PT-2026-77302

An issue was discovered in openHiTLS 0.2.0 through 0.3.2. In the X.509 certificate chain verification, the basic constraints extension and CA flag processing of intermediate CAs are only verified for v3 certificates, and v1/v2 certificates are ignored...

EUVD-2026-61278

An issue was discovered in openHiTLS 0.2.0 through 0.3.2. In the X.509 certificate chain verification, the basic constraints extension and CA flag processing of intermediate CAs are only verified for v3 certificates, and v1/v2 certificates are ignored...

CVE-2026-57826

An issue was discovered in openHiTLS 0.2.0 through 0.3.2. In the X.509 certificate chain verification, the basic constraints extension and CA flag processing of intermediate CAs are only verified for v3 certificates, and v1/v2 certificates are ignored...

BIT-CONSUL-2026-19015 Uncontrolled resource consumption in the Consul Connect CA roots endpoint

Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable...

PT-2026-73386

When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local...

Fabric CA Developer's Guide: LDAP Injection via Unescaped Username in GetUser Filter

When fabric-ca is configured with an LDAP backend, the username from HTTP Basic authentication is included in an LDAP uid search filter without proper escaping. An unauthenticated attacker with network access to the CA enrollment endpoint could exploit this to perform LDAP injection before passwo...

GHSA-XGHW-P77P-3R7X Fabric CA Developer's Guide: LDAP Injection via Unescaped Username in GetUser Filter

When fabric-ca is configured with an LDAP backend, the username from HTTP Basic authentication is included in an LDAP uid search filter without proper escaping. An unauthenticated attacker with network access to the CA enrollment endpoint could exploit this to perform LDAP injection before passwo...

GO-2025-3770 vulnerabilities

Vulnerabilities for packages: rclone, gitness, tkn-fips, caddy, cloudflared, dapr-fips, karma, tkn, step, step-ca-fips, step-issuer-fips, buf, dapr, kyverno-policy-reporter-ui-fips, gogatekeeper, kyverno-policy-reporter-ui, caddy-fips, sftpgo, telegraf, step-ca, rclone-fips, step-fips, step-issue...

GO-2026-4458 vulnerabilities

Vulnerabilities for packages: step, step-ca, step-ca-fips, caddy, step-issuer-fips, caddy-fips, step-fips, step-issuer...

GO-2025-4068 vulnerabilities

Vulnerabilities for packages: step, step-ca, step-ca-fips, caddy, step-issuer-fips, caddy-fips, step-fips, step-issuer...

GO-2026-4775 vulnerabilities

Vulnerabilities for packages: frankenphp-8.5, frankenphp-8.4, step-ca-fips, caddy, step-issuer-fips, caddy-fips, frankenphp-8.2, frankenphp-8.3...

GO-2024-2605 vulnerabilities

Vulnerabilities for packages: trillian, kots, step, trillian-fips, step-ca, argo-workflows-fips, wavefront-collector-for-kubernetes, argo-workflows, caddy, caddy-fips...

GO-2025-3372 vulnerabilities

Vulnerabilities for packages: google-osconfig-agent, pulumi-language-java, sigstore-scaffolding-fips, dgraph, pulumi, grafana-mimir, sriov-network-device-plugin, amass, skaffold, caddy, nfs-subdir-external-provisioner-fips, opa-envoy, flux-image-reflector-controller, spark-operator-fips,...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: cloudnative-pg, melange, minio, pulumi-language-dotnet, conftest, grpc-health-probe, gomplate, sigstore-scaffolding, step, guac, trivy, dex, dagger, kargo, osv-scanner, spire-server, spicedb, k8sgpt, ferretdb, ksops, restic, opentelemetry-collector, cert-manager-cmct...

GO-2025-4068 vulnerabilities

Vulnerabilities for packages: step, caddy, step-issuer, step-ca...

GO-2026-4458 vulnerabilities

Vulnerabilities for packages: step, caddy, step-issuer, step-ca...

GO-2025-3770 vulnerabilities

Vulnerabilities for packages: gitness, kyverno-policy-reporter-ui, karma, gogatekeeper, step-ca, step, step-issuer, tkn, caddy, sftpgo, cloudflared, buf, rclone...

GO-2024-2605 vulnerabilities

Vulnerabilities for packages: kots, trillian, step-ca, argo-workflows, step, caddy...

GO-2024-2606 vulnerabilities

Vulnerabilities for packages: kots, amass, kine, temporal-server, ferretdb, trillian, kube-bench, step-ca, argo-workflows, step, k3s, caddy, src, spicedb...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: sqlpad, wal-g, argo-workflows, nuclei, sigstore-scaffolding, step, guac, secrets-store-csi-driver-provider-azure, trivy, spire-server, argo-events, prometheus-operator, hugo, rclone, tekton-chains, buildkitd, flux-source-controller, k8sgpt, timestamp-authority,...