Skip to content
OpenAdvisories

Package · Wolfi

dogstatsd-7.73

39 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.5
    CVE-2026-56852 Public exploit

    Infinite loop on invalid input in golang.org/x/text

    A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

    golang.org/x/text golang.org/x/text/unicode/norm zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  • High 7.3
    CVE-2026-46680 Public exploit

    containerd user ID handling bypass allows runAsNonRoot evasion

    containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot eva…

    containerd containerd zot kubescape Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.2
    CVE-2026-41567 Public exploit

    Docker: `PUT /containers/{id}/archive` executes container binary on the host

    Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves de…

    Docker moby Docker Engine moby/v2/daemon Debian Ubuntu Alpine Wolfi Go
  • High 8.8
    CVE-2026-34040 Public exploit

    Moby: AuthZ plugin bypass with oversized request body

    Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

    moby moby zot kots Debian Ubuntu Alpine Wolfi Go
  • Critical 9.1
    CVE-2026-33186 Public exploit

    gRPC-Go has an authorization bypass via missing leading slash in :path

    gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests …

    grpc grpc-go zot kubescape Debian Ubuntu Alpine Wolfi Go