Release date:
2026-10-23 12:22:48 UTC
Description:
- CVE-2026-78669: net/http - track HTTP/2 outbound stream flow-control windows
as a delta against a shared connection-level initial window, so a
SETTINGS_INITIAL_WINDOW_SIZE change is O(1) instead of iterating over every
open stream, preventing CPU exhaustion by a peer sending many SETTINGS frames
- CVE-2026-78667: net/http - limit the number of ranges parsed from a Range
header in FileServer, ServeContent and ServeFile to 200 (configurable via
GODEBUG=httpservecontentmaxranges), ignoring headers with too many ranges to
avoid excessive CPU consumption
Updated packages:
-
go-toolset-1.22.9-1.el9_2.tuxcare.els30.aarch64.rpm
sha:17e83fa22127f672609fb5566a2d7bb3ea9bf5ec6e8ecd3851a685ff2e7835df
-
go-toolset-1.22.9-1.el9_2.tuxcare.els30.x86_64.rpm
sha:875f416ae5c3e72d4b731cad36107cc021adc8eb4b77bf4160c2c12e930e54f0
-
golang-1.22.9-1.el9_2.tuxcare.els30.aarch64.rpm
sha:6f69b2983f5a7ce8bd3982c76caf8dc2576405b31096b16cae30a765031a41ee
-
golang-1.22.9-1.el9_2.tuxcare.els30.x86_64.rpm
sha:8b048575c702a9332b1c677aedd9193cd9dce3b1747deee6a9aad5d44b6456db
-
golang-bin-1.22.9-1.el9_2.tuxcare.els30.aarch64.rpm
sha:1dc4cf1908180bfcfcdaf0178788ffd3094988c79f0035f07d32a641a3562535
-
golang-bin-1.22.9-1.el9_2.tuxcare.els30.x86_64.rpm
sha:f843d3259b5b281aa3bc857e9177f1a9e042dacf3a1baaefb19186eeab06e5d0
-
golang-docs-1.22.9-1.el9_2.tuxcare.els30.noarch.rpm
sha:48ba978f5a44b40959d81a8cf7b0c3f6e835c053872af87724e7a2359bfac86b
-
golang-misc-1.22.9-1.el9_2.tuxcare.els30.noarch.rpm
sha:1d0aa42a5ef0235bb3fad3e8eef9ca04c5d01d339cb5b4a00e82d49839ea21f2
-
golang-src-1.22.9-1.el9_2.tuxcare.els30.noarch.rpm
sha:1137c0eac42e5784957e2656c0d72bcbb4f5a6080fd92009064f18618d8e5bf8
-
golang-tests-1.22.9-1.el9_2.tuxcare.els30.noarch.rpm
sha:842e889f017cb931c57b07c2224a6475fd45b2c0f12130fa3336aa887ec3547f
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
