go.dev/issue/48085)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/0fM21h43arc)\n", "epssDetails": { "percentile": "0.87919", "probability": "0.03253", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2021-0264" ], "CVE": [ "CVE-2021-41772" ], "CWE": [ "CWE-248" ] }, "packageName": "std/archive/zip", "proprietary": false, "creationTime": "2025-12-24T13:09:39.509429Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2022-01-13T20:54:43Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T13:08:04.888456Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-03T02:00:40.506753Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDARCHIVEZIP-15139795", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "credit": [ "Jakub Ciolek" ], "semver": { "vulnerable": [ "<1.24.12", ">=1.25.0 <1.25.6" ], "hashesRange": [ "=go1.25.0
**Go Vulnerability Report:**
\n\narchive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.\n## Remediation\nUpgrade `std/archive/zip` to version 1.24.12, 1.25.6 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4342)\n- [Go Commit](https://go.dev/cl/736713)\n- [Go Issue](https://go.dev/issue/77102)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc)\n", "epssDetails": { "percentile": "0.52972", "probability": "0.00749", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4342" ], "CVE": [ "CVE-2025-61728" ], "CWE": [ "CWE-770" ] }, "packageName": "std/archive/zip", "proprietary": false, "creationTime": "2026-01-29T12:42:56.765155Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-01-28T19:08:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-29T12:42:56.993027Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-26T02:00:28.886698Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDCMDGO-16535172", "title": "Resources Downloaded over Insecure Protocol", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "credit": [ "Mundur" ], "semver": { "vulnerable": [ "<1.25.10", ">=1.26.0-0 <1.26.3" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\n\nA malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go command will download and execute a toolchain provided by the module proxy. A malicious module proxy can bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it, so fixed versions will refuse to execute any cached, altered versions of the toolchain. The go tool trusts go.sum files to contain accurate hashes of the current module's dependencies. A malicious proxy exploiting this vulnerability to serve an altered module will have caused an incorrect hash to be recorded in the go.sum. Users who have configured a non-trusted GOPROXY can determine if they have been affected by running \"rm go.sum ; go mod tidy ; go mod verify\", which will revalidate all dependencies of the current module. The specific flaw in more detail: The go command consults the checksum database to validate downloaded modules, when a module is not listed in the go.sum file. It verifies that the module hash reported by the checksum database matches the hash of the downloaded module. If, however, the checksum database returns a successful response that contains no entry for the module, the go command incorrectly permitted validation to succeed. A module proxy may mirror or proxy the checksum database, in which case the go command will not connect to the checksum database directly. Checksums reported by the checksum database are cryptographically signed, so a malicious proxy cannot alter the reported checksum for a module. However, a proxy which returns an empty checksum response, or a checksum response for an unrelated module, could cause the go command to proceed as if a downloaded module has been validated.\n## Remediation\nUpgrade `std/cmd/go` to version 1.25.10, 1.26.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4984)\n- [Go Commit](https://go.dev/cl/775321)\n- [Go Issue](https://go.dev/issue/79070)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/qcCIEXso47M)\n", "epssDetails": { "percentile": "0.18640", "probability": "0.00285", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4984" ], "CVE": [ "CVE-2026-42501" ], "CWE": [ "CWE-494" ] }, "packageName": "std/cmd/go", "proprietary": false, "creationTime": "2026-05-08T08:12:58.815590Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-07T19:21:40Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-05-08T08:12:59.048045Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:15:11.668672Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDCMDGO-16535174", "title": "Directory Traversal", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Harshit Gupta" ], "semver": { "vulnerable": [ "<1.25.10", ">=1.26.0-0 <1.26.3" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\n\nThe \"go tool pack\" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the \"pack\" subcommand can write files to arbitrary locations on the filesystem.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `std/cmd/go` to version 1.25.10, 1.26.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4979)\n- [Go Commit](https://go.dev/cl/767520)\n- [Go Issue](https://go.dev/issue/78778)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/qcCIEXso47M)\n", "epssDetails": { "percentile": "0.04652", "probability": "0.00162", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4979" ], "CVE": [ "CVE-2026-39817" ], "CWE": [ "CWE-22" ] }, "packageName": "std/cmd/go", "proprietary": false, "creationTime": "2026-05-08T08:16:15.517586Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-07T19:21:40Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-05-08T08:16:15.756357Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:05:24.048199Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDCOMPRESSGZIP-14564381", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.17.12", ">=1.18.0-0 <1.18.4" ], "hashesRange": [ "=go1.18.0-0
**Go Vulnerability Report:**
\r\nvia the `Reader.Read` function when processing an archive that contains a large number of concatenated zero-length compressed files. An attacker can cause a panic and exhaust the stack by supplying such a crafted archive.\n## Remediation\nUpgrade `std/compress/gzip` to version 1.17.12, 1.18.4 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2022-0524)\n- [Go Commit](https://go.dev/cl/417067)\n- [Go Issue](https://go.dev/issue/53168)\n- [Google Commit](https://go.googlesource.com/go/+/b2b8872c876201eac2d0707276c6999ff3eb185e)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE)\n", "epssDetails": { "percentile": "0.80715", "probability": "0.02066", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2022-0524" ], "CVE": [ "CVE-2022-30631" ], "CWE": [ "CWE-674" ] }, "packageName": "std/compress/gzip", "proprietary": false, "creationTime": "2025-12-24T13:00:48.242326Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2022-07-20T20:52:11Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T13:07:25.326819Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-03T14:03:43.270023Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDCRYPTOELLIPTIC-14564697", "title": "Uncaught Exception", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Project Wycheproof" ], "semver": { "vulnerable": [ "<1.17.9", ">=1.18.0-0 <1.18.1" ], "hashesRange": [ "=go1.18.0-0
**Go Vulnerability Report:**
\r\nvia the `P256().ScalarMult` or `P256().ScalarBaseMult` functions when provided with a crafted scalar input longer than 32 bytes. An attacker can cause a panic and potentially disrupt service by supplying such an input. This is only exploitable if the architecture is not amd64, arm64, ppc64le, or s390x.\n## Remediation\nUpgrade `std/crypto/elliptic` to version 1.17.9, 1.18.1 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2022-0435)\n- [Go Commit](https://go.dev/cl/397135)\n- [Go Commit](https://go.googlesource.com/go/+/37065847d87df92b5eb246c88ba2085efcf0b331)\n- [Go Issue](https://go.dev/issue/52075)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/oecdBNLOml8)\n", "epssDetails": { "percentile": "0.90719", "probability": "0.04160", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2022-0435" ], "CVE": [ "CVE-2022-28327" ], "CWE": [ "CWE-248" ] }, "packageName": "std/crypto/elliptic", "proprietary": false, "creationTime": "2025-12-24T13:18:16.357478Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2022-05-20T21:17:46Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T13:08:53.597780Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-17T02:00:35.899177Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDCRYPTOELLIPTIC-14564775", "title": "Struts: Validator Without Form Field", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "Guido Vranken" ], "semver": { "vulnerable": [ "<1.16.14", ">=1.17.0-0 <1.17.7" ], "hashesRange": [ "=go1.17.0-0
**Go Vulnerability Report:**
\r\nvia the `IsOnCurve` function. An attacker can trigger a panic or cause invalid cryptographic operations by supplying specially crafted `big.Int` values that are negative or overflow the expected field element range.\n## Remediation\nUpgrade `std/crypto/elliptic` to version 1.16.14, 1.17.7 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2021-0319)\n- [Go Commit](https://go.dev/cl/382455)\n- [Go Commit](https://go.googlesource.com/go/+/7f9494c277a471f6f47f4af3036285c0b1419816)\n- [Go Issue](https://go.dev/issue/50974)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ)\n", "epssDetails": { "percentile": "0.87181", "probability": "0.03073", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2021-0319" ], "CVE": [ "CVE-2022-23806" ], "CWE": [ "CWE-110" ] }, "packageName": "std/crypto/elliptic", "proprietary": false, "creationTime": "2025-12-24T13:21:39.308255Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2022-05-23T22:15:21Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T13:09:24.256166Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-01T02:00:31.535569Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDCRYPTORAND-14565598", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Davis Goodin", "Quim Muntal of Microsoft" ], "semver": { "vulnerable": [ "<1.17.11", ">=1.18.0-0 <1.18.3" ], "hashesRange": [ "=go1.18.0-0
**Go Vulnerability Report:**
\r\nin the `rand.Read` function on Windows when a buffer larger than 1 << 32 - 1 bytes is provided. An attacker can cause the process to hang indefinitely by supplying an excessively large buffer.\n## Remediation\nUpgrade `std/crypto/rand` to version 1.17.11, 1.18.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2022-0477)\n- [Go Commit](https://go.dev/cl/402257)\n- [Go Commit](https://go.googlesource.com/go/+/bb1f4416180511231de6d17a1f2f55c82aafc863)\n- [Go Issue](https://go.dev/issue/52561)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ)\n", "epssDetails": { "percentile": "0.82371", "probability": "0.02260", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2022-0477" ], "CVE": [ "CVE-2022-30634" ], "CWE": [ "CWE-674" ] }, "packageName": "std/crypto/rand", "proprietary": false, "creationTime": "2025-12-24T14:00:02.473828Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2022-06-09T01:43:37Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T13:14:14.512012Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-02T14:02:24.295437Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDCRYPTOTLS-14545635", "title": "Uncaught Exception", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Marten Seemann" ], "semver": { "vulnerable": [ "<1.19.6", ">=1.20.0-0 <1.20.1" ], "hashesRange": [ "=go1.20.0-0
**Go Vulnerability Report:**
\r\nLarge handshake records may cause panics in crypto/tls.Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses.This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert).\n## Remediation\nUpgrade `std/crypto/tls` to version 1.19.6, 1.20.1 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2023-1570)\n- [Go Commit](https://go.dev/cl/468125)\n- [Go Issue](https://go.dev/issue/58001)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E)\n", "epssDetails": { "percentile": "0.61833", "probability": "0.01111", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2023-1570" ], "CVE": [ "CVE-2022-41724" ], "CWE": [ "CWE-248" ] }, "packageName": "std/crypto/tls", "proprietary": false, "creationTime": "2025-12-22T15:01:11.432189Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2023-02-16T22:24:51Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:36:16.520485Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-13T02:00:39.243015Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDCRYPTOTLS-14565531", "title": "Timing Attack", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.20.0" ], "hashesRange": [ "
