Open Source Vulnerabilities

argo-workflows, argo-workflows, go

net/http HTTP/1

argo-workflows, argo-workflows, go

various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms

argo-workflows

attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames

openbao

Moby is an open source container framework

openbao

Security fix for GHSA-x744-4wpc-v9h2 applied in: openbao 2.5.4-r1

python-urllib3_1, python-urllib3_1, python-urllib3_1

Security update for python-urllib3_1

expat, rootio-expat

CVE-2026-113351 in expat - Patched by Root

expat, rootio-expat

CVE-2026-115506 in expat - Patched by Root

flux-2.10, flux-2.10

flux-2.10, flux-2.10

flux-2.10, flux-2.10

nats-server

NATS

aws-cli

libexpat before 2

aws-cli

In libexpat before 2

harbor-fips

Moby is an open source container framework developed by Docker Inc

harbor-fips

beego is an open-source web framework for the Go programming language

harbor-fips

Beego is an open-source web framework for the Go programming language

rclone

Parsing a malicious font file can cause excessive memory allocation

rclone

Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image

rclone

TIFF decoder does not place a limit on the size of PackBits-compressed data

dompurify

TuxCare security update for dompurify (1 CVE)

rclone, rclone, rclone

Billy is an interface filesystem abstraction for Go

rclone, rclone, rclone

Billy is an interface filesystem abstraction for Go

rclone, rclone

Parsing a WEBP image with an invalid, large size panics on 32-bit platforms

rclone, rclone, rclone, rclone

Security fix for GO-2026-5051 applied in: rclone 1.74.3-r2, rclone 1.71.2-r3, rclone 1.73.5-r5, rclone 1.72.1-r11

kubernetes-dns-node-cache

security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion

rclone

maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error

gitea, gitea, rclone

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

io.netty:netty-codec, io.netty:netty-codec-dns, io.netty:netty-codec-haproxy, io.netty:netty-codec-http, io.netty:netty-codec-http2, io.netty:netty-codec-mqtt, io.netty:netty-codec-redis, io.netty:netty-handler, io.netty:netty-handler-proxy, io.netty:netty-resolver-dns, io.netty:netty-transport-native-epoll, io.netty:netty-transport-native-kqueue, io.netty:netty-transport-sctp

TuxCare security update for io.netty (24 CVEs)

minio

Security fix for GHSA-32fw-gq77-f2f2 applied in: minio 0.20250907.161309-r0

minio

In Eclipse Paho Go MQTT v3

minio, minio

Security fix for GHSA-6g7g-w4f8-9c9x applied in: minio 0.20250907.161309-r0, minio 0.20250907.161309-r1

minio

Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0

apache-hive

AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses

apache-hive

Netty is a network application framework for development of protocol servers and clients

apache-hive

vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker t...

apache-hive

Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded...

apache-hive

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS)

apache-hive

Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the follo...

apache-hive

Schema parsing in the parquet-avro module of Apache Parquet 1

apache-hive

Schema parsing in the parquet-avro module of Apache Parquet 1

apache-hive

Schema parsing in the Java SDK of Apache Avro 1

dompurify

TuxCare security update for dompurify (1 CVE)

apache-hive

Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java

apache-hive

Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via `httpclient_impl` connection property; however, the driver does not verify if the class implements...

minio

Security fix for GHSA-wf45-q9ch-q8gh applied in: minio 0.20250907.161309-r3

apache-hive

Apache HttpClient versions prior to version 4

apache-hive

Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network

apache-hive

Uncontrolled Resource Consumption vulnerability in Apache Commons IO

grafana

In Grafana 2