11796 matches found
CLEANSTART-2026-BI76349 SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate
Security vulnerability affects the loki package. SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate...
CLEANSTART-2026-MH81237 For certain crafted inputs, a 'ed25519
Security vulnerability affects the loki package. For certain crafted inputs, a 'ed25519...
CLEANSTART-2026-PY35354 Security fix for GHSA-wf45-q9ch-q8gh applied in: loki 3.7.1-r1
Security vulnerability affects the loki package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-VC55522 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
CVE-2026-42502 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...
CLEANSTART-2026-HE86842 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
CVE-2026-42506 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...
CLEANSTART-2026-EE25517 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
CVE-2026-25681 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...
CLEANSTART-2026-MN47589 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service
CVE-2026-25680 affects multiple packages. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. See references for individual vulnerability details...
CLEANSTART-2026-YJ73507 NewNTUnicodeString does not check for string length overflow
Security vulnerability affects the loki package. NewNTUnicodeString does not check for string length overflow...
CLEANSTART-2026-HB43303 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
CVE-2026-27136 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...
CLEANSTART-2026-PR31494 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute
Security vulnerability affects the loki package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute...
CLEANSTART-2026-RQ22332 "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames
Security vulnerability affects the loki package. The "go tool pack" subcommand usually used only by the compiler as an internal tool with known-good inputs does not sanitize output filenames...
CLEANSTART-2026-WS35873 "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp")
Security vulnerability affects the loki package. The "go bug" command writes to two files with predictable names in the system temporary directory for example, "/tmp"...
CLEANSTART-2026-WV65132 Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0
Security vulnerability affects the loki package. Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0...
CLEANSTART-2026-CG56781 When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as fo...
Security vulnerability affects the loki package. When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded...
CLEANSTART-2026-QP25328 malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation
Security vulnerability affects the loki package. A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation...
CLEANSTART-2026-BY91929 Security fix for GHSA-hrxh-6v49-42gf applied in: loki 3.7.1-r2, secrets-store-csi-driver-provider-aws 3.1.4-r1
GHSA-hrxh-6v49-42gf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-DS50998 Prometheus is an open-source monitoring system and time series database
Security vulnerability affects the loki package. Prometheus is an open-source monitoring system and time series database...
CLEANSTART-2026-KU01035 (*x509
Security vulnerability affects the loki package. x509...
CLEANSTART-2026-WI70265 Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations
Security vulnerability affects the loki package. Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations...
CLEANSTART-2026-ES62774 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU
Security vulnerability affects the loki package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...
CLEANSTART-2026-HE08866 When returning errors, functions in the net/textproto package would include its input as part of the error
Security vulnerability affects the loki package. When returning errors, functions in the net/textproto package would include its input as part of the error...
CLEANSTART-2026-NW24142 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0
CVE-2026-33814 affects multiple packages. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0. See references for individual vulnerability details...
CLEANSTART-2026-DF36684 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...
Security vulnerability affects the loki package. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block...
CLEANSTART-2026-GQ93723 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322
Security vulnerability affects the loki package. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322...
CLEANSTART-2026-FO79285 ReverseProxy can forward queries containing parameters not visible to Rewrite functions
Security vulnerability affects the loki package. ReverseProxy can forward queries containing parameters not visible to Rewrite functions...
CLEANSTART-2026-CQ72737 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash
Security vulnerability affects the loki package. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...
CLEANSTART-2026-FK79056 Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)
Security vulnerability affects the loki package. The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL 0...
CLEANSTART-2026-FW47694 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not
Security vulnerability affects the loki package. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not...
CLEANSTART-2026-YE69466 gRPC-Go is the Go language implementation of gRPC
CVE-2026-84304 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-VW95960 gRPC-Go is the Go language implementation of gRPC
CVE-2026-84303 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-FL18888 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures
Security vulnerability affects the loki package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...
CLEANSTART-2026-IC69892 etcd is a distributed key-value store for the data of a distributed system
Security vulnerability affects the loki package. etcd is a distributed key-value store for the data of a distributed system...
CLEANSTART-2026-PK17685 Prometheus is an open-source monitoring system and time series database
Security vulnerability affects the loki package. Prometheus is an open-source monitoring system and time series database...
CLEANSTART-2026-YT70018 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface
Security vulnerability affects the loki package. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...
CLEANSTART-2026-UV13195 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer
CVE-2026-46600 affects multiple packages. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...
CLEANSTART-2026-BE87842 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion
Security vulnerability affects the loki package. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
CLEANSTART-2026-GN20091 Previously, resolving relative paths containing parent directory ('
Security vulnerability affects the loki package. Previously, resolving relative paths containing parent directory '...
CLEANSTART-2026-CD74178 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
CVE-2026-39821 affects multiple packages. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...
CLEANSTART-2026-BN60910 Prometheus is an open-source monitoring system and time series database
Security vulnerability affects the loki package. Prometheus is an open-source monitoring system and time series database...
CLEANSTART-2026-DZ88780 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS
Security vulnerability affects the loki package. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...
CLEANSTART-2026-KI81212 gRPC-Go is the Go language implementation of gRPC
CVE-2026-84445 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-JK20975 OpenTelemetry-Go is the Go implementation of OpenTelemetry
Security vulnerability affects the loki package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...
CLEANSTART-2026-HD45306 OpenTelemetry-Go is the Go implementation of OpenTelemetry
CVE-2026-81870 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...
CLEANSTART-2026-OE88191 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection
Security vulnerability affects the loki package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection...
CLEANSTART-2026-RY51837 Previously, a channel registered in the mux's chanList is not usable until it is established
Security vulnerability affects the loki package. Previously, a channel registered in the mux's chanList is not usable until it is established...
CLEANSTART-2026-DY58341 Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID
Security vulnerability affects the apache-nifi package. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID...
CLEANSTART-2026-MR78444 UTF8DataInputJsonParser
Security vulnerability affects the apache-nifi package. UTF8DataInputJsonParser...
CLEANSTART-2026-MS81723 NumberInput
Security vulnerability affects the apache-nifi package. NumberInput...
CLEANSTART-2026-ZW78541 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not
CVE-2026-56862 affects multiple packages. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. See references for individual vulnerability details...
CLEANSTART-2026-UB80318 Security fix for GHSA-gcjh-h69q-9w9g applied in: kube-state-metrics 2.19.1-r3, kube-state-metrics 2.17.0-r6, kube-state-metrics 2.18.0-r9
GHSA-gcjh-h69q-9w9g affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...