rpm package
opensuse/gomuks&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/gomuks&distro=openSUSE%20Tumbleweed
Vulnerabilities (8)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-42506 | Med | 6.1 | < 26.03+git.1780250926.564a8707-1.1 | 26.03+git.1780250926.564a8707-1.1 | May 22, 2026 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. | |
| CVE-2026-42502 | Med | 6.1 | < 26.03+git.1780250926.564a8707-1.1 | 26.03+git.1780250926.564a8707-1.1 | May 22, 2026 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. | |
| CVE-2026-39821 | Cri | 9.6 | < 26.03+git.1780250926.564a8707-1.1 | 26.03+git.1780250926.564a8707-1.1 | May 22, 2026 | The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in program | |
| CVE-2026-27136 | Med | 6.1 | < 26.03+git.1780250926.564a8707-1.1 | 26.03+git.1780250926.564a8707-1.1 | May 22, 2026 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. | |
| CVE-2026-25681 | Med | 6.1 | < 26.03+git.1780250926.564a8707-1.1 | 26.03+git.1780250926.564a8707-1.1 | May 22, 2026 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. | |
| CVE-2026-33809 | Med | 5.3 | < 26.03+git.1780250926.564a8707-1.1 | 26.03+git.1780250926.564a8707-1.1 | Mar 25, 2026 | A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error. | |
| CVE-2025-47911 | Med | 5.3 | < 0.3.1-2.1 | 0.3.1-2.1 | Feb 5, 2026 | The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content. | |
| CVE-2024-24792 | Hig | 7.5 | < 0.3.0-3.1 | 0.3.0-3.1 | Jun 27, 2024 | Parsing a corrupt or malicious image with invalid color indices can cause a panic. |
- affected < 26.03+git.1780250926.564a8707-1.1fixed 26.03+git.1780250926.564a8707-1.1
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
- affected < 26.03+git.1780250926.564a8707-1.1fixed 26.03+git.1780250926.564a8707-1.1
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
- affected < 26.03+git.1780250926.564a8707-1.1fixed 26.03+git.1780250926.564a8707-1.1
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in program
- affected < 26.03+git.1780250926.564a8707-1.1fixed 26.03+git.1780250926.564a8707-1.1
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
- affected < 26.03+git.1780250926.564a8707-1.1fixed 26.03+git.1780250926.564a8707-1.1
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
- affected < 26.03+git.1780250926.564a8707-1.1fixed 26.03+git.1780250926.564a8707-1.1
A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.
- affected < 0.3.1-2.1fixed 0.3.1-2.1
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
- affected < 0.3.0-3.1fixed 0.3.0-3.1
Parsing a corrupt or malicious image with invalid color indices can cause a panic.