**Go Vulnerability Report:**
\r\nvia the `crypto/tls` process. An attacker can recover session key bits by exploiting timing information leaked during the removal of PKCS#1 padding in RSA-based TLS key exchanges.\n## Remediation\nUpgrade `std/crypto/tls` to version 1.20.0 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2023-2375)\n- [Go Commit](https://go.dev/cl/326012/26)\n- [Go Issue](https://go.dev/issue/20654)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/QMK8IQALDvA)\n- [Red Hat](https://people.redhat.com/~hkario/marvin/)\n", "epssDetails": { "percentile": "0.65408", "probability": "0.01250", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2023-2375" ], "CVE": [ "CVE-2023-45287" ], "CWE": [ "CWE-208" ] }, "packageName": "std/crypto/tls", "proprietary": false, "creationTime": "2025-12-24T13:58:22.186316Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2023-12-05T16:16:44Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T13:13:36.357268Z", "severityBasedOn": "CVSS", "modificationTime": "2026-06-18T02:00:56.240480Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDCRYPTOTLS-15928849", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Jakub Ciolek" ], "semver": { "vulnerable": [ "<1.25.9", ">=1.26.0-0 <1.26.2" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\n\nIf one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.\n## Remediation\nUpgrade `std/crypto/tls` to version 1.25.9, 1.26.2 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4870)\n- [Go Commit](https://go.dev/cl/763767)\n- [Go Issue](https://go.dev/issue/78334)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU)\n", "epssDetails": { "percentile": "0.47726", "probability": "0.00621", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4870" ], "CVE": [ "CVE-2026-32283" ], "CWE": [ "CWE-770" ] }, "packageName": "std/crypto/tls", "proprietary": false, "creationTime": "2026-04-08T09:53:35.179170Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-04-07T22:53:49Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-04-08T09:53:35.396399Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T02:00:29.783488Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDCRYPTOTLS-18858453", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Qi Deng of Aurascape.ai" ], "semver": { "vulnerable": [ "<1.25.13", ">=1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `std/crypto/tls` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-6090)\n- [Go Code Review](https://go.dev/cl/804261)\n- [Go Issue](https://go.dev/issue/80528)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.44650", "probability": "0.00568", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-6090" ], "CVE": [ "CVE-2026-56862" ], "CWE": [ "CWE-400" ] }, "packageName": "std/crypto/tls", "proprietary": false, "creationTime": "2026-08-16T13:30:25.367479Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-13T21:43:54Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:30:25.586356Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-10T02:00:45.946419Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDCRYPTOX509-14545542", "title": "Uncaught Exception", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Jakub Ciolek" ], "semver": { "vulnerable": [ "<1.24.8", ">=1.25.0 <1.25.2" ], "hashesRange": [ "=go1.25.0
**Go Vulnerability Report:**
\r\nValidating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method.This affects programs which validate arbitrary certificate chains.\n## Remediation\nUpgrade `std/crypto/x509` to version 1.24.8, 1.25.2 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2025-4013)\n- [Go Commit](https://go.dev/cl/709853)\n- [Go Issue](https://go.dev/issue/75675)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI)\n", "epssDetails": { "percentile": "0.29562", "probability": "0.00381", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2025-4013" ], "CVE": [ "CVE-2025-58188" ], "CWE": [ "CWE-248" ] }, "packageName": "std/crypto/x509", "proprietary": false, "creationTime": "2025-12-22T14:39:06.297378Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2025-10-29T21:50:08Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:33:09.972855Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T02:00:34.583324Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDCRYPTOX509-14545554", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Jakub Ciolek" ], "semver": { "vulnerable": [ "<1.24.9", ">=1.25.0 <1.25.3" ], "hashesRange": [ "=go1.25.0
**Go Vulnerability Report:**
\r\nDue to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate.This affects programs which validate arbitrary certificate chains.\n## Remediation\nUpgrade `std/crypto/x509` to version 1.24.9, 1.25.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2025-4007)\n- [Go Commit](https://go.dev/cl/709854)\n- [Go Issue](https://go.dev/issue/75681)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI)\n", "epssDetails": { "percentile": "0.32305", "probability": "0.00406", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2025-4007" ], "CVE": [ "CVE-2025-58187" ], "CWE": [ "CWE-770" ] }, "packageName": "std/crypto/x509", "proprietary": false, "creationTime": "2025-12-22T14:47:45.885042Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2025-10-29T21:49:50Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:33:26.631605Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T02:00:34.584308Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDCRYPTOX509-14545632", "title": "Uncaught Exception", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "John Howard" ], "semver": { "vulnerable": [ "<1.21.8", ">=1.22.0-0 <1.22.1" ], "hashesRange": [ "=go1.22.0-0
**Go Vulnerability Report:**
\r\nVerifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic.This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.\n## Remediation\nUpgrade `std/crypto/x509` to version 1.21.8, 1.22.1 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2024-2598)\n- [Go Commit](https://go.dev/cl/569339)\n- [Go Issue](https://go.dev/issue/65390)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg)\n", "epssDetails": { "percentile": "0.47198", "probability": "0.00667", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2024-2598" ], "CVE": [ "CVE-2024-24783" ], "CWE": [ "CWE-248" ] }, "packageName": "std/crypto/x509", "proprietary": false, "creationTime": "2025-12-22T14:57:40.002815Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-03-05T22:14:58Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:34:58.199367Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-20T15:25:11.045301Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDCRYPTOX509-15928851", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Jakub Ciolek" ], "semver": { "vulnerable": [ "<1.25.9", ">=1.26.0-0 <1.26.2" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\r\n\r\nValidating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.\n## Remediation\nUpgrade `std/crypto/x509` to version 1.25.9, 1.26.2 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4946)\n- [Go Commit](https://go.dev/cl/758061)\n- [Go Issue](https://go.dev/issue/78281)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU)\n", "epssDetails": { "percentile": "0.26751", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4946" ], "CVE": [ "CVE-2026-32281" ], "CWE": [ "CWE-770" ] }, "packageName": "std/crypto/x509", "proprietary": false, "creationTime": "2026-04-08T10:01:35.660992Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-04-07T22:53:49Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-04-08T10:01:35.927084Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T02:00:29.855350Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDCRYPTOX509-17135840", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Jakub Ciolek" ], "semver": { "vulnerable": [ "<1.25.11", ">=1.26.0-0 <1.26.4" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\n\n(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.\n## Remediation\nUpgrade `std/crypto/x509` to version 1.25.11, 1.26.4 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-5037)\n- [Go Commit](https://go.dev/cl/783621)\n- [Go Issue](https://go.dev/issue/79694)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw)\n", "epssDetails": { "percentile": "0.46081", "probability": "0.00591", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-5037" ], "CVE": [ "CVE-2026-27145" ], "CWE": [ "CWE-770" ] }, "packageName": "std/crypto/x509", "proprietary": false, "creationTime": "2026-06-03T10:36:09.094050Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-02T21:39:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-06-03T10:36:09.279699Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-27T02:00:38.121971Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDDATABASESQL-14545642", "title": "Race Condition", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L", "credit": [ "Spike Curtis from Coder" ], "semver": { "vulnerable": [ "<1.23.12", ">=1.24.0 <1.24.6" ], "hashesRange": [ "=go1.24.0
**Go Vulnerability Report:**
\r\nCancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.\n## Remediation\nUpgrade `std/database/sql` to version 1.23.12, 1.24.6 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2025-3849)\n- [Go Commit](https://go.dev/cl/693735)\n- [Go Issue](https://go.dev/issue/74831)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/x5MKroML2yM)\n", "epssDetails": { "percentile": "0.30195", "probability": "0.00383", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2025-3849" ], "CVE": [ "CVE-2025-47907" ], "CWE": [ "CWE-362" ] }, "packageName": "std/database/sql", "proprietary": false, "creationTime": "2025-12-22T15:09:03.946233Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2025-08-07T15:07:27Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:37:49.802027Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-07T14:06:22.297469Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDDEBUGMACHO-14545650", "title": "Uncaught Exception", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Burak Çarıkçı - Yunus Yıldırım" ], "semver": { "vulnerable": [ "<1.16.10", ">=1.17.0-0 <1.17.3" ], "hashesRange": [ "=go1.17.0-0
**Go Vulnerability Report:**
\r\nCalling File.ImportedSymbols on a loaded file which contains an invalid dynamic symbol table command can cause a panic, in particular if the encoded number of undefined symbols is larger than the number of symbols in the symbol table.\n## Remediation\nUpgrade `std/debug/macho` to version 1.16.10, 1.17.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2021-0263)\n- [Go Commit](https://go.dev/cl/367075)\n- [Go Commit](https://go.googlesource.com/go/+/61536ec03063b4951163bd09609c86d82631fa27)\n- [Go Issue](https://go.dev/issue/48990)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/0fM21h43arc)\n", "epssDetails": { "percentile": "0.91163", "probability": "0.04698", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2021-0263" ], "CVE": [ "CVE-2021-41771" ], "CWE": [ "CWE-248" ] }, "packageName": "std/debug/macho", "proprietary": false, "creationTime": "2025-12-22T15:18:21.536002Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2022-01-13T03:45:03Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:47:21.445531Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-01T14:04:45.085600Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDENCODINGASN1-18858463", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Marwan Atia" ], "semver": { "vulnerable": [ "<1.25.13", ">=1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.\n## Remediation\nUpgrade `std/encoding/asn1` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-5972)\n- [Go Code Review](https://go.dev/cl/814980)\n- [Go Issue](https://go.dev/issue/80405)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.44468", "probability": "0.00568", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-5972" ], "CVE": [ "CVE-2026-33818" ], "CWE": [ "CWE-674" ] }, "packageName": "std/encoding/asn1", "proprietary": false, "creationTime": "2026-08-16T13:31:49.649800Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-13T21:43:54Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:31:49.810065Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-10T02:00:45.337609Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDENCODINGGOB-14545582", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.17.12", ">=1.18.0-0 <1.18.4" ], "hashesRange": [ "=go1.18.0-0
**Go Vulnerability Report:**
\r\nCalling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion.\n## Remediation\nUpgrade `std/encoding/gob` to version 1.17.12, 1.18.4 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2022-0526)\n- [Go Commit](https://go.dev/cl/417064)\n- [Go Commit](https://go.googlesource.com/go/+/6fa37e98ea4382bf881428ee0c150ce591500eb7)\n- [Go Issue](https://go.dev/issue/53615)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE)\n", "epssDetails": { "percentile": "0.77869", "probability": "0.01810", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2022-0526" ], "CVE": [ "CVE-2022-30635" ], "CWE": [ "CWE-674" ] }, "packageName": "std/encoding/gob", "proprietary": false, "creationTime": "2025-12-22T14:50:37.249526Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2022-07-20T20:52:17Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:34:31.144780Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-04T02:00:46.107910Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDENCODINGGOB-14545643", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Md Sakib Anwar" ], "semver": { "vulnerable": [ "<1.22.7", ">=1.23.0-0 <1.23.1" ], "hashesRange": [ "=go1.23.0-0
**Go Vulnerability Report:**
\r\nCalling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to [CVE-2022-30635](https://security.snyk.io/vuln/SNYK-GOLANG-STDENCODINGGOB-14545582).\n## Remediation\nUpgrade `std/encoding/gob` to version 1.22.7, 1.23.1 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2024-3106)\n- [Go Commit](https://go.dev/cl/611239)\n- [Go Issue](https://go.dev/issue/69139)\n- [Google Groups Forum](https://groups.google.com/g/golang-dev/c/S9POB9NCTdk)\n", "epssDetails": { "percentile": "0.61994", "probability": "0.01127", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2024-3106" ], "CVE": [ "CVE-2024-34156" ], "CWE": [ "CWE-674" ] }, "packageName": "std/encoding/gob", "proprietary": false, "creationTime": "2025-12-22T15:12:56.949920Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-09-06T19:15:23Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:37:56.015388Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-21T03:25:36.856343Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDENCODINGPEM-14545563", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Jakub Ciolek" ], "semver": { "vulnerable": [ "<1.24.8", ">=1.25.0 <1.25.2" ], "hashesRange": [ "=go1.25.0
**Go Vulnerability Report:**
\r\nThe processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input.This affects programs which parse untrusted PEM inputs.\n## Remediation\nUpgrade `std/encoding/pem` to version 1.24.8, 1.25.2 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2025-4009)\n- [Go Commit](https://go.dev/cl/709858)\n- [Go Issue](https://go.dev/issue/75676)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI)\n", "epssDetails": { "percentile": "0.49665", "probability": "0.00661", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2025-4009" ], "CVE": [ "CVE-2025-61723" ], "CWE": [ "CWE-770" ] }, "packageName": "std/encoding/pem", "proprietary": false, "creationTime": "2025-12-22T14:48:45.904796Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2025-10-29T21:49:55Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:33:35.197142Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T02:00:34.027261Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDENCODINGPEM-14545636", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Juho Nurminen" ], "semver": { "vulnerable": [ "<1.17.9", ">=1.18.0-0 <1.18.1" ], "hashesRange": [ "=go1.18.0-0
**Go Vulnerability Report:**
\r\nStack overflow via a large amount of PEM data via the `Decode` function. An attacker can cause a stack overflow and potentially crash the application by supplying a large amount of PEM data.\n## Remediation\nUpgrade `std/encoding/pem` to version 1.17.9, 1.18.1 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2022-0433)\n- [Go Commit](https://go.dev/cl/399820)\n- [Go Commit](https://go.googlesource.com/go/+/45c3387d777caf28f4b992ad9a6216e3085bb8fe)\n- [Go Issue](https://go.dev/issue/51853)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/oecdBNLOml8)\n", "epssDetails": { "percentile": "0.95046", "probability": "0.09950", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2022-0433" ], "CVE": [ "CVE-2022-24675" ], "CWE": [ "CWE-674" ] }, "packageName": "std/encoding/pem", "proprietary": false, "creationTime": "2025-12-22T15:04:27.901555Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2022-05-20T21:17:25Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:36:23.613234Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-14T02:00:38.074268Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDENCODINGXML-14545645", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.17.12", ">=1.18.0-0 <1.18.4" ], "hashesRange": [ "=go1.18.0-0
**Go Vulnerability Report:**
\r\nUnmarshaling an XML document into a Go struct which has a nested field that uses the 'any' field tag can panic due to stack exhaustion.\n## Remediation\nUpgrade `std/encoding/xml` to version 1.17.12, 1.18.4 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2022-0523)\n- [Go Commit](https://go.dev/cl/417061)\n- [Go Commit](https://go.googlesource.com/go/+/c4c1993fd2a5b26fe45c09592af6d3388a3b2e08)\n- [Go Issue](https://go.dev/issue/53611)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE)\n", "epssDetails": { "percentile": "0.80914", "probability": "0.02086", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2022-0523" ], "CVE": [ "CVE-2022-30633" ], "CWE": [ "CWE-674" ] }, "packageName": "std/encoding/xml", "proprietary": false, "creationTime": "2025-12-22T15:14:26.467552Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2022-07-20T20:52:06Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:46:08.665088Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-04T02:00:46.579352Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDENCODINGXML-14545649", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Juho Nurminen" ], "semver": { "vulnerable": [ "<1.17.12", ">=1.18.0-0 <1.18.4" ], "hashesRange": [ "=go1.18.0-0
**Go Vulnerability Report:**
\r\nCalling Decoder.Skip when parsing a deeply nested XML document can cause a panic due to stack exhaustion.\n## Remediation\nUpgrade `std/encoding/xml` to version 1.17.12, 1.18.4 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2022-0521)\n- [Go Commit](https://go.dev/cl/417062)\n- [Go Commit](https://go.googlesource.com/go/+/08c46ed43d80bbb67cb904944ea3417989be4af3)\n- [Go Issue](https://go.dev/issue/53614)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE)\n", "epssDetails": { "percentile": "0.83598", "probability": "0.02418", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2022-0521" ], "CVE": [ "CVE-2022-28131" ], "CWE": [ "CWE-674" ] }, "packageName": "std/encoding/xml", "proprietary": false, "creationTime": "2025-12-22T15:17:05.671846Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2022-07-20T17:02:04Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:47:11.521162Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-04T02:00:46.580363Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDENCODINGXML-18858455", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.25.13", ">=1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.\n## Remediation\nUpgrade `std/encoding/xml` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-6088)\n- [Go Code Review](https://go.dev/cl/803320)\n- [Go Issue](https://go.dev/issue/80481)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.44468", "probability": "0.00568", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-6088" ], "CVE": [ "CVE-2026-56859" ], "CWE": [ "CWE-674" ] }, "packageName": "std/encoding/xml", "proprietary": false, "creationTime": "2026-08-16T13:30:41.577448Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-13T21:43:54Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:30:41.759190Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-10T02:00:45.639999Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDGOBUILDCONSTRAINT-14545644", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.22.7", ">=1.23.0-0 <1.23.1" ], "hashesRange": [ "=go1.23.0-0
**Go Vulnerability Report:**
\r\nCalling Parse on a \"// +build\" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.\n## Remediation\nUpgrade `std/go/build/constraint` to version 1.22.7, 1.23.1 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2024-3107)\n- [Go Commit](https://go.dev/cl/611240)\n- [Go Issue](https://go.dev/issue/69141)\n- [Google Groups Forum](https://groups.google.com/g/golang-dev/c/S9POB9NCTdk)\n", "epssDetails": { "percentile": "0.59877", "probability": "0.01046", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2024-3107" ], "CVE": [ "CVE-2024-34158" ], "CWE": [ "CWE-674" ] }, "packageName": "std/go/build/constraint", "proprietary": false, "creationTime": "2025-12-22T15:13:40.544077Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-09-06T19:15:23Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:38:10.721756Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-03T02:00:37.522886Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDGOSCANNER-14550550", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Philippe Antoine" ], "semver": { "vulnerable": [ "<1.19.8", ">=1.20.0-0 <1.20.3" ], "hashesRange": [ "=go1.20.0-0
**Go Vulnerability Report:**
\r\nCalling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.\n## Remediation\nUpgrade `std/go/scanner` to version 1.19.8, 1.20.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2023-1702)\n- [Go Commit](https://go.dev/cl/482078)\n- [Go Issue](https://go.dev/issue/59180)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8)\n", "epssDetails": { "percentile": "0.69340", "probability": "0.01412", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2023-1702" ], "CVE": [ "CVE-2023-24537" ], "CWE": [ "CWE-835" ] }, "packageName": "std/go/scanner", "proprietary": false, "creationTime": "2025-12-23T08:54:45.902970Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2023-04-05T21:05:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T13:03:30.591990Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T15:25:28.863217Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDHTMLTEMPLATE-14548479", "title": "Improper Encoding or Escaping of Output", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "Juho Nurminen" ], "semver": { "vulnerable": [ "<1.19.9", ">=1.20.0-0 <1.20.4" ], "hashesRange": [ "=go1.20.0-0
**Go Vulnerability Report:**
Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set \"\\t\\n\\f\\r\\u0020\\u2028\\u2029\" in JavaScript contexts that also contain actions may not be properly sanitized during execution.\n## Remediation\nUpgrade `std/html/template` to version 1.19.9, 1.20.4 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2023-1752)\n- [Go Code Review](https://go.dev/cl/491616)\n- [Go Issue](https://go.dev/issue/59721)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU)\n", "epssDetails": { "percentile": "0.72834", "probability": "0.01560", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2023-1752" ], "CVE": [ "CVE-2023-24540" ], "CWE": [ "CWE-116" ] }, "packageName": "std/html/template", "proprietary": false, "creationTime": "2025-12-23T07:08:07.465607Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2023-05-05T21:10:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:49:51.446759Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-19T02:00:46.312036Z", "socialTrendAlert": false, "severityWithCritical": "critical", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDHTMLTEMPLATE-14548487", "title": "Cross-site Scripting (XSS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "Sohom Datta" ], "semver": { "vulnerable": [ "<1.19.8", ">=1.20.0-0 <1.20.3" ], "hashesRange": [ "=go1.20.0-0
