8331 matches found
CLEANSTART-2026-QL41079 Arithmetic over induction variables in loops were not correctly checked for underflow or overflow
Security vulnerability affects the kube-state-metrics-fips package. Arithmetic over induction variables in loops were not correctly checked for underflow or overflow...
CLEANSTART-2026-OK73778 SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass
Security vulnerability affects the kube-state-metrics-fips package. SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass...
CLEANSTART-2026-MZ79050 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
Security vulnerability affects the kube-state-metrics-fips package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...
CLEANSTART-2026-SI53222 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service
Security vulnerability affects the kube-state-metrics-fips package. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...
CLEANSTART-2026-HL08395 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
Security vulnerability affects the kube-state-metrics-fips package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...
CLEANSTART-2026-KC38093 Security fix for GHSA-9h8m-3fm2-qjrq applied in: kube-state-metrics-fips 2.18.0-r2
Security vulnerability affects the kube-state-metrics-fips package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-QV05313 Security fix for GHSA-gcjh-h69q-9w9g applied in: kube-state-metrics-fips 2.18.0-r4
Security vulnerability affects the kube-state-metrics-fips package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-GG34182 OpenTelemetry-Go is the Go implementation of OpenTelemetry
Security vulnerability affects the kube-state-metrics-fips package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...
CLEANSTART-2026-JP88303 Previously, a channel registered in the mux's chanList is not usable until it is established
Security vulnerability affects the kube-state-metrics-fips package. Previously, a channel registered in the mux's chanList is not usable until it is established...
CLEANSTART-2026-KJ60632 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...
Security vulnerability affects the kube-state-metrics-fips package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595...
CLEANSTART-2026-SF83107 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not
Security vulnerability affects the kube-state-metrics-fips package. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not...
CLEANSTART-2026-FG96390 Security fix for GHSA-8wmf-6v46-5gfg applied in: kube-state-metrics-fips 2.19.1-r2
Security vulnerability affects the kube-state-metrics-fips package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-WT03886 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection
Security vulnerability affects the kube-state-metrics-fips package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection...
CLEANSTART-2026-ON08381 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion
Security vulnerability affects the kube-state-metrics-fips package. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
CLEANSTART-2026-SU70558 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer
Security vulnerability affects the kube-state-metrics-fips package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...
CLEANSTART-2026-CH48185 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface
Security vulnerability affects the kube-state-metrics-fips package. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...
CLEANSTART-2026-HO44930 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures
Security vulnerability affects the kube-state-metrics-fips package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...
CLEANSTART-2026-ID25713 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS
Security vulnerability affects the kube-state-metrics-fips package. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...
CLEANSTART-2026-BS59545 Previously, resolving relative paths containing parent directory ('
Security vulnerability affects the kube-state-metrics-fips package. Previously, resolving relative paths containing parent directory '...
