CLEANSTART-2026-PH23926 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

Security vulnerability affects the rabbitmq-cluster-operator package. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently...

CLEANSTART-2026-ND67671 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

Security vulnerability affects the rabbitmq-cluster-operator package. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request...

CLEANSTART-2026-NH23437 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

Security vulnerability affects the rabbitmq-cluster-operator package. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing...

CLEANSTART-2026-UR29764 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

Security vulnerability affects the rabbitmq-cluster-operator package. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

CLEANSTART-2026-XV44707 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

Security vulnerability affects the rabbitmq-cluster-operator package. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the...

GHSA-8RVJ-MM4H-C258 vulnerabilities

Vulnerabilities for packages: athenz-cert-manager-issuer, percona-server-mongodb-operator-fips, cert-manager-cmctl-fips, cert-manager-openshift-routes-fips, athenz-cert-manager-issuer-fips, aws-privateca-issuer-fips, aws-privateca-issuer, cert-manager-istio-csr, cert-manager-cmctl,...

CLEANSTART-2026-KJ42355 Security fix for GHSA-pc3f-x583-g7j2 applied in: rabbitmq-cluster-operator 2.19.2-r1, velero 1.16.2-r4, argo-cd-fips 3.3.7-r0, dynatrace-operator 1.7.3-r1

GHSA-pc3f-x583-g7j2 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-TR09708 Security fix for GHSA-8wmf-6v46-5gfg applied in: rabbitmq-cluster-operator 2.21.1-r6

Security vulnerability affects the rabbitmq-cluster-operator package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-105253

Security vulnerability affects the rabbitmq-cluster-operator package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-LX31883 Security fix for GHSA-gx3x-vq4p-mhhv applied in: cert-manager-cmctl 2.3.0-r1, cert-manager-cmctl-fips 2.4.0-r2, percona-xtradb-cluster-operator 1.19.0-r1, percona-xtradb-cluster-operator-fips 1.19.0-r1

GHSA-gx3x-vq4p-mhhv affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OJ21892 Security fix for CVE-2026-25518 applied in: cert-manager-cmctl-fips 2.4.0-r2, percona-xtradb-cluster-operator 1.18.0-r1, percona-xtradb-cluster-operator-fips 1.18.0-r1, step-issuer 0.9.11-r1

CVE-2026-25518 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2026-55225 Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, an attacker who can create a Kafka custom resource can set Kafka.spec.entityOperator watchedNamespace to a target namespace, causing the Cluster...

CVE-2026-55225

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, an attacker who can create a Kafka custom resource can set Kafka.spec.entityOperator watchedNamespace to a target namespace, causing the Cluster...

CVE-2026-55225: Improper Privilege Management

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, an attacker who can create a Kafka custom resource can set Kafka.spec.entityOperator watchedNamespace to a target namespace, causing the Cluster...

CLEANSTART-2026-CT24188 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Multiple security vulnerabilities affect the rabbitmq-cluster-operator package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

CLEANSTART-2026-XP64749 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Multiple security vulnerabilities affect the rabbitmq-cluster-operator package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

CLEANSTART-2026-CW06250 Security fixes in rabbitmq-cluster-operator 2.22.4-r0

Package rabbitmq-cluster-operator version 2.22.4-r0 fixes 8 vulnerabilities: CVE-2026-39821, CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-46600...

GO-2026-4399 vulnerabilities

Vulnerabilities for packages: percona-server-mongodb-operator-fips, cert-manager-cmctl-fips, cert-manager-openshift-routes-fips, opentelemetry-operator-fips, opentelemetry-operator, aws-privateca-issuer-fips, aws-privateca-issuer, cert-manager-istio-csr, cert-manager-cmctl, mariadb-operator-fips,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: ksops, kubeflow-katib, argo-cd, kubescape, nri-haproxy, terraform-provider-acme, aactl, glab, rancher, sftpgo-plugin-pubsub, nova, vault-benchmark, stakater-reloader, k9s, dbmate, cloud-provider-azure, cloud-sql-proxy, db-operator, rook, emissary,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: grpcurl, ksops, wave, headlamp, k3d, kubeflow-katib, nri-haproxy, kubernetes-csi-external-resizer, aactl, git-sync, openbao-k8s, sftpgo-plugin-pubsub, terraform-mcp-server, vault-benchmark, helm-set-status, hey, stakater-reloader, lvm-driver, crossplane-provider-sql,...