CLEANSTART-2026-RM04756 Security fix for GHSA-gcjh-h69q-9w9g applied in: cert-manager 1.17.4-r6

Security vulnerability affects the cert-manager package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-DT35013 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the cert-manager package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-AJ86283 etcd is a distributed key-value store for the data of a distributed system

Security vulnerability affects the cert-manager package. etcd is a distributed key-value store for the data of a distributed system...

CLEANSTART-2026-DZ84628 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the cert-manager package. gRPC-Go is the Go language implementation of gRPC...

CLEANSTART-2026-OM77164 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-VT22987 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84445 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-MH20908 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

CVE-2026-97032 affects multiple packages. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. See references for individual vulnerability details...

CLEANSTART-2026-SL63462 When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression

CVE-2026-94448 affects multiple packages. When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. See references for individual vulnerability details...

CLEANSTART-2026-UM98418 Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes

CVE-2026-94440 affects multiple packages. Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes. See references for individual vulnerability details...

CLEANSTART-2026-IS42310 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the conne...

CVE-2026-94439 affects multiple packages. When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. See references for individual vulnerability details...

CLEANSTART-2026-BQ73969 jackson-databind's deserializer for java

Security vulnerability affects the apache-zookeeper package. jackson-databind's deserializer for java...

CLEANSTART-2026-HB03857 DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator

Security vulnerability affects the apache-zookeeper package. DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator...

CLEANSTART-2026-XJ89582 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

CVE-2026-78669 affects multiple packages. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values. See references for individual vulnerability...

CLEANSTART-2026-PZ04696 Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specify...

CVE-2026-97031 affects multiple packages. Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. See references for individual...

CLEANSTART-2026-YF57213 When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU

CVE-2026-78667 affects multiple packages. When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU. See references for individual vulnerability details...

CLEANSTART-2026-JD77891 jackson-databind binds a JSON string to a javax

Security vulnerability affects the apache-zookeeper package. jackson-databind binds a JSON string to a javax...

CLEANSTART-2026-LY16502 Security fix for GHSA-whvh-wf3x-g77j applied in: tensorflow-gpu-jupyter 2.18.1-r0

Security vulnerability affects the tensorflow-gpu-jupyter package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-ED51951 Security fix for GHSA-h5v5-8746-g7mm applied in: tensorflow-gpu-jupyter 2.18.1-r0

Security vulnerability affects the tensorflow-gpu-jupyter package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-AA89451 JLine is a Java library for handling console input

Security vulnerability affects the apache-zookeeper package. JLine is a Java library for handling console input...

CLEANSTART-2026-IS00308 JLine is a Java library for handling console input

Security vulnerability affects the apache-zookeeper package. JLine is a Java library for handling console input...

CLEANSTART-2026-IM74303 client may issue specially crafted HTTP/1

Security vulnerability affects the apache-zookeeper package. A client may issue specially crafted HTTP/1...

CLEANSTART-2026-XA13767 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...

CLEANSTART-2026-AH69997 JLine is a Java library for handling console input

Security vulnerability affects the apache-zookeeper package. JLine is a Java library for handling console input...

CLEANSTART-2026-NU47623 Security fix for GHSA-89vp-jrxv-24w8 applied in: tensorflow-gpu-jupyter 2.18.1-r0

Security vulnerability affects the tensorflow-gpu-jupyter package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-OY78254 TypeDeserializerBase

Security vulnerability affects the apache-zookeeper package. TypeDeserializerBase...

CLEANSTART-2026-XT22555 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID

Security vulnerability affects the apache-zookeeper package. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID...

CLEANSTART-2026-BG25300 On Windows, when the target of Root

CVE-2026-56857 affects multiple packages. On Windows, when the target of Root. See references for individual vulnerability details...

CLEANSTART-2026-QN00727 UTF8DataInputJsonParser

Security vulnerability affects the apache-zookeeper package. UTF8DataInputJsonParser...

CLEANSTART-2026-JZ86635 Security fix for GHSA-pppj-hq3g-57pj applied in: tensorflow-gpu-jupyter 2.18.1-r0

Security vulnerability affects the tensorflow-gpu-jupyter package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-PG40177 NumberInput

Security vulnerability affects the apache-zookeeper package. NumberInput...

CLEANSTART-2026-SP63769 Security fix for GHSA-gx64-gj6p-pc4c applied in: tensorflow-gpu-jupyter 2.18.1-r0

Security vulnerability affects the tensorflow-gpu-jupyter package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-SU71305 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

CVE-2026-78659 affects multiple packages. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request. See references for individual vulnerability details...

CLEANSTART-2026-XC27558 When http

CVE-2026-56866 affects multiple packages. When http. See references for individual vulnerability details...

CLEANSTART-2026-KS88992 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

CVE-2026-78660 affects multiple packages. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. See references for individual vulnerability details...

CLEANSTART-2026-NJ79271 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Security vulnerability affects the gitea package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection...

CLEANSTART-2026-VR61817 amqp091-go is a Go AMQP 0

Security vulnerability affects the opentelemetry-collector-contrib package. amqp091-go is a Go AMQP 0...

CLEANSTART-2026-DC26983 Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled

Security vulnerability affects the gitea package. Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled...

CLEANSTART-2026-RN01361 Previously, a channel registered in the mux's chanList is not usable until it is established

Security vulnerability affects the gitea package. Previously, a channel registered in the mux's chanList is not usable until it is established...

CLEANSTART-2026-EV52382 RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes

CVE-2026-106123 affects multiple packages. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. See references for individual vulnerability details...

CLEANSTART-2026-VZ71675 yawkat LZ4 Java provides LZ4 compression for Java

CVE-2026-106453 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-HX04785 yawkat LZ4 Java provides LZ4 compression for Java

CVE-2026-106452 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-JZ50665 RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes

CVE-2026-106122 affects multiple packages. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. See references for individual vulnerability details...

CLEANSTART-2026-HP65010 RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes

CVE-2026-106121 affects multiple packages. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. See references for individual vulnerability details...

CLEANSTART-2026-YP08378 yawkat LZ4 Java provides LZ4 compression for Java

CVE-2026-106451 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-WC49025 yawkat LZ4 Java provides LZ4 compression for Java

CVE-2026-106449 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-CE18531 yawkat LZ4 Java provides LZ4 compression for Java

CVE-2026-106450 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-QJ90552 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

CVE-2026-97032 affects multiple packages. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. See references for individual vulnerability details...

CLEANSTART-2026-KA94544 Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specify...

CVE-2026-97031 affects multiple packages. Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. See references for individual...

CLEANSTART-2026-WJ95486 When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU

CVE-2026-78667 affects multiple packages. When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU. See references for individual vulnerability details...

CLEANSTART-2026-KA26751 trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped

CVE-2026-97030 affects multiple packages. A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. See references for individual vulnerability details...