Skip to content
OpenAdvisories

Package · Wolfi

gitlab-kas-18.11

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 5.3
    CVE-2026-41178

    OpenTelemetry-Go's baggage parsing no longer caps raw header length

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 a…

    open-telemetry go.opentelemetry.io/otel/propagation go.opentelemetry.io/otel/baggage zot Debian Ubuntu Wolfi Go
  • Low 2.3
    CVE-2026-41889

    pgx: SQL Injection via placeholder confusion with dollar quoted string literals

    pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be inte…

    jackc pgx kots k3s Debian Ubuntu Azure Linux Wolfi Go
  • High 7.5
    CVE-2026-34986

    Go JOSE affect by a panic in JWE decryption

    Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JS…

    go-jose go-jose zot kubescape Debian Ubuntu Alpine Wolfi Go