SB20260731152 - Anolis OS update for golang

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260731152

SB20260731152 - Anolis OS update for golang

Published: July 31, 2026

Security Bulletin ID SB20260731152
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Input validation error (CVE-ID: CVE-2026-32281)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in Certificate.Verify in crypto/x509 when validating certificate chains containing a very large number of policy mappings. A remote attacker can present a specially crafted certificate chain to cause a denial of service.

This only affects validation of otherwise trusted certificate chains issued by a root CA in the VerifyOptions.Roots CertPool or in the system certificate pool.


2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-32288)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled memory allocation in archive/tar Reader.Next when parsing a maliciously crafted tar archive containing a large number of sparse regions encoded in the old GNU sparse map format. A remote attacker can supply a specially crafted archive to cause a denial of service.


3) Cross-site scripting (CVE-ID: CVE-2026-32289)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to inject arbitrary script code.

The vulnerability exists due to improper neutralization of input during web page generation in html/template when processing template actions within JavaScript template literals. A remote attacker can supply crafted input that is incorrectly escaped to inject arbitrary script code.

Exploitation requires templates that use branches or actions within JavaScript template literals.


Remediation

Install update from vendor's website.

References