Skip to content
OpenAdvisories
Medium · 5.3 CVE-2025-58189 BIT-golang-2025-58189EUVD-2025-36737GHSA-cxq7-xw9v-rcv3GO-2025-4008

ALPN negotiation error contains attacker controlled information in crypto/tls

Published Oct 29, 2025 · Updated Nov 4, 2025 · Assigned by Go

Vendor: Go standard library Product: crypto/tls Package: age Package: amass Package: apisix-ingress-controller Package: apisix-ingress-controller-compat Package: apisix-ingress-controller-iamguarded-compat Package: argo-rollouts Package: atlantis Package: aws-node-termination-handler Package: aws-node-termination-handler-compat Package: aws-s3-controller Package: aws-signer-notation-plugin Package: aws-sigv4-proxy Package: aws-sigv4-proxy-compat Package: azure-ipam Package: azure-ipam-dropgz Package: azure-workload-identity-webhook Package: azure-workload-identity-webhook-compat Package: bazelisk Package: bazelisk-default Package: bom Package: boring-registry Package: cadvisor Package: cadvisor-compat Package: capslock Package: cargobump Package: cert-exporter Package: cert-manager-cmctl Package: cert-manager-webhook-pdns Package: certificate-transparency Package: certificate-transparency-trillian-ctserver Package: cfssl Package: cfssl-bundle Package: cfssl-certinfo Package: cfssl-json Package: cfssl-mkbundle Package: cfssl-multirootca Package: cfssl-newkey Package: cfssl-scan Package: chartmuseum Package: checksec Package: chisel Package: chisel-compat Package: cloud-provider-gcp-cloud-controller-manager Package: cloud-provider-gcp-cloud-controller-manager-compat Package: cloud-provider-vsphere Package: cloud-sql-proxy-2.16 Package: cloud-sql-proxy-2.16-compat Package: cluster-api-gcp-controller Package: cluster-api-gcp-controller-compat Package: cluster-api-helm-controller Package: cluster-api-helm-controller-compat Package: cluster-api-provider-vsphere Package: cluster-api-provider-vsphere-compat Package: cluster-proportional-autoscaler Package: cluster-proportional-autoscaler-compat Package: configmap-reload Package: conftest Package: conjur-cli Package: container-object-storage-interface Package: container-object-storage-interface-controller Package: container-object-storage-interface-controller-compat Package: container-object-storage-interface-sidecar Package: container-object-storage-interface-sidecar-compat Package: controller-gen Package: crane Package: crane-cov Package: cri-tools Package: crictl Package: critest Package: crossplane-crank Package: ctop Package: custom-pod-autoscaler Package: custom-pod-autoscaler-compat Package: custom-pod-autoscaler-operator Package: custom-pod-autoscaler-operator-compat Package: dagdotdev Package: dask-gateway Package: dask-gateway-server Package: dbmate Package: delve Package: dfc Package: direnv Package: distribution Package: dive Package: docker-cli-buildx Package: docker-credential-acr-env Package: docker-credential-ecr-login Package: docker-credential-gcr Package: docker-machine-driver-harvester Package: docker-machine-driver-linode Package: dockerize Package: doppler-kubernetes-operator Package: dynamic-localpv-provisioner Package: elvish Package: envconsul Package: etcd-3.6 Package: etcd-3.6-iamguarded-compat Package: extism Package: falco-exporter Package: falco-no-driver Package: falcoctl Package: falcosidekick Package: ferretdb Package: fixuid Package: flyte Package: fq Package: fscrypt Package: fulcio Package: gcsfuse Package: ghaudit Package: git-credential-oauth Package: gke-gcloud-auth-plugin Package: glow Package: go Package: go-1.20 Package: go-1.22 Package: go-1.23 Package: go-bindata Package: go-licenses Package: go-md2man Package: go-md2man-doc Package: gobump Package: gobuster Package: golang Package: golang-1.10 Package: golang-1.13 Package: golang-1.14 Package: golang-1.16 Package: golang-1.17 Package: golang-1.18 Package: golang-1.19 Package: golang-1.20 Package: golang-1.21 Package: golang-1.22 Package: golang-1.23 Package: golang-1.24 Package: golang-1.24 Package: golang-1.25 Package: golang-1.6 Package: golang-1.8 Package: golang-1.9 Package: gops Package: gostatsd Package: gosu Package: gotestsum Package: govulncheck Package: grpcurl Package: guac Package: guaccsub Package: guacgql Package: guacingest Package: guacone Package: harbor-2.14 Package: harbor-2.14-exporter Package: harbor-2.14-jobservice Package: harbor-2.14-portal Package: harbor-2.14-portal-nginx-config Package: harbor-2.14-redis-compat Package: harbor-2.14-registryctl Package: harbor-registry Package: hello-world-golang Package: helm-docs Package: helm-mapkubeapis Package: helm-push Package: helm-set-status Package: hey Package: hivemind Package: http-echo Package: hydra Package: incert Package: infinispan-operator Package: infinispan-operator-compat Package: ini-file Package: ip-masq-agent Package: ipfs-cluster Package: ipfs-cluster-compat Package: ipfs-cluster-oci-entrypoint Package: iptables-wrappers Package: istio-pilot-agent-1.25 Package: istio-pilot-agent-1.25-compat Package: jitsucom-bulker Package: jitsucom-bulker-bulker Package: jitsucom-bulker-bulker-compat Package: jitsucom-bulker-ingest Package: jitsucom-bulker-ingest-compat Package: jitsucom-bulker-ingmgr Package: jitsucom-bulker-ingmgr-compat Package: jitsucom-bulker-sidecar Package: jitsucom-bulker-sidecar-compat Package: jitsucom-bulker-syncctl Package: jitsucom-bulker-syncctl-compat Package: juicefs-1.3 Package: juicefs-1.3-compat Package: k3d Package: k3d-proxy Package: k3d-tools Package: k6 Package: kaf Package: kafka_exporter Package: kafka-proxy Package: kafka-proxy-compat Package: kapp Package: katib-earlystopping Package: katib-suggestion-goptuna-compat Package: katib-suggestion-hyperband Package: katib-suggestion-hyperopt Package: katib-suggestion-nas-darts Package: katib-suggestion-nas-enas Package: katib-suggestion-optuna-enas Package: katib-suggestion-pbt-enas Package: katib-suggestion-skopt-enas Package: katib-tfevent-metricscollector Package: kbld Package: kind Package: ko Package: kpt Package: kratos Package: kratos-protoc-gen Package: kube-bench Package: kube-bench-configs Package: kube-logging-operator-custom-runner Package: kube-logging-operator-custom-runner-compat Package: kube-metrics-adapter Package: kube-rbac-proxy Package: kube-state-metrics Package: kube-state-metrics-iamguarded-compat Package: kube-vip-cloud-provider Package: kube-vip-cloud-provider-compat Package: kubebuilder Package: kubecolor Package: kubectl-argo-rollouts Package: kubeflow Package: kubeflow-access-management Package: kubeflow-access-management-compat Package: kubeflow-admission-webhook Package: kubeflow-admission-webhook-compat Package: kubeflow-notebook-controller Package: kubeflow-notebook-controller-compat Package: kubeflow-profile-controller Package: kubeflow-profile-controller-compat Package: kubeflow-pvcviewer-controller Package: kubeflow-pvcviewer-controller-compat Package: kubeflow-tensorboard-controller Package: kubeflow-tensorboard-controller-compat Package: kubelet-csr-approver Package: kubelet-csr-approver-compat Package: kuberlr Package: kubernetes-csi-driver-hostpath Package: kubernetes-csi-external-attacher Package: kubernetes-csi-external-attacher-compat Package: kubernetes-csi-external-health-monitor Package: kubernetes-csi-external-health-monitor-compat Package: kubernetes-csi-livenessprobe Package: kubernetes-dashboard-metrics-scraper Package: kubernetes-dashboard-metrics-scraper-compat Package: kubernetes-dashboard-web Package: kubernetes-dashboard-web-compat Package: kubernetes-event-exporter Package: kubernetes-event-exporter-iamguarded-compat Package: kubernetes-replicator Package: kubescape-operator Package: kubevela Package: kubevela-vela-cli Package: kubevela-vela-core Package: kubevela-vela-core-compat Package: kustomize Package: kwok Package: kwokctl Package: lazydocker Package: licenseclassifier Package: litefs Package: local-path-provisioner Package: logstash-exporter Package: mage Package: manifest-tool Package: maru Package: mc Package: mc-iamguarded-2025-compat Package: mesosphere-vsphere-csi Package: mesosphere-vsphere-csi-driver Package: mesosphere-vsphere-csi-syncer Package: metacontroller Package: metrics-server Package: metrics-server-compat Package: metrics-server-iamguarded-compat Package: minio-object-browser Package: minio-object-browser-iamguarded-compat Package: mkcert Package: mockery Package: mockgen Package: mods Package: mongo-tools Package: mongodb-kubernetes-operator Package: mongodb-kubernetes-operator-compat Package: mongodb-kubernetes-operator-readinessprobe Package: mongodb-kubernetes-operator-readinessprobe-compat Package: mongodb-kubernetes-operator-version-upgrade-post-start-hook Package: mongodb-kubernetes-operator-version-upgrade-post-start-hook-compat Package: nats Package: nerdctl Package: neuvector-db-updater Package: neuvector-dbgen Package: neuvector-sigstore-interface Package: newrelic-nri-statsd Package: nfs-subdir-external-provisioner Package: nodetaint Package: nova Package: nova-compat Package: nri-prometheus Package: nsc Package: oauth2-proxy Package: oauth2-proxy-iamguarded-compat Package: octo-sts Package: octo-sts-webhook Package: openbao-k8s Package: openbao-k8s-compat Package: opensearch-k8s-operator Package: opensearch-k8s-operator-compat Package: opentofu-1.9 Package: oras Package: otel-cli Package: petname Package: pg_user Package: pgpool2_exporter Package: php-fpm_exporter Package: podcli Package: podinfo Package: podinfo-compat Package: policy-controller Package: policy-controller-tester Package: portieris Package: portieris-compat Package: prometheus-adapter Package: prometheus-alertmanager Package: prometheus-alertmanager-iamguarded-compat Package: prometheus-pushgateway Package: prometheus-pushgateway-iamguarded-compat Package: promxy Package: protoc-gen-go Package: protoc-gen-go-grpc Package: pulumi-kubernetes-operator Package: pvc-autoresizer Package: pvc-autoresizer-compat Package: rancher-helm-3 Package: rancher-loglevel Package: rancher-machine Package: rancher-system-agent Package: rancher-telemetry Package: redka Package: regclient Package: regclient-regbot Package: regclient-regbot-compat Package: regclient-regctl Package: regclient-regctl-compat Package: regclient-regsync Package: regclient-regsync-compat Package: rekor Package: rekor-backfill-index Package: rekor-cli Package: rekor-server Package: render-template Package: renovate Package: restic Package: restic-compat Package: rootlesskit Package: rootlesskit-config-nonroot Package: runc Package: runc-doc Package: s5cmd Package: sbom-convert Package: sbom-scorecard Package: scorecard Package: sealed-secrets Package: sealed-secrets-compat Package: sealed-secrets-kubeseal Package: sealed-secrets-kubeseal-compat Package: secrets-store-csi-driver Package: secrets-store-csi-driver-crds Package: secrets-store-csi-driver-provider-aws Package: secrets-store-csi-driver-provider-gcp Package: shfmt Package: sigstore-scaffolding Package: sigstore-scaffolding-cloudsqlproxy Package: sigstore-scaffolding-ctlog-createctconfig Package: sigstore-scaffolding-ctlog-managectroots Package: sigstore-scaffolding-ctlog-verifyfulcio Package: sigstore-scaffolding-fulcio-createcerts Package: sigstore-scaffolding-getoidctoken Package: sigstore-scaffolding-rekor-createsecret Package: sigstore-scaffolding-trillian-createdb Package: sigstore-scaffolding-trillian-createtree Package: sigstore-scaffolding-trillian-updatetree Package: sigstore-scaffolding-tsa-createcertchain Package: sigstore-scaffolding-tuf-createsecret Package: sigstore-scaffolding-tuf-server Package: skaffold Package: skopeo Package: slsa-verifier Package: smarter-device-manager Package: sonobuoy Package: sonobuoy-compat Package: sops Package: spark-operator Package: spark-operator-oci-entrypoint Package: speedtest-go Package: spicedb-operator Package: spicedb-operator-compat Package: spiffe-helper Package: spiffe-helper-compat Package: spire-controller-manager Package: spire-controller-manager-compat Package: spqr Package: src-fingerprint Package: sriov-network-device-plugin Package: sriov-network-device-plugin-entrypoint Package: stakater-reloader Package: stakater-reloader-compat Package: stdlib Package: step-kms-plugin Package: stern Package: task Package: terraform Package: terraform-compat Package: terraform-docs Package: terraform-local-provider-config Package: terraform-provider-azapi Package: terraform-provider-azuread Package: terraform-provider-kubernetes Package: terraform-provider-random Package: terraform-provider-sendgrid Package: terraform-provider-time Package: terraform-provider-tls Package: tfsec Package: thanos-operator Package: timescaledb-parallel-copy Package: timescaledb-tune Package: timestamp-authority Package: timestamp-authority-cli Package: timestamp-authority-server Package: timoni Package: tofu-controller Package: tofu-controller-compat Package: tofu-controller-runner Package: tofu-controller-runner-compat Package: trillian Package: trillian-logserver Package: trillian-logsigner Package: trivy-operator Package: vault-env Package: vault-env-compat Package: vault-k8s Package: vault-secrets-webhook Package: vault-secrets-webhook-compat Package: velero Package: velero-compat Package: velero-plugin-for-aws Package: velero-plugin-for-aws-compat Package: velero-plugin-for-csi Package: velero-plugin-for-csi-compat Package: velero-plugin-for-microsoft-azure Package: velero-plugin-for-microsoft-azure-compat Package: velero-restore-helper Package: vendir Package: vertical-pod-autoscaler Package: vertical-pod-autoscaler-recommender Package: vertical-pod-autoscaler-updater Package: vexctl Package: vt-cli Package: wait-for-port Package: wave Package: wazero Package: wgcf Package: whereabouts Package: whereabouts-compat Package: wire-go Package: wireguard-go Package: xcaddy Package: xcover Package: yunikorn-k8shim Package: yunikorn-k8shim-compat Package: yunikorn-web Package: yunikorn-web-compat Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.

Affected products

VendorProductAffectedFixed
Go standard library crypto/tls < 1.24.8, 1.25.0 – < 1.25.2 1.24.8

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 13 golang-1.24 No fix yet —
Debian 12 golang-1.19 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS golang-1.23 +2 No fix yet —
Ubuntu 25.10 golang-1.23 +2 No fix yet —
Ubuntu 24.04 LTS golang-1.21 +4 No fix yet —
Ubuntu 22.04 LTS golang-1.17 +7 No fix yet —
Ubuntu 20.04 LTS golang-1.13 +5 No fix yet —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS golang-1.8 +2 No fix yet —
Ubuntu 16.04 LTS golang-1.6 +1 No fix yet —
Ubuntu 14.04 LTS golang-1.10 No fix yet —
Ubuntu Pro 22.04 LTS golang-1.13 No fix yet —
Ubuntu Pro 20.04 LTS golang-1.16 No fix yet —
Ubuntu Pro 18.04 LTS golang-1.13 +2 No fix yet —
Ubuntu Pro 16.04 LTS golang-1.13 +1 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 golang1.25 +6 1.25.9-1.hum1 RHSA-2026:7385
Red Hat Hardened Images 1 golang1.26 +6 1.26.2-1.hum1 RHSA-2026:7291

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
SLES 15 SP7 go1.24-openssl 1.24.12-150600.13.15.1 SUSE-SU-2026:0308-1
SLES 15 SP7 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1
SLES 15 SP7 go1.25-openssl 1.25.6-150600.13.9.1 SUSE-SU-2026:0298-1
SLES 15 SP6 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
SLES 15 SP6 go1.24-openssl 1.24.12-150600.13.15.1 SUSE-SU-2026:0308-1
SLES 15 SP6 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1
SLES 15 SP6 go1.25-openssl 1.25.6-150600.13.9.1 SUSE-SU-2026:0298-1
SLES 15 SP5 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
SLES 15 SP5 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLES 15 SP5 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1
SLES 15 SP5 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLES 15 SP4 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
SLES 15 SP4 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLES 15 SP4 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1
SLES 15 SP4 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLES 15 SP3 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
SLES 15 SP3 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 go1.24 1.24.11-160000.1.1 SUSE-SU-2025:21193-1
SLES for SAP 16.0 go1.24-openssl 1.24.13-160000.1.1 SUSE-SU-2026:20629-1
SLES for SAP 16.0 go1.25 1.25.5-160000.1.1 SUSE-SU-2025:21192-1
SLES for SAP 16.0 go1.25-openssl 1.25.7-160000.1.1 SUSE-SU-2026:20623-1
SLES for SAP 15 SP6 go1.24-openssl 1.24.12-150600.13.15.1 SUSE-SU-2026:0308-1
SLES for SAP 15 SP6 go1.25-openssl 1.25.6-150600.13.9.1 SUSE-SU-2026:0298-1
SLES for SAP 15 SP5 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
SLES for SAP 15 SP5 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLES for SAP 15 SP5 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1
SLES for SAP 15 SP5 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLES for SAP 15 SP4 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
SLES for SAP 15 SP4 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLES for SAP 15 SP4 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1
SLES for SAP 15 SP4 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLES for SAP 15 SP3 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
SLES for SAP 15 SP3 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1
SLES 16.0 go1.24 1.24.11-160000.1.1 SUSE-SU-2025:21193-1
SLES 16.0 go1.24-openssl 1.24.13-160000.1.1 SUSE-SU-2026:20629-1
SLES 16.0 go1.25 1.25.5-160000.1.1 SUSE-SU-2025:21192-1
SLES 16.0 go1.25-openssl 1.25.7-160000.1.1 SUSE-SU-2026:20623-1
SLE HPC 15 SP5 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
