ALT-PU-2026-19524-1 — kubernetes1.34

BDU:2026-05686

MEDIUM5.3

Уязвимость пакета golang-x-net языка программирования Golang, связанная с выполнением цикла с недоступным условием выхода, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-04-21Modified: 2026-08-31

CVSS 3.xMEDIUM 5.3

CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVSS 2.0MEDIUM 5.0

CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P

References

BDU:2026-05687

MEDIUM5.3

Уязвимость пакета golang-x-net языка программирования Golang, связанная с недостаточным контролем ресурса в период его существования, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-04-21Modified: 2026-08-31

CVSS 3.xMEDIUM 5.3

CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVSS 2.0MEDIUM 5.0

CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P

References

BDU:2026-08587

HIGH7.5

Уязвимость реализации протокола HTTP/2 языка программирования Go, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-06-22Modified: 2026-10-07

CVSS 3.xHIGH 7.5

CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS 2.0HIGH 7.8

CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C

References

BDU:2026-15279

MEDIUM6.5

Уязвимость пакета golang-x-net языка программирования Golang, связанная с неконтролируемым расходом ресурсов, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-09-24

CVSS 3.xMEDIUM 6.5

CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS 2.0HIGH 7.8

CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C

References

BDU:2026-15280

MEDIUM6.1

Уязвимость пакета golang-x-net языка программирования Golang, связанная с некорректным ограничением визуализированных слоев пользовательского интерфейса, позволяющая нарушителю провести атаку типа clickjacking («захват клика»)

Published: 2026-09-24

CVSS 3.xMEDIUM 6.1

CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS 2.0MEDIUM 6.4

CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N

References

BDU:2026-15282

MEDIUM6.1

Уязвимость пакета golang-x-net языка программирования Golang, связанная с некорректным ограничением визуализированных слоев пользовательского интерфейса, позволяющая нарушителю провести атаку типа clickjacking («захват клика»)

Published: 2026-09-24

CVSS 3.xMEDIUM 6.1

CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS 2.0MEDIUM 6.4

CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N

References

BDU:2026-15293

HIGH8.2

Уязвимость пакета golang-x-net языка программирования Golang, связанная с неправильной проверкой небезопасной эквивалентности входных данных, позволяющая нарушителю обойти существующие ограничения безопасности и выполнить произвольный код

Published: 2026-09-24

CVSS 3.xHIGH 8.2

CVSS:3.x/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

CVSS 2.0MEDIUM 6.6

CVSS:2.0/AV:N/AC:H/Au:S/C:C/I:C/A:N

References

BDU:2026-15305

MEDIUM6.1

Уязвимость пакета golang-x-net языка программирования Golang, связанная с некорректным ограничением визуализированных слоев пользовательского интерфейса, позволяющая нарушителю провести атаку типа clickjacking («захват клика»)

Published: 2026-09-24

CVSS 3.xMEDIUM 6.1

CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS 2.0MEDIUM 6.4

CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N

References

BDU:2026-15306

MEDIUM6.1

Уязвимость пакета golang-x-net языка программирования Golang, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю выполнить произвольный код

Published: 2026-09-24

CVSS 3.xMEDIUM 6.1

CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS 2.0MEDIUM 6.4

CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N

References

CVE-2025-47911

MEDIUM5.3

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

Published: 2026-02-05Modified: 2026-06-17

CVSS 3.xMEDIUM 5.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

CVE-2025-58190

MEDIUM5.3

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

Published: 2026-02-05Modified: 2026-06-17

CVSS 3.xMEDIUM 5.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

CVE-2026-2270

NONE

CVE-2026-25680

MEDIUM6.5

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Published: 2026-05-22Modified: 2026-07-23

CVSS 3.xMEDIUM 6.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

CVE-2026-25681

MEDIUM6.1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Published: 2026-05-22Modified: 2026-07-23

CVSS 3.xMEDIUM 6.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

CVE-2026-27136

MEDIUM6.1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Published: 2026-05-22Modified: 2026-07-23

CVSS 3.xMEDIUM 6.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

CVE-2026-33814

HIGH7.5

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

Published: 2026-05-07Modified: 2026-09-18

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

CVE-2026-39821

CRITICAL9.6

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Published: 2026-05-22Modified: 2026-09-17

CVSS 3.xCRITICAL 9.6

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

References

CVE-2026-42502

MEDIUM6.1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Published: 2026-05-22Modified: 2026-07-23

CVSS 3.xMEDIUM 6.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

CVE-2026-42506

MEDIUM6.1

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Published: 2026-05-22Modified: 2026-07-23

CVSS 3.xMEDIUM 6.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

CVE-2026-56852

HIGH7.5

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

Published: 2026-07-21Modified: 2026-07-23

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

GHSA-5cv4-jp36-h3mw

MEDIUM6.5

Go Net HTML parser is vulnerable to denial of service

Published: 2026-05-26Modified: 2026-07-01

CVSS 3.xMEDIUM 6.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

GHSA-w4gw-w5jq-g9jh

MEDIUM5.3

golang.org/x/net/html has a Quadratic Parsing Complexity issue

Published: 2026-02-12

CVSS 3.xMEDIUM 5.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

Package update kubernetes1.34 in branch sisyphus_loongarch64

Closed issues (22)

Уязвимость реализации протокола HTTP/2 языка программирования Go, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость пакета golang-x-net языка программирования Golang, связанная с неконтролируемым расходом ресурсов, позволяющая нарушителю вызвать отказ в обслуживании

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

Go Net HTML parser is vulnerable to denial of service

golang.org/x/net/html has a Quadratic Parsing Complexity issue