**Go Vulnerability Report:**
Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected.Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to terminate the literal, injecting arbitrary Javascript code into the Go template.As ES6 template literals are rather complex, and themselves can do string interpolation, the decision was made to simply disallow Go template actions from being used inside of them (e.g. \"var a = {{.}}\"), since there is no obviously safe way to allow this behavior. This takes the same approach as github.com/google/safehtml.With fix, Template.Parse returns an Error when it encounters templates like this, with an ErrorCode of value 12. This ErrorCode is currently unexported, but will be exported in the release of Go 1.21.Users who rely on the previous behavior can re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat that backticks will now be escaped. This should be used with caution.\n## Details\n\nCross-site scripting (or XSS) is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and executed by the end user’s browser when the user interacts with the compromised website.\n\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\n\nInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\n\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as `<`; and `>` can be coded as `>`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\n \nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \n\n### Types of attacks\nThere are a few methods by which XSS can be manipulated:\n\n|Type|Origin|Description|\n|--|--|--|\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\n\n### Affected environments\nThe following environments are susceptible to an XSS attack:\n\n* Web servers\n* Application servers\n* Web application environments\n\n### How to prevent\nThis section describes the top best practices designed to specifically protect your code: \n\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \n* Give users the option to disable client-side scripts.\n* Redirect invalid requests.\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n## Remediation\nUpgrade `std/html/template` to version 1.19.8, 1.20.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2023-1703)\n- [Go Code Review](https://go.dev/cl/482079)\n- [Go Issue](https://go.dev/issue/59234)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8)\n", "epssDetails": { "percentile": "0.80814", "probability": "0.02281", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2023-1703" ], "CVE": [ "CVE-2023-24538" ], "CWE": [ "CWE-79" ] }, "packageName": "std/html/template", "proprietary": false, "creationTime": "2025-12-23T07:15:19.772083Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2023-04-05T21:05:27Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:51:02.755078Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-12T02:00:26.187123Z", "socialTrendAlert": false, "severityWithCritical": "critical", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDINTERNALSAFEFILEPATH-14606269", "title": "Relative Path Traversal", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Damien Neil" ], "semver": { "vulnerable": [ "<1.20.11", ">=1.21.0-0 <1.21.4" ], "hashesRange": [ "=go1.21.0-0
**Go Vulnerability Report:**
The filepath package does not recognize paths with a \\??\\ prefix as special.On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x.Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b.Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b.In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name.UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `std/internal/safefilepath` to version 1.20.11, 1.21.4 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2023-2185)\n- [Go Code Review](https://go.dev/cl/540277)\n- [Go Code Review](https://go.dev/cl/541175)\n- [Go Issue](https://go.dev/issue/63713)\n- [Go Issue](https://go.dev/issue/64028)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY)\n- [Google Groups Forum](https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ)\n", "epssDetails": { "percentile": "0.84285", "probability": "0.02758", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2023-45283" ], "CWE": [ "CWE-22" ] }, "packageName": "std/internal/safefilepath", "proprietary": false, "creationTime": "2025-12-25T08:36:45.918397Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2023-11-07T19:37:05Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T13:19:42.313134Z", "severityBasedOn": "CVSS", "modificationTime": "2026-06-15T15:17:48.587041Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDINTERNALSYSCALLUNIX-16086164", "title": "Time-of-check Time-of-use (TOCTOU) Race Condition", "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "credit": [ "Uuganbayar Lkhamsuren" ], "semver": { "vulnerable": [ "<1.25.9", ">=1.26.0-0 <1.26.2" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.\n## Remediation\nUpgrade `std/internal/syscall/unix` to version 1.25.9, 1.26.2 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4864)\n- [Go Commit](https://go.dev/cl/763761)\n- [Go Issue](https://go.dev/issue/78293)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU)\n", "epssDetails": { "percentile": "0.19520", "probability": "0.00292", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4864" ], "CVE": [ "CVE-2026-32282" ], "CWE": [ "CWE-367" ] }, "packageName": "std/internal/syscall/unix", "proprietary": false, "creationTime": "2026-04-16T19:13:55.553568Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-04-07T22:53:49Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-04-16T19:14:32.856527Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-03T02:00:36.408488Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDIOFS-14545646", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.17.12", ">=1.18.0-0 <1.18.4" ], "hashesRange": [ "=go1.18.0-0
**Go Vulnerability Report:**
\r\nCalling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion.\n## Remediation\nUpgrade `std/io/fs` to version 1.17.12, 1.18.4 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2022-0527)\n- [Go Commit](https://go.dev/cl/417065)\n- [Go Commit](https://go.googlesource.com/go/+/fa2d41d0ca736f3ad6b200b2a4e134364e9acc59)\n- [Go Issue](https://go.dev/issue/53415)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE)\n", "epssDetails": { "percentile": "0.80754", "probability": "0.02069", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2022-0527" ], "CVE": [ "CVE-2022-30630" ], "CWE": [ "CWE-674" ] }, "packageName": "std/io/fs", "proprietary": false, "creationTime": "2025-12-22T15:15:16.763214Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2022-07-20T20:52:22Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:46:14.890824Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-03T14:03:42.180525Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDMATHBIG-14548568", "title": "Uncaught Exception", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "@catenacyber" ], "semver": { "vulnerable": [ "<1.17.13", ">=1.18.0-0 <1.18.5" ], "hashesRange": [ "=go1.18.0-0
**Go Vulnerability Report:**
Decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service.\n## Remediation\nUpgrade `std/math/big` to version 1.17.13, 1.18.5 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2022-0537)\n- [Go Code Review](https://go.dev/cl/417774)\n- [Go Commit](https://go.googlesource.com/go/+/055113ef364337607e3e72ed7d48df67fde6fc66)\n- [Go Issue](https://go.dev/issue/53871)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/YqYYG87xB10)\n", "epssDetails": { "percentile": "0.84995", "probability": "0.02629", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2022-0537" ], "CVE": [ "CVE-2022-32189" ], "CWE": [ "CWE-248" ] }, "packageName": "std/math/big", "proprietary": false, "creationTime": "2025-12-23T07:32:20.186352Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2022-08-01T22:21:06Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:53:50.147823Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T02:00:34.401642Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDMATHBIG-14549339", "title": "Integer Overflow or Wraparound", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Emmanuel Odeke" ], "semver": { "vulnerable": [ "<1.16.14", ">=1.17.0-0 <1.17.7" ], "hashesRange": [ "=go1.17.0-0
**Go Vulnerability Report:**
\r\nRat.SetString had an overflow issue that can lead to uncontrolled memory consumption.\n## Remediation\nUpgrade `std/math/big` to version 1.16.14, 1.17.7 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2021-0317)\n- [Go Commit](https://go.dev/cl/379537)\n- [Go Commit](https://go.googlesource.com/go/+/ad345c265916bbf6c646865e4642eafce6d39e78)\n- [Go Issue](https://go.dev/issue/50699)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ)\n", "epssDetails": { "percentile": "0.85982", "probability": "0.02807", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2021-0317" ], "CVE": [ "CVE-2022-23772" ], "CWE": [ "CWE-190" ] }, "packageName": "std/math/big", "proprietary": false, "creationTime": "2025-12-23T08:49:49.000962Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2022-05-23T22:15:42Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T13:01:09.539608Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-01T02:00:31.952473Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDMIME-17135844", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "p4p3r" ], "semver": { "vulnerable": [ "<1.25.11", ">=1.26.0-0 <1.26.4" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\n\nDecoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.\n## Remediation\nUpgrade `std/mime` to version 1.25.11, 1.26.4 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-5038)\n- [Go Commit](https://go.dev/cl/774481)\n- [Go Issue](https://go.dev/issue/79217)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw)\n", "epssDetails": { "percentile": "0.42188", "probability": "0.00560", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-5038" ], "CVE": [ "CVE-2026-42504" ], "CWE": [ "CWE-770" ] }, "packageName": "std/mime", "proprietary": false, "creationTime": "2026-06-03T10:42:37.184395Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-02T21:39:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-06-03T10:42:37.356366Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-11T15:26:21.503952Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDMIMEMULTIPART-14548565", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Arpad Ryszka", "Jakob Ackermann" ], "semver": { "vulnerable": [ "<1.19.6", ">=1.20.0-0 <1.20.1" ], "hashesRange": [ "=go1.20.0-0
**Go Vulnerability Report:**
A denial of service is possible from excessive resource consumption in net/http and mime/multipart.Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue.ReadForm takes a maxMemory parameter, and is documented as storing \"up to maxMemory bytes +10MB (reserved for non-file parts) in memory\". File parts which cannot be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file parts is excessively large and can potentially open a denial of service vector on its own. However, ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead, part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In addition, ReadForm contained no limit on the number of disk files created, permitting a relatively small request body to create a large number of disk temporary files.With fix, ReadForm now properly accounts for various forms of memory overhead, and should now stay within its documented limit of 10MB + maxMemory bytes of memory consumption. Users should still be aware that this limit is high and may still be hazardous.In addition, ReadForm now creates at most one on-disk temporary file, combining multiple form parts into a single temporary file. The mime/multipart.File interface type's documentation states, \"If stored on disk, the File's underlying concrete type will be an *os.File.\". This is no longer the case when a form contains more than one file part, due to this coalescing of parts into a single file. The previous behavior of using distinct files for each form part may be reenabled with the environment variable GODEBUG=multipartfiles=distinct.Users should be aware that multipart.ReadForm and the http.Request methods that call it do not limit the amount of disk consumed by temporary files. Callers can limit the size of form data with http.MaxBytesReader.\n## Remediation\nUpgrade `std/mime/multipart` to version 1.19.6, 1.20.1 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2023-1569)\n- [Go Code Review](https://go.dev/cl/468124)\n- [Go Issue](https://go.dev/issue/58006)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E)\n", "epssDetails": { "percentile": "0.66296", "probability": "0.01241", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2023-1569" ], "CVE": [ "CVE-2022-41725" ], "CWE": [ "CWE-770" ] }, "packageName": "std/mime/multipart", "proprietary": false, "creationTime": "2025-12-23T07:31:02.703663Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2023-02-21T20:44:30Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:52:57.912906Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-07T02:00:25.837196Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDMIMEMULTIPART-14552568", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Jakob Ackermann" ], "semver": { "vulnerable": [ "<1.19.8", ">=1.20.0-0 <1.20.3" ], "hashesRange": [ "=go1.20.0-0
**Go Vulnerability Report:**
\r\n\r\nMultipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes:\r\n1. `mime/multipart.Reader.ReadForm` limits the total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed, leading it to accept larger inputs than intended.\r\n2. Limiting total memory does not account for increased pressure on the garbage collector from large numbers of small allocations in forms with many parts.\r\n3. ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage collector.\r\nThe combination of these factors can permit an attacker to cause an program that parses multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service. This affects programs that use `mime/multipart.Reader.ReadForm`, as well as form parsing in the `net/http` package with the Request methods `FormFile`, `FormValue`, `ParseMultipartForm`, and `PostFormValue.With` fix, `ReadForm` now does a better job of estimating the memory consumption of parsed forms, and performs many fewer short-lived allocations.In addition, the fixed `mime/multipart.Reader` imposes the following limits on the size of parsed forms:\r\n1. Forms parsed with ReadForm may contain no more than 1000 parts. This limit may be adjusted with the environment variable `GODEBUG=multipartmaxparts=`.\r\n2. Form parts parsed with NextPart and NextRawPart may contain no more than 10,000 header fields. In addition, forms parsed with ReadForm may contain no more than 10,000 header fields across all parts. This limit may be adjusted with the environment variable `GODEBUG=multipartmaxheaders=`.\n## Remediation\nUpgrade `std/mime/multipart` to version 1.19.8, 1.20.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2023-1705)\n- [Go Commit](https://go.dev/cl/482075)\n- [Go Commit](https://go.dev/cl/482076)\n- [Go Commit](https://go.dev/cl/482077)\n- [Go Issue](https://go.dev/issue/59153)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8)\n", "epssDetails": { "percentile": "0.70654", "probability": "0.01479", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2023-1705" ], "CVE": [ "CVE-2023-24536" ], "CWE": [ "CWE-770" ] }, "packageName": "std/mime/multipart", "proprietary": false, "creationTime": "2025-12-23T16:22:00.567939Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2023-04-05T21:04:39Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T13:06:38.363507Z", "severityBasedOn": "CVSS", "modificationTime": "2026-06-30T02:00:22.818151Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDNET-16535159", "title": "Double Free", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "hamayanhamayan" ], "semver": { "vulnerable": [ "<1.25.10", ">=1.26.0-0 <1.26.3" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\r\n\r\nWhen using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.\n## Remediation\nUpgrade `std/net` to version 1.25.10, 1.26.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4981)\n- [Go Commit](https://go.dev/cl/767860)\n- [Go Issue](https://go.dev/issue/78803)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/qcCIEXso47M)\n", "epssDetails": { "percentile": "0.55328", "probability": "0.00813", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4981" ], "CVE": [ "CVE-2026-33811" ], "CWE": [ "CWE-415" ] }, "packageName": "std/net", "proprietary": false, "creationTime": "2026-05-08T07:47:55.531293Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-07T19:21:40Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-05-08T07:47:55.737831Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T02:00:29.793319Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDNET-16535161", "title": "Uncaught Exception", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.25.10", ">=1.26.0-0 <1.26.3" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\n\nThe Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).\n## Remediation\nUpgrade `std/net` to version 1.25.10, 1.26.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4971)\n- [Go Commit](https://go.dev/cl/775320)\n- [Go Issue](https://go.dev/issue/79006)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/qcCIEXso47M)\n", "epssDetails": { "percentile": "0.47398", "probability": "0.00620", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4971" ], "CVE": [ "CVE-2026-39836" ], "CWE": [ "CWE-248" ] }, "packageName": "std/net", "proprietary": false, "creationTime": "2026-05-08T07:50:03.529718Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-07T19:21:40Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-05-08T07:50:03.729144Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:00:42.458847Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDNETHTTP-14545515", "title": "Directory Traversal", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.18.9", ">=1.19.0-0 <1.19.4" ], "hashesRange": [ "=go1.19.0-0
**Go Vulnerability Report:**
\r\nOn Windows, restricted files can be accessed via os.DirFS and http.Dir.The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permit access to Windows device files under that root. For example, os.DirFS(\"C:/tmp\").Open(\"COM1\") opens the COM1 device. Both os.DirFS and http.Dir only provide read-only filesystem access. In addition, on Windows, an os.DirFS for the directory (the root of the current drive) can permit a maliciously crafted path to escape from the drive and access any path on the system.With fix applied, the behavior of os.DirFS(\"\") has changed. Previously, an empty root was treated equivalently to \"/\", so os.DirFS(\"\").Open(\"tmp\") would open the path \"/tmp\". This now returns an error.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `std/net/http` to version 1.18.9, 1.19.4 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2022-1143)\n- [Go Commit](https://go.dev/cl/455716)\n- [Go Issue](https://go.dev/issue/56694)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ)\n", "epssDetails": { "percentile": "0.69106", "probability": "0.01279", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2022-1143" ], "CVE": [ "CVE-2022-41720" ], "CWE": [ "CWE-22" ] }, "packageName": "std/net/http", "proprietary": false, "creationTime": "2025-12-22T08:15:45.805592Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2022-12-07T16:08:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2025-12-22T11:21:13.505988Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T02:00:27.551286Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDNETHTTP-14548596", "title": "Insertion of Sensitive Information Into Sent Data", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "credit": [ "Takeshi Kaneko" ], "semver": { "vulnerable": [ "<1.23.10", ">=1.24.0-0 <1.24.4" ], "hashesRange": [ "=go1.24.0-0
**Go Vulnerability Report:**
\r\nProxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.\n## Remediation\nUpgrade `std/net/http` to version 1.23.10, 1.24.4 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2025-3751)\n- [Go Commit](https://go.dev/cl/679257)\n- [Go Issue](https://go.dev/issue/73816)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A)\n", "epssDetails": { "percentile": "0.49837", "probability": "0.00666", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2025-3751" ], "CVE": [ "CVE-2025-4673" ], "CWE": [ "CWE-201" ] }, "packageName": "std/net/http", "proprietary": false, "creationTime": "2025-12-23T08:25:47.049128Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2025-06-11T16:23:58Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:54:56.836227Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-12T14:03:28.290258Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDNETHTTP-14548598", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Geoff Franks" ], "semver": { "vulnerable": [ "<1.21.12", ">=1.22.0-0 <1.22.5" ], "hashesRange": [ "=go1.22.0-0
**Go Vulnerability Report:**
\r\nThe net/http HTTP/1.1 client mishandled the case where a server responds to a request with an \"Expect: 100-continue\" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail.An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending \"Expect: 100-continue\" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.\n## Remediation\nUpgrade `std/net/http` to version 1.21.12, 1.22.5 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2024-2963)\n- [Go Commit](https://go.dev/cl/591255)\n- [Go Issue](https://go.dev/issue/67555)\n- [Google Groups Forum](https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ)\n", "epssDetails": { "percentile": "0.69149", "probability": "0.01414", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2024-2963" ], "CVE": [ "CVE-2024-24791" ], "CWE": [ "CWE-770" ] }, "packageName": "std/net/http", "proprietary": false, "creationTime": "2025-12-23T08:28:02.227983Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-07-02T20:11:00Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:55:10.001159Z", "severityBasedOn": "CVSS", "modificationTime": "2026-06-16T02:00:37.919606Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDNETHTTP-14548601", "title": "HTTP Response Splitting", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "credit": [ "Bartek Nowotarski" ], "semver": { "vulnerable": [ "<1.19.11", ">=1.20.0-0 <1.20.6" ], "hashesRange": [ "=go1.20.0-0
**Go Vulnerability Report:**
\r\nThe HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests.With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.\n## Remediation\nUpgrade `std/net/http` to version 1.19.11, 1.20.6 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2023-1878)\n- [Go Commit](https://go.dev/cl/506996)\n- [Go Issue](https://go.dev/issue/60374)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/2q13H6LEEx0)\n", "epssDetails": { "percentile": "0.70349", "probability": "0.01453", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2023-1878" ], "CVE": [ "CVE-2023-29406" ], "CWE": [ "CWE-113" ] }, "packageName": "std/net/http", "proprietary": false, "creationTime": "2025-12-23T08:31:50.877621Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2023-07-11T19:19:08Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:56:50.441259Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-24T02:00:40.713665Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDNETHTTP-14548603", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "murakmii" ], "semver": { "vulnerable": [ "<1.16.12", ">=1.17.0-0 <1.17.5" ], "hashesRange": [ "=go1.17.0-0
**Go Vulnerability Report:**
\r\nAn attacker can cause unbounded memory growth in servers accepting HTTP/2 requests.\n## Remediation\nUpgrade `std/net/http` to version 1.16.12, 1.17.5 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2022-0288)\n- [Go Commit](https://go.dev/cl/369794)\n- [Go Issue](https://go.dev/issue/50058)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/hcmEScgc00k)\n", "epssDetails": { "percentile": "0.89055", "probability": "0.03958", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2022-0288" ], "CVE": [ "CVE-2021-44716" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-vc3p-29h2-gpcp" ] }, "packageName": "std/net/http", "proprietary": false, "creationTime": "2025-12-23T08:34:40.208265Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2022-07-15T23:08:33Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:57:05.356101Z", "severityBasedOn": "CVSS", "modificationTime": "2026-06-18T02:00:56.626223Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDNETHTTP-14565071", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Bartek Nowotarski" ], "semver": { "vulnerable": [ "<1.21.9", ">=1.22.0-0 <1.22.2" ], "hashesRange": [ "=go1.22.0-0
**Go Vulnerability Report:**
\r\nAn attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames.Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed.This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send.The fix sets a limit on the amount of excess header frames we will process before closing a connection.\n## Remediation\nUpgrade `std/net/http` to version 1.21.9, 1.22.2 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2024-2687)\n- [Go Commit](https://go.dev/cl/576155)\n- [Go Issue](https://go.dev/issue/65051)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M)\n", "epssDetails": { "percentile": "0.99806", "probability": "0.91969", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2024-2687" ], "CVE": [ "CVE-2023-45288" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-4v7x-pqxf-cx7m" ] }, "packageName": "std/net/http", "proprietary": false, "creationTime": "2025-12-24T13:33:48.782884Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-04-03T21:12:01Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T13:09:38.617506Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-10T15:25:12.162033Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDNETHTTP-14565072", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.20.10", ">=1.21.0-0 <1.21.3" ], "hashesRange": [ "=go1.21.0-0
**Go Vulnerability Report:**
\r\nA malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing.With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection.This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2.The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.\n## Remediation\nUpgrade `std/net/http` to version 1.20.10, 1.21.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2023-2102)\n- [Go Commit](https://go.dev/cl/534215)\n- [Go Commit](https://go.dev/cl/534235)\n- [Go Issue](https://go.dev/issue/63417)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ)\n", "epssDetails": { "percentile": "0.88568", "probability": "0.03796", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2023-2102" ], "CVE": [ "CVE-2023-39325" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-4374-p667-p6c8" ] }, "packageName": "std/net/http", "proprietary": false, "creationTime": "2025-12-24T13:35:06.423413Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2023-10-11T16:49:53Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T13:09:45.336089Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-18T02:00:38.959698Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDNETHTTP-14565075", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Bahruz Jabiyev", "Tommaso Innocenti", "Anthony Gavazzi", "Steven Sprecher", "Kaan Onarlioglu" ], "semver": { "vulnerable": [ "<1.18.6", ">=1.19.0-0 <1.19.1" ], "hashesRange": [ "=go1.19.0-0
**Go Vulnerability Report:**
\r\nHTTP/2 server connections can hang forever waiting for a clean shutdown that was preempted by a fatal error. This condition can be exploited by a malicious client to cause a denial of service.\n## Remediation\nUpgrade `std/net/http` to version 1.18.6, 1.19.1 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2022-0969)\n- [Go Commit](https://go.dev/cl/428735)\n- [Go Issue](https://go.dev/issue/54658)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/x49AQzIVX-s)\n", "epssDetails": { "percentile": "0.87552", "probability": "0.03269", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2022-0969" ], "CVE": [ "CVE-2022-27664" ], "CWE": [ "CWE-835" ], "GHSA": [ "GHSA-69cg-p879-7622" ] }, "packageName": "std/net/http", "proprietary": false, "creationTime": "2025-12-24T13:37:26.414086Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2022-09-12T20:23:06Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T13:10:18.751786Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-10T02:00:46.188647Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDNETHTTP-14565077", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Philippe Antoine" ], "semver": { "vulnerable": [ "<1.19.6", ">=1.20.0-0 <1.20.1" ], "hashesRange": [ "=go1.20.0-0
**Go Vulnerability Report:**
\r\nA maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.\n## Remediation\nUpgrade `std/net/http` to version 1.19.6, 1.20.1 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2023-1571)\n- [Go Commit](https://go.dev/cl/468135)\n- [Go Commit](https://go.dev/cl/468295)\n- [Go Issue](https://go.dev/issue/57855)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E)\n", "epssDetails": { "percentile": "0.90352", "probability": "0.04561", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2023-1571" ], "CVE": [ "CVE-2022-41723" ], "CWE": [ "CWE-770" ], "GHSA": [ "GHSA-vvpx-j8f3-3w6h" ] }, "packageName": "std/net/http", "proprietary": false, "creationTime": "2025-12-24T13:39:36.451701Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2023-02-16T22:31:36Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T13:10:30.020129Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-15T02:00:34.165075Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDNETHTTP-16535158", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Marwan Atia" ], "semver": { "vulnerable": [ "<1.25.10", ">=1.26.0-0 <1.26.3" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\n\nWhen processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a `SETTINGS_MAX_FRAME_SIZE` with a value of 0.\n## Remediation\nUpgrade `std/net/http` to version 1.25.10, 1.26.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4918)\n- [Go Commit](https://go.dev/cl/761581)\n- [Go Commit](https://go.dev/cl/761640)\n- [Go Issue](https://go.dev/issue/78476)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/qcCIEXso47M)\n", "epssDetails": { "percentile": "0.54175", "probability": "0.00781", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4918" ], "CVE": [ "CVE-2026-33814" ], "CWE": [ "CWE-835" ] }, "packageName": "std/net/http", "proprietary": false, "creationTime": "2026-05-08T07:35:59.608372Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-07T19:21:40Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-05-08T07:35:59.838416Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-27T02:00:38.361656Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDNETHTTP-18858429", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.25.13", ">=1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `std/net/http` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-6089)\n- [Go Code Review](https://go.dev/cl/795540)\n- [Go Issue](https://go.dev/issue/80205)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.44468", "probability": "0.00568", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-6089" ], "CVE": [ "CVE-2026-56853" ], "CWE": [ "CWE-400" ] }, "packageName": "std/net/http", "proprietary": false, "creationTime": "2026-08-16T13:28:12.349185Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-13T21:43:54Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:28:12.649447Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-10T02:00:46.191702Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDNETHTTPHTTPUTIL-14548566", "title": "HTTP Request Smuggling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Gal Goldstein", "Daniel Abeles" ], "semver": { "vulnerable": [ "<1.18.7", ">=1.19.0-0 <1.19.2" ], "hashesRange": [ "=go1.19.0-0
**Go Vulnerability Report:**
Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value.After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.\n## Remediation\nUpgrade `std/net/http/httputil` to version 1.18.7, 1.19.2 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2022-1038)\n- [Go Code Review](https://go.dev/cl/432976)\n- [Go Issue](https://go.dev/issue/54663)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/xtuG5faxtaU)\n", "epssDetails": { "percentile": "0.71869", "probability": "0.01408", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2022-1038" ], "CVE": [ "CVE-2022-2880" ], "CWE": [ "CWE-444" ] }, "packageName": "std/net/http/httputil", "proprietary": false, "creationTime": "2025-12-23T07:31:21.701031Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2022-10-06T16:42:43Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:53:04.079165Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-12T02:00:39.242592Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDNETHTTPINTERNAL-14548500", "title": "HTTP Request Smuggling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "credit": [ "Jeppe Bonde Weikop" ], "semver": { "vulnerable": [ "<1.23.8", ">=1.24.0-0 <1.24.2" ], "hashesRange": [ "=go1.24.0-0
**Go Vulnerability Report:**
The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.\n## Remediation\nUpgrade `std/net/http/internal` to version 1.23.8, 1.24.2 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2025-3563)\n- [Go Code Review](https://go.dev/cl/652998)\n- [Go Issue](https://go.dev/issue/71988)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/Y2uBTVKjBQk)\n", "epssDetails": { "percentile": "0.56157", "probability": "0.00826", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2025-3563" ], "CVE": [ "CVE-2025-22871" ], "CWE": [ "CWE-444" ] }, "packageName": "std/net/http/internal", "proprietary": false, "creationTime": "2025-12-23T07:17:38.743988Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2025-04-08T19:46:23Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:51:23.651193Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:02.938506Z", "socialTrendAlert": false, "severityWithCritical": "critical", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDNETMAIL-14548482", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Philippe Antoine" ], "semver": { "vulnerable": [ "<1.24.8", ">=1.25.0 <1.25.2" ], "hashesRange": [ "=go1.25.0
**Go Vulnerability Report:**
The `ParseAddress` function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption.\n## Remediation\nUpgrade `std/net/mail` to version 1.24.8, 1.25.2 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2025-4006)\n- [Go Code Review](https://go.dev/cl/709860)\n- [Go Issue](https://go.dev/issue/75680)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI)\n", "epssDetails": { "percentile": "0.49004", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2025-4006" ], "CVE": [ "CVE-2025-61725" ], "CWE": [ "CWE-770" ] }, "packageName": "std/net/mail", "proprietary": false, "creationTime": "2025-12-23T07:13:08.194725Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2025-10-29T21:48:35Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:50:11.738531Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T02:00:32.061873Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDNETMAIL-14548677", "title": "Improper Neutralization", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "Juho Nurminen", "Slonser" ], "semver": { "vulnerable": [ "<1.21.8", ">=1.22.0-0 <1.22.1" ], "hashesRange": [ "=go1.22.0-0
