{"vulnerability": "cve-2026-4659", "sightings": [{"uuid": "4c10e2f0-32a7-4cac-90d6-7ef3d665dfca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4659", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjorhb7jcn26", "content": "", "creation_timestamp": "2026-04-17T11:00:14.381105Z"}, {"uuid": "5041250a-f1aa-48d1-98c9-5cc056a1a264", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4659", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mjoxtl33bz26", "content": "", "creation_timestamp": "2026-04-17T12:54:29.907084Z"}, {"uuid": "13d602a6-e396-4611-b4d9-0fb85fa5ce49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4659", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mjpo2le3u52h", "content": "", "creation_timestamp": "2026-04-17T19:32:07.258975Z"}, {"uuid": "f22e5bac-8559-4981-9d9c-11a47c7b9c5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4659", "type": "seen", "source": "Telegram/AZQnk1q88GRrPNbtJYRdzFvYzsq1JKqTcpasHMe998GraXQ", "content": "", "creation_timestamp": "2026-04-17T09:15:54.000000Z"}, {"uuid": "934c0938-4db2-4087-a0bb-c9b79cf8a535", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46598", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmgbtjxtaj2k", "content": "CVE-2026-46598 - Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent\nCVE ID : CVE-2026-46598\n \n Published : May 22, 2026, 4:16 a.m. | 1\u00a0hour, 34\u00a0minutes ago\n \n Description : For certain crafted inputs, a 'ed25519.PrivateKey' was created by ca...", "creation_timestamp": "2026-05-22T06:15:06.547470Z"}, {"uuid": "3a3671bb-970e-4131-bcb8-7169cd6343f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46597", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmgbwgulo32c", "content": "CVE-2026-46597 - Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh\nCVE ID : CVE-2026-46597\n \n Published : May 22, 2026, 4:16 a.m. | 1\u00a0hour, 34\u00a0minutes ago\n \n Description : An incorrectly placed cast from bytes to int allowed for server-side panic i...", "creation_timestamp": "2026-05-22T06:16:40.590784Z"}, {"uuid": "44e7fbbf-ac1c-4bf7-913b-65e15393c38e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46595", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmgc4lusjl2k", "content": "CVE-2026-46595 - Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh\nCVE ID : CVE-2026-46595\n \n Published : May 22, 2026, 4:16 a.m. | 1\u00a0hour, 34\u00a0minutes ago\n \n Description : Previously, CVE-2024-45337 fixed an authorization bypass for mis...", "creation_timestamp": "2026-05-22T06:20:07.197203Z"}, {"uuid": "246b3c59-5b39-4d65-9bac-28ac0c16cc67", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46599", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmzjr6anon23", "content": "CVE-2026-46599 - Excessive resource consumption in PackBits decompression in golang.org/x/image/tiff\nCVE ID : CVE-2026-46599\n \n Published : May 29, 2026, 8:16 p.m. | 16\u00a0minutes ago\n \n Description : The TIFF decoder does not place a limit on the size of PackBits-compressed data...", "creation_timestamp": "2026-05-29T21:57:28.692785Z"}, {"uuid": "a898a33f-3c35-44a8-b0ed-bc2b87983b56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46597", "type": "seen", "source": "https://gist.github.com/alon710/0234a3b8537da177958a0a725a5f30b9", "content": "# CVE-2026-46597: CVE-2026-46597: Remote Denial of Service in golang.org/x/crypto/ssh via AES-GCM Padding Integer Overflow\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-06-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-46597\n\n## Summary\nA high-severity Denial of Service (DoS) vulnerability (CVE-2026-46597 / GO-2026-5013) exists in the golang.org/x/crypto/ssh module before version v0.52.0. The flaw stems from an incorrect operator order during a type conversion of the GCM packet padding size, allowing a remote, unauthenticated attacker to trigger an out-of-bounds slice runtime panic and crash the Go process.\n\n## TL;DR\nUnauthenticated remote attackers can crash Go-based SSH servers or clients using AES-GCM ciphers by exploiting an integer overflow in padding length checks.\n\n## Technical Details\n\n- **CWE ID**: CWE-191 / CWE-704\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.00359 (27.78% percentile)\n- **Impact**: Complete Denial of Service (A:H)\n- **Exploit Status**: Unproven / No Public PoC\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- golang.org/x/crypto/ssh\n- Docker\n- containerd\n- HashiCorp Vault\n- Gitea\n- Prometheus\n- AWS Systems Manager Agent (SSM)\n- cAdvisor\n- Podman\n- Trivy\n- **golang.org/x/crypto**: < v0.52.0 (Fixed in: `v0.52.0`)\n\n## Mitigation\n\n- Upgrade the golang.org/x/crypto module to version v0.52.0 or later and recompile downstream applications.\n- Disable AES-GCM cipher suites (aes128-gcm@openssh.com, aes256-gcm@openssh.com) in the SSH server and client configurations.\n\n**Remediation Steps:**\n1. Update your go.mod file: run 'go get golang.org/x/crypto@v0.52.0'\n2. Run 'go mod tidy' to update dependency trees.\n3. Rebuild and redeploy all affected services and container images.\n4. Verify dependencies across downstream microservices using SCA tools.\n\n## References\n\n- [Go Issue Tracker Tracker: Issue 79561](https://go.dev/issue/79561)\n- [Go Gerrit Change List CL 781620](https://go.dev/cl/781620)\n- [Go Gitiles Code Patch Commit abbc44d](https://go.googlesource.com/crypto/+/abbc44d451a6f9236a2bbd26cbcd4d0fec473da3^!)