CLEANSTART-2026-XN15507 During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions

🗓️ 30 Apr 2026 00:51:56Reported by GoogleType

osv🔗 osv.dev👁 12 Views

Unbounded work in chain building with intermediates in VerifyOptions affects opentofu-fips security.

Reporter	Title	Published	Views	Family All 18492
OSV	CLEANSTART-2026-AC04649 Security fixes in argo-workflows-fips 3.7.10-r1	30 Jul 202607:10	–	osv
OSV	CLEANSTART-2026-AC52683 Security fixes in istio 1.28.5-r1	30 Jul 202607:10	–	osv
OSV	CLEANSTART-2026-AC65885 Security fixes for CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-61732, CVE-2025-68119, CVE-2025-68121, CVE-2026-25518, CVE-2026-25679, CVE-2026-26958, CVE-2026-27139, CVE-2026-27142, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x applied in versions: 1.18.0-r0, 1.18.0-r1, 1.18.0-r2, 1.18.0-r3	1 Apr 202609:13	–	osv
OSV	CLEANSTART-2026-AC75649 Security fixes in velero-plugin-for-gcp-fips 1.13.2-r2	30 Jul 202607:10	–	osv
OSV	CLEANSTART-2026-AC87637 Security fixes in eks-distro-kube-proxy-fips 1.35.7-r1	30 Jul 202607:10	–	osv
OSV	CLEANSTART-2026-AD01239 Security fixes in argo-cd-fips 3.2.5-r0	30 Jul 202607:10	–	osv
OSV	CLEANSTART-2026-AD15516 Security fixes in prometheus-redis-exporter-fips 1.77.0-r0	30 Jul 202607:10	–	osv
OSV	CLEANSTART-2026-AD41794 SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process	30 Jan 202615:47	–	osv
OSV	CLEANSTART-2026-AD69953 Security fixes in argo-cd-fips 3.1.14-r0	30 Jul 202607:10	–	osv
OSV	CLEANSTART-2026-AD71344 Security fixes for CVE-2024-10005, CVE-2024-10006, CVE-2025-47913, CVE-2025-47914, CVE-2025-58181, CVE-2025-61727, CVE-2025-61729, CVE-2026-1229, CVE-2026-24051, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, ghsa-2464-8j7c-4cjm, ghsa-2x5j-vhc8-9cwm, ghsa-6v2p-p543-phr9, ghsa-c6gw-w398-hv78, ghsa-fv92-fjc5-jj9h, ghsa-hcg3-q754-cr77, ghsa-jc7w-c686-c4v9, ghsa-mh63-6h87-95cp, ghsa-p77j-4mvh-x3m3, ghsa-qxp5-gwg8-xv66, ghsa-vvgc-356p-c3xw, ghsa-wjrx-6529-hcj3 applied in versions: 1.10.7-r0, 1.10.7-r1, 1.10.9-r0, 1.10.9-r1, 1.10.9-r2, 1.10.9-r3, 1.9.4-r0	1 Apr 202609:38	–	osv

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-XN15507.json
osv	www.osv.dev/vulnerability/CVE-2020-8912
osv	www.osv.dev/vulnerability/CVE-2025-47913
osv	www.osv.dev/vulnerability/CVE-2025-47914
osv	www.osv.dev/vulnerability/CVE-2025-58181
osv	www.osv.dev/vulnerability/CVE-2025-61727
osv	www.osv.dev/vulnerability/CVE-2025-61729
osv	www.osv.dev/vulnerability/CVE-2026-1229
osv	www.osv.dev/vulnerability/CVE-2026-24051
osv	www.osv.dev/vulnerability/CVE-2026-25679

23 Jun 2026 05:15Current

7.1High risk

Vulners AI Score7.1

CVSS 3.19.8

EPSS0.01557

chain building vulnerability intermediate certificates verify options opentofu fips vulnerabilities