CLSA-2026-1791279538
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791279538.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1791279538
- Upstream
CVE (5)
- CVE-2026-33818
- CVE-2026-56858
- CVE-2026-56859
- CVE-2026-56860
- CVE-2026-56862
- Published
- 2026-10-06T09:39:12Z
- Modified
- 2026-10-26T09:43:18Z
- Summary
- delve: Fix of 5 CVEs
- Details
-
- Rebuild with golang 1.25.7-1.el9_6.tuxcare.els16 to fix the following CVEs
- CVE-2026-33818: enforce a maximum recursion depth in encoding/asn1 Unmarshal to prevent stack exhaustion on deeply nested structures
- CVE-2026-56859: add a recursion depth guard in encoding/xml so that DecodeElement no longer resets the depth counter
- CVE-2026-56858: track the JavaScript regexp context in html/template so a pathological input cannot close an unescaped '/' early
- CVE-2026-56860: avoid quadratic complexity in net/url resolvePath by resolving ".." segments with index-based backtracking
- CVE-2026-56862: do not count handshake messages as state-advancing after the crypto/tls handshake has completed, bounding KeyUpdate key derivation
- Rebuild with golang 1.25.7-1.el9_6.tuxcare.els16 to fix the following CVEs
- References
-
- https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1791279538.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-33818
- https://nvd.nist.gov/vuln/detail/CVE-2026-56858
- https://nvd.nist.gov/vuln/detail/CVE-2026-56859
- https://nvd.nist.gov/vuln/detail/CVE-2026-56860
- https://nvd.nist.gov/vuln/detail/CVE-2026-56862