CLEANSTART-2026-US79386 Security fix for ghsa-hfvc-g4fc-pqhx applied in: loki 3.7.1-r0

Security vulnerability affects the loki package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-DU50032 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the loki package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-ZA34964 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the loki package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-WU91498 When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh

Security vulnerability affects the loki package. When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh...

CLEANSTART-2026-WW85548 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs

Security vulnerability affects the loki package. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...

CLEANSTART-2026-OJ26404 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...

Security vulnerability affects the loki package. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped...

CLEANSTART-2026-HX71601 in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it

Security vulnerability affects the loki package. The in-memory keyring returned by NewKeyring silently accepted keys with the ConfirmBeforeUse constraint but never enforced it...

CLEANSTART-2026-UN89941 When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty pa...

Security vulnerability affects the loki package. When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress...

CLEANSTART-2026-UP76614 RSA and DSA public key parsers did not enforce size limits on key parameters

Security vulnerability affects the loki package. The RSA and DSA public key parsers did not enforce size limits on key parameters...

CLEANSTART-2026-TA77263 malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop

Security vulnerability affects the loki package. A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop...

CLEANSTART-2026-ZW28198 Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation

Security vulnerability affects the loki package. Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation...

CLEANSTART-2026-SR68419 Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh

Security vulnerability affects the loki package. The Verify method for FIDO/U2F security key types sk-ecdsa-sha2-nistp256@openssh...

CLEANSTART-2026-MH81237 For certain crafted inputs, a 'ed25519

Security vulnerability affects the loki package. For certain crafted inputs, a 'ed25519...

CLEANSTART-2026-HB43303 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

CVE-2026-27136 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...

CLEANSTART-2026-WS35873 "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp")

Security vulnerability affects the loki package. The "go bug" command writes to two files with predictable names in the system temporary directory for example, "/tmp"...

CLEANSTART-2026-RQ22332 "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames

Security vulnerability affects the loki package. The "go tool pack" subcommand usually used only by the compiler as an internal tool with known-good inputs does not sanitize output filenames...

CLEANSTART-2026-PY35354 Security fix for ghsa-wf45-q9ch-q8gh applied in: loki 3.7.1-r1

Security vulnerability affects the loki package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-HE86842 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

CVE-2026-42506 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...

CLEANSTART-2026-VC55522 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

CVE-2026-42502 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...

CLEANSTART-2026-EE25517 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

CVE-2026-25681 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...

CLEANSTART-2026-WV65132 Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0

Security vulnerability affects the loki package. Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0...

CLEANSTART-2026-MN47589 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service

CVE-2026-25680 affects multiple packages. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. See references for individual vulnerability details...

CLEANSTART-2026-PR31494 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

Security vulnerability affects the loki package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute...

CLEANSTART-2026-CG56781 When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as fo...

Security vulnerability affects the loki package. When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded...

CLEANSTART-2026-YJ73507 NewNTUnicodeString does not check for string length overflow

Security vulnerability affects the loki package. NewNTUnicodeString does not check for string length overflow...

CLEANSTART-2026-BI76349 SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate

Security vulnerability affects the loki package. SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate...

CLEANSTART-2026-DS50998 Prometheus is an open-source monitoring system and time series database

Security vulnerability affects the loki package. Prometheus is an open-source monitoring system and time series database...

CLEANSTART-2026-KU01035 (*x509

Security vulnerability affects the loki package. x509...

CLEANSTART-2026-CQ72737 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash

Security vulnerability affects the loki package. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...

CLEANSTART-2026-GQ93723 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322

Security vulnerability affects the loki package. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322...

CLEANSTART-2026-FK79056 Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)

Security vulnerability affects the loki package. The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL 0...

CLEANSTART-2026-DF36684 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...

Security vulnerability affects the loki package. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block...

CLEANSTART-2026-FO79285 ReverseProxy can forward queries containing parameters not visible to Rewrite functions

Security vulnerability affects the loki package. ReverseProxy can forward queries containing parameters not visible to Rewrite functions...

CLEANSTART-2026-NW24142 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

CVE-2026-33814 affects multiple packages. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0. See references for individual vulnerability details...

CLEANSTART-2026-ES62774 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

Security vulnerability affects the loki package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...

CLEANSTART-2026-HE08866 When returning errors, functions in the net/textproto package would include its input as part of the error

Security vulnerability affects the loki package. When returning errors, functions in the net/textproto package would include its input as part of the error...

CLEANSTART-2026-QP25328 malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation

Security vulnerability affects the loki package. A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation...

CLEANSTART-2026-BY91929 Security fix for ghsa-hrxh-6v49-42gf applied in: loki 3.7.1-r2, secrets-store-csi-driver-provider-aws 3.1.4-r1

ghsa-hrxh-6v49-42gf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-FW47694 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not

Security vulnerability affects the loki package. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not...

CLEANSTART-2026-PK17685 Prometheus is an open-source monitoring system and time series database

Security vulnerability affects the loki package. Prometheus is an open-source monitoring system and time series database...

CLEANSTART-2026-GN20091 Previously, resolving relative paths containing parent directory ('

Security vulnerability affects the loki package. Previously, resolving relative paths containing parent directory '...

CLEANSTART-2026-IC69892 etcd is a distributed key-value store for the data of a distributed system

Security vulnerability affects the loki package. etcd is a distributed key-value store for the data of a distributed system...

CLEANSTART-2026-UV13195 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

CVE-2026-46600 affects multiple packages. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...

CLEANSTART-2026-VW95960 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84303 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-FL18888 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

Security vulnerability affects the loki package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

CLEANSTART-2026-YE69466 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-BE87842 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

Security vulnerability affects the loki package. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...

CLEANSTART-2026-OE88191 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Security vulnerability affects the loki package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection...

CLEANSTART-2026-RY51837 Previously, a channel registered in the mux's chanList is not usable until it is established

Security vulnerability affects the loki package. Previously, a channel registered in the mux's chanList is not usable until it is established...

CLEANSTART-2026-HD45306 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-81870 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...