Search CVE reports
1 – 10 of 49 results
In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that...
26 affected packages
golang-golang-x-net, google-guest-agent, google-osconfig-agent, containerd, golang-golang-x-net-dev...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-golang-x-net | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| google-guest-agent | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| google-osconfig-agent | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| containerd | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-golang-x-net-dev | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| adsys | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | — |
| juju-core | Not in release | Not in release | Not in release | — | — |
| lxd | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| golang | Not in release | Not in release | Not in release | — | — |
| golang-1.6 | Not in release | Not in release | Not in release | — | — |
| golang-1.8 | Not in release | Not in release | Not in release | — | Needs evaluation |
| golang-1.9 | Not in release | Not in release | Not in release | — | Needs evaluation |
| golang-1.10 | Not in release | Not in release | Not in release | — | Needs evaluation |
| golang-1.13 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-1.14 | Not in release | Not in release | Not in release | Needs evaluation | — |
| golang-1.16 | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| golang-1.17 | Not in release | Not in release | Needs evaluation | — | — |
| golang-1.18 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-1.20 | Not in release | Not in release | Needs evaluation | Needs evaluation | — |
| golang-1.21 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | — |
| golang-1.22 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | — |
| golang-1.23 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.24 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.25 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.26 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.27 | Not in release | Not in release | Not in release | — | — |
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing...
26 affected packages
golang-golang-x-net, google-guest-agent, google-osconfig-agent, containerd, golang-golang-x-net-dev...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-golang-x-net | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| google-guest-agent | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| google-osconfig-agent | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| containerd | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-golang-x-net-dev | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| adsys | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | — |
| juju-core | Not in release | Not in release | Not in release | — | — |
| lxd | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| golang | Not in release | Not in release | Not in release | — | — |
| golang-1.6 | Not in release | Not in release | Not in release | — | — |
| golang-1.8 | Not in release | Not in release | Not in release | — | Needs evaluation |
| golang-1.9 | Not in release | Not in release | Not in release | — | Needs evaluation |
| golang-1.10 | Not in release | Not in release | Not in release | — | Needs evaluation |
| golang-1.13 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-1.14 | Not in release | Not in release | Not in release | Needs evaluation | — |
| golang-1.16 | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| golang-1.17 | Not in release | Not in release | Needs evaluation | — | — |
| golang-1.18 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-1.20 | Not in release | Not in release | Needs evaluation | Needs evaluation | — |
| golang-1.21 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | — |
| golang-1.22 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | — |
| golang-1.23 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.24 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.25 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.26 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.27 | Not in release | Not in release | Not in release | — | — |
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to...
26 affected packages
golang-golang-x-net, google-guest-agent, google-osconfig-agent, containerd, golang-golang-x-net-dev...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-golang-x-net | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| google-guest-agent | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| google-osconfig-agent | Vulnerable | Vulnerable | Vulnerable | Vulnerable | Vulnerable |
| containerd | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-golang-x-net-dev | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| adsys | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | — |
| juju-core | Not in release | Not in release | Not in release | — | — |
| lxd | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| golang | Not in release | Not in release | Not in release | — | — |
| golang-1.6 | Not in release | Not in release | Not in release | — | — |
| golang-1.8 | Not in release | Not in release | Not in release | — | Needs evaluation |
| golang-1.9 | Not in release | Not in release | Not in release | — | Needs evaluation |
| golang-1.10 | Not in release | Not in release | Not in release | — | Needs evaluation |
| golang-1.13 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-1.14 | Not in release | Not in release | Not in release | Needs evaluation | — |
| golang-1.16 | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| golang-1.17 | Not in release | Not in release | Needs evaluation | — | — |
| golang-1.18 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-1.20 | Not in release | Not in release | Needs evaluation | Needs evaluation | — |
| golang-1.21 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | — |
| golang-1.22 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | — |
| golang-1.23 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.24 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.25 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.26 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.27 | Not in release | Not in release | Not in release | — | — |
Some fixes available 3 of 77
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
26 affected packages
golang-golang-x-net, google-guest-agent, google-osconfig-agent, containerd, golang-golang-x-net-dev...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-golang-x-net | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| google-guest-agent | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| google-osconfig-agent | Vulnerable | Vulnerable | Vulnerable | Vulnerable | Vulnerable |
| containerd | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-golang-x-net-dev | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| adsys | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | — |
| juju-core | Not in release | Not in release | Not in release | — | — |
| lxd | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| golang | Not in release | Not in release | Not in release | — | — |
| golang-1.6 | Not in release | Not in release | Not in release | — | — |
| golang-1.8 | Not in release | Not in release | Not in release | — | Needs evaluation |
| golang-1.9 | Not in release | Not in release | Not in release | — | Needs evaluation |
| golang-1.10 | Not in release | Not in release | Not in release | — | Needs evaluation |
| golang-1.13 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-1.14 | Not in release | Not in release | Not in release | Needs evaluation | — |
| golang-1.16 | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| golang-1.17 | Not in release | Not in release | Needs evaluation | — | — |
| golang-1.18 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-1.20 | Not in release | Not in release | Needs evaluation | Needs evaluation | — |
| golang-1.21 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | — |
| golang-1.22 | Not in release | Fixed | Fixed | Fixed | — |
| golang-1.23 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.24 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.25 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.26 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.27 | Not in release | Not in release | Not in release | — | — |
Some fixes available 3 of 77
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the...
26 affected packages
golang-golang-x-net, google-guest-agent, google-osconfig-agent, containerd, golang-golang-x-net-dev...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-golang-x-net | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| google-guest-agent | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| google-osconfig-agent | Vulnerable | Vulnerable | Vulnerable | Vulnerable | Vulnerable |
| containerd | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-golang-x-net-dev | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| adsys | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | — |
| juju-core | Not in release | Not in release | Not in release | — | — |
| lxd | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| golang | Not in release | Not in release | Not in release | — | — |
| golang-1.6 | Not in release | Not in release | Not in release | — | — |
| golang-1.8 | Not in release | Not in release | Not in release | — | Needs evaluation |
| golang-1.9 | Not in release | Not in release | Not in release | — | Needs evaluation |
| golang-1.10 | Not in release | Not in release | Not in release | — | Vulnerable |
| golang-1.13 | Not in release | Not in release | Vulnerable | Vulnerable | Vulnerable |
| golang-1.14 | Not in release | Not in release | Not in release | Vulnerable | — |
| golang-1.16 | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| golang-1.17 | Not in release | Not in release | Vulnerable | — | — |
| golang-1.18 | Not in release | Not in release | Vulnerable | Vulnerable | Vulnerable |
| golang-1.20 | Not in release | Not in release | Needs evaluation | Needs evaluation | — |
| golang-1.21 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | — |
| golang-1.22 | Not in release | Fixed | Fixed | Fixed | — |
| golang-1.23 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.24 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.25 | Vulnerable | Needs evaluation | Needs evaluation | — | — |
| golang-1.26 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.27 | Not in release | Not in release | Not in release | — | — |
Some fixes available 3 of 77
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward...
26 affected packages
golang-golang-x-net, google-guest-agent, google-osconfig-agent, containerd, golang-golang-x-net-dev...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-golang-x-net | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| google-guest-agent | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| google-osconfig-agent | Vulnerable | Vulnerable | Vulnerable | Vulnerable | Vulnerable |
| containerd | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-golang-x-net-dev | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| adsys | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | — |
| juju-core | Not in release | Not in release | Not in release | — | — |
| lxd | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| golang | Not in release | Not in release | Not in release | — | — |
| golang-1.6 | Not in release | Not in release | Not in release | — | — |
| golang-1.8 | Not in release | Not in release | Not in release | — | Needs evaluation |
| golang-1.9 | Not in release | Not in release | Not in release | — | Needs evaluation |
| golang-1.10 | Not in release | Not in release | Not in release | — | Needs evaluation |
| golang-1.13 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-1.14 | Not in release | Not in release | Not in release | Needs evaluation | — |
| golang-1.16 | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| golang-1.17 | Not in release | Not in release | Needs evaluation | — | — |
| golang-1.18 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-1.20 | Not in release | Not in release | Needs evaluation | Needs evaluation | — |
| golang-1.21 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | — |
| golang-1.22 | Not in release | Fixed | Fixed | Fixed | — |
| golang-1.23 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.24 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.25 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.26 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.27 | Not in release | Not in release | Not in release | — | — |
Some fixes available 3 of 77
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead....
26 affected packages
golang-golang-x-net, google-guest-agent, google-osconfig-agent, containerd, golang-golang-x-net-dev...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-golang-x-net | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| google-guest-agent | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| google-osconfig-agent | Vulnerable | Vulnerable | Vulnerable | Vulnerable | Vulnerable |
| containerd | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-golang-x-net-dev | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| adsys | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | — |
| juju-core | Not in release | Not in release | Not in release | — | — |
| lxd | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| golang | Not in release | Not in release | Not in release | — | — |
| golang-1.6 | Not in release | Not in release | Not in release | — | — |
| golang-1.8 | Not in release | Not in release | Not in release | — | Needs evaluation |
| golang-1.9 | Not in release | Not in release | Not in release | — | Needs evaluation |
| golang-1.10 | Not in release | Not in release | Not in release | — | Needs evaluation |
| golang-1.13 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-1.14 | Not in release | Not in release | Not in release | Needs evaluation | — |
| golang-1.16 | Not in release | Not in release | Not in release | Needs evaluation | Needs evaluation |
| golang-1.17 | Not in release | Not in release | Needs evaluation | — | — |
| golang-1.18 | Not in release | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
| golang-1.20 | Not in release | Not in release | Needs evaluation | Needs evaluation | — |
| golang-1.21 | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | — |
| golang-1.22 | Not in release | Fixed | Fixed | Fixed | — |
| golang-1.23 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.24 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.25 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.26 | Needs evaluation | Needs evaluation | Needs evaluation | — | — |
| golang-1.27 | Not in release | Not in release | Not in release | — | — |
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume...
3 affected packages
golang-google-grpc, google-guest-agent, grpc
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-google-grpc | Needs evaluation | Vulnerable | Vulnerable | Needs evaluation | Needs evaluation |
| google-guest-agent | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| grpc | Not affected | Not affected | Not affected | Not affected | Not affected |
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata...
3 affected packages
golang-google-grpc, google-guest-agent, grpc
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-google-grpc | Needs evaluation | Not affected | Not affected | Needs evaluation | Needs evaluation |
| google-guest-agent | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
| grpc | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions...
4 affected packages
golang-go.crypto, snapd, lxd, google-guest-agent
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| golang-go.crypto | Vulnerable | Vulnerable | Needs evaluation | Needs evaluation | Needs evaluation |
| snapd | Not affected | Not affected | Not affected | Needs evaluation | Needs evaluation |
| lxd | Not in release | Not in release | Not in release | Not affected | Needs evaluation |
| google-guest-agent | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |