CVE-2026-27139 vulnerabilities

Vulnerabilities for packages: kube-vip-cloud-provider, kubernetes-dashboard-web, prometheus-alertmanager, net-kourier, timescaledb-parallel-copy, snyk-cli, cis-operator, sftpgo-plugin-auth, kafka-proxy, influx, yunikorn-k8shim, spark-operator, kubernetes-ingress-defaultbackend, pgtimetable,...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: spicedb-fips, prometheus, k6-fips, kubernetes-csi-livenessprobe, blob-csi-fips, kubernetes-dashboard-auth-fips, boring-registry-fips, kubernetes-csi-driver-hostpath, argocd-image-updater-fips, databricks-cli, metrics-server, cilium-envoy-fips, plugin-barman-cloud,...

Amazon Linux 2 : soci-snapshotter, --advisory ALAS2DOCKER-2026-100 (ALASDOCKER-2026-100)

The version of soci-snapshotter installed on the remote host is prior to 0.12.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-100 advisory. net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing...

OESA-2026-1436 kata-containers security update

This is core component of Kata Container, to make it work, you need a isulad/docker engine. Security Fixes: Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. In versions prior to 3.26.0, when a contain...

CLEANSTART-2026-XK29348 Security fixes for GHSA-F6X5-JH6R-WRFV, GHSA-J5W8-Q4QC-RX2X applied in versions: 8.4.0-r0

Multiple security vulnerabilities affect the kubernetes-csi-external-snapshotter-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

Medium: soci-snapshotter

Issue Overview: net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP archives CVE-2025-61728 crypto/tls: handshake messages may be processed at the incorrect encryption level CVE-2025-61730 crypto/tls: Config.Clone copies...

GHSA-W4GW-W5JQ-G9JH vulnerabilities

Vulnerabilities for packages: k8s-device-plugin, runc, gitness, aws-load-balancer-controller, fuse-overlayfs-snapshotter, k3s, wuzz...

GHSA-W4GW-W5JQ-G9JH vulnerabilities

Vulnerabilities for packages: gitness, nvidia-gpu-operator-validator, k3s, aws-load-balancer-controller, rke2-runtime-fips, backup-restore-operator, etcd, gendesk, runc, rke2-runtime, cilium-envoy-fips, cilium-envoy, terraform, fuse-overlayfs-snapshotter, gitlab-rails-ce, localstack,...

CVE-2025-47911 vulnerabilities

Vulnerabilities for packages: gitness, nvidia-gpu-operator-validator, k3s, aws-load-balancer-controller, rke2-runtime-fips, backup-restore-operator, etcd, gendesk, runc, rke2-runtime, cilium-envoy-fips, cilium-envoy, terraform, fuse-overlayfs-snapshotter, gitlab-rails-ce, localstack,...

CVE-2025-58190 vulnerabilities

Vulnerabilities for packages: gitness, nvidia-gpu-operator-validator, k3s, aws-load-balancer-controller, rke2-runtime-fips, backup-restore-operator, etcd, gendesk, runc, rke2-runtime, cilium-envoy-fips, cilium-envoy, terraform, fuse-overlayfs-snapshotter, gitlab-rails-ce, localstack,...

CVE-2025-47911 vulnerabilities

Vulnerabilities for packages: k8s-device-plugin, runc, gitness, aws-load-balancer-controller, fuse-overlayfs-snapshotter, k3s, wuzz...

CVE-2025-58190 vulnerabilities

Vulnerabilities for packages: k8s-device-plugin, runc, gitness, aws-load-balancer-controller, fuse-overlayfs-snapshotter, k3s, wuzz...

Medium: soci-snapshotter

Issue Overview: net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP archives CVE-2025-61728 crypto/tls: handshake messages may be processed at the incorrect encryption level CVE-2025-61730 crypto/tls: Config.Clone copies...

Amazon Linux 2023 : soci-snapshotter (ALAS2023-2026-1421)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1421 advisory. net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP archives CVE-2025-61728 crypto/tls: handshake messages may be processe...

CVE-2026-24054

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. In versions prior to 3.26.0, when a container image is malformed or contains no layers, containerd falls back to bind-mounting an empty snapshotter...

AZL-75770 CVE-2026-24054 affecting package kata-containers for versions less than 3.19.1.kata2-3

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. In versions prior to 3.26.0, when a container image is malformed or contains no layers, containerd falls back to bind-mounting an empty snapshotter...

EUVD-2026-4958

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. In versions prior to 3.26.0, when a container image is malformed or contains no layers, containerd falls back to bind-mounting an empty snapshotter...

CVE-2026-24054 Kata Containers Runtime: Host block device can be hotplugged to the VM if the container image is malformed or contains no layers

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. In versions prior to 3.26.0, when a container image is malformed or contains no layers, containerd falls back to bind-mounting an empty snapshotter...

Amazon Linux 2023 : soci-snapshotter (ALAS2023-2025-1334)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1334 advisory. crypto/x509: excluded subdomain constraint does not restrict wildcard SANs An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf...

Medium: soci-snapshotter

Issue Overview: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not...