Package Search Help
You can use boolean logic (e.g. AND/OR/NOT) for complex search queries. For more help and examples, see the search documentation.
Search by package name:
my-package (implicit)
name:my-package (explicit)
Search by package filename:
filename:my-package.ext
Search by package tag:
tag:latest
Search by package version:
version:1.0.0
prerelease:true (prereleases)
prerelease:false (no prereleases)
Search by package architecture:
architecture:x86_64
Search by package distribution:
distribution:el
Search by package license:
license:MIT
Search by package format:
format:deb
Search by package status:
status:in_progress
Search by package file checksum:
checksum:5afba
Search by package security status:
severity:critical
Search by package vulnerabilities:
vulnerabilities:>1
vulnerabilities:<1000
Search by # of package downloads:
downloads:>8
downloads:<100
Search by package type:
type:binary
type:source
Search by package size (bytes):
size:>50000
size:<10000
Search by dependency name/version:
dependency:log4j
dependency:log4j=1.0.0
dependency:log4j>1.0.0
Search by uploaded date:
uploaded:>"1 day ago"
uploaded:<"August 14, 2022 EST"
Search by entitlement token (identifier):
entitlement:3lKPVJPosCsY
Search by policy violation:
policy_violated:true
deny_policy_violated:true
license_policy_violated:true
vulnerability_policy_violated:true
Search by repository:
repository:repo-name
Search by last download date:
last_downloaded:<"30 days ago"
last_downloaded:>"August 14, 2022 EST"
Search queries for all Debian-specific (and related) package types
Search by component:
deb_component:unstable
Search queries for all Maven-specific (and related) package types
Search by group ID:
maven_group_id:org.apache
Search queries for all Docker-specific (and related) package types
Search by image digest:
docker_image_digest:sha256:7c5..6d4
(full hashref only)
Search by layer digest:
docker_layer_digest:sha256:4c4..ae4
(full hashref only)
Search queries for all Generic-specific package types
Search by file path:
generic_filepath:path/to/file.txt
Search by directory:
generic_directory:path/to
Field type modifiers (depending on the type, you can influence behaviour)
For all queries, you can use:
~foo for negation
For string queries, you can use:
^foo to anchor to start of term
foo$ to anchor to end of term
foo*bar for fuzzy matching
For number/date or version queries, you can use:
>foo for values greater than
>=foo for values greater / equal
<foo for values less than
<=foo for values less / equal
Need a secure and centralised artifact repository to deliver Alpine,
Cargo,
CocoaPods,
Composer,
Conan,
Conda,
CRAN,
Dart,
Debian,
Docker,
Generic,
Go,
Helm,
Hex,
HuggingFace,
LuaRocks,
Maven,
MCP,
npm,
NuGet,
P2,
Python,
RedHat,
Ruby,
Swift,
Terraform,
Vagrant,
VSX,
Raw & More packages?
Cloudsmith is the new standard in Package / Artifact Management and Software Distribution.
With support for all major package formats, you can trust us to manage your software supply chain.
tetrate
(Tetrate)
/
getistio-containers
Tetrate Istio Distro project (formerly GetIstio) container images registry
proxyv2
01703ee62ba870054783d55775b…
One-liner (summary)
A certifiably-awesome package curated by Bender Rodriguez, hosted by Cloudsmith.
Description
A certifiably-awesome package curated by Bender Rodriguez, hosted by Cloudsmith.
