230 matches found
CLEANSTART-2026-JV70419 Security fixes in loki 3.6.12-r0
Package loki version 3.6.12-r0 fixes 4 vulnerabilities: CVE-2020-8911, CVE-2020-8912, CVE-2026-56852, CVE-2026-46600...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: loki3.7: loki3.7-3.7.4-0.1.hum1 aarch64, x8664 loki3.7-canary-3.7.4-0.1.hum1 aarch64, x8664 loki3.7-logcli-3.7.4-0.1.hum1 aarch64, x8664 loki3.7-3.7.4-0.1.hum1.src src...
SUSE CVE-2026-21729
Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy...
CVE-2026-21729
Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy...
EUVD-2026-44862
Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy...
CVE-2026-21729 Loki detected_fields query limits results in unbounded memory allocation
Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy...
CVE-2026-21729 Loki detected_fields query limits results in unbounded memory allocation
Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy...
CVE-2026-21729
Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy...
CVE-2026-21729
CVE-2026-21729 concerns Loki: queries with large limits can trigger large memory allocations, potentially affecting service availability depending on deployment. The available documents do not specify affected Loki versions, exact vulnerable components, or a remediation. It is not stated whether ...
PT-2026-60405
Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy...
CVE-2026-21729: Allocation of Resources Without Limits or Throttling
Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy...
Loki detected_fields query limits results in unbounded memory allocation
The Loki detectedfields endpoint allocates 2limit elements in slices and maps based on the user-supplied limit query parameter, regardless of actual result count. A massive limit value e.g. 600000000 allocates 20-30 GiB even with zero matching results, causing OOM, resulting in denial of service...
GHSA-45GG-VH54-H5M9 vulnerabilities
Vulnerabilities for packages: trivy-operator, flux-source-controller, drone, kyverno-fips, terraform, minio, mattermost, minio-fips, coder, commercial-kyverno, vitess, gitlab-kas, upwind-agent, argo-workflows, skaffold-fips, reports-server, kubescape-server-fips, k9s, argo-cd-fips, helm, flux,...
GHSA-W879-237Q-WC7R vulnerabilities
Vulnerabilities for packages: tkn, kots, kubernetes, mattermost, gomplate, terraform-provider-tls, gitea, ksops, flux-notification-controller, wolfictl, syft, chisel, flux-kustomize-controller, skaffold, pulumi, crossplane-provider-azure-storage, ko, gitlab-kas, gitlab-runner, eksctl, zot,...
GHSA-X527-X647-Q7GG vulnerabilities
Vulnerabilities for packages: kaf, cloud-provider-aws, kots, kubernetes, mattermost, trivy-operator, trivy, flux, loki, nerdctl, telegraf, cert-manager, gitea, flux-source-controller, argocd-image-updater, external-dns, flux-image-automation-controller, kyverno, k9s, opentelemetry-collector,...
GHSA-F5WC-C3C7-36MC vulnerabilities
Vulnerabilities for packages: kots, kubernetes, mattermost, gomplate, gitea, wolfictl, syft, skaffold, pulumi, gitlab-kas, zot, prometheus, spire-server, chezmoi, aactl, opentofu, step-issuer, trivy-operator, flux, telegraf, flux-source-controller, argocd-image-updater, external-dns, nfpm,...
GHSA-JPPX-RXG9-JMRX vulnerabilities
Vulnerabilities for packages: kaf, podman, cloud-provider-aws, kots, kubernetes, mattermost, flux, loki, nerdctl, telegraf, cert-manager, external-dns, docker-cli-buildx, kyverno, opentelemetry-collector, external-secrets-operator, kine, falco-no-driver, kubernetes-dashboard, rancher, k3s,...
BIT-GRAFANA-2026-10601 Path traversal in the Tempo and Loki data source plugins
A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal responses, or trigger administrative actions on the...
PT-2026-52859
The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, enabling path traversal. A Viewer-role user can: 1 capture admin-configured datasource credentials secureJsonData custom headers by traversing to an...