CVE-2025-22872 affecting package ig for versions less than 0.37.0-4

CVE-2025-22872 affecting package ig for versions less than 0.37.0-4. A patched version of the package is available...

AZL-60492 CVE-2025-22872 affecting package ig for versions less than 0.37.0-4

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...

CVE-2025-29786 affecting package ig for versions less than 0.37.0-3

CVE-2025-29786 affecting package ig for versions less than 0.37.0-3. A patched version of the package is available...

CVE-2025-27144 affecting package ig for versions less than 0.37.0-2

CVE-2025-27144 affecting package ig for versions less than 0.37.0-2. A patched version of the package is available...

CVE-2024-45338 affecting package ig for versions less than 0.32.0-3

CVE-2024-45338 affecting package ig for versions less than 0.32.0-3. A patched version of the package is available...

AZL-42330 CVE-2024-3727 affecting package ig for versions less than 0.29.0-1

A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks...

AZL-42745 CVE-2023-47108 affecting package ig for versions less than 0.30.0-1

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels net.peer.sock.addr and net.peer.sock.port that have unbound cardinality. It leads to the...

AZL-42750 CVE-2023-44487 affecting package ig for versions less than 0.30.0-1

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

AZL-41765 CVE-2022-2879 affecting package ig for versions less than 0.29.0-1

Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB...