Skip to content
OpenAdvisories

Package · Wolfi

linkerd2-metrics-api-compat

12 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-55198

    Helm May Panic Due To Incorrect YAML Content

    Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, when parsing Chart.yaml and index.yaml files, an improper validation of type error can lead to a panic. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring Y…

    helm helm zot kubescape Azure Linux Wolfi Go
  • Medium 6.5
    CVE-2025-55199

    Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion

    Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, it is possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory (OOM) termination. This issue has been resolved i…

    helm helm zot kubescape Azure Linux Wolfi Go
  • Medium 5.1
    CVE-2025-55159

    slab allows out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check

    slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined…

    tokio-rs slab rust linkerd2-controller Ubuntu Azure Linux Wolfi crates.io
  • Medium 6.8
    CVE-2025-4673

    Sensitive headers not cleared on cross-origin redirect in net/http

    Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.

    Go standard library net/http katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 5.1
    CVE-2024-12224

    idna accepts Punycode labels that do not produce any non-ASCII when decoded

    Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to anoth…

    servo rust-url linkerd2-controller linkerd2-tap Debian Ubuntu Alpine Wolfi crates.io
  • Medium 4.6
    CVE-2024-40635 Public exploit

    containerd has an integer overflow in User ID handling

    containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition wh…

    containerd containerd zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  • Medium 4.0
    CVE-2025-22866

    Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec

    Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is en…

    Go standard library crypto/internal/nistec go zot Debian Ubuntu Alpine Wolfi Go