92 matches found
GO-2026-6609 vulnerabilities
Vulnerabilities for packages: hubble-ui, step, kube-arangodb, chartmuseum, filebrowser, flux-source-controller, openbao, flux, karpenter, cloudprober, kyverno-policy-reporter, kyverno-policy-reporter-ui, cert-manager, cert-manager-webhook-pdns, gitlab-pages, temporal-ui-server, k8s-device-plugin,...
GHSA-F4XW-M386-M277 vulnerabilities
Vulnerabilities for packages: hubble-ui, step, kube-arangodb, chartmuseum, filebrowser, flux-source-controller, openbao, flux, karpenter, cloudprober, kyverno-policy-reporter, kyverno-policy-reporter-ui, cert-manager, cert-manager-webhook-pdns, gitlab-pages, temporal-ui-server, k8s-device-plugin,...
CVE-2026-84445 affecting package prometheus-adapter for versions less than 0.12.0-11
CVE-2026-84445 affecting package prometheus-adapter for versions less than 0.12.0-11. A patched version of the package is available...
AZL-107811 CVE-2026-97032 affecting package prometheus-adapter 0.12.0-10
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...
AZL-107808 CVE-2026-78669 affecting package prometheus-adapter 0.12.0-10
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...
AZL-107814 CVE-2026-78663 affecting package prometheus-adapter 0.12.0-10
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...
AZL-107817 CVE-2026-78659 affecting package prometheus-adapter 0.12.0-10
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...
AZL-107820 CVE-2026-78660 affecting package prometheus-adapter 0.12.0-10
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...
GO-2026-6505 vulnerabilities
Vulnerabilities for packages: kubernetes-csi-external-resizer, cloud-provider-azure, sqlexporter, nuclei, db-operator, redis-operator, terraform-provider-grafana, vault-env, azuredisk-csi, kube-metrics-adapter, local-static-provisioner, linkerd2, azure-service-operator, cert-manager-istio-csr,...
CVE-2026-37236 affecting package prometheus-adapter for versions less than 0.12.0-10
CVE-2026-37236 affecting package prometheus-adapter for versions less than 0.12.0-10. A patched version of the package is available...
AZL-101079 CVE-2026-84445 affecting package prometheus-adapter 0.12.0-10
gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer allow internal/transport/http2server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go...
AZL-100944 CVE-2026-83530 affecting package prometheus-adapter 0.12.0-10
A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...
AZL-99333 CVE-2026-84304 affecting package prometheus-adapter 0.12.0-9
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...
AZL-98394 CVE-2026-37236 affecting package prometheus-adapter for versions less than 0.12.0-10
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...
CVE-2026-73500 affecting package prometheus-adapter for versions less than 0.12.0-9
CVE-2026-73500 affecting package prometheus-adapter for versions less than 0.12.0-9. A patched version of the package is available...
GO-2023-2113 vulnerabilities
Vulnerabilities for packages: buildkitd, rancher-webhook-fips, prometheus-adapter, metrics-server-fips, kubernetes, kubevela, up, caddy, kube-oidc-proxy, kubernetes-fips, rancher-webhook, k3s...
GO-2023-2341 vulnerabilities
Vulnerabilities for packages: nodetaint, prometheus-adapter, ip-masq-agent, kubernetes-dns-node-cache, aws-ebs-csi-driver, aws-efs-csi-driver-fips, spark-operator, aws-efs-csi-driver...
GO-2023-2382 vulnerabilities
Vulnerabilities for packages: nsc, prometheus-adapter-fips, smarter-device-manager, kubernetes-csi-livenessprobe, aws-flb-cloudwatch, aactl, go-licenses, prometheus-statsd-exporter-fips, tigera-operator, vertical-pod-autoscaler, amass, docker-cli, oras, cni-plugins, gobuster, wait-for-port,...