Skip to content
OpenAdvisories

Package · Alpine

k3s

17 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.5
    CVE-2023-45142

    OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics

    OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when ma…

    open-telemetry opentelemetry-go-contrib k3s buildkitd Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2023-32187

    K3s apiserver port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack

    An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supervisor port (TCP 6443) cause denial of service. This issue affects k3s: from v1.24.0 before v1.24.17+k3s1, from v1.25.…

    SUSE k3s k3s k3s Alpine Wolfi Go
  • High 7.6
    CVE-2021-30465 EPSS 10%

    mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs

    runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange a…

    buildah runc github.com/opencontainers/runc k3s Debian Ubuntu Azure Linux Alpine Go
  • High 7.5
    CVE-2019-9512 EPSS 83%

    Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

    Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is qu…

    go stdlib golang-1.8 golang-1.10 Debian Ubuntu Azure Linux Alpine Go
  • High 7.5
    CVE-2019-9514 EPSS 83%

    Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

    Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depe…

    nodejs go golang-1.8 golang-1.10 Debian Ubuntu Azure Linux Alpine