CLEANSTART-2026-VU77552 Security fixes in grafana 13.0.7-r1

Package grafana version 13.0.7-r1 fixes 8 vulnerabilities: ghsa-r277-6w6q-xmqw, CVE-2026-73502, CVE-2026-42151, CVE-2026-44903, CVE-2026-40179...

CVE-2026-73502

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In...

CVE-2026-73502 kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In...

CVE-2026-73502

In openapi3filter/req_resp_decoder.go (~line 197), defaultContentParameterDecoder dereferences mt.Schema.Value without a nil check, panicking on any spec using a schema-less content parameter. Unauthenticated clients trigger this with one request, causing per-request aborts or full process crashe...

CVE-2026-73502 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kms, crossplane-provider-aws-lambda, crossplane-provider-aws-rds, kubevela, crossplane-provider-aws-sqs, crossplane-provider-aws-eks, crossplane-provider-family-azure, hugo, crossplane-provider-keycloak, dataplaneapi,...