Skip to content
OpenAdvisories

Package · Wolfi

tekton-pipelines-controller-1.11

15 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.9
    CVE-2026-116586

    Go JOSE: Panics in JSON parsing

    Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controll…

    go-jose go-jose zarf k3d-proxy Debian Ubuntu Azure Linux Wolfi Go
  • Medium 6.9
    CVE-2026-116585

    Go JOSE: Panic during CBC-HMAC processing

    Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, decrypting untrusted JWE …

    go-jose go-jose zarf k3d-proxy Debian Ubuntu Azure Linux Wolfi Go
  • Medium 5.3
    CVE-2026-41178

    OpenTelemetry-Go's baggage parsing no longer caps raw header length

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 a…

    open-telemetry go.opentelemetry.io/otel/propagation go.opentelemetry.io/otel/baggage zot Debian Ubuntu Wolfi Go
  • Medium 5.3
    CVE-2026-39882

    OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the c…

    open-telemetry opentelemetry-go zot kubescape Debian Ubuntu Azure Linux Wolfi Go