Open Source Vulnerabilities

go-fips-1.26, argo-workflows, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips

Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate

velero, vt-cli, consul-k8s-fips, velero-plugin-for-aws, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips

During the TLS 1

kube-state-metrics, go-fips-1.26, velero, temporal-server-fips, helm, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips

discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary

loki, loki, loki, loki, prometheus, prometheus

Delete function fails to properly validate offsets when processing malformed JSON input

dex, opa-fips, prometheus-redis-exporter-fips, prometheus-redis-exporter-fips, rclone, velero, renovate, prometheus-alertmanager, ollama-fips, ollama-fips, temporal-server, temporal-server, argo-rollouts-fips, weaviate-fips, weaviate-fips, kube-state-metrics-fips, runc, etcd, thanos, thanos, etcd, velero-plugin-for-aws, opentelemetry-collector, helm, logstash-exporter-fips, argo-cd-fips, argo-cd-fips, kube-vip-fips, kube-vip-fips, logstash-exporter-fips

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

velero, vt-cli, wave, minio-operator, thanos, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips

Within HostnameError

dex, opa-fips, prometheus-redis-exporter-fips, prometheus-redis-exporter-fips, rclone, velero, renovate, prometheus-alertmanager, ollama-fips, ollama-fips, temporal-server, temporal-server, argo-rollouts-fips, weaviate-fips, weaviate-fips, kube-state-metrics-fips, runc, etcd, thanos, thanos, etcd, velero-plugin-for-aws, opentelemetry-collector, velero-plugin-for-csi, helm, logstash-exporter-fips, argo-cd-fips, argo-cd-fips, kube-vip-fips, kube-vip-fips, logstash-exporter-fips

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

go-fips-1.26, go-fips-1.26, velero, vt-cli, go1.25, consul-k8s-fips, velero-plugin-for-aws, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened

go-fips-1.26, velero, vt-cli, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips

excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

kube-state-metrics, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, rabbitmq-cluster-operator, etcd, rabbitmq-cluster-operator, minio, kubernetes-dns-node-cache, rclone, rclone, velero, prometheus-operator, prometheus-mysqld-exporter, rabbitmq-messaging-topology-operator, argo-cd-fips, argo-cd-fips, temporal-server-fips, kube-state-metrics, kubernetes-dns-node-cache, nats-streaming, nats-streaming, thanos, kube-state-metrics, git-lfs-fips, helm-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, prometheus, sealed-secrets, logstash-exporter-fips

"go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames

bank-vaults, prometheus-operator, etcd, grafana-rollout-operator, cluster-autoscaler-fips, haproxy-ingress, velero, prometheus, yunikorn-k8shim, prometheus-mysqld-exporter, prometheus-mysqld-exporter, argo-cd-fips, temporal-server-fips, temporal-server-fips, kafka, prometheus-node-exporter, prometheus-node-exporter, prometheus-node-exporter, cortex, cortex, dynatrace-operator, dynatrace-operator, dynatrace-operator, dynatrace-operator, rancher-fleet-agent, nats-streaming, nats-streaming, victoriametrics-operator, prometheus, thanos, thanos, dynatrace-operator, dynatrace-operator, aws-network-policy-agent, traefik, smarter-device-manager, smarter-device-manager, metallb, fulcio, ingress-nginx-controller, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, git-lfs-fips, helm-fips, logstash-exporter-fips

NewNTUnicodeString does not check for string length overflow

go-fips-1.26, go-fips-1.26, argo-workflows, velero, go1.25, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content

kibana-8.19-bitnami

dex, opa-fips, prometheus-redis-exporter-fips, prometheus-redis-exporter-fips, rclone, velero, renovate, prometheus-alertmanager, ollama-fips, ollama-fips, temporal-server, temporal-server, argo-rollouts-fips, weaviate-fips, weaviate-fips, kube-state-metrics-fips, runc, etcd, thanos, thanos, etcd, velero-plugin-for-aws, opentelemetry-collector, cosign, helm, logstash-exporter-fips, argo-cd-fips, argo-cd-fips, kube-vip-fips, kube-vip-fips, logstash-exporter-fips

