GO-2026-5013 vulnerabilities

Vulnerabilities for packages: gptscript, kubernetes-dashboard, flux-kustomize-controller, policy-controller, podman, terragrunt, crossplane-provider-aws-kms, gh, gitlab-runner, traefik, chisel, containerd, atlantis, scorecard, kine, osv-scanner, zot, falcoctl, crossplane-provider-aws-sqs,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: rancher-system-upgrade-controller, gptscript, runc, minio-object-browser, thanos-operator, cfssl, kubernetes-dashboard, postgres-operator, flux-kustomize-controller, opensearch-k8s-operator, policy-controller, rancher-helm, paranoia, swagger, chart-testing,...

Photon OS 5.0: Nerdctl PHSA-2023-5.0-91-0044

An update of the nerdctl package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0044. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

GHSA-259R-337F-4RFW vulnerabilities

Vulnerabilities for packages: prometheus-operator, aactl, commercial-expanso-edge, backup-restore-operator, loki, minio, kaf, cert-manager, omnictl-multiarch, kots, upwind-agent, kyverno, kine, falco-no-driver, commercial-grafana, cilium, prometheus-mongodb-exporter, reports-server, spire-server,...

GHSA-259R-337F-4RFW vulnerabilities

Vulnerabilities for packages: nerdctl, k3s, kyverno, kots, telegraf, falco-no-driver, k3d, containerd, spire-server, kine, zot, loki, kaf, flux, prometheus-operator, helm, snyk-cli, minio, aactl...

Amazon Linux 2023 : nerdctl (ALAS2023-2026-1908)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1908 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, . to execute repeatedly on the same...

Amazon Linux 2 : nerdctl, --advisory ALAS2-2026-3497 (ALAS-2026-3497)

The version of nerdctl installed on the remote host is prior to 2.2.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3497 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN...

Medium: nerdctl

Issue Overview: x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, "." to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically bas...

Medium: nerdctl

Issue Overview: x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, "." to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically bas...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-athena, crossplane-provider-keycloak, harbor, crossplane-provider-azure-storagesync, crossplane-provider-aws-athena-fips, crossplane-provider-aws-lexmodels-fips, mattermost-fips, crossplane-provider-aws-kinesis-fips, knative-serving,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: nemo, argocd-image-updater, aactl, harbor, backup-restore-operator, mattermost-fips, cloud-provider-aws, knative-serving, upwind-agent, external-secrets-operator-fips, trivy, kine, cilium, kubernetes, knative-kafka-broker, drone, flux, seaweedfs-rocksdb-fips,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-athena, crossplane-provider-keycloak, harbor, crossplane-provider-azure-storagesync, crossplane-provider-aws-athena-fips, crossplane-provider-aws-lexmodels-fips, mattermost-fips, crossplane-provider-aws-kinesis-fips, knative-serving,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: gptscript, docker-machine-driver-harvester, kubernetes-dashboard, flux-kustomize-controller, policy-controller, podman, terragrunt, gh, gitlab-runner, chisel, containerd, atlantis, scorecard, kine, osv-scanner, zot, falcoctl, cilium-cli, pulumi-language-yaml,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: fscrypt, kubernetes-dashboard, skaffold, nerdctl, k3s, kubescape, kots, kyverno, telegraf, falco-no-driver, rancher, rancher-agent, chisel, containerd, istio, spire-server, kine, osv-scanner, zarf, zot, gitlab-kas, external-secrets-operator, loki, argocd-image-update...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: fscrypt, kubernetes-dashboard, nerdctl, buildah, k3s, podman, docker-cli-buildx, kots, kyverno, telegraf, falco-no-driver, rancher, rancher-agent, containerd, istio, spire-server, kine, zot, gitlab-kas, external-secrets-operator, loki, kaf, cilium-cli, opentofu,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: fscrypt, kubernetes-dashboard, nerdctl, buildah, k3s, podman, docker-cli-buildx, kots, kyverno, telegraf, falco-no-driver, rancher, rancher-agent, containerd, istio, spire-server, kine, zot, gitlab-kas, external-secrets-operator, loki, kaf, cilium-cli, kubernetes,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: fscrypt, docker-machine-driver-harvester, kubernetes-dashboard, skaffold, nerdctl, k3s, kubescape, kots, kyverno, telegraf, falco-no-driver, rancher, rancher-agent, chisel, containerd, istio, spire-server, kine, osv-scanner, zarf, zot, gitlab-kas,...

Amazon Linux 2 : nerdctl, --advisory ALAS2-2026-3334 (ALAS-2026-3334)

The version of nerdctl installed on the remote host is prior to 2.2.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3334 advisory. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. CVE-2026-25680 Parsing...

Amazon Linux 2023 : nerdctl (ALAS2023-2026-1735)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1735 advisory. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. CVE-2026-33811 When processing HTTP/2 SETTINGS frames, transport...

Amazon Linux 2 : nerdctl, --advisory ALAS2-2026-3319 (ALAS-2026-3319)

The version of nerdctl installed on the remote host is prior to 2.2.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3319 advisory. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a...