| Status | Completed |
|---|---|
| Checksum (MD5) | 9a9054772f1b8879b461700bb8a23af7 |
| Checksum (SHA-1) | 8915f7c115169b1459c51360bbd361892bb7df9a |
| Checksum (SHA-256) | 01703ee62ba870054783d55775b4913c27fe5873433ebd309df67404f19d885a |
| Checksum (SHA-512) | 2d1088a4adf22ae01ca991c8efc94523eda93291dcb60a8a1af8950b40ca5a3735… |
| GPG Signature | |
| GPG Fingerprint | 7490c226a7c21a19bb1d09e800b3a57eef287d7b |
| Storage Region | Dublin, Ireland |
| Type | Binary (contains binaries and binary artifacts) |
| Uploaded At | 1 month ago |
| Uploaded By |
|
| Slug Id | proxyv2-3ft4 |
| Unique Id | wsMwZcqYvzrn |
| Version (Raw) | 01703ee62ba870054783d55775b4913c27fe5873433ebd309df67404f19d885a |
| Version (Parsed) |
|
| docker-specific metadata | |
| Image Digest | sha256:01703ee62ba870054783d55775b4913c27fe5873433ebd309df67404f19d885a |
| Config Digest | sha256:5756240b4a77b0b6a39fbb41e6260abe9ec7fba1a1b17bfdee63a8eca851fce1 |
| V1 OCI Index Digest | sha256:62dd2ad103eb5d31de5dfd5716c12d189f983dc637b3460c5a8fd8ec8fbc1606 |
| V1 Distribution (Signed) Digest | sha256:0de50a936238aef87c39b7420904484c5b47367a2f770fba6958ad7ae3ed9b70 |
| V1 OCI Digest | sha256:03959ae89ceafe4a3212798d08062c6d772f9c77460a4f9c269c61c49ad8ba54 |
| V2 Distribution List Digest | sha256:c1ec3e4447a8f98df7ce4bc3e21b9a672b460706f3f33ea8033640a49c78badf |
| V1 Distribution Digest | sha256:634226b7e2eea5c704192d634f391892b460155fa5b71aac584725a0599e648d |
| V2 Distribution Digest | sha256:01703ee62ba870054783d55775b4913c27fe5873433ebd309df67404f19d885a |
| extended metadata | |
| Manifest Type | V2 Distribution |
| Architecture | amd64 |
| Author | github.com/chainguard-dev/apko |
| Config | |
| Created | 2026-06-04 11:38:08 UTC |
| Os | linux |
This package was uploaded with the following V2 Distribution manifest:
{"schemaVersion":2,"mediaType":"application/vnd.docker.distribution.manifest.v2+json","config":{"mediaType":"application/vnd.docker.container.image.v1+json","size":2798,"digest":"sha256:db1ac9b3ff14fde7679dfb7b8afe8ae93c37108bc41f942563148ff3f209e40d"},"layers":[{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","size":7979432,"digest":"sha256:0b11edac5cf31d533fe3b8140598b696df39d336ca5a459cf7d6f4f7bd79686a"},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","size":5046,"digest":"sha256:0d1934e7553b26bb81eace020913d4b7b3df802fe2a66be1adcf7cdd0c4975b5"},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","size":39596923,"digest":"sha256:d2a996c979bfcf2e7b872f0dd749b07c08c5236f93eebb58a4dcf5f9480f8ae2"},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","size":10369714,"digest":"sha256:557deb330be167d39a9c795f975fa415f8bc21fc40f6c77fd58f6d53e55b6bd4"}]}Last scanned
1 month ago
Scan result
Vulnerable
Vulnerability count
31
Max. severity
Critical| Target: | wsMwZcqYvzrn.sbom-cyclonedx.json (wolfi 20230201) | |
| MEDIUM |
CVE-2026-4046: glibc: glibc: Denial of Service via iconv() function with specific character setsThe iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.Package Name: glibc Installed Version: 2.43-r0 Fixed Version: 2.43-r6 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org inbox.sourceware.org linux.oracle.com linux.oracle.com nvd.nist.gov packages.fedoraproject.org sourceware.org sourceware.org sourceware.org www.cve.org |
|
| MEDIUM |
CVE-2026-4437: glibc: glibc: Incorrect DNS response parsing via crafted DNS server responseCalling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.Package Name: glibc Installed Version: 2.43-r0 Fixed Version: 2.43-r4 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov sourceware.org www.cve.org www.openwall.com |
|
| MEDIUM |
CVE-2026-5450: glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large widthCalling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.Package Name: glibc Installed Version: 2.43-r0 Fixed Version: 2.43-r7 References: access.redhat.com inbox.sourceware.org nvd.nist.gov nvd.nist.gov sourceware.org www.cve.org |
|
| MEDIUM |
CVE-2026-5928: glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodingsCalling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.Package Name: glibc Installed Version: 2.43-r0 Fixed Version: 2.43-r7 References: access.redhat.com nvd.nist.gov sourceware.org www.cve.org |
|
| MEDIUM |
CVE-2026-4046: glibc: glibc: Denial of Service via iconv() function with specific character setsThe iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.Package Name: glibc-locale-posix Installed Version: 2.43-r0 Fixed Version: 2.43-r6 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org inbox.sourceware.org linux.oracle.com linux.oracle.com nvd.nist.gov packages.fedoraproject.org sourceware.org sourceware.org sourceware.org www.cve.org |