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

stakater-reloader, stakater-reloader, stakater-reloader, stakater-reloader, trust-manager, vault, vault, stakater-reloader, stakater-reloader, vault, vault, kubernetes-csi-external-snapshotter, bank-vaults, grafana-rollout-operator, rabbitmq-cluster-operator, rabbitmq-cluster-operator, kedacore-http-add-on, cluster-autoscaler-fips, kedacore-http-add-on, rclone, knative-net-istio, knative-net-istio, haproxy-ingress, velero, prometheus-mysqld-exporter, prometheus, yunikorn-k8shim, renovate, prometheus-mysqld-exporter, prometheus-node-exporter-fips, prometheus-alertmanager, prometheus-operator, rabbitmq-messaging-topology-operator, rabbitmq-messaging-topology-operator, vault, vault, ollama-fips, ollama-fips, temporal-server, temporal-server, argo-cd-fips, argo-cd-fips, argo-cd-fips, argo-cd-fips, argo-rollouts-fips, temporal-server-fips, kube-state-metrics, mongodb, mongodb, prometheus-node-exporter, prometheus-node-exporter, weaviate-fips, weaviate-fips, ollama-fips, ollama-fips, ollama-fips, ollama-fips, ollama-fips, ollama-fips, weaviate-fips, ollama-fips, ollama-fips, ollama-fips, ollama-fips, runc, flux-image-automation-controller, flux-image-automation-controller, kube-state-metrics-fips, dynatrace-operator, dynatrace-operator, kubernetes-event-exporter, terraform, cluster-autoscaler, istio, rancher-fleet-agent, kubernetes-dns-node-cache, secrets-store-csi-driver-provider-aws, kumactl, etcd, etcd, minio-operator, step-kms-plugin, victoriametrics-operator, thanos, prometheus, thanos, dynatrace-operator, dynatrace-operator, external-secrets-operator, dynatrace-operator, dynatrace-operator, external-secrets-operator, etcd, etcd, velero-plugin-for-aws, cloudnative-pg, opentelemetry-collector, smarter-device-manager, velero-fips, velero-fips, velero-fips, velero-fips, velero-fips, velero-plugin-for-csi, velero-plugin-for-csi, velero-plugin-for-csi, velero-plugin-for-csi, cadvisor, cadvisor, helm, step, victoriametrics-operator, ingress-nginx-controller, metallb, sealed-secrets, trust-manager, helm, helm, kube-state-metrics, istio, ingress-nginx-controller, ingress-nginx-controller, sealed-secrets, rqlite, fulcio, argo-cd-fips, argo-cd-fips, wave, sealed-secrets, kube-vip-fips, kube-vip-fips

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

dex, opa-fips, prometheus-redis-exporter-fips, prometheus-redis-exporter-fips, rclone, velero, renovate, prometheus-alertmanager, ollama-fips, ollama-fips, temporal-server, temporal-server, argo-rollouts-fips, weaviate-fips, weaviate-fips, kube-state-metrics-fips, runc, etcd, thanos, thanos, etcd, velero-plugin-for-aws, opentelemetry-collector, velero-plugin-for-csi, helm, logstash-exporter-fips, argo-cd-fips, argo-cd-fips, kube-vip-fips, kube-vip-fips, logstash-exporter-fips

Previously, resolving relative paths containing parent directory ('

kube-state-metrics, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, rabbitmq-cluster-operator, etcd, rabbitmq-cluster-operator, minio, kubernetes-dns-node-cache, rclone, rclone, velero, prometheus-operator, prometheus-mysqld-exporter, prometheus-mysqld-exporter, rabbitmq-messaging-topology-operator, argo-cd-fips, argo-cd-fips, temporal-server-fips, kube-state-metrics, kubernetes-dns-node-cache, nats-streaming, nats-streaming, thanos, kube-state-metrics, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, git-lfs-fips, helm-fips, logstash-exporter-fips, prometheus, sealed-secrets

malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation

go-fips-1.26, argo-workflows, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips

ParseAddress function constructs domain-literal address components through repeated string concatenation

kube-state-metrics, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, rabbitmq-cluster-operator, etcd, rabbitmq-cluster-operator, minio, kubernetes-dns-node-cache, rclone, rclone, velero, prometheus-operator, prometheus-mysqld-exporter, rabbitmq-messaging-topology-operator, argo-cd-fips, argo-cd-fips, temporal-server-fips, kube-state-metrics, kubernetes-dns-node-cache, nats-streaming, nats-streaming, thanos, kube-state-metrics, git-lfs-fips, helm-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, prometheus, sealed-secrets, logstash-exporter-fips

