CLEANSTART-2026-FL92445 Security fixes in victoriametrics-cluster 1.132.0-r0

Package victoriametrics-cluster version 1.132.0-r0 fixes 2 vulnerabilities: CVE-2025-68121, CVE-2025-61732...

CLEANSTART-2026-PH84276 Security fixes for CVE-2026-27145, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288, CVE-2026-32289, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-39820, CVE-2026-39823, CVE-2026-39824, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499, CVE-2026-42504, CVE-2026-42507 applied in versions: 1.138.0-r0

Multiple security vulnerabilities affect the victoriametrics-vmauth package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-PG81236 Security fixes for CVE-2025-61732, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, ghsa-66jq-2c23-2xh5, ghsa-9h8m-3fm2-qjrq applied in versions: 0.65.0-r0, 0.65.0-r1

Multiple security vulnerabilities affect the victoriametrics-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MM70006 Security fixes for CVE-2025-61732, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, ghsa-66jq-2c23-2xh5, ghsa-9h8m-3fm2-qjrq applied in versions: 0.65.0-r0, 0.65.0-r1

Multiple security vulnerabilities affect the victoriametrics-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

GHSA-H74G-238J-357M vulnerabilities

Vulnerabilities for packages: aws-flb-firehose, containerd, kyverno, cilium, knative-eventing, cilium-cli, runc, flux, coredns, kubernetes, aactl, aws-flb-kinesis, argo-cd, helm, karma, zot, kubevela, kots, falco-no-driver, fluent-bit-plugin-loki, kubo, redka, trino, go, hubble,...

CVE-2026-39825 vulnerabilities

Vulnerabilities for packages: aws-flb-firehose, containerd, kyverno, cilium, knative-eventing, cilium-cli, runc, flux, coredns, kubernetes, aactl, aws-flb-kinesis, argo-cd, helm, karma, zot, kubevela, kots, falco-no-driver, fluent-bit-plugin-loki, kubo, redka, trino, go, hubble,...

GHSA-H74G-238J-357M vulnerabilities

Vulnerabilities for packages: knative-eventing, vitess, commercial-chainloop-cli, aws-flb-firehose-fips, kube-fluentd-operator, containerd, zitadel, coder-fips, kubo-fips, upwind-agent, yunikorn-web-fips, nvidia-nsight-compute-13.0, ansible-operator-fips, authentik, etcd, cluster-autoscaler-fips,...

CVE-2026-39825 vulnerabilities

Vulnerabilities for packages: knative-eventing, vitess, commercial-chainloop-cli, aws-flb-firehose-fips, kube-fluentd-operator, containerd, zitadel, coder-fips, kubo-fips, upwind-agent, yunikorn-web-fips, nvidia-nsight-compute-13.0, ansible-operator-fips, authentik, etcd, cluster-autoscaler-fips,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: cri-tools, azure-container-networking, nova-fips, newrelic-k8s-metadata-injection, terraform-provider-sendgrid-fips, clickhouse-operator, aws-flb-firehose-fips, nri-prometheus, aws-fsx-csi-driver, kuberay-operator, crossplane-provider-aws-eks-fips,...

CLEANSTART-2026-ZB99802 Security fixes for CVE-2025-61732, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, ghsa-66jq-2c23-2xh5, ghsa-9h8m-3fm2-qjrq applied in versions: 0.65.0-r0, 0.65.0-r1, 0.65.0-r2

Multiple security vulnerabilities affect the victoriametrics-operator-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GC37751 Security fixes for CVE-2025-61732, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, ghsa-66jq-2c23-2xh5, ghsa-9h8m-3fm2-qjrq applied in versions: 0.65.0-r0, 0.65.0-r1

Multiple security vulnerabilities affect the victoriametrics-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GX29850 Security fixes for CVE-2025-61732, CVE-2025-68121 applied in versions: 1.132.0-r0, 1.132.0-r1

Multiple security vulnerabilities affect the victoriametrics-cluster package. These issues are resolved in later releases. See references for individual vulnerability details...

Denial Of Service (DoS)

github.com/VictoriaMetrics/VictoriaMetrics is vulnerable to Denial of Service DoS. The vulnerability is due to the snappy decoder ignoring request size limits, which allows an attacker to send malformed compressed blocks that trigger excessive memory usage and cause service disruption...

GHSA-7HFW-R8QC-89V4 vulnerabilities

Vulnerabilities for packages: nova-fips, grafana-operator-fips, flux-image-reflector-controller, metacontroller, grafana-rollout-operator, temporal-fips, steampipe, victoriametrics-fips, victorialogs-fips, podinfo, flux-fips, grafana-operator, omnictl-multiarch, flux-helm-controller,...

CVE-2026-27138 vulnerabilities

Vulnerabilities for packages: nova-fips, grafana-operator-fips, flux-image-reflector-controller, metacontroller, grafana-rollout-operator, temporal-fips, steampipe, victoriametrics-fips, victorialogs-fips, podinfo, flux-fips, grafana-operator, omnictl-multiarch, flux-helm-controller,...

CVE-2026-27137 vulnerabilities

Vulnerabilities for packages: nova-fips, grafana-operator-fips, flux-image-reflector-controller, metacontroller, grafana-rollout-operator, temporal-fips, steampipe, victoriametrics-fips, victorialogs-fips, podinfo, flux-fips, grafana-operator, omnictl-multiarch, flux-helm-controller,...

GHSA-PH5J-38MG-J6HP vulnerabilities

Vulnerabilities for packages: nova-fips, grafana-operator-fips, flux-image-reflector-controller, metacontroller, grafana-rollout-operator, temporal-fips, steampipe, victoriametrics-fips, victorialogs-fips, podinfo, flux-fips, grafana-operator, omnictl-multiarch, flux-helm-controller,...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: docker-credential-acr-env, gptscript, knative-eventing, crossplane, mods, splunk-otel-collector, gomplate, tempo, terraform-docs, wave, kserve-rest-proxy, sonobuoy, crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-sqs, configmap-reload,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: docker-credential-acr-env, gptscript, mage, knative-eventing, crossplane, mods, splunk-otel-collector, gomplate, tempo, terraform-docs, confluent-cp-docker-utils, wave, kserve-rest-proxy, sonobuoy, crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-sqs,...

SUSE CVE-2025-65942

VictoriaMetrics is a scalable solution for monitoring and managing time series data. In versions from 1.0.0 to before 1.110.23, from 1.111.0 to before 1.122.8, and from 1.123.0 to before 1.129.1, affected versions are vulnerable to DoS attacks because the snappy decoder ignored VictoriaMetrics...