Jakub Ciolek

In HTTP/1 servers, a race condition occurs when the limit of `MaxBytesReader` is exceeded. The server automatically sets the "Connection: close" header without proper synchronization, which may conflict with another header being set explicitly in the server handler. This can lead to a runtime panic and cause the server to crash if the handler reads the request body concurrently while writing the response header.

Excessive CPU consumption occurs when parsing a Range header that contains a large number of small ranges. This issue affects the `FileServer(FS)`, `ServeContent`, and `ServeFile(FS)` functions.

Parsing a multipart form can bypass memory limits, allowing an arbitrarily long line to be read into memory. This occurs when the remaining limit at the start of a part is less than 400 bytes.

An HTTP server handler improperly continues to read and serve requests from a connection after sending a 2xx response to an HTTP/1 CONNECT request without hijacking the connection. Because a 2xx response to an HTTP/1 CONNECT is intended to convert the connection into a tunnel, the server should stop treating the connection as HTTP. This behavior can lead to request smuggling, a technique where an attacker interferes with the way a website processes sequences of HTTP requests, occurring when an intermediate proxy views the connection data as tunneled while the server interprets it as HTTP.

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server. This occurs when the peer opens a large number of streams and subsequently sends numerous small SETTINGS frames containing `SETTINGS INITIAL WINDOW SIZE` values.

A maliciously crafted image can cause a Denial of Service (DoS) condition. When a container is created from such an image, memory exhaustion occurs, resulting in an Out Of Memory (OOM) kill of the containerd process. This action makes the container runtime API unavailable and can disrupt clients, including the Docker Engine or Kubernetes control-plane components.

Inefficient candidate hostname parsing occurs in the `crypto/x509` package. The `(*x509.Certificate).VerifyHostname` function previously called `matchHostnames()` in a loop over all DNS Subject Alternative Name (SAN) entries, causing `strings.Split(host, ".")` to execute repeatedly on the same input hostname. When a large DNS SAN list is present, verification costs scale quadratically based on the number of SAN entries multiplied by the hostname's label count. This overhead occurs even for untrusted certificates because `x509.Verify` validates hostnames before building the certificate chain.

Name of the Vulnerable Software and Affected Versions tar.Reader (affected versions not specified) Description tar.Reader can allocate an unbounded amount of memory when processing a specially crafted archive containing numerous sparse regions encoded using the "old GNU sparse map" format. This can lead to excessive memory consumption and potentially cause a denial-of-service condition. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A flaw exists where certificate verification can lead to a program crash. This occurs when a certificate within a chain lacks a DNS name while another certificate in the same chain has excluded name constraints. This issue impacts programs directly verifying X.509 certificate chains or those utilizing TLS. The issue affects 27 Lambda base images using stdlib.

A flaw exists in AWS Lambda base images utilizing stdlib. Specifically, when validating a certificate chain with multiple email address constraints that share common local portions but differ in domain portions, the constraints are not correctly applied. Only the last constraint in the chain is considered during verification.

SSH Agent servers do not properly check the size of messages when handling new identity requests. This can lead to a program crash, specifically a panic, if a deliberately crafted, malformed message causes an out-of-bounds read.

SSH servers that process GSSAPI authentication requests are susceptible to an issue where the number of mechanisms included in the request is not validated. This can lead to excessive memory usage, potentially causing a denial-of-service condition.

SSH clients may experience a panic and premature termination of the client process when receiving an SSH AGENT SUCCESS response while expecting a typed response. This can lead to disruptions in SSH sessions.

The `html.Parse` function exhibits quadratic parsing complexity when handling specific inputs. This can result in a denial of service (DoS) if an attacker submits maliciously crafted HTML content.

The software exhibits quadratic complexity when checking name constraints in X.509 certificate validation. This can lead to performance issues during certificate verification.

The `Reader.ReadResponse` function in the `net/textproto` package experiences excessive CPU consumption.

The software experiences quadratic complexity during the parsing of certain invalid inputs when handling PEM encoded data. This can lead to performance issues.

The Go programming language contains a flaw in the `crypto/x509` component where validating certificate chains with DSA public keys can lead to a program panic due to an incorrect interface cast. This occurs because the code expects DSA public keys to implement the `Equal` method. Exploitation of this issue by a remote attacker can result in a denial-of-service condition. Additionally, OpenTofu is affected by a denial-of-service issue in the "tofu init" function when processing maliciously crafted module package responses. Fedora has released updates for containernetworking-plugins, Gobuster, and complyctl to address security vulnerabilities, including CVE-2025-58188.

The issue is a memory exhaustion flaw in the encoding/asn1 package of the Go programming language. The code pre-allocates memory based on fields within a DER structure before fully validating the correctness or content of those fields. Processing a maliciously crafted DER payload can lead to excessive memory allocation, potentially causing a denial-of-service condition. The vulnerability also affects OpenTofu, causing a denial of service in the `tofu init` function when processing maliciously crafted module package responses.

The Go programming language contains a flaw in the archive/zip functionality that can lead to denial-of-service. Specifically, crafted ZIP files can trigger super-linear processing and excessive consumption of memory and CPU resources when opened, potentially causing a disruption of service. This issue affects backend services and build pipelines that automatically parse ZIP content.