|
| MEDIUM |
CVE-2026-4437: glibc: glibc: Incorrect DNS response parsing via crafted DNS server responseCalling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.Package Name: glibc-locale-posix Installed Version: 2.43-r0 Fixed Version: 2.43-r4 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov sourceware.org www.cve.org www.openwall.com |
|
| MEDIUM |
CVE-2026-5450: glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large widthCalling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.Package Name: glibc-locale-posix Installed Version: 2.43-r0 Fixed Version: 2.43-r7 References: access.redhat.com inbox.sourceware.org nvd.nist.gov nvd.nist.gov sourceware.org www.cve.org |
|
| MEDIUM |
CVE-2026-5928: glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodingsCalling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.Package Name: glibc-locale-posix Installed Version: 2.43-r0 Fixed Version: 2.43-r7 References: access.redhat.com nvd.nist.gov sourceware.org www.cve.org |
|
| MEDIUM |
CVE-2026-4046: glibc: glibc: Denial of Service via iconv() function with specific character setsThe iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.Package Name: ld-linux Installed Version: 2.43-r0 Fixed Version: 2.43-r6 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org inbox.sourceware.org linux.oracle.com linux.oracle.com nvd.nist.gov packages.fedoraproject.org sourceware.org sourceware.org sourceware.org www.cve.org |
|
| MEDIUM |
CVE-2026-4437: glibc: glibc: Incorrect DNS response parsing via crafted DNS server responseCalling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.Package Name: ld-linux Installed Version: 2.43-r0 Fixed Version: 2.43-r4 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov sourceware.org www.cve.org www.openwall.com |
|
| MEDIUM |
CVE-2026-5450: glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large widthCalling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.Package Name: ld-linux Installed Version: 2.43-r0 Fixed Version: 2.43-r7 References: access.redhat.com inbox.sourceware.org nvd.nist.gov nvd.nist.gov sourceware.org www.cve.org |
|
| MEDIUM |
CVE-2026-5928: glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodingsCalling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.Package Name: ld-linux Installed Version: 2.43-r0 Fixed Version: 2.43-r7 References: access.redhat.com nvd.nist.gov sourceware.org www.cve.org |
|
| LOW |
CVE-2026-4438: glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functionsCalling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.Package Name: glibc Installed Version: 2.43-r0 Fixed Version: 2.43-r4 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov sourceware.org www.cve.org www.openwall.com |
|
| LOW |
CVE-2026-4438: glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functionsCalling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.Package Name: glibc-locale-posix Installed Version: 2.43-r0 Fixed Version: 2.43-r4 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov sourceware.org www.cve.org www.openwall.com |
|
| LOW |
CVE-2026-4438: glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functionsCalling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.Package Name: ld-linux Installed Version: 2.43-r0 Fixed Version: 2.43-r4 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org nvd.nist.gov sourceware.org www.cve.org www.openwall.com |
|
| Target: | usr/local/bin/pilot-agent | |
| CRITICAL |
CVE-2026-33186: google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validationgRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.Package Name: google.golang.org/grpc Installed Version: v1.75.1 Fixed Version: 1.79.3 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com nvd.nist.gov www.cve.org |
|
| HIGH |
CVE-2025-15558: docker/cli: Docker CLI for Windows: Privilege escalation via malicious plugin binariesDocker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user. This issue affects Docker CLI: through 29.1.5 and Windows binaries acting as a CLI-plugin manager using the github.com/docker/cli/cli-plugins/manager https://pkg.go.dev/github.com/docker/cli@v29.1.5+incompatible/cli-plugins/manager package, such as Docker Compose. This issue does not impact non-Windows binaries, and projects not using the plugin-manager code.Package Name: github.com/docker/cli Installed Version: v28.3.3+incompatible Fixed Version: 29.2.0 References: access.redhat.com docs.docker.com docs.docker.com github.com github.com github.com github.com github.com nvd.nist.gov www.cve.org www.zerodayinitiative.com www.zerodayinitiative.com |
|
| HIGH |
