GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: terraform, snyk-cli, minio, zarf, cilium, mattermost-fips, zitadel, k9s, kyverno-fips, kubevela-fips, cloud-provider-aws, calico-fips, kube-arangodb-fips, trivy-operator-fips, harbor, gatekeeper-fips, flux-fips, rancher-agent, flux, cilium-cli, kubernetes-dashboard,...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: terraform, snyk-cli, minio, cilium, mattermost-fips, zitadel, kyverno-fips, cloud-provider-aws, calico-fips, kube-arangodb-fips, podman-fips, harbor, gatekeeper-fips, rancher-agent, flux, cilium-cli, kubernetes-dashboard, docker-cli-buildx, teleport-operator-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: terraform, jfrog-cli, apko, buildkitd, nfpm, snyk-cli, vault-fips, amazon-ssm-agent, minio, zarf, crossplane-provider-azure-servicefabric, vault-benchmark, cilium, mapotf, chainloop-cli-fips, crossplane-provider-azure-policyinsights, ksops,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: terraform, snyk-cli, minio, zarf, cilium, mattermost-fips, zitadel, k9s, kyverno-fips, kubevela-fips, cloud-provider-aws, calico-fips, kube-arangodb-fips, trivy-operator-fips, harbor, gatekeeper-fips, flux-fips, rancher-agent, flux, cilium-cli, kubernetes-dashboard,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: terraform, jfrog-cli, apko, nfpm, snyk-cli, amazon-ssm-agent, minio, zarf, cilium, mapotf, chainloop-cli-fips, mattermost-fips, zitadel, k9s, kyverno-fips, kubevela-fips, cloud-provider-aws, chainctl, calico-fips, kube-arangodb-fips, chainloop-cli, podman-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: vitess, argocd-image-updater, rootlesskit, external-secrets-operator, dagger, nerdctl, crossplane-provider-azure-storage, cluster-api-azure-controller, flux-operator, gatus, snyk-cli, witness, kubescape, chisel, pulumi, tflint, melange, gomplate, gitlab-runner,...

GHSA-Q7J3-V8QV-22VQ OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL

Impact Possible data exposure. Summary While downloading packages from a maliciously crafted URL, some git operations against that URL could allow arbitrary file read. This might allow disclosure of confidential information. Details OpenTofu relies on go-getter for downloading packages like...

GHSA-PXH5-6RRC-8RJV vulnerabilities

Vulnerabilities for packages: opentofu...

GHSA-PXH5-6RRC-8RJV vulnerabilities

Vulnerabilities for packages: opentofu-fips, opentofu...

GHSA-PXH5-6RRC-8RJV OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server

Impact Unauthenticated denial of service. Summary When installing provider or module packages from attacker-controlled servers, the server may cause tofu initto enter an infinite loop sending garbage data to that server. Those who depend on modules or providers served from untrusted third-party...

OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server

Impact Unauthenticated denial of service. Summary When installing provider or module packages from attacker-controlled servers, the server may cause tofu initto enter an infinite loop sending garbage data to that server. Those who depend on modules or providers served from untrusted third-party...

CLEANSTART-2026-GY48351 Within HostnameError

Multiple security vulnerabilities affect the opentofu-fips package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2026-CN84623 Within HostnameError

Multiple security vulnerabilities affect the opentofu-fips package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2026-XN15507 During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions

Multiple security vulnerabilities affect the opentofu-fips package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions. See references for individual vulnerability details...

CLEANSTART-2026-MI12470 Within HostnameError

Multiple security vulnerabilities affect the opentofu-fips package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2026-SO13464 During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions

Multiple security vulnerabilities affect the opentofu-fips package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions. See references for individual vulnerability details...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: flux, percona-server-mongodb-operator, openbao, k6, spqr, external-secrets-operator, harbor, telegraf, yunikorn-k8shim, rclone, cert-manager, nuclei, teleport, rancher, xeol, grafana, cert-manager-istio-csr, juicefs, minio, dex, gitlab-runner, kyverno-notation-aws,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: flux, percona-server-mongodb-operator, openbao, k6, spqr, external-secrets-operator, harbor, telegraf, yunikorn-k8shim, rclone, cert-manager, nuclei, teleport, rancher, xeol, grafana, cert-manager-istio-csr, juicefs, minio, dex, gitlab-runner, kyverno-notation-aws,...

OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses

Impact Unauthenticated denial of service. Summary When installing module packages from attacker-controlled sources, tofu init may use unbounded memory, cause high CPU usage, or deadlock when encountering maliciously-crafted TLS certificate chains or tar archives. Those who depend on modules or...

CVE-2026-4660 vulnerabilities

Vulnerabilities for packages: grype, trivy-operator, steampipe, snyk-cli, kubescape, trivy, kots, xeol, zarf, tflint, conftest, task, tfsec, terragrunt, wolfictl, terraform, syft, opentofu, zot, k9s...