spire-oidc-discovery-provider

6 results · Clear filters · Feed

• High 7.5
  CVE-2026-56852 Public exploit

  Infinite loop on invalid input in golang.org/x/text

  A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

  golang.org/x/text golang.org/x/text/unicode/norm zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  Jul 21, 2026
• Medium 6.5
  CVE-2026-27145 Public exploit

  Inefficient candidate hostname parsing in crypto/x509

  (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification c…

  Go standard library crypto/x509 golang stdlib Debian Ubuntu Azure Linux Wolfi Go
  Jun 2, 2026
• Critical 10.0
  CVE-2026-46595 Public exploit

  Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

  Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

  golang.org/x/crypto golang.org/x/crypto/ssh zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  May 22, 2026
• Medium 4.4
  CVE-2025-22870 Public exploit

  HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

  Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be prox…

  Go standard library golang.org/x/net net/http golang.org/x/net/proxy Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 12, 2025
• Critical 9.1
  CVE-2024-45337 Public exploit

  Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto

  Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function do…

  golang.org/x/crypto golang.org/x/crypto/ssh katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Dec 11, 2024
• Medium 6.4
  CVE-2020-8559 Public exploit

  Privilege escalation from compromised node to cluster

  The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a ful…

  Kubernetes Kubernetes zot kots Debian Alpine Wolfi Go
  Jul 22, 2020