**Go Vulnerability Report:**
\r\nThe ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.\n## Remediation\nUpgrade `std/net/mail` to version 1.21.8, 1.22.1 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2024-2609)\n- [Go Commit](https://go.dev/cl/555596)\n- [Go Issue](https://go.dev/issue/65083)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg)\n", "epssDetails": { "percentile": "0.62039", "probability": "0.01050", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2024-2609" ], "CVE": [ "CVE-2024-24784" ], "CWE": [ "CWE-150" ] }, "packageName": "std/net/mail", "proprietary": false, "creationTime": "2025-12-23T08:46:33.993559Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-03-05T22:15:04Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T13:00:33.251202Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-06T14:04:14.874375Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDNETMAIL-16535166", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "thatnealpatel" ], "semver": { "vulnerable": [ "<1.25.10", ">=1.26.0-0 <1.26.3" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\r\n\r\nWell-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.\n## Remediation\nUpgrade `std/net/mail` to version 1.25.10, 1.26.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4986)\n- [Go Commit](https://go.dev/cl/759940)\n- [Go Issue](https://go.dev/issue/78566)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/qcCIEXso47M)\n", "epssDetails": { "percentile": "0.54463", "probability": "0.00784", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4986" ], "CVE": [ "CVE-2026-39820" ], "CWE": [ "CWE-770" ] }, "packageName": "std/net/mail", "proprietary": false, "creationTime": "2026-05-08T08:04:44.554244Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-07T19:21:40Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-05-08T08:04:44.821365Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-03T02:00:40.967914Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDNETNETIP-14548515", "title": "Improper Check for Unusual or Exceptional Conditions", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "Enze Wang", "Jianjun Chen" ], "semver": { "vulnerable": [ "<1.21.11", ">=1.22.0-0 <1.22.4" ], "hashesRange": [ "=go1.22.0-0
**Go Vulnerability Report:**
The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.\n## Remediation\nUpgrade `std/net/netip` to version 1.21.11, 1.22.4 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2024-2887)\n- [Go Code Review](https://go.dev/cl/590316)\n- [Go Issue](https://go.dev/issue/67680)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ)\n", "epssDetails": { "percentile": "0.77561", "probability": "0.01952", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2024-2887" ], "CVE": [ "CVE-2024-24790" ], "CWE": [ "CWE-754" ] }, "packageName": "std/net/netip", "proprietary": false, "creationTime": "2025-12-23T07:21:28.042471Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-06-04T22:48:55Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:51:59.716696Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-15T15:25:29.119173Z", "socialTrendAlert": false, "severityWithCritical": "critical", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDNETTEXTPROTO-14552561", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Bartek Nowotarski" ], "semver": { "vulnerable": [ "<1.21.8", ">=1.22.0-0 <1.22.1" ], "hashesRange": [ "=go1.22.0-0
**Go Vulnerability Report:**
\r\n\r\nWhen parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.\n## Remediation\nUpgrade `std/net/textproto` to version 1.21.8, 1.22.1 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2024-2599)\n- [Go Commit](https://go.dev/cl/569341)\n- [Go Issue](https://go.dev/issue/65383)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg)\n", "epssDetails": { "percentile": "0.63361", "probability": "0.01165", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2024-2599" ], "CVE": [ "CVE-2023-45290" ], "CWE": [ "CWE-770" ] }, "packageName": "std/net/textproto", "proprietary": false, "creationTime": "2025-12-23T16:17:49.686655Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2024-03-05T22:15:00Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T13:06:02.617465Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-08T15:25:18.408300Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDNETTEXTPROTO-14552562", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Jakob Ackermann" ], "semver": { "vulnerable": [ "<1.19.8", ">=1.20.0-0 <1.20.3" ], "hashesRange": [ "=go1.20.0-0
**Go Vulnerability Report:**
\r\n\r\nHTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service.With fix, header parsing now correctly allocates only the memory required to hold parsed headers.\n## Remediation\nUpgrade `std/net/textproto` to version 1.19.8, 1.20.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2023-1704)\n- [Go Commit](https://go.dev/cl/481994)\n- [Go Issue](https://go.dev/issue/58975)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8)\n", "epssDetails": { "percentile": "0.76763", "probability": "0.01888", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2023-1704" ], "CVE": [ "CVE-2023-24534" ], "CWE": [ "CWE-770" ] }, "packageName": "std/net/textproto", "proprietary": false, "creationTime": "2025-12-23T16:18:58.298660Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2023-04-05T21:04:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T13:06:28.529269Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-10T02:00:32.082387Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDNETTEXTPROTO-14552569", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Jakob Ackermann" ], "semver": { "vulnerable": [ "<1.19.8", ">=1.20.0-0 <1.20.3" ], "hashesRange": [ "=go1.20.0-0
**Go Vulnerability Report:**
\r\n\r\nMultipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes:\r\n1. `mime/multipart.Reader.ReadForm` limits the total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed, leading it to accept larger inputs than intended.\r\n2. Limiting total memory does not account for increased pressure on the garbage collector from large numbers of small allocations in forms with many parts.\r\n3. ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage collector.\r\nThe combination of these factors can permit an attacker to cause an program that parses multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service. This affects programs that use `mime/multipart.Reader.ReadForm`, as well as form parsing in the `net/http` package with the Request methods `FormFile`, `FormValue`, `ParseMultipartForm`, and `PostFormValue.With` fix, `ReadForm` now does a better job of estimating the memory consumption of parsed forms, and performs many fewer short-lived allocations.In addition, the fixed `mime/multipart.Reader` imposes the following limits on the size of parsed forms:\r\n1. Forms parsed with ReadForm may contain no more than 1000 parts. This limit may be adjusted with the environment variable `GODEBUG=multipartmaxparts=`.\r\n2. Form parts parsed with NextPart and NextRawPart may contain no more than 10,000 header fields. In addition, forms parsed with ReadForm may contain no more than 10,000 header fields across all parts. This limit may be adjusted with the environment variable `GODEBUG=multipartmaxheaders=`.\n## Remediation\nUpgrade `std/net/textproto` to version 1.19.8, 1.20.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2023-1705)\n- [Go Commit](https://go.dev/cl/482075)\n- [Go Commit](https://go.dev/cl/482076)\n- [Go Commit](https://go.dev/cl/482077)\n- [Go Issue](https://go.dev/issue/59153)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8)\n", "epssDetails": { "percentile": "0.70654", "probability": "0.01479", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2023-1705" ], "CVE": [ "CVE-2023-24536" ], "CWE": [ "CWE-770" ] }, "packageName": "std/net/textproto", "proprietary": false, "creationTime": "2025-12-23T16:22:00.607375Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2023-04-05T21:04:39Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T13:06:38.576697Z", "severityBasedOn": "CVSS", "modificationTime": "2026-06-30T02:00:23.532971Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDNETURL-15139468", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "jub0bs" ], "semver": { "vulnerable": [ "<1.24.12", ">=1.25.0 <1.25.6" ], "hashesRange": [ "=go1.25.0
**Go Vulnerability Report:**
\n\nThe net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.\n## Remediation\nUpgrade `std/net/url` to version 1.24.12, 1.25.6 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4341)\n- [Go Commit](https://go.dev/cl/736712)\n- [Go Issue](https://go.dev/issue/77101)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc)\n", "epssDetails": { "percentile": "0.82788", "probability": "0.02326", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4341" ], "CVE": [ "CVE-2025-61726" ], "CWE": [ "CWE-770" ] }, "packageName": "std/net/url", "proprietary": false, "creationTime": "2026-01-29T12:37:21.296942Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-01-28T19:08:18Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-29T12:37:21.488322Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-26T02:00:30.876016Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDNETURL-18858438", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.25.13", ">=1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `std/net/url` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-6218)\n- [Go Code Review](https://go.dev/cl/803681)\n- [Go Issue](https://go.dev/issue/80494)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.43587", "probability": "0.00550", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-6218" ], "CVE": [ "CVE-2026-56860" ], "CWE": [ "CWE-400" ] }, "packageName": "std/net/url", "proprietary": false, "creationTime": "2026-08-16T13:28:43.607348Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-13T21:43:54Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:28:43.780899Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:00:42.599966Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDOS-14545514", "title": "Directory Traversal", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.18.9", ">=1.19.0-0 <1.19.4" ], "hashesRange": [ "=go1.19.0-0
**Go Vulnerability Report:**
\r\nOn Windows, restricted files can be accessed via os.DirFS and http.Dir.The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permit access to Windows device files under that root. For example, os.DirFS(\"C:/tmp\").Open(\"COM1\") opens the COM1 device. Both os.DirFS and http.Dir only provide read-only filesystem access. In addition, on Windows, an os.DirFS for the directory (the root of the current drive) can permit a maliciously crafted path to escape from the drive and access any path on the system.With fix applied, the behavior of os.DirFS(\"\") has changed. Previously, an empty root was treated equivalently to \"/\", so os.DirFS(\"\").Open(\"tmp\") would open the path \"/tmp\". This now returns an error.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `std/os` to version 1.18.9, 1.19.4 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2022-1143)\n- [Go Commit](https://go.dev/cl/455716)\n- [Go Issue](https://go.dev/issue/56694)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ)\n", "epssDetails": { "percentile": "0.69106", "probability": "0.01279", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2022-1143" ], "CVE": [ "CVE-2022-41720" ], "CWE": [ "CWE-22" ] }, "packageName": "std/os", "proprietary": false, "creationTime": "2025-12-22T08:15:45.427014Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2022-12-07T16:08:45Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2025-12-22T11:21:13.101951Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T02:00:27.423618Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDOS-17905377", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "Mundur" ], "semver": { "vulnerable": [ "<1.25.12", ">=1.26.0-0 <1.26.5", ">=1.27.0-0 <1.27.0-rc.2" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root.\n## Remediation\nUpgrade `std/os` to version 1.25.12, 1.26.5, 1.27.0-rc.2 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4970)\n- [Go Code Review](https://go.dev/cl/797880)\n- [Go Issue](https://go.dev/issue/79005)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc)\n", "epssDetails": { "percentile": "0.12762", "probability": "0.00232", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4970" ], "CVE": [ "CVE-2026-39822" ], "CWE": [ "CWE-59" ] }, "packageName": "std/os", "proprietary": false, "creationTime": "2026-07-09T11:52:28.124727Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-07T21:34:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-07-09T11:52:28.309070Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T14:05:23.087760Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDOSEXEC-14552362", "title": "Untrusted Search Path", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "Chris Darroch", "brian m. carlson", "Mikhail Shcherbakov" ], "semver": { "vulnerable": [ "<1.17.11", ">=1.18.0-0 <1.18.3" ], "hashesRange": [ "=go1.18.0-0