"go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp")

go-fips-1.26, argo-workflows, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips

processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input

kube-state-metrics, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, rabbitmq-cluster-operator, minio, prometheus-mysqld-exporter, opentofu-fips, consul, fabric-peer, fabric-peer, fabric-peer, fabric-peer, velero-plugin-for-aws, calico, prometheus, sealed-secrets

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint

kube-state-metrics, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, rabbitmq-cluster-operator, etcd, rabbitmq-cluster-operator, minio, kubernetes-dns-node-cache, rclone, rclone, prometheus-mysqld-exporter, velero, prometheus, prometheus-operator, prometheus-mysqld-exporter, prometheus-mysqld-exporter, elastic-beats, rabbitmq-messaging-topology-operator, argo-cd-fips, argo-cd-fips, temporal-server-fips, kube-state-metrics, prometheus-node-exporter, prometheus-node-exporter, vt-cli, dynatrace-operator, dynatrace-operator, consul, kubernetes-dns-node-cache, nats-streaming, nats-streaming, thanos, calico, kube-state-metrics, ingress-nginx-controller, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, git-lfs-fips, helm-fips, logstash-exporter-fips, prometheus, sealed-secrets

Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)

wazuh-dashboard-dashboards-reporting-fips

wazuh-dashboard-dashboards-reporting-fips

kube-state-metrics, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, opentelemetry-collector-contrib, go-fips-1.26, velero, yunikorn-k8shim, rabbitmq-messaging-topology-operator, temporal-server-fips, vt-cli, thanos, velero-plugin-for-aws, helm, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, sealed-secrets

url

kube-state-metrics, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, rabbitmq-cluster-operator, minio, velero, prometheus-mysqld-exporter, rabbitmq-messaging-topology-operator, argo-cd-fips, temporal-server-fips, vt-cli, opentofu-fips, consul, thanos, velero-plugin-for-aws, calico, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, prometheus, sealed-secrets

Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used

kube-state-metrics, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, rabbitmq-cluster-operator, minio, velero, prometheus-mysqld-exporter, rabbitmq-messaging-topology-operator, argo-cd-fips, temporal-server-fips, vt-cli, opentofu-fips, consul, thanos, velero-plugin-for-aws, calico, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, prometheus, sealed-secrets

tar

stakater-reloader, stakater-reloader, stakater-reloader, stakater-reloader, stakater-reloader, vault, vault, kube-state-metrics, cert-manager, vault, vault, helm, loki, loki, loki, loki, dex, opa-fips, kubernetes-csi-external-snapshotter, etcd, rabbitmq-cluster-operator, bank-vaults, prometheus-operator, prometheus-redis-exporter-fips, prometheus-redis-exporter-fips, etcd, grafana-rollout-operator, cluster-autoscaler-fips, minio, rclone, haproxy-ingress, haproxy-ingress, haproxy-ingress, haproxy-ingress, haproxy-ingress, openbao, velero, prometheus, prometheus, yunikorn-k8shim, renovate, prometheus-mysqld-exporter, prometheus-node-exporter-fips, prometheus-alertmanager, ollama-fips, ollama-fips, temporal-server, temporal-server, argo-cd-fips, argo-rollouts-fips, temporal-server-fips, weaviate-fips, wave, ollama-fips, ollama-fips, ollama-fips, ollama-fips, ollama-fips, ollama-fips, weaviate-fips, cortex, cortex, etcd-fips, kube-state-metrics-fips, ollama-fips, ollama-fips, ollama-fips, ollama-fips, runc, dynatrace-operator, dynatrace-operator, dynatrace-operator, dynatrace-operator, consul, cluster-autoscaler, memcached-exporter, rancher-fleet-agent, helm-operator, kubernetes-dns-node-cache, kumactl, etcd, step-kms-plugin, victoriametrics-operator, thanos, thanos, prometheus, thanos, thanos, dynatrace-operator, dynatrace-operator, fabric-peer, fabric-peer, step-issuer, aws-network-policy-agent, cosign, etcd, traefik, velero-plugin-for-aws, velero-plugin-for-aws, opentelemetry-collector, smarter-device-manager, smarter-device-manager, velero-fips, velero-fips, velero-fips, velero-fips, velero-fips, velero-fips, cadvisor, cadvisor, cosign, ingress-nginx-controller, metallb, helm, kube-state-metrics, logstash-exporter-fips, step-issuer, ingress-nginx-controller, fulcio, grafana-org-operator, argo-cd-fips, argo-cd-fips, git-lfs-fips, helm-fips, wave, kube-vip-fips, sealed-secrets, kube-vip-fips

ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

kube-state-metrics, prometheus, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, rabbitmq-cluster-operator, etcd, rabbitmq-cluster-operator, minio, kubernetes-dns-node-cache, rclone, rclone, velero, prometheus, prometheus-operator, prometheus-mysqld-exporter, prometheus-mysqld-exporter, elastic-beats, rabbitmq-messaging-topology-operator, argo-cd-fips, argo-cd-fips, temporal-server-fips, kube-state-metrics, vt-cli, consul, kubernetes-dns-node-cache, nats-streaming, nats-streaming, thanos, calico, kube-state-metrics, ingress-nginx-controller, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, git-lfs-fips, helm-fips, logstash-exporter-fips, prometheus, sealed-secrets

If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...

kube-state-metrics, helm, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, rabbitmq-cluster-operator, etcd, rabbitmq-cluster-operator, rabbitmq-cluster-operator, atlantis, kubernetes-dns-node-cache, rclone, haproxy-ingress, haproxy-ingress, argo-workflows, prometheus-mysqld-exporter, velero, prometheus, prometheus-mysqld-exporter, prometheus-mysqld-exporter, elastic-beats, rabbitmq-messaging-topology-operator, argo-cd-fips, kube-state-metrics, prometheus-node-exporter, prometheus-node-exporter, prometheus-node-exporter, dynatrace-operator, dynatrace-operator, nats-streaming, nats-streaming, fabric-peer, fabric-peer, fabric-peer, fabric-peer, traefik, velero-fips, velero-plugin-for-aws, velero-plugin-for-aws, velero-plugin-for-aws, velero-fips, velero-fips, metallb, metallb, metallb, calico, kube-state-metrics, logstash-exporter-fips, logstash-exporter-fips, sealed-secrets, git-lfs-fips, helm-fips, prometheus, logstash-exporter-fips, sealed-secrets

(*x509

kube-state-metrics, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, rabbitmq-cluster-operator, minio, velero, prometheus-mysqld-exporter, rabbitmq-messaging-topology-operator, argo-cd-fips, temporal-server-fips, vt-cli, opentofu-fips, consul, thanos, velero-plugin-for-aws, calico, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, prometheus, sealed-secrets

On Linux, if the target of Root

kube-state-metrics, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, rabbitmq-cluster-operator, minio, velero, prometheus-mysqld-exporter, rabbitmq-messaging-topology-operator, argo-cd-fips, temporal-server-fips, vt-cli, opentofu-fips, consul, thanos, velero-plugin-for-aws, calico, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, prometheus, sealed-secrets

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources

kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, minio, velero, prometheus-mysqld-exporter, rabbitmq-messaging-topology-operator, argo-cd-fips, temporal-server-fips, thanos, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, prometheus

compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, ...

kube-state-metrics, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, rabbitmq-cluster-operator, minio, rclone, argo-workflows, velero, prometheus-mysqld-exporter, rabbitmq-messaging-topology-operator, argo-cd-fips, temporal-server-fips, vt-cli, opentofu-fips, consul, thanos, fabric-peer, fabric-peer, velero-plugin-for-aws, calico, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, prometheus, sealed-secrets

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions

kube-state-metrics, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, rabbitmq-cluster-operator, minio, argo-workflows, velero, prometheus-mysqld-exporter, rabbitmq-messaging-topology-operator, argo-cd-fips, temporal-server-fips, vt-cli, opentofu-fips, consul, thanos, velero-plugin-for-aws, calico, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, prometheus, sealed-secrets

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service

kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, rabbitmq-cluster-operator, minio, velero, prometheus-mysqld-exporter, rabbitmq-messaging-topology-operator, argo-cd-fips, temporal-server-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, prometheus, sealed-secrets

