CVE-2025-65637 affecting package cni-plugins for versions less than 1.4.0-4

CVE-2025-65637 affecting package cni-plugins for versions less than 1.4.0-4. A patched version of the package is available...

PT-2025-55006

Уязвимость сетевых плагинов CNI Plugins связана с раскрытием информации. Эксплуатация уязвимости может позволить нарушителю получить несанкционированный доступ к защищаемой информации...

Amazon Linux 2023 : cni-plugins (ALAS2023-2025-1287)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1287 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6 addresses to be included in square brackets within the host component of a URL...

Amazon Linux 2 : cni-plugins, --advisory ALAS2-2025-3078 (ALAS-2025-3078)

The version of cni-plugins installed on the remote host is prior to 1.7.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3078 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6...

AZL-71563 CVE-2025-65637 affecting package cni-plugins for versions less than 1.3.0-10

A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving...

AZL-71510 CVE-2025-65637 affecting package cni-plugins for versions less than 1.4.0-4

A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving...

Medium: cni-plugins

Issue Overview: Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon. CVE-2025-22874 Proxy-Authorization and Proxy-Authenticate headers...

Amazon Linux 2023 : cni-plugins (ALAS2023-2025-1143)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1143 advisory. Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which a...

Important: cni-plugins

Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...

Important: cni-plugins

Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...

Amazon Linux 2 : cni-plugins (ALAS-2025-2882)

The version of cni-plugins installed on the remote host is prior to 1.7.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2882 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare...

Important: cni-plugins

Issue Overview: The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. CVE-2024-24790 The net/http package accepted data in the chunked transfer encoding...

Important: cni-plugins

Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...

CVE-2025-22872 affecting package cni-plugins for versions less than 1.4.0-3

CVE-2025-22872 affecting package cni-plugins for versions less than 1.4.0-3. A patched version of the package is available...

CVE-2025-22872 affecting package cni-plugins for versions less than 1.3.0-8

CVE-2025-22872 affecting package cni-plugins for versions less than 1.3.0-8. A patched version of the package is available...

AZL-60502 CVE-2025-22872 affecting package cni-plugins for versions less than 1.3.0-8

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...

AZL-60447 CVE-2025-22872 affecting package cni-plugins for versions less than 1.4.0-3

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: prometheus-operator, gosu, kaf, vexctl, php-fpmexporter, task, kubebuilder, petname, supercronic, docker-credential-acr-env, go-licenses, spark-operator, cni-plugins, crossplane-provider-azure, kubevela, slsa-verifier, cluster-proportional-autoscaler, grafana-operato...

GHSA-8XFX-RJ4P-23JM vulnerabilities

Vulnerabilities for packages: vault, syft, k8ssandra-client-fips, crossplane-provider-aws-ec2, lazygit, scorecard, cfssl-fips, hivemind, consul, k8s-device-plugin, nri-cassandra, yq, victoriametrics-fips, metrics-server-fips, flux-source-controller, gosu, aactl, delve, rootlesskit, envoy-ratelimi...

GHSA-J7VJ-RW65-4V26 vulnerabilities

Vulnerabilities for packages: vault, syft, k8ssandra-client-fips, crossplane-provider-aws-ec2, lazygit, scorecard, cfssl-fips, hivemind, consul, k8s-device-plugin, nri-cassandra, yq, victoriametrics-fips, metrics-server-fips, flux-source-controller, gosu, aactl, delve, rootlesskit, envoy-ratelimi...