CVE-2026-39883" data-hovercard-type="advisory" data-hovercard-url="/advisories/GHSA-hfvc-g4fc-pqhx/hovercard" href="https://github.com/advisories/GHSA-hfvc-g4fc-pqhx">CVE-2026-39883: Arbitrary code execution via PATH hijacking on BSD/Solaris Update golang.org/x/crypto v0.49.0 -> v0.52.0: - CVE-2026-39827: SSH channel exhaustion via repeated channel opens - CVE-2026-39828: Unauthorized command execution via discarded SSH permissions - CVE-2026-39829: DoS via crafted public key with excessive parameters - CVE-2026-39830: DoS via resource leak from unsolicited SSH responses - CVE-2026-39832: Security bypass due to improper handling of key restrictions - CVE-2026-39835: DoS via crafted SSH certificate - CVE-2026-42508: Revocation bypass via unchecked SignatureKey in knownhosts - CVE-2026-46595: Authorization bypass due to skipped source-address validation - CVE-2026-46597: Server-side panic via incorrectly placed cast from bytes to int Update golang.org/x/net v0.52.0 -> v0.55.0: - CVE-2026-25681: Arbitrary code execution via Cross-Site Scripting in html package - CVE-2026-27136: XSS via Render of arbitrary parsed HTML - CVE-2026-33814: DoS via malformed SETTINGS_MAX_FRAME_SIZE HTTP/2 frame - CVE-2026-39821: Privilege escalation via incorrect Punycode label processing in idna - CVE-2026-42502: XSS via Render of arbitrary parsed HTML Signed-off-by: Wesley Hayutin <weshayutin@gmail.com>

Uh oh!

Commits

Commits on Jul 3, 2026

fix multiple CVE's