Release date:
2026-10-09 18:46:25 UTC
Description:
- CVE-2026-33818: unbounded recursion in encoding/asn1 Unmarshal
- CVE-2026-39820: quadratic string concatenation in net/mail consumeComment
- CVE-2026-39821: ASCII-only Punycode labels accepted by x/net/idna process()
- CVE-2026-42499: quadratic string concatenation in net/mail consumePhrase
- CVE-2026-56853: missing ReadHeaderTimeout in net/http unencrypted HTTP/2 check
- CVE-2026-56858: XSS via JS regexp context tracking in html/template
- CVE-2026-56859: unbounded recursion in encoding/xml DecodeElement
- CVE-2026-56860: quadratic complexity in net/url resolvePath
- CVE-2026-56862: unlimited post-handshake KeyUpdate messages in crypto/tls
- Rebuild with golang >= 1.26.7-1.el9_8 for the standard library fixes
Updated packages:
-
ignition-2.26.0-1.el9_8.tuxcare.els1.aarch64.rpm
sha:d6d7a3c4729783a9a9b7fcb4cc12891a0ef9513d9be56e9cb323fcf632de2ace
-
ignition-2.26.0-1.el9_8.tuxcare.els1.x86_64.rpm
sha:e6ea86dbc78e01d13a705b598251c3ab343c9cea74b3025a0540e686320625cf
-
ignition-edge-2.26.0-1.el9_8.tuxcare.els1.aarch64.rpm
sha:997908cfdac764e8dfbc5662cbf0979c59fcef3987d963ec3a168fb84d61b347
-
ignition-edge-2.26.0-1.el9_8.tuxcare.els1.x86_64.rpm
sha:4056d3a2e71aedc0838c3d66ac994256c029d9965f534232507334e72834e26c
-
ignition-grub-2.26.0-1.el9_8.tuxcare.els1.aarch64.rpm
sha:3ade8f8be878696536db94393e455d38f042029e66e322c4bc13881549d9927c
-
ignition-grub-2.26.0-1.el9_8.tuxcare.els1.x86_64.rpm
sha:432367c498fb10dec9eeb4518ad9b12dae934bc9c81ee8b5a1fa8408f776ae35
-
ignition-validate-2.26.0-1.el9_8.tuxcare.els1.aarch64.rpm
sha:00c30b26cbf811f7ea5f7f308929e581666231819926a757b03a7e90c9cd3215
-
ignition-validate-2.26.0-1.el9_8.tuxcare.els1.x86_64.rpm
sha:b3d51c92f1207d6123f1e3e60536cd499ebbe638408e5119f88546a92055d1e1
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
