147 matches found
AZL-87507 CVE-2026-27136 affecting package cni-plugins for versions less than 1.4.0-6
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87513 CVE-2026-25680 affecting package cni-plugins for versions less than 1.4.0-6
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...
AZL-87516 CVE-2026-25681 affecting package cni-plugins for versions less than 1.4.0-6
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
CVE-2025-58190 affecting package cni-plugins for versions less than 1.4.0-5
CVE-2025-58190 affecting package cni-plugins for versions less than 1.4.0-5. A patched version of the package is available...
CVE-2025-58190 affecting package cni-plugins for versions less than 1.3.0-11
CVE-2025-58190 affecting package cni-plugins for versions less than 1.3.0-11. A patched version of the package is available...
CVE-2025-47911 affecting package cni-plugins for versions less than 1.3.0-11
CVE-2025-47911 affecting package cni-plugins for versions less than 1.3.0-11. A patched version of the package is available...
ROS-20260209-73-0042
Vulnerability in cni-plugins related to lack of protection of proprietary data. Exploitation of the vulnerability may allow a remote intruder to gain unauthorized access to protected information...
AZL-76901 CVE-2025-58190 affecting package cni-plugins for versions less than 1.4.0-5
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
AZL-76839 CVE-2025-58190 affecting package cni-plugins for versions less than 1.3.0-11
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
AZL-76898 CVE-2025-47911 affecting package cni-plugins for versions less than 1.4.0-5
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
AZL-76836 CVE-2025-47911 affecting package cni-plugins for versions less than 1.3.0-11
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
Medium: cni-plugins
Issue Overview: net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP archives CVE-2025-61728 crypto/tls: handshake messages may be processed at the incorrect encryption level CVE-2025-61730 crypto/tls: Config.Clone copies...
Medium: cni-plugins
Issue Overview: net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP archives CVE-2025-61728 crypto/tls: handshake messages may be processed at the incorrect encryption level CVE-2025-61730 crypto/tls: Config.Clone copies...
Amazon Linux 2023 : cni-plugins (ALAS2023-2026-1373)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1373 advisory. net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP archives CVE-2025-61728 crypto/tls: handshake messages may be processe...
Amazon Linux 2 : cni-plugins, --advisory ALAS2-2026-3134 (ALAS-2026-3134)
The version of cni-plugins installed on the remote host is prior to 1.7.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3134 advisory. net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary...
Medium: cni-plugins
Issue Overview: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not...
Amazon Linux 2 : cni-plugins, --advisory ALAS2-2025-3098 (ALAS-2025-3098)
The version of cni-plugins installed on the remote host is prior to 1.7.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3098 advisory. crypto/x509: excluded subdomain constraint does not restrict wildcard SANs An excluded subdomain constraint in a...
Medium: cni-plugins
Issue Overview: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not...