\n- [Go Vulnerability Database Entry GO-2026-5013](https://pkg.go.dev/vuln/GO-2026-5013)\n- [Go Announcements Mailing List](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)\n- [CVE Registry Entry CVE-2026-46597](https://www.cve.org/CVERecord?id=CVE-2026-46597)\n- [Wiz Vulnerability Advisory](https://www.wiz.io/vulnerability-database/cve/cve-2026-46597)\n- [Shodan Search Queries](https://www.shodan.io/search?query=CVE-2026-46597)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-46597) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-26T13:42:31.989216Z"}, {"uuid": "d4e4cb16-8bcb-4cef-9d10-ff6b51911b81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46590", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mpwcpyu2zz2i", "content": "CVE-2026-46590: Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)", "creation_timestamp": "2026-07-05T19:29:10.588256Z"}, {"uuid": "399b7389-c387-4130-9fb4-3e3f3c106d97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46592", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mpweezp6dg24", "content": "CVE-2026-46592: Apache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation", "creation_timestamp": "2026-07-05T19:58:48.368808Z"}, {"uuid": "06ef62e3-070a-433d-b416-bce8d8902e60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46591", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mpwf7wztkm2n", "content": "CVE-2026-46591: Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)", "creation_timestamp": "2026-07-05T20:13:51.393302Z"}, {"uuid": "7fb7856b-195d-416d-aa90-43f46747892a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46599", "type": "seen", "source": "https://gist.github.com/alon710/b509de249400d70367353eccad7c34f4", "content": "# CVE-2026-46599: CVE-2026-46599: Unrestricted Memory Allocation in golang.org/x/image/tiff PackBits Decoder\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-46599\n\n## Summary\nCVE-2026-46599 (also identified by Go vulnerability alias GO-2026-5032) is a high-severity denial-of-service vulnerability in the Go image repository, specifically within the TIFF decoder's PackBits decompression engine. A lack of resource limits during the parsing of Run-Length Encoded PackBits streams allows an attacker to construct a crafted TIFF image that achieves significant decompression amplification. This flaw enables an unauthenticated remote attacker to exhaust system resources, leading to an Out-of-Memory crash or a prolonged application hang.\n\n## TL;DR\nUnrestricted PackBits decompression in golang.org/x/image/tiff allows unauthenticated remote attackers to trigger denial of service via memory exhaustion using a crafted 2MB TIFF image that decompresses to 745MB.\n\n## Technical Details\n\n- **CWE ID**: CWE-770 (Allocation of Resources Without Limits or Throttling)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: 0.00353\n- **EPSS Percentile**: 27.35%\n- **Exploit Status**: No public functional exploit code (None/PoC-only)\n- **KEV Status**: Not in CISA's Known Exploited Vulnerabilities (KEV) catalog\n\n## Affected Systems\n\n- Go ecosystem applications using golang.org/x/image/tiff\n- Tailscale clients and mesh components\n- Rclone cloud storage utilities\n- Gitea self-hosted Git services\n- Kubescape CLI scanner\n- Echo web framework-driven backend services parsing multipart image structures\n- **golang.org/x/image/tiff**: < v0.41.0 (Fixed in: `v0.41.0`)\n\n## Mitigation\n\n- Upgrade golang.org/x/image to v0.41.0 or higher\n- Implement application-level file validation to block TIFF files\n- Enforce strict HTTP request body size limits\n- Rebuild and redeploy all statically compiled Go binaries\n\n**Remediation Steps:**\n1. Navigate to the Go module directory\n2. Execute 'go get golang.org/x/image@v0.41.0'\n3. Run 'go mod tidy' to update go.sum\n4. Recompile application binaries with 'go build'\n5. Deploy the updated executable to production environments\n\n## References\n\n- [NVD Record for CVE-2026-46599](https://nvd.nist.gov/vuln/detail/CVE-2026-46599)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-46599)\n- [Go Vulnerability Database Entry](https://pkg.go.dev/vuln/GO-2026-5032)\n- [Go Issue Tracker Thread](https://go.dev/issue/79577)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-46599) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-06T08:02:31.782633Z"}, {"uuid": "b81b4799-82bc-4f1a-9e84-9e8ef307e07a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46591", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mq6otrzp4q26", "content": "\u0423\u0433\u0440\u043e\u0437\u0430 CVE-2026-46591: \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043b\u043e\u0433\u0438\u043a\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432\n\n\n\nhttps://kripta.biz/posts/0369E6D8-7E54-4CB2-ACC6-95B6CAC6DD07", "creation_timestamp": "2026-07-09T03:27:18.616777Z"}, {"uuid": "3a378fad-6437-4942-ba7f-1c250258db7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46590", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mq6ovvkgmv2w", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-46590 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Apache Camel PQC: \u0440\u0438\u0441\u043a\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/7F7BB718-C759-497C-B5E0-F40E883789D3", "creation_timestamp": "2026-07-09T03:28:29.469525Z"}, {"uuid": "26a68d18-35c4-4f8e-a80f-0f9c506d57a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46592", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mq6oxazobr22", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-46592: \u041e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 'Confused Deputy'\n\n\n\nhttps://kripta.biz/posts/C9FB7118-0729-44CF-803D-0E9EFC179FA6", "creation_timestamp": "2026-07-09T03:29:16.100446Z"}, {"uuid": "c0061e07-0a79-4808-a55c-32d7eb5dfc47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46590", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mq7gud5wfd2m", "content": "\ud83d\udccc CVE-2026-46590 - Deserialization of Untrusted Data vulnerability in Apache Camel PQC component.\n\nThe camel-pqc component persists post-quantum key metadata (KeyMetadat... https://www.cyberhub.blog/cves/CVE-2026-46590", "creation_timestamp": "2026-07-09T10:37:06.729844Z"}]}