GO-2026-6505 vulnerabilities

Vulnerabilities for packages: grype, k8sgpt, linkerd2, kubescape, prometheus-operator, db-operator, rke2-cloud-provider, fluent-operator, net-kourier, azure-service-operator, xeol, spark-operator, gh, spicedb, fulcio, docker-machine-driver-harvester, kubernetes-csi-external-resizer, weaviate,...

pumba

用于 Docker、containerd 和 Podman 的混沌测试工具 快速开始 · 用户指南 · 网络混沌 · 部署 · 贡献 Pumba 是一款用于 Docker、containerd 和 Podman 容器的混沌测试与网络模拟工具。受到 Netflix Chaos Monkey 的启发，Pumba 将混沌工程带入容器层面——杀死、停止、暂停和删除容器，注入网络延迟和数据包丢失，或对容器资源进行压力测试。 工作原理 graph LR APumba CLI --|Docker API / containerd API / Podman compat API| BContainer...

cve-2019-5736-reproducer

CVE-2019-5736 再現ツール これにより、RunC-CVE-2019-5736があなたのKVMインスタンスで動作することを確認できます。 ワークフロー概要 このリポジトリで CVE-2019-5736 の影響を受ける docker.io 関連パッケージをビルドする LXD上でUbuntu 18.04のKVMインスタンスを起動する VM内に脆弱性のある .deb パッケージをインストールする RunC-CVE-2019-5736 で紹介されている手順を試す 脆弱性のある .deb パッケージをビルドする $ docker-compose build --no-cache $...

CVE-2022-23648-POC

CVE-2022-23648 の PoC これは @fel1x の CVE-2022-23648 の概念実証です。開示情報は こちら、CVE 情報は こちら、そして詳細情報と緩和策のアイデアをまとめたブログは こちら を参照してください。Containerfile に必要な情報が記載されており、VOLUME のターゲットを変更することで異なるパスを試すことができます。 最も簡単に動作を確認する方法は、悪用可能なイメージを持つ KinD を使用することです。 基本テスト手順 ノードに /var/lib/kubelet/pki に大量のデータがない限り、このテストは安全なはずです。 kind...

CVE-2026-37236 affecting package moby-containerd-cc for versions less than 1.7.7-17

CVE-2026-37236 affecting package moby-containerd-cc for versions less than 1.7.7-17. A patched version of the package is available...

Rocky Linux 8 [CIQ] Security Update: libslirp / libslirp-debuginfo / libslirp-debugsource / etc Multiple Vulnerabilities (crlsa-2023_6939)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20236939 advisory. go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents CVE-2022-3064 golang: html/template: improper handling...

CLEANSTART-2026-WQ27487 tar

Security vulnerability affects the containerd package. tar...

CLEANSTART-2026-DR35313 During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions

Security vulnerability affects the containerd package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions...

CLEANSTART-2026-ZS14091 SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate

Security vulnerability affects the containerd package. SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate...

CLEANSTART-2026-SV65560 in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it

Security vulnerability affects the containerd package. The in-memory keyring returned by NewKeyring silently accepted keys with the ConfirmBeforeUse constraint but never enforced it...

CLEANSTART-2026-BW04566 RSA and DSA public key parsers did not enforce size limits on key parameters

Security vulnerability affects the containerd package. The RSA and DSA public key parsers did not enforce size limits on key parameters...

CLEANSTART-2026-AJ28533 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service

Security vulnerability affects the containerd package. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...

CLEANSTART-2025-IG62048 Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0

Security vulnerability affects the containerd package. Cloud Native Computing Foundation CNCF CNI Container Networking Interface 0...

CLEANSTART-2025-LA45180 runc through 1

Security vulnerability affects the containerd package. runc through 1...

CLEANSTART-2025-WZ56191 Go before 1

Security vulnerability affects the containerd package. Go before 1...

CLEANSTART-2025-NR50910 runc through 1

Security vulnerability affects the containerd package. runc through 1...

CLEANSTART-2025-DA74849 Moby is an open-source project created by Docker to enable and accelerate software containerization

Security vulnerability affects the containerd package. Moby is an open-source project created by Docker to enable and accelerate software containerization...

CLEANSTART-2025-UG08794 containerd is an open source container runtime

Security vulnerability affects the containerd package. containerd is an open source container runtime...

CLEANSTART-2025-PN33710 containerd is an open source container runtime

Security vulnerability affects the containerd package. containerd is an open source container runtime...

Important: runfinch-finch

Issue Overview: A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...