AZL-101079 CVE-2026-84445 affecting package prometheus-adapter 0.12.0-10

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer allow internal/transport/http2server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go...

AZL-100944 CVE-2026-83530 affecting package prometheus-adapter 0.12.0-10

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...

AZL-99333 CVE-2026-84304 affecting package prometheus-adapter 0.12.0-9

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

AZL-98394 CVE-2026-37236 affecting package prometheus-adapter 0.12.0-9

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

CVE-2026-73500 affecting package prometheus-adapter for versions less than 0.12.0-9

CVE-2026-73500 affecting package prometheus-adapter for versions less than 0.12.0-9. A patched version of the package is available...

GO-2023-2113 vulnerabilities

Vulnerabilities for packages: prometheus-adapter, kubevela, k3s, rancher-webhook, caddy, buildkitd, metrics-server-fips, kubernetes, up, kube-oidc-proxy, kubernetes-fips, rancher-webhook-fips...

GO-2023-2341 vulnerabilities

Vulnerabilities for packages: prometheus-adapter, aws-efs-csi-driver-fips, ip-masq-agent, aws-ebs-csi-driver, nodetaint, kubernetes-dns-node-cache, spark-operator, aws-efs-csi-driver...

GO-2023-2382 vulnerabilities

Vulnerabilities for packages: vertical-pod-autoscaler, grpcurl, ip-masq-agent, stakater-reloader, prometheus-beat-exporter-fips, protoc-gen-go-grpc, aactl, gke-gcloud-auth-plugin, docker-credential-ecr-login, sops, kube-logging-logging-operator, aws-flb-cloudwatch, aws-flb-kinesis,...

GO-2023-2113 vulnerabilities

Vulnerabilities for packages: buildkitd, kubevela, kubernetes, k3s, caddy, up, prometheus-adapter...

GO-2023-2341 vulnerabilities

Vulnerabilities for packages: nodetaint, ip-masq-agent, aws-efs-csi-driver, kubernetes-dns-node-cache, spark-operator, prometheus-adapter...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: gitlab-runner, terragrunt, db-operator, cloudnative-pg, crossplane-provider-aws-ec2, crossplane-provider-aws-lambda, speedtest-go, witness, crossplane-provider-aws-sqs, calico, node-problem-detector, hubble-ui, gitlab-pages, src-fingerprint, spire-server,...

CLEANSTART-2026-MN93701 Security fixes in prometheus-adapter 0.12.0-r1

Package prometheus-adapter version 0.12.0-r1 fixes 3 vulnerabilities: ghsa-vgwf-h737-ff37, ghsa-f5wc-c3c7-36mc, ghsa-5cgq-3rg8-m6cv...

AZL-95946 CVE-2026-73500 affecting package prometheus-adapter for versions less than 0.12.0-9

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listenertls.go, each connection handle...

CVE-2026-56852 affecting package prometheus-adapter for versions less than 0.12.0-7

CVE-2026-56852 affecting package prometheus-adapter for versions less than 0.12.0-7. A patched version of the package is available...

AZL-93279 CVE-2026-56852 affecting package prometheus-adapter for versions less than 0.12.0-7

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

GHSA-FF52-PH69-CF7X vulnerabilities

Vulnerabilities for packages: db-operator, crossplane-provider-aws-ec2, witness, node-problem-detector, undock, src-fingerprint, kubernetes-dashboard-metrics-scraper, tkn, k8sgpt-operator, kubernetes-replicator, fluxcd-kustomize-mutating-webhook, rancher-fleet, libnvidia-container, nri-kafka,...

CVE-2026-42506 affecting package prometheus-adapter for versions less than 0.12.0-6

CVE-2026-42506 affecting package prometheus-adapter for versions less than 0.12.0-6. A patched version of the package is available...

CVE-2026-42502 affecting package prometheus-adapter for versions less than 0.12.0-6

CVE-2026-42502 affecting package prometheus-adapter for versions less than 0.12.0-6. A patched version of the package is available...

CVE-2026-27136 affecting package prometheus-adapter for versions less than 0.12.0-6

CVE-2026-27136 affecting package prometheus-adapter for versions less than 0.12.0-6. A patched version of the package is available...

CVE-2026-25680 affecting package prometheus-adapter for versions less than 0.12.0-6

CVE-2026-25680 affecting package prometheus-adapter for versions less than 0.12.0-6. A patched version of the package is available...