Skip to content
OpenAdvisories

Package · Wolfi

k3s

144 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 7.5
    CVE-2026-56852 Public exploit

    Infinite loop on invalid input in golang.org/x/text

    A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

    golang.org/x/text golang.org/x/text/unicode/norm zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  • High 7.2
    CVE-2026-41567 Public exploit

    Docker: `PUT /containers/{id}/archive` executes container binary on the host

    Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves de…

    Docker moby Docker Engine moby/v2/daemon Debian Ubuntu Alpine Wolfi Go
  • High 7.3
    CVE-2026-39883 Public exploit

    OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on …

    open-telemetry opentelemetry-go zot kubescape Ubuntu Wolfi Go
  • High 8.8
    CVE-2026-34040 Public exploit

    Moby: AuthZ plugin bypass with oversized request body

    Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

    moby moby zot kots Debian Ubuntu Alpine Wolfi Go
  • High 7.3
    CVE-2025-52881 Public exploit

    runc: LSM labels can be bypassed with malicious config using dummy procfs files

    runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with s…

    opencontainers runc zot kubescape Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2023-45288 Public exploit EPSS 89%

    HTTP/2 CONTINUATION flood in net/http

    An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a reques…

    Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 8.6
    CVE-2024-21626 Public exploit EPSS 19%

    runc container breakout through process.cwd trickery and leaked fds

    runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a worki…

    opencontainers runc zot kubescape Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2023-47108 Public exploit

    DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics

    OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels `net.peer.sock.addr` and `net.peer.sock.port` that have…

    open-telemetry opentelemetry-go-contrib kubescape k3s Ubuntu Azure Linux Wolfi Go
  • High 7.5
    CVE-2023-39325 Public exploit

    HTTP/2 rapid reset can cause excessive work in net/http

    A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress requ…

    Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go