CLEANSTART-2026-SI53222 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service

Security vulnerability affects the kube-state-metrics-fips package. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...

CLEANSTART-2026-HL08395 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the kube-state-metrics-fips package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

CLEANSTART-2026-KC38093 Security fix for ghsa-9h8m-3fm2-qjrq applied in: kube-state-metrics-fips 2.18.0-r2

Security vulnerability affects the kube-state-metrics-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-GG34182 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the kube-state-metrics-fips package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-QV05313 Security fix for ghsa-gcjh-h69q-9w9g applied in: kube-state-metrics-fips 2.18.0-r4

Security vulnerability affects the kube-state-metrics-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-KJ60632 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Security vulnerability affects the kube-state-metrics-fips package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595...

CLEANSTART-2026-JP88303 Previously, a channel registered in the mux's chanList is not usable until it is established

Security vulnerability affects the kube-state-metrics-fips package. Previously, a channel registered in the mux's chanList is not usable until it is established...

CLEANSTART-2026-WT03886 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Security vulnerability affects the kube-state-metrics-fips package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection...

CLEANSTART-2026-SF83107 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not

Security vulnerability affects the kube-state-metrics-fips package. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not...

CLEANSTART-2026-FG96390 Security fix for ghsa-8wmf-6v46-5gfg applied in: kube-state-metrics-fips 2.19.1-r2

Security vulnerability affects the kube-state-metrics-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-ON08381 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

Security vulnerability affects the kube-state-metrics-fips package. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...

CLEANSTART-2026-SU70558 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

Security vulnerability affects the kube-state-metrics-fips package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...

CLEANSTART-2026-CH48185 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

Security vulnerability affects the kube-state-metrics-fips package. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...

CLEANSTART-2026-ID25713 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

Security vulnerability affects the kube-state-metrics-fips package. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

CLEANSTART-2026-HO44930 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

Security vulnerability affects the kube-state-metrics-fips package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

CLEANSTART-2026-BS59545 Previously, resolving relative paths containing parent directory ('

Security vulnerability affects the kube-state-metrics-fips package. Previously, resolving relative paths containing parent directory '...

Rocky Linux 9 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc (crlsa-2025_15900)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202515900 advisory. podman: Podman kube play command may overwrite host files CVE-2025-9566 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc (crlsa-2026_18722)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202618722 advisory. podman: Podman kube play command may overwrite host files CVE-2025-9566 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 10.0 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc (crlsa-2025_15901)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202515901 advisory. podman: Podman kube play command may overwrite host files CVE-2025-9566 Tenable has extracted the preceding description block directly from the CIQ security...

CLEANSTART-2026-HE89623 Security fix for ghsa-gcjh-h69q-9w9g applied in: kube-state-metrics-fips 2.18.0-r3, kube-state-metrics-fips 2.19.1-r1, istio-pilot-discovery 1.31.1-r0

ghsa-gcjh-h69q-9w9g affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...