kubernetes-1.36

4 results · Clear filters · Feed

• High 7.5
  CVE-2026-56852 Public exploit

  Infinite loop on invalid input in golang.org/x/text

  A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

  golang.org/x/text golang.org/x/text/unicode/norm zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  Jul 21, 2026
• Medium 6.5
  CVE-2026-27145 Public exploit

  Inefficient candidate hostname parsing in crypto/x509

  (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification c…

  Go standard library crypto/x509 golang stdlib Debian Ubuntu Azure Linux Wolfi Go
  Jun 2, 2026
• Critical 10.0
  CVE-2026-46595 Public exploit

  Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

  Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

  golang.org/x/crypto golang.org/x/crypto/ssh zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  May 22, 2026
• Medium 6.3
  CVE-2020-8554 Public exploit

  Kubernetes man in the middle using LoadBalancer or ExternalIPs

  Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a pri…

  Kubernetes Kubernetes kubernetes-1.35 kubernetes Debian Azure Linux Wolfi Go
  Jan 21, 2021