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass

kube-state-metrics, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, rabbitmq-cluster-operator, etcd, rabbitmq-cluster-operator, minio, kubernetes-dns-node-cache, rclone, rclone, velero, prometheus, prometheus-operator, prometheus-mysqld-exporter, elastic-beats, rabbitmq-messaging-topology-operator, argo-cd-fips, argo-cd-fips, temporal-server-fips, kube-state-metrics, vt-cli, consul, kubernetes-dns-node-cache, nats-streaming, nats-streaming, thanos, calico, kube-state-metrics, ingress-nginx-controller, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, git-lfs-fips, helm-fips, logstash-exporter-fips, prometheus, sealed-secrets

ReverseProxy can forward queries containing parameters not visible to Rewrite functions

kube-state-metrics, prometheus, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, rabbitmq-cluster-operator, etcd, rabbitmq-cluster-operator, minio, kubernetes-dns-node-cache, rclone, rclone, velero, prometheus, prometheus-operator, prometheus-mysqld-exporter, elastic-beats, rabbitmq-messaging-topology-operator, argo-cd-fips, argo-cd-fips, temporal-server-fips, kube-state-metrics, vt-cli, consul, kubernetes-dns-node-cache, nats-streaming, nats-streaming, thanos, calico, kube-state-metrics, ingress-nginx-controller, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, git-lfs-fips, helm-fips, logstash-exporter-fips, prometheus, sealed-secrets

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

epiphany: TLS certificate warning bypass via race in tlsErrorPage message handler

kube-state-metrics, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, rabbitmq-cluster-operator, etcd, rabbitmq-cluster-operator, minio, kubernetes-dns-node-cache, rclone, rclone, argo-workflows, prometheus-mysqld-exporter, velero, prometheus, prometheus-operator, prometheus-mysqld-exporter, elastic-beats, rabbitmq-messaging-topology-operator, argo-cd-fips, argo-cd-fips, temporal-server-fips, kube-state-metrics, prometheus-node-exporter, prometheus-node-exporter, prometheus-node-exporter, vt-cli, dynatrace-operator, dynatrace-operator, consul, kubernetes-dns-node-cache, nats-streaming, nats-streaming, thanos, fabric-peer, fabric-peer, calico, kube-state-metrics, ingress-nginx-controller, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, git-lfs-fips, helm-fips, logstash-exporter-fips, prometheus, sealed-secrets

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322

kube-state-metrics, prometheus, helm, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, rabbitmq-cluster-operator, etcd, rabbitmq-cluster-operator, rabbitmq-cluster-operator, atlantis, kubernetes-dns-node-cache, rclone, haproxy-ingress, haproxy-ingress, prometheus-mysqld-exporter, velero, prometheus, prometheus-mysqld-exporter, prometheus-mysqld-exporter, elastic-beats, rabbitmq-messaging-topology-operator, argo-cd-fips, temporal-server-fips, kube-state-metrics, prometheus-node-exporter, prometheus-node-exporter, prometheus-node-exporter, dynatrace-operator, dynatrace-operator, nats-streaming, nats-streaming, fabric-peer, fabric-peer, fabric-peer, fabric-peer, traefik, velero-fips, velero-fips, velero-plugin-for-aws, velero-plugin-for-aws, velero-plugin-for-aws, velero-fips, metallb, metallb, metallb, calico, kube-state-metrics, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, sealed-secrets, git-lfs-fips, helm-fips, prometheus, logstash-exporter-fips, sealed-secrets

When returning errors, functions in the net/textproto package would include its input as part of the error

