CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: nats-fips, cilium, redka, qemu-guesthelper, jaeger, splunk-otel-collector, coredns-fips, amazon-ecs-cni-plugins, amazon-ecs-agent-fips, grafana-operator, envconsul-fips, net-kourier, aws-flb-cloudwatch, envoy-gateway, spegel, karpenter-fips, opa-envoy, kubernetes,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: nats-fips, cilium, oauth2-proxy, container-object-storage-interface-fips, swagger, prometheus-nats-exporter-fips, cert-manager-csi-driver-fips, redka, crossplane-provider-aws-sns-fips, chart-testing, crossplane-provider-aws-acm, jaeger,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, crossplane-provider-aws-acm, splunk-otel-collector, aws-s3-controller, karma-fips, kafka-proxy, amazon-ecs-cni-plugins, policy-bot, grafana-operator, nodetaint, pushprox, spegel, karpenter-fips, go-licenses, sbom-convert, libnvidia-container,...

GHSA-GJVH-7JH8-7XHM vulnerabilities

Vulnerabilities for packages: nats-fips, kubeflow-katib, cilium, oauth2-proxy, container-object-storage-interface-fips, swagger, prometheus-nats-exporter-fips, cert-manager-csi-driver-fips, redka, crossplane-provider-aws-sns-fips, chart-testing, crossplane-provider-aws-acm, jaeger,...

CLEANSTART-2026-JT73156 protojson

Multiple security vulnerabilities affect the prometheus-node-exporter package. The protojson. See references for individual vulnerability details...

CLEANSTART-2026-DK61762 filippo

Multiple security vulnerabilities affect the prometheus-mysqld-exporter package. filippo. See references for individual vulnerability details...

CLEANSTART-2026-AR20742 attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing

Multiple security vulnerabilities affect the prometheus-mysqld-exporter package. An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing. See references for individual vulnerability details...

CLEANSTART-2026-RI97043 attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing

Multiple security vulnerabilities affect the prometheus-mysqld-exporter package. An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing. See references for individual vulnerability details...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value through the UploadTraces, UploadMetrics, and uploadLogs response-handling paths in exporters/otlp/otlptrace/otlptracehttp/client.go, exporters/otlp/otlpmetric/otlpmetrichttp/client.go, and...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value through the UploadTraces, UploadMetrics, and uploadLogs response-handling paths in exporters/otlp/otlptrace/otlptracehttp/client.go, exporters/otlp/otlpmetric/otlpmetrichttp/client.go, and...

AZL-82163 CVE-2026-39882 affecting package containerd2 for versions less than 2.2.4-2

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters traces/metrics/logs read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is...

AZL-82112 CVE-2026-39882 affecting package azurelinux-image-tools for versions less than 1.3.0-1

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters traces/metrics/logs read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is...

AZL-82461 CVE-2026-39882 affecting package moby-engine for versions less than 25.0.3-17

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters traces/metrics/logs read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is...

CVE-2026-39882

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters traces/metrics/logs read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is...

opentelemetry-go: OTLP HTTP exporters read unbounded HTTP response bodies

overview: this report shows that the otlp HTTP exporters traces/metrics/logs read the full HTTP response body into an in-memory bytes.Buffer without a size cap. this is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled or a network attacker can mitm t...

CLEANSTART-2026-FU47971 protojson

Multiple security vulnerabilities affect the prometheus-node-exporter package. The protojson. See references for individual vulnerability details...

CLEANSTART-2026-BK17545 attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing

Multiple security vulnerabilities affect the prometheus-mysqld-exporter package. An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing. See references for individual vulnerability details...

CLEANSTART-2026-VD84830 Security fixes for CVE-2025-61732, CVE-2025-68121 applied in versions: 1.10.0-r0

Multiple security vulnerabilities affect the prometheus-elasticsearch-exporter-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DF22934 Security fixes for CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-61732, CVE-2025-68119, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27141, CVE-2026-27142, ghsa-6v2p-p543-phr9, ghsa-f6x5-jh6r-wrfv, ghsa-hcg3-q754-cr77, ghsa-j5w8-q4qc-rx2x, ghsa-qxp5-gwg8-xv66, ghsa-v778-237x-gjrc, ghsa-vvgc-356p-c3xw applied in versions: 0.28.0-r0, 0.28.0-r1

Multiple security vulnerabilities affect the prometheus-statsd-exporter package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-EW27017 Security fixes for CVE-2025-61732, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142 applied in versions: 1.10.0-r0, 1.10.0-r1

Multiple security vulnerabilities affect the prometheus-elasticsearch-exporter package. These issues are resolved in later releases. See references for individual vulnerability details...