CVE-2021-1056

CVE-2021-1056 CVE-2021-1056 is a vulnerability I submitted to NVIDIA PSIRT. Personally, it may lead to high security risks in multi-tenant HPC clusters, especially in cloud machine-learning platforms. This repository simply demonstrates the vulnerability on GPU containers created by...

GHSA-VWCJ-R8V9-P53F vulnerabilities

Vulnerabilities for packages: step-ca, kine, k8s-device-plugin, nerdctl, runc, telegraf, helm, loki, prometheus-operator, zot, k3s, kyverno, wuzz, spire-server, caddy, flux, cilium-cli, opentelemetry-collector, k6, fuse-overlayfs-snapshotter, cert-manager, hugo, minio, hubble, falco-no-driver,...

CVE-2026-78660 affecting package sriov-network-device-plugin for versions less than 3.7.0-9

CVE-2026-78660 affecting package sriov-network-device-plugin for versions less than 3.7.0-9. A patched version of the package is available...

CVE-2026-78669 affecting package sriov-network-device-plugin for versions less than 3.7.0-9

CVE-2026-78669 affecting package sriov-network-device-plugin for versions less than 3.7.0-9. A patched version of the package is available...

CVE-2026-56857 vulnerabilities

Vulnerabilities for packages: commercial-nginx-ingress, k8s-device-plugin, nvidia-nsight-compute-12.8, frankenphp-8.4, telegraf, commercial-chainloop-cli, ingress-nginx-controller-fips, karpenter-fips, terraform, commercial-gitlab-workhorse-ee, reports-server, nemo, commercial-gitlab-rails-ee-fip...

GO-2026-6609 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, k8s-device-plugin, gitlab-pages, yunikorn-web, atlantis, grafana-alloy, rancher-agent, juicefs, cloudprober, continuity, grafana-pyroscope, flux-source-controller, loki, argo-workflows, openbao, filebrowser, mesosphere-vsphere-csi,...

GHSA-C3Q7-M35P-9QQ7 vulnerabilities

Vulnerabilities for packages: loki, k8s-device-plugin, external-dns, kubernetes, spire-server, flux, cert-manager, aactl, ingress-nginx-controller, falco-no-driver...

GO-2026-6604 vulnerabilities

Vulnerabilities for packages: loki, k8s-device-plugin, external-dns, kubernetes, spire-server, flux, cert-manager, aactl, ingress-nginx-controller, falco-no-driver...

GHSA-F4XW-M386-M277 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, k8s-device-plugin, gitlab-pages, yunikorn-web, atlantis, grafana-alloy, rancher-agent, juicefs, cloudprober, continuity, grafana-pyroscope, flux-source-controller, loki, argo-workflows, openbao, filebrowser, mesosphere-vsphere-csi,...

CVE-2026-56857 vulnerabilities

Vulnerabilities for packages: loki, k8s-device-plugin, external-dns, kubernetes, spire-server, flux, cert-manager, aactl, ingress-nginx-controller, falco-no-driver...

AZL-107898 CVE-2026-97032 affecting package sriov-network-device-plugin 3.7.0-8

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107889 CVE-2026-78669 affecting package sriov-network-device-plugin 3.7.0-8

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107895 CVE-2026-78663 affecting package sriov-network-device-plugin 3.7.0-8

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

AZL-107892 CVE-2026-78659 affecting package sriov-network-device-plugin 3.7.0-8

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

AZL-107901 CVE-2026-78660 affecting package sriov-network-device-plugin 3.7.0-8

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

CVE-2026-84304 affecting package sriov-network-device-plugin for versions less than 3.7.0-8

CVE-2026-84304 affecting package sriov-network-device-plugin for versions less than 3.7.0-8. An upgraded version of the package is available that resolves this issue...

CVE-2026-84445 affecting package sriov-network-device-plugin for versions less than 3.7.0-8

CVE-2026-84445 affecting package sriov-network-device-plugin for versions less than 3.7.0-8. An upgraded version of the package is available that resolves this issue...

CLEANSTART-2026-ON51112 Security fix for CVE-2025-27612 applied in: nvidia-device-plugin 0.19.2-r1

Security vulnerability affects the nvidia-device-plugin package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101299

Security vulnerability affects the nvidia-device-plugin package. This issue is resolved in later releases. See references for vulnerability details...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: cadvisor-fips, opentelemetry-collector-contrib-fips, grafana-alloy-fips, k8s-device-plugin, runc, grafana-alloy, cluster-autoscaler, neuvector-scanner-fips, buildah, neuvector-scanner, k3s, cadvisor, docker, neuvector-fips, eks-distro-fips, gosu,...