150 matches found
FluentRender Code Execution
The vulnerability of the FluentRender component of the logging-operator data collector module related to Fluentd involves incorrect elimination of certain elements in the output data. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...
CLEANSTART-2026-FI20100 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request
Security vulnerability affects the kube-logging-operator package. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request...
CLEANSTART-2026-EN61439 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...
Security vulnerability affects the kube-logging-operator package. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffere...
CLEANSTART-2026-RX13164 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...
Security vulnerability affects the kube-logging-operator package. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...
CLEANSTART-2026-GI35870 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently
Security vulnerability affects the kube-logging-operator package. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently...
CLEANSTART-2026-IV56904 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing
Security vulnerability affects the kube-logging-operator package. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing...
PT-2026-120250
Security vulnerability affects the kube-logging-operator package. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently...
PT-2026-120249
Security vulnerability affects the kube-logging-operator package. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request...
PT-2026-120248
Security vulnerability affects the kube-logging-operator package. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffere...
PT-2026-120251
Security vulnerability affects the kube-logging-operator package. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing...
PT-2026-120252
Security vulnerability affects the kube-logging-operator package. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS INITIAL WINDOW SIZE values...
GO-2026-6605 vulnerabilities
Vulnerabilities for packages: verticadb-operator, prometheus-adapter, keda, gitness, wal-g, dockerize, fluent-bit-plugin-loki, policy-controller, kuberlr, step-issuer, trufflehog, prometheus, container-object-storage-interface, aws-flb-cloudwatch, docker-credential-ecr-login, loki, k6, filebrowse...
GO-2026-6590 OpenShift Cluster Logging Operator missing authorization flaw in github.com/openshift/cluster-logging-operator
OpenShift Cluster Logging Operator missing authorization flaw in github.com/openshift/cluster-logging-operator. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
PT-2026-105607
OpenShift Cluster Logging Operator missing authorization flaw in github.com/openshift/cluster-logging-operator. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
CLEANSTART-2026-QD34337 Security fix for GHSA-mxw3-3hh2-x2mh applied in: kube-logging-operator 6.2.2-r0, logstash-fips 9.2.6-r0
GHSA-mxw3-3hh2-x2mh affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-KN09353 Security fix for GHSA-xc9x-jj77-9p9j applied in: kube-logging-operator 6.2.2-r0
Security vulnerability affects the kube-logging-operator package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-VV73117 Security fix for GHSA-g7gv-6qhm-4h2j applied in: kube-logging-operator 6.2.2-r0
Security vulnerability affects the kube-logging-operator package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-DT55361 Security fix for GHSA-59gp-qqm7-cw4j applied in: kube-logging-operator 6.2.2-r0
Security vulnerability affects the kube-logging-operator package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-WC65057 Security fix for GHSA-v9wx-v5z4-wgfj applied in: kube-logging-operator 6.2.2-r0
Security vulnerability affects the kube-logging-operator package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-TY83067 Security fix for GHSA-jfh8-c2jp-hdph applied in: kube-logging-operator 6.2.2-r0
Security vulnerability affects the kube-logging-operator package. This issue is resolved in later releases. See references for vulnerability details...