istio-pilot-discovery-1.29

8 results · Clear filters · Feed

• Medium 5.3
  CVE-2026-128085

  opentelemetry-go: AttributeValueLengthLimit is fully bypassed by attribute values composed of valid U+FFFD runes

  OpenTelemetry-Go is the Go implementation of OpenTelemetry. From SDK version 1.33.0, SDK log version 0.9.0, and trace version 1.35.0 until version 1.47.0, the AttributeValueLengthLimit and WithAttributeValueLengthLimit truncation paths in sdk/internal/attrnor…

  open-telemetry opentelemetry-go go.opentelemetry.io/otel/sdk zot Debian Wolfi Go
  Nov 13, 2026
• Medium 5.9
  CVE-2026-56860

  Avoid quadratic complexity in resolvePath in net/url

  Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte…

  Go standard library net/url katib-suggestion-hyperopt katib-suggestion-goptuna-compat Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026
• Medium 6.1
  CVE-2026-56858

  Fix Javascript regexp context tracking in html/template

  Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

  Go standard library html/template katib-suggestion-hyperopt katib-suggestion-goptuna-compat Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026
• Medium 5.3
  CVE-2026-42505

  Invoking Encrypted Client Hello privacy leak in crypto/tls

  Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

  Go standard library crypto/tls katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jul 8, 2026
• Medium 5.3
  CVE-2026-42507

  Arbitrary inputs are included in errors without any escaping in net/textproto

  When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.

  Go standard library net/textproto golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jun 2, 2026
• Medium 6.5
  CVE-2026-27145 Public exploit

  Inefficient candidate hostname parsing in crypto/x509

  (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification c…

  Go standard library crypto/x509 golang stdlib Debian Ubuntu Azure Linux Wolfi Go
  Jun 2, 2026
• Medium 5.1
  CVE-2026-44903

  Prometheus: Stored XSS via crafted histogram bucket label values in the heatmap display of the old Prometheus web UI

  Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the histogram heatmap chart view does not es…

  prometheus prometheus k8sgpt minio Debian Ubuntu Wolfi Go
  May 26, 2026
• Medium 5.3
  CVE-2026-40179 Public exploit

  Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer

  Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values a…

  prometheus prometheus minio splunk-otel-collector Ubuntu Alpine Wolfi Go
  Apr 15, 2026