SLE HPC 15 SP5 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLE HPC 15 SP5 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1
SLE HPC 15 SP5 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLE HPC 15 SP4 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
SLE HPC 15 SP4 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLE HPC 15 SP4 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1
SLE HPC 15 SP4 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLE HPC 15 SP3 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
SLE HPC 15 SP3 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1
SUSE Enterprise Storage 7.1 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
SUSE Enterprise Storage 7.1 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed go1.24 1.24.8-1.1 openSUSE-SU-2025:15608-1
openSUSE Tumbleweed go1.25 1.25.2-1.1 openSUSE-SU-2025:15609-1
openSUSE Tumbleweed govulncheck-vulndb 0.0.20251029T215107-1.1 openSUSE-SU-2025:15695-1
openSUSE Tumbleweed regclient 0.10.0-1.1 openSUSE-SU-2025:15723-1
openSUSE Leap 16.0 go1.24 1.24.11-160000.1.1 openSUSE-SU-2025:20158-1
openSUSE Leap 16.0 go1.24-openssl 1.24.13-160000.1.1 openSUSE-SU-2026:20308-1
openSUSE Leap 16.0 go1.25 1.25.5-160000.1.1 openSUSE-SU-2025:20157-1
openSUSE Leap 16.0 go1.25-openssl 1.25.7-160000.1.1 openSUSE-SU-2026:20301-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 15.6 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
openSUSE Leap 15.6 go1.24-openssl 1.24.12-150600.13.15.1 SUSE-SU-2026:0308-1
openSUSE Leap 15.6 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1
openSUSE Leap 15.6 go1.25-openssl 1.25.6-150600.13.9.1 SUSE-SU-2026:0298-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 go 1.25.2-r0 —
Alpine v3.23 go 1.25.2-r0 —
Alpine v3.22 go 1.24.8-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 amazon-cloudwatch-agent 1.300060.1-1.amzn2023 ALAS2023-2025-1275
Amazon Linux 2023 amazon-ssm-agent 3.3.3572.0-1.amzn2023 ALAS2023-2025-1359
Amazon Linux 2023 cni-plugins 1.7.1-1.amzn2023.0.3 ALAS2023-2025-1287
Amazon Linux 2023 containerd +1 2.1.4-1.amzn2023.0.2 ALAS2023-2025-1272
Amazon Linux 2023 docker 25.0.13-1.amzn2023.0.2 ALAS2023-2025-1274
Amazon Linux 2023 ecs-init 1.101.0-1.amzn2023 ALAS2023-2025-1295
Amazon Linux 2023 golang +6 1.24.8-1.amzn2023.0.1 ALAS2023-2025-1239
Amazon Linux 2023 golist 0.10.1-11.amzn2023.0.5 ALAS2023-2025-1276
Amazon Linux 2023 libcap +3 2.73-1.amzn2023.0.4 ALAS2023-2025-1279
Amazon Linux 2023 nerdctl 2.1.5-1.amzn2023.0.2 ALAS2023-2025-1278
Amazon Linux 2023 oci-add-hooks 0-0.1.20200504git268e3bb.amzn2023.0.6 ALAS2023-2025-1273
Amazon Linux 2023 runc 1.3.3-2.amzn2023.0.1 ALAS2023-2025-1286
Amazon Linux 2023 runfinch-finch 1.10.0-1.amzn2023.0.5 ALAS2023-2025-1270
Amazon Linux 2023 soci-snapshotter 0.11.1-1.amzn2023.0.3 ALAS2023-2025-1277
Amazon Linux 2 amazon-cloudwatch-agent 1.300060.1-1.amzn2 ALAS2-2025-3068
Amazon Linux 2 amazon-ssm-agent 3.3.3572.0-1.amzn2 ALAS2-2025-3121
Amazon Linux 2 cni-plugins 1.7.1-1.amzn2.0.3 ALAS2-2025-3078
Amazon Linux 2 cri-tools 1.32.0-1.amzn2.0.2 ALAS2-2025-3079
Amazon Linux 2 golang +6 1.24.8-1.amzn2.0.1 ALAS2-2025-3042
Amazon Linux 2 golist 0.10.1-10.amzn2.0.8 ALAS2-2025-3069
Amazon Linux 2 nerdctl 2.1.5-1.amzn2.0.2 ALAS2-2025-3070
Amazon Linux 2 rclone 1.55.1-1.amzn2.0.3 ALAS2-2025-3071

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 golang No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling age 1.2.1-r8 —
Wolfi rolling amass 5.0.1-r1 —
Wolfi rolling apisix-ingress-controller +2 1.8.4-r4 —
Wolfi rolling argo-rollouts +1 1.8.3-r4 —
Wolfi rolling atlantis 0.36.0-r2 —
Wolfi rolling aws-s3-controller 1.1.1-r1 —
Wolfi rolling aws-signer-notation-plugin 1.0.2292-r3 —
Wolfi rolling aws-sigv4-proxy +1 1.10-r3 —
Wolfi rolling azure-ipam +1 0.4.0-r4 —
Wolfi rolling azure-workload-identity-webhook +1 1.5.1-r3 —
Wolfi rolling bazelisk +1 1.27.0-r1 —
Wolfi rolling bom 0.7.1-r1 —
Wolfi rolling boring-registry 0.16.6-r2 —
Wolfi rolling cadvisor +1 0.53.0-r6 —
Wolfi rolling capslock 0.2.8-r1 —
Wolfi rolling cargobump 0.1.0-r7 —
Wolfi rolling cert-exporter 2.16.0-r2 —
Wolfi rolling cert-manager-cmctl 2.3.0-r5 —
Wolfi rolling cert-manager-webhook-pdns 2.5.3-r1 —
Wolfi rolling certificate-transparency +1 1.3.2-r4 —
Wolfi rolling cfssl +7 1.6.5-r23 —
Wolfi rolling chartmuseum 0.16.3-r8 —
Wolfi rolling checksec 3.0.2-r6 —
Wolfi rolling chisel +1 1.11.3-r1 —
Wolfi rolling cloud-provider-gcp-cloud-controller-manager +1 34.0.0-r1 —
Wolfi rolling cloud-sql-proxy-2.16 +1 2.16.0-r10 —
Wolfi rolling cluster-api-gcp-controller +1 1.10.0-r4 —
Wolfi rolling cluster-api-provider-vsphere +1 1.14.0-r2 —
Wolfi rolling cluster-proportional-autoscaler +1 1.10.2-r7 —
Wolfi rolling configmap-reload 0.15.0-r4 —
Wolfi rolling conftest 0.63.0-r1 —
Wolfi rolling conjur-cli 8.1.3-r1 —
Wolfi rolling container-object-storage-interface +4 0.2.1-r2 —
Wolfi rolling controller-gen 0.19.0-r2 —
Wolfi rolling crane +1 0.20.6-r3 —
Wolfi rolling crictl +3 1.34.0-r2 —
Wolfi rolling crossplane-crank 2.0.2-r4 —
Wolfi rolling ctop 0.7.7-r28 —
Wolfi rolling custom-pod-autoscaler +1 2.12.2-r3 —
Wolfi rolling custom-pod-autoscaler-operator +1 1.4.2-r3 —
Wolfi rolling dagdotdev 0.0.17-r3 —
Wolfi rolling dask-gateway +1 2025.4.0-r5 —
Wolfi rolling dbmate 2.28.0-r2 —
Wolfi rolling delve +2 1.25.2-r2 —
Wolfi rolling dfc 0.9.5-r1 —
Wolfi rolling direnv 2.37.1-r2 —
Wolfi rolling distribution 3.0.0-r42 —
Wolfi rolling dive 0.13.1-r9 —
Wolfi rolling docker-cli-buildx 0.29.1-r1 —
Wolfi rolling docker-credential-acr-env 0.7.0-r24 —
Wolfi rolling docker-credential-ecr-login 0.10.1-r3 —
Wolfi rolling docker-credential-gcr 2.1.30-r5 —
Wolfi rolling docker-machine-driver-harvester 1.0.4-r1 —
Wolfi rolling docker-machine-driver-linode 0.1.15-r6 —
Wolfi rolling dockerize 0.9.6-r1 —
Wolfi rolling doppler-kubernetes-operator 1.7.1-r1 —
Wolfi rolling dynamic-localpv-provisioner 4.3.0-r4 —
Wolfi rolling elvish 0.21.0-r7 —
Wolfi rolling envconsul 0.13.4-r2 —
Wolfi rolling etcd-3.6 +1 3.6.5-r1 —
Wolfi rolling extism 1.6.3-r2 —
Wolfi rolling falco-exporter 0.8.7-r10 —
Wolfi rolling falco-no-driver 0.43.0-r1 —
Wolfi rolling falcoctl 0.11.4-r1 —
Wolfi rolling falcosidekick 2.32.0-r1 —
Wolfi rolling ferretdb 2.5.0-r2 —
Wolfi rolling flyte 1.16.1-r1 —
Wolfi rolling fq 0.15.1-r3 —
Wolfi rolling fscrypt 0.3.5-r11 —
Wolfi rolling fulcio 1.7.1-r8 —
Wolfi rolling gcsfuse 2.12.2-r6 —
Wolfi rolling ghaudit 0.4.0-r15 —
Wolfi rolling git-credential-oauth +2 0.16.0-r1 —
Wolfi rolling gke-gcloud-auth-plugin 0.1.0-r10 —
Wolfi rolling glow 2.1.1-r7 —
Wolfi rolling go-1.20 +2 No fix yet —
Wolfi rolling go-bindata 3.1.3-r31 —
Wolfi rolling go-licenses 2.0.1-r1 —
Wolfi rolling go-md2man +1 2.0.7-r4 —
Wolfi rolling gobump 0.9.3-r2 —
Wolfi rolling gobuster 3.8.2-r2 —
Wolfi rolling gops 0.3.28-r21 —
Wolfi rolling gostatsd 28.3.0-r19 —
Wolfi rolling gosu 1.19-r1 —
Wolfi rolling gotestsum +4 1.13.0-r1 —
Wolfi rolling govulncheck 1.1.4-r4 —
Wolfi rolling grpcurl 1.9.3-r8 —
Wolfi rolling guac +4 1.0.1-r1 —
Wolfi rolling harbor-2.14 +6 2.14.0-r2 —
Wolfi rolling harbor-registry 3.0.0-r11 —
Wolfi rolling hello-world-golang 1.3-r14 —
Wolfi rolling helm-docs 1.14.2-r15 —
Wolfi rolling helm-push 0.10.4-r35 —
Wolfi rolling helm-set-status 0.3.0-r5 —
Wolfi rolling hey 0.1.4-r27 —
Wolfi rolling hivemind 1.1.0-r11 —
Wolfi rolling http-echo 1.0.0-r18 —
Wolfi rolling hydra 2.3.0-r13 —
Wolfi rolling incert 0.5.0-r6 —
Wolfi rolling infinispan-operator +1 2.4.18-r1 —
Wolfi rolling ini-file 1.4.9-r2 —
Wolfi rolling ip-masq-agent 2.12.0-r14 —
Wolfi rolling ipfs-cluster +2 1.1.4-r8 —
Wolfi rolling iptables-wrappers 2-r3 —
Wolfi rolling istio-pilot-agent-1.25 +1 1.25.5-r2 —
Wolfi rolling jitsucom-bulker +10 2.11.913-r0 —
Wolfi rolling juicefs-1.3 +1 1.3.0-r7 —
Wolfi rolling k3d +2 5.8.3-r18 —
Wolfi rolling k6 +1 1.3.0-r1 —
Wolfi rolling kaf 0.2.13-r5 —
Wolfi rolling kafka-proxy +1 0.4.3-r5 —
Wolfi rolling kafka_exporter 1.9.0-r39 —
Wolfi rolling kapp 0.64.2-r5 —
Wolfi rolling katib-earlystopping +8 0.19.0-r31 —
Wolfi rolling katib-suggestion-goptuna-compat 0.19.0-r40 —
Wolfi rolling kbld 0.46.0-r4 —
Wolfi rolling kind 0.30.0-r2 —
Wolfi rolling ko 0.18.0-r7 —
Wolfi rolling kpt 1.0.0_beta55-r13 —
Wolfi rolling kratos +1 2.9.1-r1 —
Wolfi rolling kube-bench +1 0.13.0-r1 —
Wolfi rolling kube-logging-operator-custom-runner +1 0.13.0-r2 —
Wolfi rolling kube-metrics-adapter 0.2.6-r1 —
Wolfi rolling kube-rbac-proxy 0.20.0-r1 —
Wolfi rolling kube-state-metrics +2 2.17.0-r1 —
Wolfi rolling kube-vip-cloud-provider +1 0.0.12-r5 —
Wolfi rolling kubebuilder 4.9.0-r1 —
Wolfi rolling kubecolor 0.5.2-r1 —
Wolfi rolling kubeflow +12 1.10.0-r7 —
Wolfi rolling kubelet-csr-approver +1 1.2.11-r1 —
Wolfi rolling kuberlr +1 0.6.1-r4 —
Wolfi rolling kubernetes-csi-driver-hostpath 1.17.0-r6 —
Wolfi rolling kubernetes-csi-external-attacher +1 4.10.0-r1 —
Wolfi rolling kubernetes-dashboard-metrics-scraper +1 1.2.2-r13 —
Wolfi rolling kubernetes-dashboard-web +1 1.7.0-r7 —
Wolfi rolling kubernetes-event-exporter +1 1.7-r47 —
Wolfi rolling kubernetes-replicator 2.12.0-r3 —
Wolfi rolling kubescape-operator 0.2.109-r1 —
Wolfi rolling kubevela +3 1.10.4-r2 —
Wolfi rolling kustomize 5.7.1-r2 —
Wolfi rolling kwok +1 0.7.0-r4 —
Wolfi rolling lazydocker 0.24.1-r8 —
Wolfi rolling licenseclassifier 2.0.0-r5 —
Wolfi rolling litefs 0.5.14-r4 —
Wolfi rolling local-path-provisioner 0.0.32-r2 —
Wolfi rolling logstash-exporter 1.9.1-r2 —
Wolfi rolling mage 1.15.0-r17 —
Wolfi rolling manifest-tool 2.2.1-r1 —
Wolfi rolling maru 0.6.0-r5 —
Wolfi rolling mc +1 0.20250813.083541-r1 —
Wolfi rolling mesosphere-vsphere-csi +2 3.5.0-r3 —
Wolfi rolling metacontroller 4.12.5-r1 —
Wolfi rolling metrics-server +2 0.8.0-r4 —
Wolfi rolling minio-object-browser +1 2.0.4-r1 —
Wolfi rolling mkcert 1.4.4-r17 —
Wolfi rolling mockery 3.5.5-r1 —
Wolfi rolling mockgen 0.6.0-r2 —
Wolfi rolling mods 1.8.1-r3 —
Wolfi rolling mongo-tools 100.13.0-r3 —
Wolfi rolling mongodb-kubernetes-operator +5 0.13.0-r4 —
Wolfi rolling nats 0.3.0-r1 —
Wolfi rolling nerdctl 2.1.6-r1 —
Wolfi rolling neuvector-dbgen +1 0_git20240423-r8 —
Wolfi rolling neuvector-sigstore-interface 0_git20250629-r4 —
Wolfi rolling newrelic-nri-statsd 2.11.0-r9 —
Wolfi rolling nfs-subdir-external-provisioner 4.0.18-r25 —
Wolfi rolling nodetaint 0.0.4-r38 —
Wolfi rolling nova +1 3.11.8-r3 —
Wolfi rolling nri-prometheus 2.27.2-r1 —
Wolfi rolling nsc 2.12.0-r1 —
Wolfi rolling oauth2-proxy +1 7.12.0-r2 —
Wolfi rolling octo-sts +1 0.5.3-r3 —
Wolfi rolling openbao-k8s +1 1.4.0-r40 —
Wolfi rolling opensearch-k8s-operator +1 2.8.0-r3 —
Wolfi rolling opentofu-1.9 1.9.4-r2 —
Wolfi rolling otel-cli 0.4.5-r7 —
Wolfi rolling petname 2.11-r17 —
Wolfi rolling pg_user 1.1.1-r2 —
Wolfi rolling pgpool2_exporter 1.2.2-r6 —
Wolfi rolling php-fpm_exporter 2.2.0-r17 —
Wolfi rolling podcli +2 6.9.2-r1 —
Wolfi rolling policy-controller +1 0.13.1-r1 —
Wolfi rolling portieris +1 0.13.31-r1 —
