CVE-2025-29786 affecting package keda for versions less than 2.14.1-4

CVE-2025-29786 affecting package keda for versions less than 2.14.1-4. A patched version of the package is available...

AZL-59183 CVE-2025-30204 affecting package keda for versions less than 2.14.1-5

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...

AZL-59192 CVE-2025-29923 affecting package keda for versions less than 2.14.1-5

go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.3, go-redis potentially responds out of order when CLIENT SETINFO times out during connection establishment. This can happen when the client is configured to transmit its identity, there...

CVE-2022-3162 affecting package keda for versions less than 2.4.0-28

CVE-2022-3162 affecting package keda for versions less than 2.4.0-28. A patched version of the package is available...

CVE-2025-29786 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib-fips, kargo, eks-distro-fips, amazon-cloudwatch-agent-fips, nats, argo-workflows, keda, argo-cd, eks-distro, opentelemetry-collector, argo-workflows-fips, argo-rollouts, splunk-otel-collector-fips, amazon-cloudwatch-agent,...

GHSA-93MQ-9FFX-83M2 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib-fips, kargo, eks-distro-fips, amazon-cloudwatch-agent-fips, nats, argo-workflows, keda, argo-cd, eks-distro, opentelemetry-collector, argo-workflows-fips, argo-rollouts, splunk-otel-collector-fips, amazon-cloudwatch-agent,...

AZL-58861 CVE-2025-29786 affecting package keda for versions less than 2.14.1-5

Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if the Expr expression parser is given an unbounded input string, it will attempt to compile the entire string and generate an Abstract Syntax Tree AST node for each part of the expression. In scenarios wher...

CVE-2025-27144 affecting package keda for versions less than 2.14.1-3

CVE-2025-27144 affecting package keda for versions less than 2.14.1-3. A patched version of the package is available...

CVE-2025-22868 affecting package keda for versions less than 2.14.1-3

CVE-2025-22868 affecting package keda for versions less than 2.14.1-3. A patched version of the package is available...

AZL-58438 CVE-2025-22870 affecting package keda for versions less than 2.4.0-29

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to ".example.com", a request to "::1%25.example.com:80 will incorrectly match and not be proxied...

AZL-58455 CVE-2025-22870 affecting package keda for versions less than 2.14.1-7

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to ".example.com", a request to "::1%25.example.com:80 will incorrectly match and not be proxied...

CVE-2025-27144 affecting package keda for versions less than 2.4.0-27

CVE-2025-27144 affecting package keda for versions less than 2.4.0-27. A patched version of the package is available...

AZL-57344 CVE-2025-22868 affecting package keda for versions less than 2.14.1-3

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

AZL-57138 CVE-2025-27144 affecting package keda for versions less than 2.4.0-27

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE...

AZL-57165 CVE-2025-27144 affecting package keda for versions less than 2.14.1-3

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE...

Azure Linux 3.0 Security Update: cert-manager / keda / kube-vip-cloud-provider / prometheus-adapter (CVE-2022-3162)

The version of cert-manager / keda / kube-vip-cloud-provider / prometheus-adapter installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-3162 advisory. - Users authorized to list or watch one type of...

CVE-2024-28180 affecting package keda for versions less than 2.4.0-26

CVE-2024-28180 affecting package keda for versions less than 2.4.0-26. A patched version of the package is available...

Azure Linux 3.0 Security Update: application-gateway-kubernetes-ingress / cf-cli / cri-o / csi-driver-lvm / golang / keda / moby-engine / node-problem-detector (CVE-2021-44716)

The version of application-gateway-kubernetes-ingress / cf-cli / cri-o / csi-driver-lvm / golang / keda / moby-engine / node-problem-detector installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-44716...

Azure Linux 3.0 Security Update: cert-manager / influxdb / keda / libcontainers-common / packer (CVE-2024-6104)

The version of cert-manager / influxdb / keda / libcontainers-common / packer installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-6104 advisory. - go-retryablehttp prior to 0.7.7 did not sanitize urls...

Azure Linux 3.0 Security Update: application-gateway-kubernetes-ingress / cf-cli / cni / containerized-data-importer / containernetworking-plugins / gh / keda / kubevirt (CVE-2022-32149)

The version of application-gateway-kubernetes-ingress / cf-cli / cni / containerized-data-importer / containernetworking-plugins / gh / keda / kubevirt installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the...