kube-state-metrics, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, bank-vaults, rabbitmq-cluster-operator, etcd, rabbitmq-cluster-operator, rabbitmq-cluster-operator, cluster-autoscaler-fips, minio, kubernetes-dns-node-cache, kubernetes-dns-node-cache, rclone, rclone, haproxy-ingress, haproxy-ingress, haproxy-ingress, argo-workflows, prometheus-mysqld-exporter, velero, prometheus, prometheus, prometheus-operator, prometheus-mysqld-exporter, prometheus-mysqld-exporter, elastic-beats, rabbitmq-messaging-topology-operator, argo-cd-fips, argo-cd-fips, temporal-server-fips, kube-state-metrics, prometheus-node-exporter, ollama-fips, ollama-fips, ollama-fips, ollama-fips, ollama-fips, ollama-fips, prometheus-node-exporter, vt-cli, cortex, cortex, ollama-fips, ollama-fips, ollama-fips, ollama-fips, consul, dynatrace-operator, dynatrace-operator, dynatrace-operator, dynatrace-operator, rancher-fleet-agent, kubernetes-dns-node-cache, kubernetes-dns-node-cache, kumactl, nats-streaming, nats-streaming, step-kms-plugin, thanos, prometheus, thanos, dynatrace-operator, dynatrace-operator, fabric-peer, fabric-peer, fabric-peer, fabric-peer, aws-network-policy-agent, smarter-device-manager, smarter-device-manager, metallb, calico, kube-state-metrics, fulcio, ingress-nginx-controller, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, git-lfs-fips, helm-fips, logstash-exporter-fips, prometheus, sealed-secrets, wave

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, minio, argo-workflows, velero, prometheus-mysqld-exporter, rabbitmq-messaging-topology-operator, argo-cd-fips, temporal-server-fips, thanos, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, prometheus

Arithmetic over induction variables in loops were not correctly checked for underflow or overflow

kube-state-metrics, go-fips-1.26, opentelemetry-collector-contrib, go-fips-1.26, go-fips-1.26, argo-workflows, argo-workflows, velero, victoriametrics-cluster, temporal-server-fips, vt-cli, go1.25, velero-plugin-for-aws, helm, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succ...

kube-vip-fips, kube-vip-fips, kube-vip-fips, kube-vip-fips, kube-vip-fips

Security fix for GO-2026-6237 applied in: kube-vip-fips 1.2.3-r0, kube-vip-fips 0.9.2-r1, kube-vip-fips 1.1.2-r1, kube-vip-fips 1.2.1-r1, kube-vip-fips 1.0.4-r1

kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, etcd, atlantis, rclone, velero, prometheus, argo-cd-fips, temporal-server-fips, traefik, velero-fips, velero-fips, velero-plugin-for-aws, velero-plugin-for-aws, velero-fips, metallb, metallb, metallb, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, git-lfs-fips, helm-fips, logstash-exporter-fips

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

grafana, grafana, prometheus, opentofu, cortex, cortex, cortex, terraform, thanos, thanos, traefik, prometheus

OpenTelemetry-Go is the Go implementation of OpenTelemetry

kube-state-metrics, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, rabbitmq-cluster-operator, etcd, rabbitmq-cluster-operator, minio, kubernetes-dns-node-cache, rclone, rclone, argo-workflows, velero, prometheus, prometheus-operator, prometheus-mysqld-exporter, elastic-beats, rabbitmq-messaging-topology-operator, argo-cd-fips, argo-cd-fips, temporal-server-fips, kube-state-metrics, vt-cli, consul, kubernetes-dns-node-cache, nats-streaming, nats-streaming, thanos, calico, kube-state-metrics, ingress-nginx-controller, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, git-lfs-fips, helm-fips, logstash-exporter-fips, prometheus, sealed-secrets

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations

grafana, cortex, cortex, terraform, thanos, traefik, prometheus

Security fix for GHSA-w8rr-5gcm-pp58 applied in: grafana 13.0.0-r0, cortex 1.21.1-r2, cortex 1.21.1-r3, terraform 1.15.1-r0, thanos 0.41.0-r0, traefik 3.6.11-r1, prometheus 3.10.0-r1

kube-state-metrics, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, kubernetes-csi-external-snapshotter, rabbitmq-cluster-operator, etcd, rabbitmq-cluster-operator, minio, kubernetes-dns-node-cache, rclone, rclone, argo-workflows, velero, prometheus, prometheus-operator, prometheus-mysqld-exporter, elastic-beats, rabbitmq-messaging-topology-operator, argo-cd-fips, argo-cd-fips, kube-state-metrics, vt-cli, consul, kubernetes-dns-node-cache, nats-streaming, nats-streaming, thanos, calico, kube-state-metrics, ingress-nginx-controller, logstash-exporter-fips, logstash-exporter-fips, logstash-exporter-fips, git-lfs-fips, helm-fips, prometheus, sealed-secrets, logstash-exporter-fips

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash