CLEANSTART-2026-AU10912 SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate

CVE-2026-39835 affects multiple packages. SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. See references for individual vulnerability details...

CLEANSTART-2026-AH42330 Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation

CVE-2026-42508 affects multiple packages. Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. See references for individual vulnerability details...

CLEANSTART-2026-OX02272 Security fix for GHSA-259r-337f-4rfw applied in: dex-fips 2.42.1-r5, nfs-subdir-external-provisioner 4.0.2-r2, temporal-server 1.31.3-r2

GHSA-259r-337f-4rfw affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UP81071 Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0

Security vulnerability affects the temporal-server package. Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0...

CLEANSTART-2026-LS69569 On Unix platforms, when listing the contents of a directory using File

Security vulnerability affects the temporal-server package. On Unix platforms, when listing the contents of a directory using File...

CLEANSTART-2026-IT36341 On Linux, if the target of Root

Security vulnerability affects the temporal-server package. On Linux, if the target of Root...

CLEANSTART-2026-MX72137 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

Security vulnerability affects the temporal-server package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute...

CLEANSTART-2026-WJ82120 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-81870 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-GZ31996 Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used

Security vulnerability affects the temporal-server package. Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used...

CLEANSTART-2026-YK14292 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the temporal-server package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-NA69133 Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints

Security vulnerability affects the temporal-server package. Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints...

CLEANSTART-2026-RH86029 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...

Security vulnerability affects the temporal-server package. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block...

CLEANSTART-2026-SB67657 Security fix for GHSA-hrxh-6v49-42gf applied in: temporal-server 1.31.3-r2

Security vulnerability affects the temporal-server package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-MM79132 Actions which insert URLs into the content attribute of HTML meta tags are not escaped

Security vulnerability affects the temporal-server package. Actions which insert URLs into the content attribute of HTML meta tags are not escaped...

CLEANSTART-2026-PF50810 When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint

Security vulnerability affects the temporal-server package. When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint...

CLEANSTART-2026-AE01464 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

Security vulnerability affects the temporal-server package. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...

CLEANSTART-2026-QS35295 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

Security vulnerability affects the temporal-server package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...

CLEANSTART-2026-SZ20487 tar

Security vulnerability affects the temporal-server package. tar...

CLEANSTART-2026-UN38263 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not

Security vulnerability affects the temporal-server package. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not...

CLEANSTART-2026-JZ54456 On Unix systems, opening a file in an os

Security vulnerability affects the temporal-server package. On Unix systems, opening a file in an os...

CLEANSTART-2026-MC77082 ReverseProxy can forward queries containing parameters not visible to Rewrite functions

Security vulnerability affects the temporal-server package. ReverseProxy can forward queries containing parameters not visible to Rewrite functions...

CLEANSTART-2026-FF24840 When returning errors, functions in the net/textproto package would include its input as part of the error

Security vulnerability affects the temporal-server package. When returning errors, functions in the net/textproto package would include its input as part of the error...

CLEANSTART-2026-AZ00076 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

Security vulnerability affects the temporal-server package. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

CLEANSTART-2026-DT87219 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Security vulnerability affects the temporal-server package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label...

CLEANSTART-2026-HQ29717 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

Security vulnerability affects the temporal-server package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...

CLEANSTART-2026-VB00141 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

Security vulnerability affects the temporal-server package. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...

CLEANSTART-2026-ST40706 url

Security vulnerability affects the temporal-server package. url...

CLEANSTART-2026-TG48757 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash

Security vulnerability affects the temporal-server package. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...

CLEANSTART-2026-FK38157 Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service

Security vulnerability affects the temporal-server package. Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service...

CLEANSTART-2026-LG62775 (*x509

Security vulnerability affects the temporal-server package. x509...

CLEANSTART-2026-DX00522 If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources

Security vulnerability affects the temporal-server package. If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources...

CLEANSTART-2026-KT14793 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

Security vulnerability affects the temporal-server package. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...

CLEANSTART-2026-OD21402 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322

Security vulnerability affects the temporal-server package. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322...

CLEANSTART-2026-KS11045 Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations

Security vulnerability affects the temporal-server package. Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations...

CLEANSTART-2026-HI32575 When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will...

Security vulnerability affects the temporal-server package. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the...

CLEANSTART-2026-CN39298 During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions

Security vulnerability affects the temporal-server package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions...

CLEANSTART-2026-FA40007 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

Security vulnerability affects the temporal-server package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

CLEANSTART-2026-GL68033 Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)

Security vulnerability affects the temporal-server package. The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL 0...

CLEANSTART-2026-IC49054 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

Security vulnerability affects the temporal-server package. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

CLEANSTART-2026-YE75739 Previously, resolving relative paths containing parent directory ('

Security vulnerability affects the temporal-server package. Previously, resolving relative paths containing parent directory '...

CLEANSTART-2026-JD93552 When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory

Security vulnerability affects the python3 package. When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory...

CLEANSTART-2026-AI33575 Security fix for ghsa-9h8m-3fm2-qjrq applied in: cosign 3.0.5-r0

Security vulnerability affects the cosign package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-DK20803 Security fix for GHSA-6wxm-mpqj-6jpf applied in: nfs-subdir-external-provisioner 4.0.2-r0

Security vulnerability affects the nfs-subdir-external-provisioner package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-UP16119 Security fix for GHSA-cg3q-j54f-5p7p applied in: nfs-subdir-external-provisioner 4.0.2-r0

Security vulnerability affects the nfs-subdir-external-provisioner package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-BZ31858 Security fix for GHSA-6v2p-p543-phr9 applied in: nfs-subdir-external-provisioner 4.0.2-r0

Security vulnerability affects the nfs-subdir-external-provisioner package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-JX77218 Kubernetes kube-apiserver in versions v1

Security vulnerability affects the nfs-subdir-external-provisioner package. The Kubernetes kube-apiserver in versions v1...

CLEANSTART-2026-TF89729 security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node

Security vulnerability affects the nfs-subdir-external-provisioner package. A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node...

CLEANSTART-2026-XK97843 HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023

Security vulnerability affects the go package. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

CLEANSTART-2026-CU11188 Security fix for GHSA-f6x5-jh6r-wrfv applied in: go1.27 1.25.5-r0

Security vulnerability affects the go1.27 package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-DP92831 Security fix for GHSA-j5w8-q4qc-rx2x applied in: go1.27 1.25.5-r0

Security vulnerability affects the go1.27 package. This issue is resolved in later releases. See references for vulnerability details...