ALPINE-CVE-2026-40014

An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor...

ALPINE-CVE-2026-27852

An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust the memory limit...

ALPINE-CVE-2026-33607

An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. No publicly available exploits are...

ALPINE-CVE-2026-15310

When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...

ALPINE-CVE-2026-76957

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412...

ALPINE-CVE-2026-19672

The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name...

ALPINE-CVE-2026-53803

rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject...

CVE-2026-48702 Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size...

CVE-2026-48702

CVE-2026-48702 : Rekor before 1.5.2 decompresses APK signatures in Alpine APK parsing without bounding the total decompressed size, enabling a decompression bomb via gzip with extreme ratios. Attackers can trigger unbounded heap allocation during requests to unauthenticated endpoints POST /api/v1...

CVE-2026-48702 Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size...

CVE-2026-48702

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size...

CVE-2026-48702 Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size...

CLEANSTART-2026-IU92725 Security fixes in prometheus-alertmanager 0.32.0-r0

Package prometheus-alertmanager version 0.32.0-r0 fixes 2 vulnerabilities: CVE-2026-39882, CVE-2026-39883...

CLEANSTART-2026-OT46541 Security fixes in secrets-store-csi-driver-fips 1.6.0-r1

Package secrets-store-csi-driver-fips version 1.6.0-r1 fixes 5 vulnerabilities: CVE-2026-56852, ghsa-hrxh-6v49-42gf, CVE-2026-41178, CVE-2026-42505, CVE-2026-39822...

CLEANSTART-2026-SG48140 Security fixes in melange 0.56.1-r1

Package melange version 0.56.1-r1 fixes 22 vulnerabilities: CVE-2026-34040, CVE-2026-33997, CVE-2026-54174, CVE-2026-39830, CVE-2026-39831...

CLEANSTART-2026-IL84688 Security fixes in cert-manager-webhook-pdns-fips 2.5.5-r1

Package cert-manager-webhook-pdns-fips version 2.5.5-r1 fixes 29 vulnerabilities: CVE-2026-39822, CVE-2026-42505, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830...

CLEANSTART-2026-EX26301 Security fixes in gitea 1.27.0-r0

Package gitea version 1.27.0-r0 fixes 1 vulnerabilities: ghsa-hrxh-6v49-42gf...

ROOT-OS-ALPINE-323-CVE-2026-9545 CVE-2026-9545 in curl - Patched by Root

Root has patched CVE-2026-9545 in the curl package for Root:Alpine:3.23. Multiple fixed versions available...

ROOT-OS-ALPINE-323-CVE-2026-11564 CVE-2026-11564 in curl - Patched by Root

Root has patched CVE-2026-11564 in the curl package for Root:Alpine:3.23. Multiple fixed versions available...

ROOT-OS-ALPINE-323-CVE-2026-8924 CVE-2026-8924 in curl - Patched by Root

Root has patched CVE-2026-8924 in the curl package for Root:Alpine:3.23. Multiple fixed versions available...