Open Source Vulnerabilities

sonarqube

Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature

rustup, rustup

Security fix for GHSA-3pv8-6f4r-ffg2 applied in: rustup 1.28.2-r0

sonarqube

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130)

sonarqube

Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153)

undici, @rootio/undici

CVE-2026-14643 in undici - Patched by Root

sonarqube

flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier

external-dns, trust-manager, trust-manager, trust-manager, trust-manager, external-dns, stakater-reloader, vault, vault, stakater-reloader, stakater-reloader

malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

sonarqube

flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input

Apache Fineract: SQL injection vulnerability in Search API

external-dns, trust-manager, trust-manager, trust-manager, trust-manager, external-dns, stakater-reloader, vault, vault, stakater-reloader, stakater-reloader

HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

sonarqube

flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input

external-dns, trust-manager, trust-manager, trust-manager, trust-manager, external-dns, stakater-reloader, vault, vault, stakater-reloader, stakater-reloader

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

sonarqube

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

external-dns, trust-manager, trust-manager, trust-manager, trust-manager, external-dns, stakater-reloader, vault, vault, stakater-reloader, stakater-reloader

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

imagemagick

sonarqube

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

imagemagick

sonarqube

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130)

external-dns, trust-manager, trust-manager, trust-manager, trust-manager, external-dns, stakater-reloader, vault, vault, stakater-reloader, stakater-reloader

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

io.projectreactor.netty:reactor-netty, io.projectreactor.netty:reactor-netty-core, io.projectreactor.netty:reactor-netty-http, io.projectreactor.netty:reactor-netty-http-brave

TuxCare security update for io.projectreactor.netty (8 CVEs)

sonarqube

flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www

external-dns, external-dns, stakater-reloader, stakater-reloader

trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped

sonarqube

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

external-dns, stakater-reloader, stakater-reloader

When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression

sonarqube

native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, with...

sonarqube

Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122)

external-dns, stakater-reloader, stakater-reloader

On Windows, when the target of Root

sonarqube

Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586)

external-dns, stakater-reloader, stakater-reloader

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes

sonarqube

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

external-dns, stakater-reloader, stakater-reloader

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the conne...

external-dns, stakater-reloader, stakater-reloader

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specify...

sonarqube

JLine is a Java library for handling console input

external-dns, stakater-reloader, stakater-reloader

When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU

sonarqube

UTF8DataInputJsonParser

external-dns, stakater-reloader, stakater-reloader

When http

Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints

sonarqube

yawkat LZ4 Java provides LZ4 compression for Java

vault, vault

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings

sonarqube

yawkat LZ4 Java provides LZ4 compression for Java

gcc-13, gcc-13, gcc-14, gcc-14, gcc-15, gcc-16

gcc-11, gcc-12, gcc-12, gcc-12, gcc-13, gcc-13, gcc-14, gcc-14, gcc-15, gcc-16

gcc-11, gcc-12, gcc-12, gcc-12, gcc-13, gcc-13, gcc-14, gcc-14, gcc-15, gcc-16

gcc

CVE-2026-114691 affecting package gcc 13.2.0-7

gcc

CVE-2026-114690 affecting package gcc 13.2.0-7

gcc

CVE-2026-115455 affecting package gcc 13.2.0-7

vault, vault

Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node

gcc-3.3, gcc-4.7, gcc-4.8, gcc-defaults, gcc-mingw-w64, gccgo-4.9, gcc-5, gcc-5-cross, gcc-defaults, gccgo-6, gcc-3.3, gcc-4.7, gcc-4.7-armel-cross, gcc-4.7-armhf-cross, gcc-4.8, gcc-4.8-arm64-cross, gcc-4.8-armhf-cross, gcc-4.8-powerpc-cross, gcc-4.8-ppc64el-cross, gcc-4.9, gcc-4.9-cross, gcc-5-cross-ports, gcc-arm-linux-androideabi, gcc-arm-none-eabi, gcc-avr, gcc-h8300-hms, gcc-i686-linux-android, gcc-m68hc1x, gcc-mingw-w64, gcc-msp430, gcc-snapshot, gcc-7, gcc-7-cross, gcc-8, gcc-8-cross, gcc-defaults, gcc-3.3, gcc-4.8, gcc-5, gcc-5-cross, gcc-5-cross-ports, gcc-6, gcc-6-cross, gcc-6-cross-ports, gcc-7-cross-ports, gcc-8-cross-ports, gcc-arm-none-eabi, gcc-avr, gcc-h8300-hms, gcc-m68hc1x, gcc-mingw-w64, gcc-msp430, gcc-snapshot, gcc-10, gcc-10-cross, gcc-9, gcc-9-cross, gcc-defaults, gcc-10-cross-mipsen, gcc-10-cross-ports, gcc-3.3, gcc-7, gcc-8, gcc-8-cross, gcc-8-cross-ports, gcc-9-cross-mipsen, gcc-9-cross-ports, gcc-arm-none-eabi, gcc-avr, gcc-h8300-hms, gcc-m68hc1x, gcc-mingw-w64, gcc-msp430, gcc-riscv64-unknown-elf, gcc-snapshot, gcc-xtensa-lx106, gcc-10, gcc-10-cross, gcc-10-cross-mipsen, gcc-10-cross-ports, gcc-11, gcc-11-cross, gcc-11-cross-ports, gcc-12, gcc-12-cross, gcc-12-cross-ports, gcc-3.3, gcc-9, gcc-9-cross, gcc-9-cross-mipsen, gcc-9-cross-ports, gcc-arm-none-eabi, gcc-avr, gcc-defaults, gcc-h8300-hms, gcc-m68hc1x, gcc-mingw-w64, gcc-msp430, gcc-or1k-elf, gcc-riscv64-unknown-elf, gcc-snapshot, gcc-xtensa-lx106, gcc-10, gcc-10-cross, gcc-10-cross-mipsen, gcc-10-cross-ports, gcc-11, gcc-11-cross, gcc-11-cross-mipsen, gcc-11-cross-ports, gcc-12, gcc-12-cross, gcc-12-cross-mipsen, gcc-12-cross-ports, gcc-13, gcc-13-cross, gcc-13-cross-ports, gcc-3.3, gcc-9, gcc-9-cross, gcc-9-cross-mipsen, gcc-9-cross-ports, gcc-arm-none-eabi, gcc-avr, gcc-defaults, gcc-h8300-hms, gcc-mingw-w64, gcc-or1k-elf, gcc-riscv64-unknown-elf, gcc-snapshot, gcc-11, gcc-11-cross, gcc-11-cross-ports, gcc-12, gcc-12-cross, gcc-12-cross-ports, gcc-13, gcc-13-cross, gcc-13-cross-ports, gcc-arm-none-eabi, gcc-avr, gcc-defaults, gcc-h8300-hms, gcc-mingw-w64, gcc-or1k-elf, gcc-riscv64-unknown-elf, gcc-snapshot, gcc-11, gcc-11-cross, gcc-11-cross-ports, gcc-12, gcc-12-cross, gcc-12-cross-ports, gcc-13, gcc-13-cross, gcc-13-cross-ports, gcc-arm-none-eabi, gcc-avr, gcc-defaults, gcc-h8300-hms, gcc-mingw-w64, gcc-or1k-elf, gcc-riscv64-unknown-elf, gcc-snapshot

gcc-3.3, gcc-4.7, gcc-4.8, gcc-defaults, gcc-mingw-w64, gccgo-4.9, gcc-5, gcc-5-cross, gcc-defaults, gccgo-6, gcc-3.3, gcc-4.7, gcc-4.7-armel-cross, gcc-4.7-armhf-cross, gcc-4.8, gcc-4.8-arm64-cross, gcc-4.8-armhf-cross, gcc-4.8-powerpc-cross, gcc-4.8-ppc64el-cross, gcc-4.9, gcc-4.9-cross, gcc-5-cross-ports, gcc-arm-linux-androideabi, gcc-arm-none-eabi, gcc-avr, gcc-h8300-hms, gcc-i686-linux-android, gcc-m68hc1x, gcc-mingw-w64, gcc-msp430, gcc-snapshot, gcc-7, gcc-7-cross, gcc-8, gcc-8-cross, gcc-defaults, gcc-3.3, gcc-4.8, gcc-5, gcc-5-cross, gcc-5-cross-ports, gcc-6, gcc-6-cross, gcc-6-cross-ports, gcc-7-cross-ports, gcc-8-cross-ports, gcc-arm-none-eabi, gcc-avr, gcc-h8300-hms, gcc-m68hc1x, gcc-mingw-w64, gcc-msp430, gcc-snapshot, gcc-10, gcc-10-cross, gcc-9, gcc-9-cross, gcc-defaults, gcc-10-cross-mipsen, gcc-10-cross-ports, gcc-3.3, gcc-7, gcc-8, gcc-8-cross, gcc-8-cross-ports, gcc-9-cross-mipsen, gcc-9-cross-ports, gcc-arm-none-eabi, gcc-avr, gcc-h8300-hms, gcc-m68hc1x, gcc-mingw-w64, gcc-msp430, gcc-riscv64-unknown-elf, gcc-snapshot, gcc-xtensa-lx106, gcc-10, gcc-10-cross, gcc-10-cross-mipsen, gcc-10-cross-ports, gcc-11, gcc-11-cross, gcc-11-cross-ports, gcc-12, gcc-12-cross, gcc-12-cross-ports, gcc-3.3, gcc-9, gcc-9-cross, gcc-9-cross-mipsen, gcc-9-cross-ports, gcc-arm-none-eabi, gcc-avr, gcc-defaults, gcc-h8300-hms, gcc-m68hc1x, gcc-mingw-w64, gcc-msp430, gcc-or1k-elf, gcc-riscv64-unknown-elf, gcc-snapshot, gcc-xtensa-lx106, gcc-10, gcc-10-cross, gcc-10-cross-mipsen, gcc-10-cross-ports, gcc-11, gcc-11-cross, gcc-11-cross-mipsen, gcc-11-cross-ports, gcc-12, gcc-12-cross, gcc-12-cross-mipsen, gcc-12-cross-ports, gcc-13, gcc-13-cross, gcc-13-cross-ports, gcc-3.3, gcc-9, gcc-9-cross, gcc-9-cross-mipsen, gcc-9-cross-ports, gcc-arm-none-eabi, gcc-avr, gcc-defaults, gcc-h8300-hms, gcc-mingw-w64, gcc-or1k-elf, gcc-riscv64-unknown-elf, gcc-snapshot, gcc-11, gcc-11-cross, gcc-11-cross-ports, gcc-12, gcc-12-cross, gcc-12-cross-ports, gcc-13, gcc-13-cross, gcc-13-cross-ports, gcc-arm-none-eabi, gcc-avr, gcc-defaults, gcc-h8300-hms, gcc-mingw-w64, gcc-or1k-elf, gcc-riscv64-unknown-elf, gcc-snapshot, gcc-11, gcc-11-cross, gcc-11-cross-ports, gcc-12, gcc-12-cross, gcc-12-cross-ports, gcc-13, gcc-13-cross, gcc-13-cross-ports, gcc-arm-none-eabi, gcc-avr, gcc-defaults, gcc-h8300-hms, gcc-mingw-w64, gcc-or1k-elf, gcc-riscv64-unknown-elf, gcc-snapshot

gcc-3.3, gcc-4.7, gcc-4.8, gcc-defaults, gcc-mingw-w64, gccgo-4.9, gcc-5, gcc-5-cross, gcc-defaults, gccgo-6, gcc-3.3, gcc-4.7, gcc-4.7-armel-cross, gcc-4.7-armhf-cross, gcc-4.8, gcc-4.8-arm64-cross, gcc-4.8-armhf-cross, gcc-4.8-powerpc-cross, gcc-4.8-ppc64el-cross, gcc-4.9, gcc-4.9-cross, gcc-5-cross-ports, gcc-arm-linux-androideabi, gcc-arm-none-eabi, gcc-avr, gcc-h8300-hms, gcc-i686-linux-android, gcc-m68hc1x, gcc-mingw-w64, gcc-msp430, gcc-snapshot, gcc-7, gcc-7-cross, gcc-8, gcc-8-cross, gcc-defaults, gcc-3.3, gcc-4.8, gcc-5, gcc-5-cross, gcc-5-cross-ports, gcc-6, gcc-6-cross, gcc-6-cross-ports, gcc-7-cross-ports, gcc-8-cross-ports, gcc-arm-none-eabi, gcc-avr, gcc-h8300-hms, gcc-m68hc1x, gcc-mingw-w64, gcc-msp430, gcc-snapshot, gcc-10, gcc-10-cross, gcc-9, gcc-9-cross, gcc-defaults, gcc-10-cross-mipsen, gcc-10-cross-ports, gcc-3.3, gcc-7, gcc-8, gcc-8-cross, gcc-8-cross-ports, gcc-9-cross-mipsen, gcc-9-cross-ports, gcc-arm-none-eabi, gcc-avr, gcc-h8300-hms, gcc-m68hc1x, gcc-mingw-w64, gcc-msp430, gcc-riscv64-unknown-elf, gcc-snapshot, gcc-xtensa-lx106, gcc-10, gcc-10-cross, gcc-10-cross-mipsen, gcc-10-cross-ports, gcc-11, gcc-11-cross, gcc-11-cross-ports, gcc-12, gcc-12-cross, gcc-12-cross-ports, gcc-3.3, gcc-9, gcc-9-cross, gcc-9-cross-mipsen, gcc-9-cross-ports, gcc-arm-none-eabi, gcc-avr, gcc-defaults, gcc-h8300-hms, gcc-m68hc1x, gcc-mingw-w64, gcc-msp430, gcc-or1k-elf, gcc-riscv64-unknown-elf, gcc-snapshot, gcc-xtensa-lx106, gcc-10, gcc-10-cross, gcc-10-cross-mipsen, gcc-10-cross-ports, gcc-11, gcc-11-cross, gcc-11-cross-mipsen, gcc-11-cross-ports, gcc-12, gcc-12-cross, gcc-12-cross-mipsen, gcc-12-cross-ports, gcc-13, gcc-13-cross, gcc-13-cross-ports, gcc-3.3, gcc-9, gcc-9-cross, gcc-9-cross-mipsen, gcc-9-cross-ports, gcc-arm-none-eabi, gcc-avr, gcc-defaults, gcc-h8300-hms, gcc-mingw-w64, gcc-or1k-elf, gcc-riscv64-unknown-elf, gcc-snapshot, gcc-11, gcc-11-cross, gcc-11-cross-ports, gcc-12, gcc-12-cross, gcc-12-cross-ports, gcc-13, gcc-13-cross, gcc-13-cross-ports, gcc-arm-none-eabi, gcc-avr, gcc-defaults, gcc-h8300-hms, gcc-mingw-w64, gcc-or1k-elf, gcc-riscv64-unknown-elf, gcc-snapshot, gcc-11, gcc-11-cross, gcc-11-cross-ports, gcc-12, gcc-12-cross, gcc-12-cross-ports, gcc-13, gcc-13-cross, gcc-13-cross-ports, gcc-arm-none-eabi, gcc-avr, gcc-defaults, gcc-h8300-hms, gcc-mingw-w64, gcc-or1k-elf, gcc-riscv64-unknown-elf, gcc-snapshot