**Go Vulnerability Report:**
\r\n\r\nOn Windows, executing `Cmd.Run`, `Cmd.Start`, `Cmd.Output`, or `Cmd.CombinedOutput` when `Cmd.Path` is unset will unintentionally trigger execution of any binaries in the working directory named either `..com` or `..exe`.\n## Remediation\nUpgrade `std/os/exec` to version 1.17.11, 1.18.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2022-0532)\n- [Go Commit](https://go.dev/cl/403759)\n- [Go Commit](https://go.googlesource.com/go/+/960ffa98ce73ef2c2060c84c7ac28d37a83f345e)\n- [Go Issue](https://go.dev/issue/52574)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ)\n", "epssDetails": { "percentile": "0.48234", "probability": "0.00627", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2022-0532" ], "CVE": [ "CVE-2022-30580" ], "CWE": [ "CWE-426" ] }, "packageName": "std/os/exec", "proprietary": false, "creationTime": "2025-12-23T15:02:20.403338Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2022-07-26T21:41:20Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T13:04:56.215627Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-04T02:00:46.606853Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDPATHFILEPATH-14552363", "title": "Directory Traversal", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Unrud" ], "semver": { "vulnerable": [ "<1.17.11", ">=1.18.0-0 <1.18.3" ], "hashesRange": [ "=go1.18.0-0
**Go Vulnerability Report:**
\r\n\r\nOn Windows, the `filepath.Clean` function can convert certain invalid paths to valid, absolute paths, potentially allowing a directory traversal attack. For example, `Clean(\".\\c:\")` returns `\"c:\"`.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `std/path/filepath` to version 1.17.11, 1.18.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2022-0533)\n- [Go Commit](https://go.dev/cl/401595)\n- [Go Commit](https://go.googlesource.com/go/+/9cd1818a7d019c02fa4898b3e45a323e35033290)\n- [Go Issue](https://go.dev/issue/52476)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ)\n", "epssDetails": { "percentile": "0.82391", "probability": "0.02261", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2022-0533" ], "CVE": [ "CVE-2022-29804" ], "CWE": [ "CWE-22" ] }, "packageName": "std/path/filepath", "proprietary": false, "creationTime": "2025-12-23T15:04:09.585484Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2022-07-28T17:25:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T13:05:39.600258Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-04T02:00:46.836073Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDPATHFILEPATH-14552364", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Juho Nurminen" ], "semver": { "vulnerable": [ "<1.17.12", ">=1.18.0-0 <1.18.4" ], "hashesRange": [ "=go1.18.0-0
**Go Vulnerability Report:**
\r\n\r\nCalling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion.\n## Remediation\nUpgrade `std/path/filepath` to version 1.17.12, 1.18.4 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2022-0522)\n- [Go Commit](https://go.dev/cl/417066)\n- [Go Commit](https://go.googlesource.com/go/+/ac68c6c683409f98250d34ad282b9e1b0c9095ef)\n- [Go Issue](https://go.dev/issue/53416)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE)\n", "epssDetails": { "percentile": "0.80754", "probability": "0.02069", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2022-0522" ], "CVE": [ "CVE-2022-30632" ], "CWE": [ "CWE-674" ] }, "packageName": "std/path/filepath", "proprietary": false, "creationTime": "2025-12-23T15:05:29.799377Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2022-07-20T17:02:29Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T13:05:45.090188Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-04T02:00:46.836670Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDPATHFILEPATH-14552560", "title": "Directory Traversal", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "RyotaK" ], "semver": { "vulnerable": [ "<1.19.6", ">=1.20.0-0 <1.20.1" ], "hashesRange": [ "=go1.20.0-0
**Go Vulnerability Report:**
\r\n\r\nA path traversal vulnerability exists in filepath.Clean on Windows.On Windows, the filepath.Clean function could transform an invalid path such as \"a/../c:/b\" into the valid path \"c:\\b\". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack.After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path \".\\c:\\b\".\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `std/path/filepath` to version 1.19.6, 1.20.1 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2023-1568)\n- [Go Commit](https://go.dev/cl/468123)\n- [Go Issue](https://go.dev/issue/57274)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E)\n", "epssDetails": { "percentile": "0.73812", "probability": "0.01678", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2023-1568" ], "CVE": [ "CVE-2022-41722" ], "CWE": [ "CWE-22" ] }, "packageName": "std/path/filepath", "proprietary": false, "creationTime": "2025-12-23T16:16:30.147352Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2023-02-16T19:49:19Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T13:05:56.647191Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-13T02:00:39.178617Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDPATHFILEPATH-14606268", "title": "Relative Path Traversal", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Damien Neil" ], "semver": { "vulnerable": [ "<1.20.12", ">=1.21.0 <1.21.5" ], "hashesRange": [ "=go1.21.0-0
**Go Vulnerability Report:**
The filepath package does not recognize paths with a \\??\\ prefix as special.On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x.Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b.Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b.In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name.UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `std/path/filepath` to version 1.20.12, 1.21.5 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2023-2185)\n- [Go Code Review](https://go.dev/cl/540277)\n- [Go Code Review](https://go.dev/cl/541175)\n- [Go Issue](https://go.dev/issue/63713)\n- [Go Issue](https://go.dev/issue/64028)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY)\n- [Google Groups Forum](https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ)\n", "epssDetails": { "percentile": "0.84285", "probability": "0.02758", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2023-45283" ], "CWE": [ "CWE-22" ] }, "packageName": "std/path/filepath", "proprietary": false, "creationTime": "2025-12-25T08:36:45.841146Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2023-11-07T19:37:05Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T13:19:42.083935Z", "severityBasedOn": "CVSS", "modificationTime": "2026-06-18T02:00:56.306548Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDREGEXP-14548569", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Juho Nurminen" ], "semver": { "vulnerable": [ "<1.16.15", ">=1.17.0-0 <1.17.8" ], "hashesRange": [ "=go1.17.0-0
**Go Vulnerability Report:**
On 64-bit platforms, an extremely deeply nested expression can cause regexp.Compile to cause goroutine stack exhaustion, forcing the program to exit. Note this applies to very large expressions, on the order of 2MB.\n## Remediation\nUpgrade `std/regexp` to version 1.16.15, 1.17.8 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2021-0347)\n- [Go Code Review](https://go.dev/cl/384616)\n- [Go Commit](https://go.googlesource.com/go/+/452f24ae94f38afa3704d4361d91d51218405c0a)\n- [Go Issue](https://go.dev/issue/51112)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/RP1hfrBYVuk)\n", "epssDetails": { "percentile": "0.87797", "probability": "0.03228", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2021-0347" ], "CVE": [ "CVE-2022-24921" ], "CWE": [ "CWE-770" ] }, "packageName": "std/regexp", "proprietary": false, "creationTime": "2025-12-23T07:33:21.294144Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2022-05-23T22:15:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:53:57.350501Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T14:04:46.841145Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDREGEXPSYNTAX-14548567", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Adam Korczynski", "OSS-Fuzz" ], "semver": { "vulnerable": [ "<1.18.7", ">=1.19.0-0 <1.19.2" ], "hashesRange": [ "=go1.19.0-0
**Go Vulnerability Report:**
Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service.The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory.After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.\n## Remediation\nUpgrade `std/regexp/syntax` to version 1.18.7, 1.19.2 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2022-1039)\n- [Go Code Review](https://go.dev/cl/439356)\n- [Go Issue](https://go.dev/issue/55949)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/xtuG5faxtaU)\n", "epssDetails": { "percentile": "0.76915", "probability": "0.01726", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2022-1039" ], "CVE": [ "CVE-2022-41715" ], "CWE": [ "CWE-770" ] }, "packageName": "std/regexp/syntax", "proprietary": false, "creationTime": "2025-12-23T07:31:56.307133Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2022-10-06T16:42:07Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:53:10.713115Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-11T14:04:09.493264Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" }, { "id": "SNYK-GOLANG-STDRUNTIME-14548560", "title": "Incorrect Privilege Assignment", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "credit": [ "Vincent Dehors" ], "semver": { "vulnerable": [ "<1.19.10", ">=1.20.0-0 <1.20.5" ], "hashesRange": [ "=go1.20.0-0
**Go Vulnerability Report:**
On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors.If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.\n## Remediation\nUpgrade `std/runtime` to version 1.19.10, 1.20.5 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2023-1840)\n- [Go Code Review](https://go.dev/cl/501223)\n- [Go Issue](https://go.dev/issue/60272)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ)\n", "epssDetails": { "percentile": "0.34748", "probability": "0.00429", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2023-1840" ], "CVE": [ "CVE-2023-29403" ], "CWE": [ "CWE-266" ] }, "packageName": "std/runtime", "proprietary": false, "creationTime": "2025-12-23T07:30:04.206034Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2023-06-08T20:16:06Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:52:50.972362Z", "severityBasedOn": "CVSS", "modificationTime": "2026-07-18T02:00:33.863832Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.16.7" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.16.7" } ], "ok": false, "dependencyCount": 4, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "gomodules", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "77 high or critical severity vulnerable dependency paths", "severityThreshold": "high", "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 77, "targetFile": "/usr/local/bin/gosu", "projectName": "github.com/tianon/gosu", "displayTargetFile": "/usr/local/bin/gosu", "hasUnknownVersions": false, "path": "docker.io/scopear/docker-db:1.5.15_ddb76b9.88/tianon/gosu" } ] }