Skip to content
OpenAdvisories

Package · Wolfi

k8s-sidecar

25 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.8
    CVE-2026-111943 Public exploit

    Distrust compromised intermediate certificates in crypto/x509

    On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in cr…

    Go standard library crypto/x509 renovate golang Debian Ubuntu Azure Linux Alpine Wolfi Go crates.io
  • Medium 4.4
    CVE-2026-25645 Public exploit

    Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

    Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is…

    psf requests open-webui katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  • High 7.5
    CVE-2025-62727 Public exploit

    Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse

    Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merg…

    Kludex starlette open-webui airflow-3 Debian Ubuntu Wolfi PyPI
  • Medium 6.2
    CVE-2024-3651 Public exploit

    Denial of Service via Quadratic Complexity in kjd/idna

    A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a…

    kjd kjd/idna katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  • High 7.5
    CVE-2024-39689 Public exploit

    Certifi removes GLOBALTRUST root certificate

    Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi…

    certifi python-certifi katib-suggestion-hyperopt katib-earlystopping Debian Wolfi PyPI
  • Medium 5.9
    CVE-2023-43804 Public exploit

    `Cookie` HTTP header isn't stripped on cross-origin redirects

    urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `C…

    urllib3 urllib3 python3 dask-gateway Debian Ubuntu Azure Linux Alpine Wolfi PyPI