CVE-2026-34986: github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) objectGo JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed in 4.1.4 and 3.0.5.Package Name: github.com/go-jose/go-jose/v4 Installed Version: v4.1.2 Fixed Version: 4.1.4 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org github.com github.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev www.cve.org |
|
| HIGH |
CVE-2026-29181: github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Denial of Service via crafted multi-value baggage headersOpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. This allows an attacker to amplify cpu and allocations by sending many baggage: header lines, even when each individual value is within the 8192-byte per-value parse limit. This vulnerability is fixed in 1.41.0.Package Name: go.opentelemetry.io/otel Installed Version: v1.37.0 Fixed Version: 1.41.0 References: access.redhat.com github.com github.com github.com github.com github.com nvd.nist.gov www.cve.org |
|
| HIGH |
CVE-2026-24051: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH HijackingOpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application. A fix was released with v1.40.0.Package Name: go.opentelemetry.io/otel/sdk Installed Version: v1.37.0 Fixed Version: 1.40.0 References: github.com github.com github.com nvd.nist.gov pkg.go.dev |
|
| HIGH |
CVE-2026-39883: github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Arbitrary code execution via PATH hijacking on BSD/SolarisOpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. This vulnerability is fixed in 1.43.0.Package Name: go.opentelemetry.io/otel/sdk Installed Version: v1.37.0 Fixed Version: 1.43.0 References: github.com access.redhat.com github.com github.com nvd.nist.gov www.cve.org |
|
| HIGH |
CVE-2026-25679: net/url: Incorrect parsing of IPv6 host literals in net/urlurl.Parse insufficiently validated the host/authority component and accepted some invalid URLs.Package Name: stdlib Installed Version: v1.24.13 Fixed Version: 1.25.8, 1.26.1 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org errata.almalinux.org errata.rockylinux.org go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev www.cve.org |
|
| HIGH |
CVE-2026-32280: crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain buildingDuring chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.Package Name: stdlib Installed Version: v1.24.13 Fixed Version: 1.25.9, 1.26.2 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev www.cve.org |
|
| HIGH |
CVE-2026-32281: crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validationValidating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.Package Name: stdlib Installed Version: v1.24.13 Fixed Version: 1.25.9, 1.26.2 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org go.dev go.dev groups.google.com nvd.nist.gov pkg.go.dev www.cve.org |
|
| HIGH |
CVE-2026-32283: crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messagesIf one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.Package Name: stdlib Installed Version: v1.24.13 Fixed Version: 1.25.9, 1.26.2 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev www.cve.org |
|
| HIGH |
CVE-2026-33811: net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAMEWhen using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.Package Name: stdlib Installed Version: v1.24.13 Fixed Version: 1.25.10, 1.26.3 References: access.redhat.com go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev www.cve.org |
|
| HIGH |
CVE-2026-33814: When processing HTTP/2 SETTINGS frames, transport will enter an infini ...When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.Package Name: stdlib Installed Version: v1.24.13 Fixed Version: 1.25.10, 1.26.3 References: github.com go-review.googlesource.com go-review.googlesource.com go.dev go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev ubuntu.com www.cve.org |
|
| HIGH |
CVE-2026-39820: Well-crafted inputs reaching ParseAddress, ParseAddressList, and Parse ...Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.Package Name: stdlib Installed Version: v1.24.13 Fixed Version: 1.25.10, 1.26.3 References: go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev |
|
| HIGH |
CVE-2026-39823: CVE-2026-27142 fixed a vulnerability in which URLs were not correctly ...CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS.Package Name: stdlib Installed Version: v1.24.13 Fixed Version: 1.25.10, 1.26.3 References: go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev |
|
| HIGH |
CVE-2026-39825: ReverseProxy can forward queries containing parameters not visible to ...ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function.Package Name: stdlib Installed Version: v1.24.13 Fixed Version: 1.25.10, 1.26.3 References: go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev |
|
| HIGH |
CVE-2026-39836: ELSA-2026-22112: go-toolset:ol8 security update (IMPORTANT)The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).Package Name: stdlib Installed Version: v1.24.13 Fixed Version: 1.25.10, 1.26.3 References: go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev |
|
| HIGH |
CVE-2026-42499: Pathological inputs could cause DoS through consumePhrase when parsing ...Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.Package Name: stdlib Installed Version: v1.24.13 Fixed Version: 1.25.10, 1.26.3 References: go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev |
|
| HIGH |
CVE-2026-42504: Decoding a maliciously-crafted MIME header containing many invalid enc ...Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.Package Name: stdlib Installed Version: v1.24.13 Fixed Version: 1.25.11, 1.26.4 References: go.dev go.dev groups.google.com nvd.nist.gov pkg.go.dev |
|
| MEDIUM |
CVE-2026-27142: html/template: URLs in meta content attribute actions are not escaped in html/templateActions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.Package Name: stdlib Installed Version: v1.24.13 Fixed Version: 1.25.8, 1.26.1 References: access.redhat.com go.dev go.dev groups.google.com nvd.nist.gov pkg.go.dev www.cve.org |
|
| MEDIUM |
CVE-2026-27145: *x509.Certificate).VerifyHostname previously called matchHostnames in ...(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.Package Name: stdlib Installed Version: v1.24.13 Fixed Version: 1.25.11, 1.26.4 References: go.dev go.dev groups.google.com nvd.nist.gov pkg.go.dev |
|
| MEDIUM |
CVE-2026-32282: golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the rootOn Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.Package Name: stdlib Installed Version: v1.24.13 Fixed Version: 1.25.9, 1.26.2 References: access.redhat.com access.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com bugzilla.redhat.com cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org cve.mitre.org errata.almalinux.org errata.rockylinux.org go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev www.cve.org |
|
| MEDIUM |
CVE-2026-32288: archive/tar: golang: Go's archive/tar package: Denial of Service via maliciously-crafted archivetar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.Package Name: stdlib Installed Version: v1.24.13 Fixed Version: 1.25.9, 1.26.2 References: access.redhat.com go.dev go.dev groups.google.com nvd.nist.gov pkg.go.dev www.cve.org |
|
| MEDIUM |
CVE-2026-32289: html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literalsContext was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.Package Name: stdlib Installed Version: v1.24.13 Fixed Version: 1.25.9, 1.26.2 References: access.redhat.com go.dev go.dev groups.google.com nvd.nist.gov pkg.go.dev www.cve.org |
|
| MEDIUM |
CVE-2026-39826: html/template: golang: html/template: Cross-site scripting due to incorrect script tag escapingIf a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.Package Name: stdlib Installed Version: v1.24.13 Fixed Version: 1.25.10, 1.26.3 References: access.redhat.com go.dev go.dev groups.google.com linux.oracle.com linux.oracle.com nvd.nist.gov pkg.go.dev www.cve.org |
|
| MEDIUM |
CVE-2026-42507: net/textproto: golang: Golang net/textproto: Misleading error messages via input injectionWhen returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.Package Name: stdlib Installed Version: v1.24.13 Fixed Version: 1.25.11, 1.26.4 References: access.redhat.com go.dev go.dev groups.google.com nvd.nist.gov pkg.go.dev www.cve.org |
|
| LOW |
CVE-2026-27139: os: FileInfo can escape from a Root in golang os moduleOn Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.Package Name: stdlib Installed Version: v1.24.13 Fixed Version: 1.25.8, 1.26.1 References: access.redhat.com go.dev go.dev groups.google.com nvd.nist.gov pkg.go.dev www.cve.org |
|
Package statistics are no longer available on cloudsmith.io. Please visit our new web app to access this feature.
These instructions assume you have setup the repository first (or read it).
To pull proxyv2 @ reference/tag sha256:01703ee62ba870054783d55775b4913c27fe5873433ebd309df67404f19d885a:
docker pull containers.istio.tetratelabs.com/proxyv2@sha256:01703ee62ba870054783d55775b4913c27fe5873433ebd309df67404f19d885aYou can also pull the latest version of this image (if it exists):
docker pull containers.istio.tetratelabs.com/proxyv2:latestTo refer to this image after pulling in a Dockerfile, specify the following:
FROM containers.istio.tetratelabs.com/proxyv2@sha256:01703ee62ba870054783d55775b4913c27fe5873433ebd309df67404f19d885a