AZL-58861 CVE-2025-29786 affecting package keda for versions less than 2.14.1-5

Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if the Expr expression parser is given an unbounded input string, it will attempt to compile the entire string and generate an Abstract Syntax Tree AST node for each part of the expression. In scenarios wher...

CVE-2025-27144 affecting package keda for versions less than 2.14.1-3

CVE-2025-27144 affecting package keda for versions less than 2.14.1-3. A patched version of the package is available...

CVE-2025-22868 affecting package keda for versions less than 2.14.1-3

CVE-2025-22868 affecting package keda for versions less than 2.14.1-3. A patched version of the package is available...

AZL-58455 CVE-2025-22870 affecting package keda for versions less than 2.14.1-7

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to ".example.com", a request to "::1%25.example.com:80 will incorrectly match and not be proxied...

AZL-58438 CVE-2025-22870 affecting package keda for versions less than 2.4.0-29

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to ".example.com", a request to "::1%25.example.com:80 will incorrectly match and not be proxied...

CVE-2025-27144 affecting package keda for versions less than 2.4.0-27

CVE-2025-27144 affecting package keda for versions less than 2.4.0-27. A patched version of the package is available...

AZL-57344 CVE-2025-22868 affecting package keda for versions less than 2.14.1-3

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

AZL-57165 CVE-2025-27144 affecting package keda for versions less than 2.14.1-3

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE...

AZL-57138 CVE-2025-27144 affecting package keda for versions less than 2.4.0-27

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE...

Azure Linux 3.0 Security Update: cert-manager / keda / kube-vip-cloud-provider / prometheus-adapter (CVE-2022-3162)

The version of cert-manager / keda / kube-vip-cloud-provider / prometheus-adapter installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-3162 advisory. - Users authorized to list or watch one type of...

CVE-2024-28180 affecting package keda for versions less than 2.4.0-26

CVE-2024-28180 affecting package keda for versions less than 2.4.0-26. A patched version of the package is available...

Azure Linux 3.0 Security Update: cert-manager / influxdb / keda / libcontainers-common / packer (CVE-2024-6104)

The version of cert-manager / influxdb / keda / libcontainers-common / packer installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-6104 advisory. - go-retryablehttp prior to 0.7.7 did not sanitize urls...

Azure Linux 3.0 Security Update: application-gateway-kubernetes-ingress / cf-cli / cri-o / csi-driver-lvm / golang / keda / moby-engine / node-problem-detector (CVE-2021-44716)

The version of application-gateway-kubernetes-ingress / cf-cli / cri-o / csi-driver-lvm / golang / keda / moby-engine / node-problem-detector installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-44716...

Azure Linux 3.0 Security Update: application-gateway-kubernetes-ingress / cf-cli / cni / containerized-data-importer / containernetworking-plugins / gh / keda / kubevirt (CVE-2022-32149)

The version of application-gateway-kubernetes-ingress / cf-cli / cni / containerized-data-importer / containernetworking-plugins / gh / keda / kubevirt installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the...

CVE-2024-45338 affecting package keda for versions less than 2.14.1-2

CVE-2024-45338 affecting package keda for versions less than 2.14.1-2. A patched version of the package is available...

CVE-2024-45338 affecting package keda for versions less than 2.4.0-25

CVE-2024-45338 affecting package keda for versions less than 2.4.0-25. A patched version of the package is available...

AZL-54562 CVE-2024-45338 affecting package keda for versions less than 2.4.0-25

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

AZL-54407 CVE-2024-45338 affecting package keda for versions less than 2.14.1-2

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

AZL-52239 CVE-2024-51744 affecting package keda for versions less than 2.4.0-29

golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...

AZL-52201 CVE-2024-51744 affecting package keda for versions less than 2.14.1-7

golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...