Multiple security vulnerabilities have been identified in FFmpeg versions before 8.1.3 and 9.x before 9.0.2. These include improper certificate validation that skips hostname checks for IP-address hosts, missing host key verification in the SFTP protocol handler, and several denial of service vulnerabilities caused by infinite loops in the DASH demuxer, HLS demuxer, and RTSP redirect handling. Additionally, a protection mechanism failure in the HLS demuxer allows bypassing protocol restrictions. These issues can lead to interception and tampering of streams, impersonation of SFTP servers, denial of service through resource exhaustion, and unauthorized resource access. Patches are available to address these vulnerabilities.
A vulnerability in SSSD's NFS idmap plugin allows an out-of-bounds write when processing oversized cached user or group name entries. This can be triggered locally by requesting identity lookups that exceed buffer sizes, potentially causing a denial of service by crashing the identity mapping service and possibly corrupting adjacent memory. The issue affects multiple specific versions of SSSD. The CVSS score is 5.8, indicating a medium severity level.
A security vulnerability (CVE-2026-98260) affects the kernel-rt packages of the Real Time Linux Kernel used in Red Hat Enterprise Linux. The issue involves improper cleanup of POSIX timers after the de_thread() function call. Red Hat has released an important security update addressing this flaw. The update requires a system reboot to take effect. The vulnerability is rated as high severity by the source data, and Red Hat recommends prompt application of the update to improve system security.
CVE-2026-97031 is a high-severity vulnerability in the Go standard library's crypto/tls package. It involves improper handling of multiple Encrypted Client Hello (ECH) outer extension references, which are disallowed by RFC 9849. A malicious client could send a crafted packet with multiple references, causing memory exhaustion on the server. The issue has been addressed by rejecting such malformed packets, mitigating the memory amplification risk.
CVE-2026-94440 is a high-severity vulnerability in the Go standard library net/textproto package. It involves allocation of resources without limits or throttling when parsing multipart forms. Specifically, the vulnerability allows bypassing memory limits and reading an arbitrarily long line into memory if the remaining limit at the start of a part is less than 400 bytes. This can lead to excessive memory consumption and potential denial of service.
CVE-2026-94439 is a high-severity vulnerability in the Go standard library net/http package involving inconsistent handling of HTTP/1 CONNECT requests. When a server handler sends a 2xx response to such a request but does not hijack the connection, it incorrectly continues to process the connection as HTTP rather than as a tunnel. This behavior can lead to HTTP request smuggling, where intermediaries and the server have differing interpretations of the connection data.
CVE-2026-78660 is a high-severity vulnerability in the Go standard library net/http package involving inconsistent interpretation of HTTP requests, leading to HTTP response smuggling. The issue arises because the HTTP/2 implementation in net/http is lax about malformed framing-related headers, which can be forwarded to HTTP/1 clients when acting as a reverse proxy. If the HTTP/1 client also does not strictly validate these headers, response smuggling can occur.
CVE-2026-78659 is a high-severity vulnerability in the Go standard library net/http package. It involves asymmetric resource consumption through the handling of "Trailer" headers in HTTP/2 servers. A malicious client can send a "Trailer" header declaring many fields, causing excessive memory allocation by the server. This bypasses existing limits on header size and count, leading to potential denial-of-service conditions. The issue does not affect HTTP/1 servers due to different header handling and lack of multiplexing. No known exploits are reported in the wild. Affected versions include multiple pre-1.26.9 and pre-1.27.2 releases, as well as versions before 0.60.0. No patch or official fix information is provided in the input data.
CVE-2026-56866 is a high-severity vulnerability in the Go standard library net/http package involving inconsistent interpretation of HTTP/1 CONNECT requests with non-empty bodies. When http.Transport sends such a CONNECT request, it writes the body without framing after headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, the connection is returned to the idle pool while the server may interpret trailing body bytes as a new pipelined HTTP/1.1 request. This desynchronization can cause response poisoning in reverse proxies that share the Transport, leading to cross-user response contamination.
CVE-2026-56857 is a critical vulnerability in the Go standard library's os package affecting Windows systems. It involves insecure operations on Windows junctions or mount points during directory creation with Root.Mkdir or Root.MkdirAll. Specifically, when the last path component is a junction pointing to an empty location, these functions can create directories at the junction target even if it lies outside the intended root directory. This behavior can lead to unauthorized directory creation outside the expected path boundaries.
CVE-2026-78669 is a high-severity vulnerability in the Go standard library net/http package. It involves asymmetric resource consumption (amplification) via HTTP/2 where a malicious peer can cause excessive CPU usage by opening many streams and sending numerous small SETTINGS frames with SETTINGS_INITIAL_WINDOW_SIZE values. This can impact both clients and servers using the affected versions of the net/http package.
CVE-2026-78663 is a critical vulnerability in the Go standard library net/http package affecting HTTP/2 servers. It allows a malicious client to bypass the configured connection-level flow control limit by causing the server to refund flow control credits twice for the same data. This occurs when a client resets a stream and the request handler subsequently reads buffered data, resulting in double refunding of connection-level flow control. Although total buffered data remains limited by concurrent stream limits and stream-level flow control, this flaw can lead to denial of service or resource exhaustion.
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.
CVE-2026-94447 is a high-severity vulnerability in the Go toolchain's cmd/go component involving improper validation of integrity check values. A user working within a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and uses a malicious GOMODPROXY can bypass the intended checksum verification. The issue is addressed by ensuring that golang.org/toolchain always fetches the canonical checksum from the network.
CVE-2026-94444 is a high-severity vulnerability in the Go toolchain's cmd/go module related to improper validation of integrity check values. It allows a user working inside a malicious Go project that defines a fake golang.org/fips140 module and connects to a malicious GOMODPROXY to have an arbitrary module served in place of the legitimate one. The issue is addressed by unpacking and verifying the trusted ziphash for the bundled golang.org/fips140 module to ensure its integrity.
CVE-2026-97030 is a cross-site scripting (XSS) vulnerability in the Go standard library's html/template package. It involves improper escaping of the 'yield' keyword in templates, where valid uses were not correctly escaped, potentially allowing injection of malicious scripts. The issue affects certain versions of the Go html/template package prior to 1.26.9 and between 1.27.0-0 and 1.27.2. The vulnerability has a medium severity with a CVSS score of 6.1.
CVE-2026-94448 is a medium severity cross-site scripting (XSS) vulnerability in the Go standard library's html/template package. The issue arises when JavaScript template literals contain consecutive expressions, causing improper context tracking and failure to reset state correctly. This flaw can lead to insufficient escaping of regular expression literals within templates, potentially allowing injection of malicious scripts.
SumatraPDF versions 3.6.1 and earlier contain an argument injection vulnerability in the SelectionTranslate.cpp source file. The issue arises from incomplete quote-only escaping when embedding selected or pasted translation text into Windows command lines. This flaw affects specific functions that build command lines for translation agents, potentially allowing attacker-controlled input to inject unauthorized command-line flags. No fixed version is currently available, and the vulnerability requires user interaction and local access. The impact is limited to scenarios where the corresponding agentic CLI backend is installed and used.
CVE-2026-107738 is an out-of-bounds read vulnerability in SumatraPDF version 3.6.1 and earlier. The issue occurs in the ChmFile::GetCharZ() function, which improperly converts unsigned string offsets to signed integers without checking for negative values. This can cause the function to read memory before the intended buffer, leading to deterministic application termination. No broader impact beyond application termination is reported. No fixed version is currently available.