Amazon Linux 2023 : cni-plugins (ALAS2023-2026-1373)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1373 advisory. net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP archives CVE-2025-61728 crypto/tls: handshake messages may be processe...

CLEANSTART-2026-EW68942 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the multus-cni-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

CLEANSTART-2026-DD39330 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the multus-cni-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.6.12

Red Hat OpenShift Service Mesh 2.6.12 This update has a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Red Hat OpenShift Service Mesh...

CVE-2022-31045 vulnerabilities

Vulnerabilities for packages: istio-pilot-agent, istio-operator, istio-pilot-discovery, istio-cni...

CVE-2022-23635 vulnerabilities

Vulnerabilities for packages: istio-pilot-agent, istio-operator, istio-pilot-discovery, istio-cni...

CVE-2021-39155 vulnerabilities

Vulnerabilities for packages: istio-pilot-agent, istio-operator, istio-pilot-discovery, istio-cni...

GHSA-QCVW-82HH-GQ38 vulnerabilities

Vulnerabilities for packages: istio-pilot-agent, istio-operator, istio-pilot-discovery, istio-cni...

GHSA-7774-7VR3-CC8J vulnerabilities

Vulnerabilities for packages: istio-pilot-agent, istio-operator, istio-pilot-discovery, istio-cni...

CVE-2021-39156 vulnerabilities

Vulnerabilities for packages: istio-pilot-agent, istio-operator, istio-pilot-discovery, istio-cni...

GHSA-XWX5-5C9G-X68X vulnerabilities

Vulnerabilities for packages: istio-pilot-agent, istio-operator, istio-pilot-discovery, istio-cni...

GHSA-HQXW-MM44-GC4R vulnerabilities

Vulnerabilities for packages: istio-pilot-agent, istio-operator, istio-pilot-discovery, istio-cni...

Medium: cni-plugins

Issue Overview: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not...

Amazon Linux 2 : cni-plugins, --advisory ALAS2-2025-3098 (ALAS-2025-3098)

The version of cni-plugins installed on the remote host is prior to 1.7.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3098 advisory. crypto/x509: excluded subdomain constraint does not restrict wildcard SANs An excluded subdomain constraint in a...

Medium: cni-plugins

Issue Overview: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not...

CVE-2025-65637 affecting package cni-plugins for versions less than 1.3.0-10

CVE-2025-65637 affecting package cni-plugins for versions less than 1.3.0-10. A patched version of the package is available...

CVE-2025-65637 affecting package cni-plugins for versions less than 1.4.0-4

CVE-2025-65637 affecting package cni-plugins for versions less than 1.4.0-4. A patched version of the package is available...

CVE-2025-67499 vulnerabilities

Vulnerabilities for packages: docker-fips, nerdctl, nerdctl-fips, istio-fips, azure-ipam, buildah, flannel, k3s, podman, flannel-fips, docker, istio, rootlesskit-fips, amazon-k8s-cni-fips, rootlesskit, buildkitd, containerd, rke2-runtime, multus-cni, multus-cni-fips, calico, datadog-agent-fips,...

GHSA-JV3W-X3R3-G6RM vulnerabilities

Vulnerabilities for packages: docker-fips, nerdctl, nerdctl-fips, istio-fips, azure-ipam, buildah, flannel, k3s, podman, flannel-fips, docker, istio, rootlesskit-fips, amazon-k8s-cni-fips, rootlesskit, buildkitd, containerd, rke2-runtime, multus-cni, multus-cni-fips, calico, datadog-agent-fips,...

CVE-2025-67499

The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container. Versions 1.6.0 through 1.8.0 inadvertently forward all traffic with the same destination port as the host port when the portmap plugin is configured with the nftables backend, thus...