Skip to content
OpenAdvisories

Package · Wolfi

guac

122 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-71557 Public exploit

    go-git: Malicious reference names may modify files outside the reference storage

    go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference …

    go-git go-git zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  • High 7.5
    CVE-2026-56852 Public exploit

    Infinite loop on invalid input in golang.org/x/text

    A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

    golang.org/x/text golang.org/x/text/unicode/norm zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  • Medium 6.5
    CVE-2026-27145 Public exploit

    Inefficient candidate hostname parsing in crypto/x509

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification c…

    Go standard library crypto/x509 golang stdlib Debian Ubuntu Azure Linux Wolfi Go
  • High 7.3
    CVE-2026-39883 Public exploit

    OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on …

    @opentelemetry opentelemetry-go zot kubescape Ubuntu Wolfi Go
  • Critical 9.1
    CVE-2026-33186 Public exploit

    gRPC-Go has an authorization bypass via missing leading slash in :path

    gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests …

    grpc grpc-go zot kubescape Debian Ubuntu Alpine Wolfi Go
  • Medium 5.3
    CVE-2025-11579 Public exploit

    DoS via Out Of Memory Crash

    github.com/nwaples/rardecode versions <=2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory Crash.

    nwaples rardecode kubescape kots Debian Ubuntu Wolfi Go
  • Medium 4.4
    CVE-2025-22870 Public exploit

    HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

    Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be prox…

    Go standard library golang.org/x/net net/http golang.org/x/net/proxy Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Critical 9.1
    CVE-2024-45337 Public exploit

    Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto

    Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function do…

    golang.org/x/crypto golang.org/x/crypto/ssh katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Critical 10.0
    CVE-2024-41110 Public exploit EPSS 16%

    Moby authz zero length regression

    Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances…

    moby moby katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 6.4
    CVE-2024-24787 Public exploit

    Arbitrary code execution during build on Darwin in cmd/go

    On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.

    Go toolchain cmd/go katib-suggestion-hyperopt katib-earlystopping Azure Linux Wolfi Go
  • High 7.5
    CVE-2023-45288 Public exploit EPSS 89%

    HTTP/2 CONTINUATION flood in net/http

    An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a reques…

    Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Critical 9.8
    CVE-2024-23653 Public exploit

    BuildKit interactive containers API does not validate entitlements check

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It w…

    moby BuildKit zot kubescape Ubuntu Azure Linux Alpine Wolfi Go
  • Critical 10.0
    CVE-2024-23652 Public exploit

    BuildKit possible host system access from mount stub cleaner

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints i…

    moby BuildKit zot kubescape Ubuntu Azure Linux Alpine Wolfi Go