ALT-PU-2026-13051-1

CVE-2026-39822

HIGH7.8

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

Опубликовано: 2026-07-08Изменено: 2026-07-13

CVSS 3.xВЫСОКАЯ 7.8

CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Ссылки

CVE-2026-41178

MEDIUM5.3

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.

Опубликовано: 2026-06-04Изменено: 2026-07-22

CVSS 3.xСРЕДНЯЯ 5.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Ссылки

CVE-2026-42505

MEDIUM5.3

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

Опубликовано: 2026-07-08Изменено: 2026-07-13

CVSS 3.xСРЕДНЯЯ 5.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Ссылки

CVE-2026-46600

HIGH7.5

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

Опубликовано: 2026-07-21Изменено: 2026-08-13

CVSS 3.xВЫСОКАЯ 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Ссылки

CVE-2026-47262

MEDIUM5.3

containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the containerd process. This renders the container runtime API unavailable and can disrupt clients such as the Docker Engine or Kubernetes control-plane components. This issue has been fixed in versions 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2.

Опубликовано: 2026-07-01Изменено: 2026-07-02

CVSS 3.xСРЕДНЯЯ 5.5

CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS 4.0СРЕДНЯЯ 5.3

CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Ссылки

https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq

CVE-2026-50163

HIGH7.1

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link("victim.secret", "/payload.tar.gz/evil_cwd_link") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname="victim.secret" with io.deis.oras.content.unpack: "true", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.

Опубликовано: 2026-07-17Изменено: 2026-07-23

CVSS 3.xВЫСОКАЯ 7.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Ссылки

CVE-2026-53488

CRITICAL9.4

containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10.

Опубликовано: 2026-06-30Изменено: 2026-07-03

CVSS 3.xВЫСОКАЯ 8.8

CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVSS 4.0КРИТИЧЕСКАЯ 9.4

CVSS:4.0/CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Ссылки

https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp

CVE-2026-56852

HIGH7.5

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

Опубликовано: 2026-07-21Изменено: 2026-07-23

CVSS 3.xВЫСОКАЯ 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Ссылки

CVE-2026-71556

HIGH7.1

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.

Опубликовано: 2026-08-07

CVSS 3.xВЫСОКАЯ 7.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Ссылки

CVE-2026-71557

MEDIUM6.3

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.

Опубликовано: 2026-08-07Изменено: 2026-08-07

CVSS 3.xСРЕДНЯЯ 6.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L

Ссылки

GHSA-259r-337f-4rfw

NONE

GHSA-5wrp-cwcj-q835

MEDIUM5.3

opentelemetry-go's baggage parsing no longer caps raw header length

Опубликовано: 2026-05-28Изменено: 2026-06-09

CVSS 3.xСРЕДНЯЯ 5.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Ссылки

GHSA-fxhp-mv3v-67qp

HIGH7.1

`oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution

Опубликовано: 2026-07-01Изменено: 2026-08-04

CVSS 3.xВЫСОКАЯ 7.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Ссылки

GHSA-hc8v-wwc9-vgxm

HIGH7.1

go-git: Worktree operations may follow symlinks

Опубликовано: 2026-08-07

CVSS 3.xВЫСОКАЯ 7.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Ссылки

GHSA-hrxh-6v49-42gf

HIGH8.8

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Опубликовано: 2026-07-21Изменено: 2026-07-21

CVSS 4.0ВЫСОКАЯ 8.8

CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Ссылки

GHSA-jpcc-p29g-p8mq

MEDIUM6.9

containerd image-triggered runtime DoS via unbounded group parsing

Опубликовано: 2026-06-19

CVSS 4.0

CVSS:4.0/CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Ссылки

GHSA-qgq7-7hm3-q39j

MEDIUM6.3

go-git: Malicious reference names may modify files outside the reference storage

Опубликовано: 2026-08-07

CVSS 3.xСРЕДНЯЯ 6.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L

Ссылки

GHSA-xhf5-7wjv-pqxp

HIGH8.7

containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull

Опубликовано: 2026-06-19

CVSS 4.0ВЫСОКАЯ 8.7

CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Ссылки

Обновление пакета portainer в ветке sisyphus_loongarch64

Закрытые проблемы (18)

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

opentelemetry-go's baggage parsing no longer caps raw header length

`oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution

go-git: Worktree operations may follow symlinks

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

containerd image-triggered runtime DoS via unbounded group parsing

go-git: Malicious reference names may modify files outside the reference storage

containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull