https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 04:43:28 +0000 https://vulnerability.circl.lu/vuln/cve-2026-32952 <p><strong>Affected:</strong> Azure go-ntlmssp</p> <p>go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using `ntlmssp.Negotiator` as an HTTP transport. Version 0.1.1 patches the issue.</p> <p><strong>Affected:</strong> Azure go-ntlmssp</p> <p>go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using `ntlmssp.Negotiator` as an HTTP transport. Version 0.1.1 patches the issue.</p> https://vulnerability.circl.lu/vuln/cve-2026-32952 https://vulnerability.circl.lu/vuln/ghsa-mh2q-q3fh-2475 <p><strong>Affected:</strong> Go: go.opentelemetry.io/otel</p> <p>multi-value `baggage:` header extraction parses each header field-value independently and aggregates members across values. this allows an attacker to amplify cpu and allocations by sending many `baggage:` header lines, even when each individual value is within the 8192-byte per-value parse limit.</p> <p>## severity</p> <p>HIGH (availability / remote request amplification)</p> <p>## relevant links</p> <p>- repository: https://github.com/open-telemetry/opentelemetry-go - pinned callsite: https://github.com/open-telemetry/opentelemetry-go/blob/1ee4a4126dbdd1bc79e9fae072fa488beffac52a/propagation/baggage.go#L58</p> <p>## vulnerability details</p> <p>**pins:** open-telemetry/opentelemetry-go@1ee4a4126dbdd1bc79e9fae072fa488beffac52a **as-of:** 2026-02-04 **policy:** direct (no program scope provided)</p> <p>**callsite:** propagation/baggage.go:58 (`extractMultiBaggage`) **attacker control:** inbound HTTP request headers (many `baggage` field-values) → `propagation.HeaderCarrier.Values(&#34;baggage&#34;)` → repeated `baggage.Parse` + member aggregation</p> <p>### root cause</p> <p>`extractMultiBaggage` iterates over all `baggage` header field-values and parses each one independently, then appends members into a shared slice. the 8192-byte parsing cap applies per header value, but the multi-value path repeats that work once per header line (bounded only by the server/proxy header byte limit).</p> <p>### impact</p> <p>in a default `net/http` configuration (max header bytes 1mb), a single request with many `baggage:` header field-values can cause large per…</p> <p><strong>Affected:</strong> Go: go.opentelemetry.io/otel</p> <p>multi-value `baggage:` header extraction parses each header field-value independently and aggregates members across values. this allows an attacker to amplify cpu and allocations by sending many `baggage:` header lines, even when each individual value is within the 8192-byte per-value parse limit.</p> <p>## severity</p> <p>HIGH (availability / remote request amplification)</p> <p>## relevant links</p> <p>- repository: https://github.com/open-telemetry/opentelemetry-go - pinned callsite: https://github.com/open-telemetry/opentelemetry-go/blob/1ee4a4126dbdd1bc79e9fae072fa488beffac52a/propagation/baggage.go#L58</p> <p>## vulnerability details</p> <p>**pins:** open-telemetry/opentelemetry-go@1ee4a4126dbdd1bc79e9fae072fa488beffac52a **as-of:** 2026-02-04 **policy:** direct (no program scope provided)</p> <p>**callsite:** propagation/baggage.go:58 (`extractMultiBaggage`) **attacker control:** inbound HTTP request headers (many `baggage` field-values) → `propagation.HeaderCarrier.Values(&#34;baggage&#34;)` → repeated `baggage.Parse` + member aggregation</p> <p>### root cause</p> <p>`extractMultiBaggage` iterates over all `baggage` header field-values and parses each one independently, then appends members into a shared slice. the 8192-byte parsing cap applies per header value, but the multi-value path repeats that work once per header line (bounded only by the server/proxy header byte limit).</p> <p>### impact</p> <p>in a default `net/http` configuration (max header bytes 1mb), a single request with many `baggage:` header field-values can cause large per…</p> https://vulnerability.circl.lu/vuln/ghsa-mh2q-q3fh-2475