Open Source Vulnerabilities

go-fips-1.25, argo-workflows, stakater-reloader-fips, argo-events, local-static-provisioner-fips, grafana-alloy-fips, multus-cni-fips, gostatsd, opensearch-k8s-operator-fips

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content

stakater-reloader-fips, argo-events, local-static-provisioner-fips, grafana-alloy-fips, multus-cni-fips, gostatsd, opensearch-k8s-operator-fips

discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary

argo-workflows, opensearch-dashboards-fips, opensearch-dashboards-fips, mongosh

ajv (Another JSON Schema Validator) before 8

mongosh

@octokit/endpoint turns REST API endpoints into generic request options

argo-workflows, multus-cni-fips, opensearch-k8s-operator-fips

Reader

mongosh, mongosh

Security fix for GHSA-pfrx-2q88-qq97 applied in: mongosh 2.5.10-r2, mongosh 2.5.10-r3

argo-workflows, multus-cni-fips, opensearch-k8s-operator-fips

When Conn

argo-workflows, multus-cni-fips, opensearch-k8s-operator-fips

Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit

argo-workflows, multus-cni-fips, opensearch-k8s-operator-fips

Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion

multus-cni-fips, opensearch-k8s-operator-fips

tar

argo-workflows, multus-cni-fips, opensearch-k8s-operator-fips

Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL

mongosh

Security fix for GHSA-rc47-6667-2j5j applied in: mongosh 2.5.10-r2

neo4j-fips-2026.10

neo4j-fips-2026.10

argo-workflows, multus-cni-fips, opensearch-k8s-operator-fips

ParseAddress function constructs domain-literal address components through repeated string concatenation

neo4j-fips-2026.10

neo4j-fips-2026.10

argo-workflows, multus-cni-fips, opensearch-k8s-operator-fips

processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input

argo-workflows, multus-cni-fips, opensearch-k8s-operator-fips

Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method

argo-workflows, multus-cni-fips, opensearch-k8s-operator-fips

Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate

keycloak

Security fix for GHSA-w9fj-cfpg-grvv applied in: keycloak 26.4.11-r0

keycloak

Security fix for GHSA-cphf-4846-3xx9 applied in: keycloak 26.4.11-r0

keycloak

Netty is an asynchronous, event-driven network application framework

keycloak

Vert

stargate

Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1

cassandra-reaper-fips, cassandra-reaper-fips, cassandra-reaper-fips, stargate

Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs

cassandra-reaper-fips, cassandra-reaper-fips, cassandra-reaper-fips, stargate

Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine

stargate

Security fix for GHSA-pvp8-3xj6-8c6x applied in: stargate 2.0.44-r4

cassandra-reaper-fips, stargate

Security fix for GHSA-wjpw-4j6x-6rwh applied in: cassandra-reaper-fips 3.8.0-r3, stargate 2.0.44-r4

cassandra-reaper-fips, stargate

Security fix for GHSA-qh8g-58pp-2wxh applied in: cassandra-reaper-fips 3.8.0-r3, stargate 2.0.44-r4

stargate, stargate

Connect2id Nimbus JOSE + JWT 10

stargate

Security fix for GHSA-xwmg-2g98-w7v9 applied in: stargate 2.0.44-r4

wazero, prometheus-operator, k8sgpt, k8sgpt-operator, kubernetes-csi-external-snapshotter-fips, volume-modifier-for-k8s-fips, consul-k8s-fips, argo-events, local-static-provisioner-fips, volume-modifier-for-k8s, multus-cni-fips, prometheus, calico, prometheus-node-exporter, cert-manager, prometheus-operator, kubernetes-csi-livenessprobe-fips, ollama-fips, ollama-fips, ollama-fips, ollama-fips, azuredisk-csi-fips, kubernetes, modelmesh-runtime-adapter, kubernetes, mockgen, elastic-beats, prometheus-redis-exporter-fips

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322

wazero, prometheus-operator, k8sgpt, k8sgpt-operator, kubernetes-csi-external-snapshotter-fips, volume-modifier-for-k8s-fips, consul-k8s-fips, argo-events, local-static-provisioner-fips, volume-modifier-for-k8s, multus-cni-fips, prometheus, calico, cert-manager, prometheus-operator, kubernetes-csi-livenessprobe-fips, ollama-fips, ollama-fips, ollama-fips, ollama-fips, azuredisk-csi-fips, kubernetes, modelmesh-runtime-adapter, kubernetes, mockgen, elastic-beats, prometheus-redis-exporter-fips

Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)

argo-workflows, wazero, prometheus-operator, k8sgpt, k8sgpt-operator, kubernetes-csi-external-snapshotter-fips, volume-modifier-for-k8s-fips, consul-k8s-fips, argo-events, local-static-provisioner-fips, volume-modifier-for-k8s, multus-cni-fips, prometheus, calico, cert-manager, prometheus-operator, kubernetes-csi-livenessprobe-fips, ollama-fips, ollama-fips, ollama-fips, ollama-fips, azuredisk-csi-fips, kubernetes, modelmesh-runtime-adapter, kubernetes, elastic-beats, prometheus-redis-exporter-fips

If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...

