rpm package
almalinux/crit
pkg:rpm/almalinux/crit
Vulnerabilities (120)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-56862 | Hig | 7.5 | < 3.18-5.module_el8.10.0+4047+545787c4 | 3.18-5.module_el8.10.0+4047+545787c4 | Aug 13, 2026 | Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indef | |
| CVE-2026-56860 | Med | 5.9 | < 3.18-5.module_el8.10.0+4047+545787c4 | 3.18-5.module_el8.10.0+4047+545787c4 | Aug 13, 2026 | Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-b | |
| CVE-2026-56859 | Hig | 7.5 | < 3.18-5.module_el8.10.0+4047+545787c4 | 3.18-5.module_el8.10.0+4047+545787c4 | Aug 13, 2026 | Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. | |
| CVE-2026-56858 | Med | 6.1 | < 3.18-5.module_el8.10.0+4047+545787c4 | 3.18-5.module_el8.10.0+4047+545787c4 | Aug 13, 2026 | Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. | |
| CVE-2026-56853 | Hig | 7.5 | < 3.18-5.module_el8.10.0+4047+545787c4 | 3.18-5.module_el8.10.0+4047+545787c4 | Aug 13, 2026 | When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. | |
| CVE-2026-33818 | Hig | 7.5 | < 3.18-5.module_el8.10.0+4047+545787c4 | 3.18-5.module_el8.10.0+4047+545787c4 | Aug 13, 2026 | Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. | |
| CVE-2026-57231 | Hig | 7.5 | < 3.18-5.module_el8.10.0+4047+545787c4 | 3.18-5.module_el8.10.0+4047+545787c4 | Jun 26, 2026 | Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that usi | |
| CVE-2026-42508 | Cri | 9.1 | < 3.18-5.module_el8.10.0+4047+545787c4 | 3.18-5.module_el8.10.0+4047+545787c4 | May 22, 2026 | Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked. | |
| CVE-2026-39835 | Med | 5.3 | < 3.18-5.module_el8.10.0+4047+545787c4 | 3.18-5.module_el8.10.0+4047+545787c4 | May 22, 2026 | SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil. | |
| CVE-2026-39832 | Cri | 9.1 | < 3.18-5.module_el8.10.0+4047+545787c4 | 3.18-5.module_el8.10.0+4047+545787c4 | May 22, 2026 | When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now | |
| CVE-2026-39830 | Cri | 9.1 | < 3.18-5.module_el8.10.0+4047+545787c4 | 3.18-5.module_el8.10.0+4047+545787c4 | May 22, 2026 | A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now | |
| CVE-2026-39829 | Hig | 7.5 | < 3.18-5.module_el8.10.0+4047+545787c4 | 3.18-5.module_el8.10.0+4047+545787c4 | May 22, 2026 | The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clien | |
| CVE-2026-42499 | Hig | 7.5 | < 3.18-5.module_el8.10.0+4047+545787c4 | 3.18-5.module_el8.10.0+4047+545787c4 | May 7, 2026 | Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. | |
| CVE-2026-33811 | Hig | 7.5 | < 3.18-5.module_el8.10.0+4047+545787c4 | 3.18-5.module_el8.10.0+4047+545787c4 | May 7, 2026 | When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. | |
| CVE-2026-32283 | Hig | 7.5 | < 3.18-5.module_el8.10.0+4047+545787c4 | 3.18-5.module_el8.10.0+4047+545787c4 | Apr 8, 2026 | If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3. | |
| CVE-2026-32281 | Hig | 7.5 | < 3.18-5.module_el8.10.0+4047+545787c4 | 3.18-5.module_el8.10.0+4047+545787c4 | Apr 8, 2026 | Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root C | |
| CVE-2026-32280 | Hig | 7.5 | < 3.18-5.module_el8.10.0+4047+545787c4 | 3.18-5.module_el8.10.0+4047+545787c4 | Apr 8, 2026 | During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls | |
| CVE-2026-34986 | Hig | 7.5 | < 3.18-5.module_el8.10.0+4047+545787c4 | 3.18-5.module_el8.10.0+4047+545787c4 | Apr 6, 2026 | Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JW | |
| CVE-2026-25679 | Hig | 7.5 | < 3.18-5.module_el8.10.0+4047+545787c4 | 3.18-5.module_el8.10.0+4047+545787c4 | Mar 6, 2026 | url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. | |
| CVE-2025-68121 | Cri | 10.0 | < 3.18-5.module_el8.10.0+4047+545787c4 | 3.18-5.module_el8.10.0+4047+545787c4 | Feb 5, 2026 | During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and |
- affected < 3.18-5.module_el8.10.0+4047+545787c4fixed 3.18-5.module_el8.10.0+4047+545787c4
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indef
- affected < 3.18-5.module_el8.10.0+4047+545787c4fixed 3.18-5.module_el8.10.0+4047+545787c4
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-b
- affected < 3.18-5.module_el8.10.0+4047+545787c4fixed 3.18-5.module_el8.10.0+4047+545787c4
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.
- affected < 3.18-5.module_el8.10.0+4047+545787c4fixed 3.18-5.module_el8.10.0+4047+545787c4
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
- affected < 3.18-5.module_el8.10.0+4047+545787c4fixed 3.18-5.module_el8.10.0+4047+545787c4
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.
- affected < 3.18-5.module_el8.10.0+4047+545787c4fixed 3.18-5.module_el8.10.0+4047+545787c4
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
- affected < 3.18-5.module_el8.10.0+4047+545787c4fixed 3.18-5.module_el8.10.0+4047+545787c4
Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that usi
- affected < 3.18-5.module_el8.10.0+4047+545787c4fixed 3.18-5.module_el8.10.0+4047+545787c4
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.
- affected < 3.18-5.module_el8.10.0+4047+545787c4fixed 3.18-5.module_el8.10.0+4047+545787c4
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.
- affected < 3.18-5.module_el8.10.0+4047+545787c4fixed 3.18-5.module_el8.10.0+4047+545787c4
When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now
- affected < 3.18-5.module_el8.10.0+4047+545787c4fixed 3.18-5.module_el8.10.0+4047+545787c4
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now
- affected < 3.18-5.module_el8.10.0+4047+545787c4fixed 3.18-5.module_el8.10.0+4047+545787c4
The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clien
- affected < 3.18-5.module_el8.10.0+4047+545787c4fixed 3.18-5.module_el8.10.0+4047+545787c4
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
- affected < 3.18-5.module_el8.10.0+4047+545787c4fixed 3.18-5.module_el8.10.0+4047+545787c4
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
- affected < 3.18-5.module_el8.10.0+4047+545787c4fixed 3.18-5.module_el8.10.0+4047+545787c4
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.
- affected < 3.18-5.module_el8.10.0+4047+545787c4fixed 3.18-5.module_el8.10.0+4047+545787c4
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root C
- affected < 3.18-5.module_el8.10.0+4047+545787c4fixed 3.18-5.module_el8.10.0+4047+545787c4
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls
- affected < 3.18-5.module_el8.10.0+4047+545787c4fixed 3.18-5.module_el8.10.0+4047+545787c4
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JW
- affected < 3.18-5.module_el8.10.0+4047+545787c4fixed 3.18-5.module_el8.10.0+4047+545787c4
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
- affected < 3.18-5.module_el8.10.0+4047+545787c4fixed 3.18-5.module_el8.10.0+4047+545787c4
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and
Page 1 of 6