CLSA-2026-1790783892
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1790783892.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1790783892
- Upstream
CVE (5)
- CVE-2026-33818
- CVE-2026-56853
- CVE-2026-56858
- CVE-2026-56860
- CVE-2026-56862
- Published
- 2026-09-30T15:58:28Z
- Modified
- 2026-10-26T09:31:36Z
- Summary
- containernetworking-plugins: Fix of 5 CVEs
- Details
-
- Rebuild against golang >= 1.25.7-1.el9_6.tuxcare.els16 to pick up the Go standard library fixes for:
- CVE-2026-33818: enforce a maximum recursion depth in encoding/asn1 Unmarshal to prevent stack exhaustion when parsing deeply-nested recursive structures
- CVE-2026-56853: apply ReadHeaderTimeout to the server's unencrypted HTTP/2 client preface check, and clear the connection timeouts again once the connection is handed off to the http2 package
- CVE-2026-56858: fix JavaScript regexp context tracking in html/template so that pathological input can no longer close an unescaped '/' early and inject attacker-controlled content
- CVE-2026-56860: avoid quadratic complexity in net/url resolvePath by resolving '..' segments with index-based backtracking on a byte buffer
- CVE-2026-56862: do not count handshake messages as state-advancing after the handshake has completed in crypto/tls, bounding the key derivation work a client can force with repeated KeyUpdate messages
- References
-
- https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1790783892.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-33818
- https://nvd.nist.gov/vuln/detail/CVE-2026-56853
- https://nvd.nist.gov/vuln/detail/CVE-2026-56858
- https://nvd.nist.gov/vuln/detail/CVE-2026-56860
- https://nvd.nist.gov/vuln/detail/CVE-2026-56862