CLSA-2026-1788378960
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1788378960.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1788378960
- Upstream
CVE (6)
- CVE-2026-33818
- CVE-2026-56853
- CVE-2026-56858
- CVE-2026-56859
- CVE-2026-56860
- CVE-2026-56862
- Published
- 2026-09-02T19:56:20Z
- Modified
- 2026-10-26T09:31:35Z
- Summary
- golang: Fix of 6 CVEs
- Details
-
- CVE-2026-33818: enforce a maximum recursion depth in encoding/asn1 Unmarshal to prevent stack exhaustion when parsing deeply-nested recursive structures
- CVE-2026-56853: apply ReadHeaderTimeout to the server's unencrypted HTTP/2 client preface check, and clear the connection timeouts again once the connection is handed off to the http2 package
- CVE-2026-56858: fix JavaScript regexp context tracking in html/template so that pathological input can no longer close an unescaped '/' early and inject attacker-controlled content
- CVE-2026-56859: add a recursion depth guard during decode in encoding/xml so that DecodeElement no longer resets the depth counter, preventing stack exhaustion
- CVE-2026-56860: avoid quadratic complexity in net/url resolvePath by resolving '..' segments with index-based backtracking on a byte buffer
- CVE-2026-56862: do not count handshake messages as state-advancing after the handshake has completed in crypto/tls, bounding the key derivation work a client can force with repeated KeyUpdate messages
- References
-
- https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1788378960.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-33818
- https://nvd.nist.gov/vuln/detail/CVE-2026-56853
- https://nvd.nist.gov/vuln/detail/CVE-2026-56858
- https://nvd.nist.gov/vuln/detail/CVE-2026-56859
- https://nvd.nist.gov/vuln/detail/CVE-2026-56860
- https://nvd.nist.gov/vuln/detail/CVE-2026-56862