GHSA-JV3W-X3R3-G6RM vulnerabilities

Vulnerabilities for packages: nerdctl-fips, amazon-k8s-cni-fips, calico-fips, flannel, multus-cni-fips, datadog-agent, calico, azure-ipam, k3s, rootlesskit, multus-cni, containerd-fips, rke2-runtime, datadog-agent-fips, flannel-fips, podman, containerd, buildah, nerdctl, istio-fips, buildkitd-fip...

CVE-2025-67499

The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container. Versions 1.6.0 through 1.8.0 inadvertently forward all traffic with the same destination port as the host port when the portmap plugin is configured with the nftables backend, thus...

Amazon Linux 2023 : cni-plugins (ALAS2023-2025-1287)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1287 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6 addresses to be included in square brackets within the host component of a URL...

Amazon Linux 2 : cni-plugins, --advisory ALAS2-2025-3078 (ALAS-2025-3078)

The version of cni-plugins installed on the remote host is prior to 1.7.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3078 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: aws-load-balancer-controller, kubescape, kube-logging-operator, ko, kubelet-csr-approver, metrics-agent, rancher-machine, sftpgo-plugin-kms, mockery, stakater-reloader, kube-fluentd-operator, aws-flb-cloudwatch, kubeflow, incert, secrets-store-csi-driver-provider-gcp...

AZL-71563 CVE-2025-65637 affecting package cni-plugins for versions less than 1.3.0-10

A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving...

AZL-71510 CVE-2025-65637 affecting package cni-plugins for versions less than 1.4.0-4

A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving...

EUVD-2018-11892

Malware in sbrugna...

EUVD-2019-19300

Malware in sbrugna...

CVE-2024-45338 affecting package cni for versions less than 1.0.1-20

CVE-2024-45338 affecting package cni for versions less than 1.0.1-20. A patched version of the package is available...

CVE-2022-32149 affecting package cni for versions less than 1.0.1-20

CVE-2022-32149 affecting package cni for versions less than 1.0.1-20. A patched version of the package is available...

EUVD-2022-1255

Malicious code in bioql PyPI...

Amazon Linux 2023 : cni-plugins (ALAS2023-2025-1143)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1143 advisory. Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which a...

Medium: cni-plugins

Issue Overview: Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon. CVE-2025-22874 Proxy-Authorization and Proxy-Authenticate headers...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: external-dns-fips, argo-cd-fips, kubeflow, cloud-provider-aws-fips, xeol-fips, zot, fuse-overlayfs-snapshotter, nfs-subdir-external-provisioner, kepler, aws-node-termination-handler, direnv, guac, pgpool2exporter-fips, conjur-cli, pgpool2exporter, kpt, fulcio, cerbos...

Important: cni-plugins

Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...

Important: cni-plugins

Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...

Amazon Linux 2 : cni-plugins (ALAS-2025-2882)

The version of cni-plugins installed on the remote host is prior to 1.7.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2882 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare...

Important: cni-plugins

Issue Overview: The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. CVE-2024-24790 The net/http package accepted data in the chunked transfer encoding...

Important: cni-plugins

Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...