opensearch-dashboards-fips

@hapi/content provided HTTP Content-* headers parsing

argo-workflows, argo-workflows, argo-workflows, opensearch-dashboards-fips

Security fix for GHSA-r4q5-vmmm-2653 applied in: argo-workflows 3.6.19-r6, argo-workflows 3.7.15-r1, argo-workflows 3.7.15-r2, opensearch-dashboards-fips 3.5.0-r0

wazero, prometheus-mysqld-exporter, prometheus-operator, k8sgpt, k8sgpt-operator, kubernetes-csi-external-snapshotter-fips, volume-modifier-for-k8s-fips, consul-k8s-fips, argo-events, local-static-provisioner-fips, volume-modifier-for-k8s, multus-cni-fips, prometheus, calico, cert-manager, prometheus-operator, kubernetes-csi-livenessprobe-fips, ollama-fips, ollama-fips, ollama-fips, ollama-fips, azuredisk-csi-fips, kubernetes, modelmesh-runtime-adapter, kubernetes, elastic-beats, prometheus-redis-exporter-fips

ReverseProxy can forward queries containing parameters not visible to Rewrite functions

argo-workflows, opensearch-dashboards-fips

brace-expansion library generates arbitrary strings containing a common prefix and suffix

argo-workflows, opensearch-dashboards-fips

Security fix for GHSA-f886-m6hf-6m8v applied in: argo-workflows 3.6.19-r5, opensearch-dashboards-fips 3.5.0-r0

argo-workflows

Security fix for GHSA-2328-f5f3-gj25 applied in: argo-workflows 3.6.19-r5

argo-workflows, opensearch-dashboards-fips

Security fix for GHSA-f23m-r3pf-42rh applied in: argo-workflows 3.6.19-r5, opensearch-dashboards-fips 3.5.0-r0

argo-workflows, opensearch-dashboards-fips

Security fix for GHSA-c2c7-rcm5-vvqj applied in: argo-workflows 3.6.19-r5, opensearch-dashboards-fips 3.5.0-r0

wazero, prometheus-mysqld-exporter, prometheus-operator, k8sgpt, k8sgpt-operator, kubernetes-csi-external-snapshotter-fips, volume-modifier-for-k8s-fips, consul-k8s-fips, argo-events, local-static-provisioner-fips, volume-modifier-for-k8s, multus-cni-fips, prometheus, calico, cert-manager, prometheus-operator, kubernetes-csi-livenessprobe-fips, ollama-fips, ollama-fips, ollama-fips, ollama-fips, azuredisk-csi-fips, kubernetes, kubernetes, modelmesh-runtime-adapter, elastic-beats, prometheus-redis-exporter-fips

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

argo-workflows, opensearch-dashboards-fips

Security fix for GHSA-3v7f-55p6-f55p applied in: argo-workflows 3.6.19-r5, opensearch-dashboards-fips 3.5.0-r0

argo-workflows, opensearch-dashboards-fips

Security fix for GHSA-r5fr-rjxr-66jc applied in: argo-workflows 3.6.19-r5, opensearch-dashboards-fips 3.5.0-r0

argo-workflows

Security fix for GHSA-q67f-28xg-22rw applied in: argo-workflows 3.6.19-r5

wazero, prometheus-operator, k8sgpt, k8sgpt-operator, kubernetes-csi-external-snapshotter-fips, volume-modifier-for-k8s-fips, consul-k8s-fips, argo-events, local-static-provisioner-fips, volume-modifier-for-k8s, multus-cni-fips, prometheus, calico, cert-manager, prometheus-operator, kubernetes-csi-livenessprobe-fips, ollama-fips, ollama-fips, ollama-fips, ollama-fips, azuredisk-csi-fips, modelmesh-runtime-adapter, kubernetes, kubernetes, mockgen, elastic-beats, prometheus-redis-exporter-fips

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations

kuberay-operator, kuberay-operator, wave, step-ca, step-ca, rancher-fleet-agent, fulcio-fips, secrets-store-csi-driver-provider-gcp, step-ca-fips, wazero, prometheus-operator, prometheus-mysqld-exporter, metacontroller, metacontroller, litestream, litestream, metrics-server-fips, amazon-cloudwatch-agent, litestream, litestream, trillian-fips, distribution, litestream, litestream, consul-fips, consul-fips, crossplane-provider-sql-fips, crossplane-provider-sql-fips, falco-exporter, k8sgpt, k8sgpt-operator, postgres-operator, postgres-operator, kubernetes-csi-external-snapshotter-fips, k8sgpt-operator, kumactl, node-problem-detector, promxy, kubernetes-dns-node-cache-fips, promxy, thanos-operator-fips, volume-modifier-for-k8s-fips, cadvisor-fips, cadvisor-fips, consul-k8s-fips, argo-events, keda-fips, local-static-provisioner-fips, vault-k8s-fips, kaniko, kaniko, prometheus-adapter, volume-modifier-for-k8s, yunikorn-k8shim-fips, multus-cni-fips, prometheus, calico, prometheus-node-exporter, dynatrace-operator, dynatrace-operator, cert-manager, metacontroller, metacontroller, prometheus-operator, karpenter, kubernetes-csi-livenessprobe-fips, ollama-fips, ollama-fips, ollama-fips, ollama-fips, azuredisk-csi-fips, modelmesh-runtime-adapter, kubernetes, kubernetes, elastic-beats, mongodb, mongodb, mongodb, mongodb, gptscript, prometheus-redis-exporter-fips

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

opensearch-dashboards-fips

Security fix for GHSA-jg4p-7fhp-p32p applied in: opensearch-dashboards-fips 3.5.0-r0