CLEANSTART-2026-GM89854 SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate

Security vulnerability affects the kube-state-metrics-fips package. SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate...

CLEANSTART-2026-PE66600 In Eclipse Jetty, a first HTTP/1

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, a first HTTP/1...

CLEANSTART-2026-BR90501 non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)

Security vulnerability affects the apache-nifi package. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters...

CLEANSTART-2026-IO10206 in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it

Security vulnerability affects the kube-state-metrics-fips package. The in-memory keyring returned by NewKeyring silently accepted keys with the ConfirmBeforeUse constraint but never enforced it...

CLEANSTART-2026-AI26012 When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty pa...

Security vulnerability affects the kube-state-metrics-fips package. When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress...

CLEANSTART-2026-HR51503 In Eclipse Jetty, an HTTP URI of this form: /public;/

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, an HTTP URI of this form: /public;/...

CLEANSTART-2026-EQ95867 In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes...

CLEANSTART-2026-WX23354 In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present...

CLEANSTART-2026-TX77163 When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh

Security vulnerability affects the kube-state-metrics-fips package. When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh...

CLEANSTART-2026-FS18704 malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop

Security vulnerability affects the kube-state-metrics-fips package. A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop...

CLEANSTART-2026-GI93885 In Eclipse Jetty, the HTTP/1

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, the HTTP/1...

CLEANSTART-2026-AM26944 In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable...

CLEANSTART-2026-HN45424 Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh

Security vulnerability affects the kube-state-metrics-fips package. The Verify method for FIDO/U2F security key types sk-ecdsa-sha2-nistp256@openssh...

CLEANSTART-2026-LM88265 RSA and DSA public key parsers did not enforce size limits on key parameters

Security vulnerability affects the kube-state-metrics-fips package. The RSA and DSA public key parsers did not enforce size limits on key parameters...

CLEANSTART-2026-GS83780 In Eclipse Jetty, versions 12

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, versions 12...

CLEANSTART-2026-WE49283 Apache NiFi 1

Security vulnerability affects the apache-nifi package. Apache NiFi 1...

CLEANSTART-2026-WD31763 When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as fo...

Security vulnerability affects the kube-state-metrics-fips package. When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second facto...

CLEANSTART-2026-UC97457 Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics

Security vulnerability affects the apache-nifi package. The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics...

CLEANSTART-2026-TF22707 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

Security vulnerability affects the kube-state-metrics-fips package. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users...

CLEANSTART-2026-HF44570 Critical XXE in Apache Tika tika-core (1

Security vulnerability affects the apache-nifi package. Critical XXE in Apache Tika tika-core 1...

CLEANSTART-2026-KF94035 Out-of-bounds memory operations in org

Security vulnerability affects the apache-nifi package. Out-of-bounds memory operations in org...

CLEANSTART-2026-EJ17153 Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs

Security vulnerability affects the apache-nifi package. The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs...

CLEANSTART-2026-SF11650 NewNTUnicodeString does not check for string length overflow

Security vulnerability affects the kube-state-metrics-fips package. NewNTUnicodeString does not check for string length overflow...

CLEANSTART-2026-VN01735 In Jakarta Mail versions prior to 2

Security vulnerability affects the apache-nifi package. In Jakarta Mail versions prior to 2...

CLEANSTART-2026-TW91822 In Eclipse Jetty, versions <=9

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, versions =9...

CLEANSTART-2026-NP15118 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Security vulnerability affects the kube-state-metrics-fips package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label...

CLEANSTART-2026-MS35151 In Eclipse Jetty versions 12

Security vulnerability affects the apache-nifi package. In Eclipse Jetty versions 12...

CLEANSTART-2026-GN63905 In jose4j before 0

Security vulnerability affects the apache-nifi package. In jose4j before 0...

CLEANSTART-2026-LU46498 "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames

Security vulnerability affects the kube-state-metrics-fips package. The "go tool pack" subcommand usually used only by the compiler as an internal tool with known-good inputs does not sanitize output filenames...

CLEANSTART-2026-VA36880 "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp")

Security vulnerability affects the kube-state-metrics-fips package. The "go bug" command writes to two files with predictable names in the system temporary directory for example, "/tmp"...

CLEANSTART-2026-DO16074 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the kube-state-metrics-fips package. gRPC-Go is the Go language implementation of gRPC...

CLEANSTART-2026-QL41079 Arithmetic over induction variables in loops were not correctly checked for underflow or overflow

Security vulnerability affects the kube-state-metrics-fips package. Arithmetic over induction variables in loops were not correctly checked for underflow or overflow...

CLEANSTART-2026-KZ49511 compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, ...

Security vulnerability affects the kube-state-metrics-fips package. The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memor...

CLEANSTART-2026-OK73778 SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass

Security vulnerability affects the kube-state-metrics-fips package. SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass...

CLEANSTART-2026-TB40408 Actions which insert URLs into the content attribute of HTML meta tags are not escaped

CVE-2026-27142 affects multiple packages. Actions which insert URLs into the content attribute of HTML meta tags are not escaped. See references for individual vulnerability details...

CLEANSTART-2026-MZ79050 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the kube-state-metrics-fips package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

CLEANSTART-2026-PF53070 On Unix platforms, when listing the contents of a directory using File

CVE-2026-27139 affects multiple packages. On Unix platforms, when listing the contents of a directory using File. See references for individual vulnerability details...

CLEANSTART-2026-ZH81930 JLine is a Java library for handling console input

Security vulnerability affects the elasticsearch package. JLine is a Java library for handling console input...

CLEANSTART-2026-HL08395 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the kube-state-metrics-fips package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

CLEANSTART-2026-SI53222 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service

Security vulnerability affects the kube-state-metrics-fips package. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...

CLEANSTART-2026-KC38093 Security fix for GHSA-9h8m-3fm2-qjrq applied in: kube-state-metrics-fips 2.18.0-r2

Security vulnerability affects the kube-state-metrics-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-SL87609 url

CVE-2026-25679 affects multiple packages. url. See references for individual vulnerability details...

CLEANSTART-2026-QV05313 Security fix for GHSA-gcjh-h69q-9w9g applied in: kube-state-metrics-fips 2.18.0-r4

Security vulnerability affects the kube-state-metrics-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-GG34182 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the kube-state-metrics-fips package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-KG16393 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84303 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-DV58280 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84445 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-HH19217 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-JP88303 Previously, a channel registered in the mux's chanList is not usable until it is established

Security vulnerability affects the kube-state-metrics-fips package. Previously, a channel registered in the mux's chanList is not usable until it is established...

CLEANSTART-2026-KJ60632 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Security vulnerability affects the kube-state-metrics-fips package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595...

CLEANSTART-2026-SF83107 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not

Security vulnerability affects the kube-state-metrics-fips package. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not...