GHSA-259R-337F-4RFW vulnerabilities

Vulnerabilities for packages: containerd, kine, minio, telegraf, cilium, backup-restore-operator, flux, prometheus, nerdctl, loki, zitadel, k3d, k3s, terraform, elastic-agent-fips, aactl, zot, snyk-cli, prometheus-operator, cert-manager, kots, kyverno, prometheus-mongodb-exporter, spire-server,...

GHSA-259R-337F-4RFW vulnerabilities

Vulnerabilities for packages: kyverno, loki, nerdctl, k3s, spire-server, zot, snyk-cli, kine, flux, telegraf, containerd, aactl, kaf, kots, minio, prometheus-operator, k3d...

Amazon Linux 2023 : nerdctl (ALAS2023-2026-1908)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1908 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, . to execute repeatedly on the same...

Medium: nerdctl

Issue Overview: x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, "." to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically bas...

Amazon Linux 2 : nerdctl, --advisory ALAS2-2026-3497 (ALAS-2026-3497)

The version of nerdctl installed on the remote host is prior to 2.2.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3497 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN...

Medium: nerdctl

Issue Overview: x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, "." to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically bas...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: gitea, containerd, k9s, traefik, kubescape-server, minio, knative-serving-fips, argocd-image-updater, argo-cd, gatekeeper, kyverno-fips, nerdctl, kube-arangodb-fips, k3s, calico-fips, trivy-fips, minio-fips, argocd-image-updater-fips, cloud-provider-aws,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: buildah, containerd, gitlab-cng, crossplane-provider-aws-kafkaconnect-fips, minio, crossplane-provider-aws-elasticsearch-fips, atlantis-fips, crossplane-provider-aws-acm, crossplane-provider-aws-emrserverless, crossplane-provider-aws-bedrockagent, argo-cd,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: buildah, containerd, gitlab-cng, crossplane-provider-aws-kafkaconnect-fips, minio, crossplane-provider-aws-elasticsearch-fips, atlantis-fips, crossplane-provider-aws-acm, crossplane-provider-aws-emrserverless, crossplane-provider-aws-bedrockagent, argo-cd,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: scorecard, flux-kustomize-controller, step-issuer, step, external-dns, flux, slsa-verifier, guac, neuvector-sigstore-interface, crossplane-provider-family-azure, pulumi, opentelemetry-collector, melange, kine, gitea, k8sgpt, osv-scanner, steampipe, openbao,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, trivy, k3s, external-dns, flux, minio, cert-manager, zarf, chisel, kubescape, mattermost, knative-serving, flux-source-controller, loki, opentelemetry-collector, kine, gitea, kots, aactl, osv-scanner, prometheus-operator, cilium,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, trivy, k3s, external-dns, flux, minio, cert-manager, zarf, chisel, kubescape, mattermost, knative-serving, flux-source-controller, loki, opentelemetry-collector, kine, gitea, kots, aactl, osv-scanner, prometheus-operator, cilium,...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: k3s, external-dns, flux, minio, cert-manager, mattermost, knative-serving, loki, opentelemetry-collector, buildah, kine, cloud-provider-aws, kots, aactl, prometheus-operator, cilium, opentofu, prometheus, istio, helm, kubernetes-dashboard, podman, spire-server,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: k3s, external-dns, flux, minio, cert-manager, mattermost, knative-serving, loki, opentelemetry-collector, buildah, kine, cloud-provider-aws, kots, aactl, prometheus-operator, cilium, prometheus, istio, helm, kubernetes-dashboard, podman, spire-server, telegraf,...

Amazon Linux 2 : nerdctl, --advisory ALAS2-2026-3334 (ALAS-2026-3334)

The version of nerdctl installed on the remote host is prior to 2.2.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3334 advisory. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. CVE-2026-25680 Parsing...

Amazon Linux 2023 : nerdctl (ALAS2023-2026-1735)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1735 advisory. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. CVE-2026-33811 When processing HTTP/2 SETTINGS frames, transport...

Amazon Linux 2 : nerdctl, --advisory ALAS2-2026-3319 (ALAS-2026-3319)

The version of nerdctl installed on the remote host is prior to 2.2.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3319 advisory. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a...

Amazon Linux 2 : nerdctl, --advisory ALAS2-2026-3265 (ALAS-2026-3265)

The version of nerdctl installed on the remote host is prior to 2.2.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3265 advisory. Arithmetic over induction variables in loops were not correctly checked for underflow or overflow in the Go compiler...

Amazon Linux 2 : nerdctl, --advisory ALAS2-2026-3229 (ALAS-2026-3229)

"The version of nerdctl installed on the remote host is prior to 2.2.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3229 advisory. url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix...

Amazon Linux 2023 : nerdctl (ALAS2023-2026-1535)

"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1535 advisory. url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir o...