CLEANSTART-2026-IK31949 Security fix for GHSA-hfvc-g4fc-pqhx applied in: cosign 2.6.4-r1, metrics-server-fips 0.8.1-r3, amazon-cloudwatch-agent 1.300065.0-r1, trillian-fips 1.7.3-r1, kube-logging-operator 6.4.0-r1, kaniko 1.24.0-r2, prometheus-adapter 0.12.0-r1, trillian 1.7.3-r1, gotenberg 8.30.1-r0, kyverno-fips 1.13.6-r9, jitsucom-bulker 2.10.0-r0

GHSA-hfvc-g4fc-pqhx affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-NM46992 Security fix for GHSA-w8rr-5gcm-pp58 applied in: amazon-cloudwatch-agent 1.300065.0-r1, kube-logging-operator 6.4.0-r1

GHSA-w8rr-5gcm-pp58 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-NW44537 Security fix for GHSA-cxh2-4639-vmc5 applied in: kube-logging-operator 6.4.0-r1

Security vulnerability affects the kube-logging-operator package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-VL19179 OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector

Security vulnerability affects the kube-logging-operator package. The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector...

CLEANSTART-2026-GI35870 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

Security vulnerability affects the kube-logging-operator package. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently...

CLEANSTART-2026-EN61439 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

Security vulnerability affects the kube-logging-operator package. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffere...

CLEANSTART-2026-IV56904 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

Security vulnerability affects the kube-logging-operator package. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing...

CLEANSTART-2026-FI20100 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

Security vulnerability affects the kube-logging-operator package. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request...

CLEANSTART-2026-RX13164 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

Security vulnerability affects the kube-logging-operator package. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

PT-2026-120252

Security vulnerability affects the kube-logging-operator package. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS INITIAL WINDOW SIZE values...

PT-2026-120250

Security vulnerability affects the kube-logging-operator package. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently...

PT-2026-120251

Security vulnerability affects the kube-logging-operator package. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing...

PT-2026-120248

Security vulnerability affects the kube-logging-operator package. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffere...

PT-2026-120249

Security vulnerability affects the kube-logging-operator package. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request...

GO-2026-6605 vulnerabilities

Vulnerabilities for packages: mattermost, mesosphere-vsphere-csi, kubernetes-csi-external-resizer, gatus, lazygit, trufflehog, kyverno-policy-reporter-ui, minio-operator, kubevela, kserve-rest-proxy, grafana, pdfcpu, delve, dfc, cloud-provider-azure, kubeflow, mountpoint-s3-csi-driver,...

CLEANSTART-2026-QD34337 Security fix for GHSA-mxw3-3hh2-x2mh applied in: kube-logging-operator 6.2.2-r0, logstash-fips 9.2.6-r0

GHSA-mxw3-3hh2-x2mh affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VV73117 Security fix for GHSA-g7gv-6qhm-4h2j applied in: kube-logging-operator 6.2.2-r0

Security vulnerability affects the kube-logging-operator package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-KN09353 Security fix for GHSA-xc9x-jj77-9p9j applied in: kube-logging-operator 6.2.2-r0

Security vulnerability affects the kube-logging-operator package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-WC65057 Security fix for GHSA-v9wx-v5z4-wgfj applied in: kube-logging-operator 6.2.2-r0

Security vulnerability affects the kube-logging-operator package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-DT55361 Security fix for GHSA-59gp-qqm7-cw4j applied in: kube-logging-operator 6.2.2-r0

Security vulnerability affects the kube-logging-operator package. This issue is resolved in later releases. See references for vulnerability details...