trust-manager

6 results · Clear filters · Feed

• Medium 4.4
  CVE-2025-22870 Public exploit

  HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

  Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be prox…

  Go standard library golang.org/x/net net/http golang.org/x/net/proxy Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 12, 2025
• Critical 9.1
  CVE-2024-45337 Public exploit

  Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto

  Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function do…

  golang.org/x/crypto golang.org/x/crypto/ssh katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Dec 11, 2024
• Medium 6.4
  CVE-2024-24787 Public exploit

  Arbitrary code execution during build on Darwin in cmd/go

  On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.

  Go toolchain cmd/go katib-suggestion-hyperopt katib-earlystopping Azure Linux Wolfi Go
  May 8, 2024
• High 7.5
  CVE-2023-45288 Public exploit EPSS 89%

  HTTP/2 CONTINUATION flood in net/http

  An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a reques…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 4, 2024
• High 7.5
  CVE-2023-39325 Public exploit

  HTTP/2 rapid reset can cause excessive work in net/http

  A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress requ…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 11, 2023
• Medium 6.4
  CVE-2020-8559 Public exploit

  Privilege escalation from compromised node to cluster

  The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a ful…

  Kubernetes Kubernetes zot kots Debian Alpine Wolfi Go
  Jul 22, 2020