11796 matches found
CLEANSTART-2026-HF94119 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection
CVE-2026-56855 affects multiple packages. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...
CLEANSTART-2026-IN42122 Security fix for GHSA-hrxh-6v49-42gf applied in: external-secrets-operator-fips 2.7.0-r1, node-problem-detector 0.8.25-r1
GHSA-hrxh-6v49-42gf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-HG42719 SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate
CVE-2026-39835 affects multiple packages. SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. See references for individual vulnerability details...
CLEANSTART-2026-WU57451 When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as fo...
CVE-2026-39828 affects multiple packages. When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. See reference...
CLEANSTART-2026-PG51733 Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh
CVE-2026-39831 affects multiple packages. The Verify method for FIDO/U2F security key types sk-ecdsa-sha2-nistp256@openssh. See references for individual vulnerability details...
CLEANSTART-2026-SG10675 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs
CVE-2026-46597 affects multiple packages. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. See references for individual vulnerability details...
CLEANSTART-2026-FL07624 in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it
CVE-2026-39833 affects multiple packages. The in-memory keyring returned by NewKeyring silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. See references for individual vulnerability details...
CLEANSTART-2026-DM81687 Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation
CVE-2026-42508 affects multiple packages. Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. See references for individual vulnerability details...
CLEANSTART-2026-VA40669 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...
CVE-2026-56854 affects multiple packages. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability...
CLEANSTART-2026-BD72670 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...
CVE-2026-46595 affects multiple packages. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped. See references for individual vulnerability...
CLEANSTART-2026-FD78851 When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty pa...
CVE-2026-39834 affects multiple packages. When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. See references for individu...
CLEANSTART-2026-NH18274 When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh
CVE-2026-39832 affects multiple packages. When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh. See references for individual vulnerability details...
CLEANSTART-2026-GS23058 RSA and DSA public key parsers did not enforce size limits on key parameters
CVE-2026-39829 affects multiple packages. The RSA and DSA public key parsers did not enforce size limits on key parameters. See references for individual vulnerability details...
CLEANSTART-2026-ZR95195 Security fix for GHSA-f6x5-jh6r-wnfv applied in: cloud-provider-aws 1.34.1-r1
Security vulnerability affects the cloud-provider-aws package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-LC49486 Security fix for GHSA-j5w8-q4qc-rx2x applied in: gcp-compute-persistent-disk-csi-driver 1.22.3-r1, cloud-provider-aws 1.34.1-r1
GHSA-j5w8-q4qc-rx2x affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-ME34886 go-git is an extensible git implementation library written in pure Go
CVE-2026-71557 affects multiple packages. go-git is an extensible git implementation library written in pure Go. See references for individual vulnerability details...
CLEANSTART-2026-JT34415 OpenTelemetry-Go is the Go implementation of OpenTelemetry
CVE-2026-81870 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...
CLEANSTART-2026-XT59199 go-git is an extensible git implementation library written in pure Go
CVE-2026-71556 affects multiple packages. go-git is an extensible git implementation library written in pure Go. See references for individual vulnerability details...
CLEANSTART-2026-YX87977 Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default
Security vulnerability affects the flux-image-automation-controller package. Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default...
CLEANSTART-2026-NO64330 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion
CVE-2026-56859 affects multiple packages. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. See references for individual vulnerability details...
CLEANSTART-2026-WP65979 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not
CVE-2026-56862 affects multiple packages. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. See references for individual vulnerability details...
CLEANSTART-2026-UZ23021 Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0
Security vulnerability affects the temporal-server-fips package. Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0...
CLEANSTART-2026-AF18240 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface
CVE-2026-56853 affects multiple packages. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. See references for individual vulnerability details...
CLEANSTART-2026-ST96789 etcd is a distributed key-value store for the data of a distributed system
Security vulnerability affects the loki package. etcd is a distributed key-value store for the data of a distributed system...
CLEANSTART-2026-UE43947 Previously, resolving relative paths containing parent directory ('
CVE-2026-56860 affects multiple packages. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...
CLEANSTART-2026-NM10568 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS
CVE-2026-56858 affects multiple packages. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. See references for individual vulnerability details...
CLEANSTART-2026-TL99619 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures
CVE-2026-33818 affects multiple packages. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. See references for individual vulnerability details...
CLEANSTART-2026-MN51569 tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory
Security vulnerability affects the buildkitd package. The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory...
CLEANSTART-2026-GF20241 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
Security vulnerability affects the apache-superset package. ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript...
CLEANSTART-2026-KZ38920 vulnerability has been found in cilium ebpf up to 0
Security vulnerability affects the buildkitd package. A vulnerability has been found in cilium ebpf up to 0...
CLEANSTART-2026-DK31702 brace-expansion library generates arbitrary strings containing a common prefix and suffix
Security vulnerability affects the apache-superset package. The brace-expansion library generates arbitrary strings containing a common prefix and suffix...
CLEANSTART-2026-BO15897 PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it
Security vulnerability affects the apache-superset package. PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it...
CLEANSTART-2026-QQ47371 brace-expansion library generates arbitrary strings containing a common prefix and suffix
Security vulnerability affects the apache-superset package. The brace-expansion library generates arbitrary strings containing a common prefix and suffix...
CLEANSTART-2026-UQ05512 brace-expansion library generates arbitrary strings containing a common prefix and suffix
Security vulnerability affects the apache-superset package. The brace-expansion library generates arbitrary strings containing a common prefix and suffix...
CLEANSTART-2026-BA84358 On Unix systems, opening a file in an os
Security vulnerability affects the buildkitd package. On Unix systems, opening a file in an os...
CLEANSTART-2026-DS75678 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello
Security vulnerability affects the buildkitd package. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...
CLEANSTART-2026-UM77147 Security fix for GHSA-9g5q-2w5x-hmxf applied in: caddy 2.11.4-r1, step 0.30.2-r4
GHSA-9g5q-2w5x-hmxf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-YO03060 Security fix for GHSA-3fxj-6jh8-hvhx applied in: caddy 2.11.4-r1, step 0.30.2-r4
GHSA-3fxj-6jh8-hvhx affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-FZ48643 Security fix for GHSA-5cgq-3rg8-m6cv applied in: ollama-fips 0.34.4-r2
Security vulnerability affects the ollama-fips package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-PC74365 SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process
CVE-2025-47913 affects multiple packages. SSH clients receiving SSHAGENTSUCCESS when expecting a typed response will panic and cause early termination of the client process. See references for individual vulnerability details...
CLEANSTART-2026-ET25167 SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be re...
CVE-2025-22869 affects multiple packages. SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted. See references for...
CLEANSTART-2026-IE69074 malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop
CVE-2026-39830 affects multiple packages. A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. See references for individual vulnerability details...
CLEANSTART-2026-FE09696 SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption
CVE-2025-58181 affects multiple packages. SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption. See references for individual vulnerability details...
CLEANSTART-2026-MZ65178 SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read
CVE-2025-47914 affects multiple packages. SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read. See references for individual vulnerability details...
CLEANSTART-2026-KO65183 Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content
Security vulnerability affects the victoria-metrics package. Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content...
CLEANSTART-2026-AY85890 discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary
Security vulnerability affects the victoria-metrics package. A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary...
CLEANSTART-2026-DY81609 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succ...
Security vulnerability affects the victoria-metrics package. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed...
CLEANSTART-2026-TQ95555 archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened
Security vulnerability affects the victoria-metrics package. archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened...
CLEANSTART-2026-NF46642 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU
Security vulnerability affects the victoria-metrics package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...