Wolfi rolling prometheus-adapter 0.12.0-r16 —
Wolfi rolling prometheus-alertmanager +1 0.28.1-r10 —
Wolfi rolling prometheus-pushgateway +1 1.11.2-r0 —
Wolfi rolling promxy 0.0.93-r4 —
Wolfi rolling protoc-gen-go 1.36.10-r1 —
Wolfi rolling protoc-gen-go-grpc 1.5.1-r8 —
Wolfi rolling pulumi-kubernetes-operator 1.16.0-r20 —
Wolfi rolling pvc-autoresizer +1 0.18.0-r1 —
Wolfi rolling rancher-helm-3 3.19.0-r1 —
Wolfi rolling rancher-loglevel 0.1.6-r8 —
Wolfi rolling rancher-machine 0.15.0.135-r1 —
Wolfi rolling rancher-system-agent 0.3.13-r4 —
Wolfi rolling rancher-telemetry 0.6.2-r5 —
Wolfi rolling redka +1 0.6.0-r4 —
Wolfi rolling regclient +8 0.9.2-r2 —
Wolfi rolling rekor +3 1.4.2-r1 —
Wolfi rolling render-template 1.0.9-r2 —
Wolfi rolling renovate 42.12.1-r0 —
Wolfi rolling restic +1 0.18.1-r1 —
Wolfi rolling rootlesskit +1 2.3.5-r7 —
Wolfi rolling runc +1 1.3.2-r1 —
Wolfi rolling s5cmd 2.3.0-r7 —
Wolfi rolling sbom-convert 0.0.7-r5 —
Wolfi rolling sbom-scorecard 0.0.7-r24 —
Wolfi rolling scorecard 5.3.0-r1 —
Wolfi rolling sealed-secrets +3 0.32.2-r2 —
Wolfi rolling secrets-store-csi-driver +1 1.5.4-r1 —
Wolfi rolling secrets-store-csi-driver-provider-aws 2.1.1-r1 —
Wolfi rolling secrets-store-csi-driver-provider-gcp 1.9.0-r3 —
Wolfi rolling shfmt 3.12.0-r3 —
Wolfi rolling sigstore-scaffolding +13 0.7.25-r1 —
Wolfi rolling skaffold 2.16.1-r3 —
Wolfi rolling skopeo 1.20.0-r4 —
Wolfi rolling slsa-verifier 2.7.1-r3 —
Wolfi rolling smarter-device-manager 1.20.11-r21 —
Wolfi rolling sonobuoy +1 0.57.3-r9 —
Wolfi rolling sops 3.11.0-r1 —
Wolfi rolling spark-operator +1 2.3.0-r4 —
Wolfi rolling speedtest-go 1.7.10-r7 —
Wolfi rolling spicedb-operator +1 1.21.0-r1 —
Wolfi rolling spiffe-helper +1 0.10.1-r2 —
Wolfi rolling spire-controller-manager +1 0.6.3-r2 —
Wolfi rolling spqr +1 2.7.0-r1 —
Wolfi rolling src-fingerprint 0.19.0-r33 —
Wolfi rolling sriov-network-device-plugin +1 3.10.0-r1 —
Wolfi rolling stakater-reloader +1 1.4.8-r2 —
Wolfi rolling step-kms-plugin 0.15.1-r2 —
Wolfi rolling stern 1.33.0-r1 —
Wolfi rolling task 3.45.4-r1 —
Wolfi rolling terraform +2 1.5.7-r34 —
Wolfi rolling terraform-docs 0.20.0-r5 —
Wolfi rolling terraform-provider-azuread 3.6.0-r1 —
Wolfi rolling terraform-provider-kubernetes 2.38.0-r3 —
Wolfi rolling terraform-provider-random 3.7.2-r4 —
Wolfi rolling terraform-provider-sendgrid 1.0.1-r7 —
Wolfi rolling terraform-provider-time 0.13.1-r4 —
Wolfi rolling terraform-provider-tls 4.1.0-r4 —
Wolfi rolling tfsec 1.28.14-r7 —
Wolfi rolling thanos-operator 0.3.7-r35 —
Wolfi rolling timescaledb-parallel-copy 0.11.0-r0 —
Wolfi rolling timescaledb-tune 0.18.1-r2 —
Wolfi rolling timestamp-authority +2 1.2.9-r1 —
Wolfi rolling timoni 0.25.2-r2 —
Wolfi rolling tofu-controller +3 0.16.0_rc5-r5 —
Wolfi rolling trillian +2 1.7.2-r5 —
Wolfi rolling trivy-operator 0.29.0-r1 —
Wolfi rolling vault-env +1 1.22.0-r3 —
Wolfi rolling vault-k8s 1.7.0-r4 —
Wolfi rolling vault-secrets-webhook +1 1.22.1-r1 —
Wolfi rolling velero +2 1.17.0-r1 —
Wolfi rolling velero-plugin-for-csi +1 0.7.1-r38 —
Wolfi rolling vendir 0.44.0-r4 —
Wolfi rolling vertical-pod-autoscaler +2 1.5.1-r1 —
Wolfi rolling vexctl +2 0.4.1-r1 —
Wolfi rolling vt-cli 1.2.0-r1 —
Wolfi rolling wait-for-port 1.0.10-r2 —
Wolfi rolling wave 0.10.0-r12 —
Wolfi rolling wazero 1.9.0-r6 —
Wolfi rolling wgcf 2.2.29-r2 —
Wolfi rolling wire-go 0.7.0-r2 —
Wolfi rolling wireguard-go 0.0.20250522-r5 —
Wolfi rolling xcaddy 0.4.5-r2 —
Wolfi rolling xcover 0.2.0-r4 —
Wolfi rolling yunikorn-k8shim +1 1.7.0-r5 —
Wolfi rolling yunikorn-web +1 1.7.0-r2 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go stdlib < 1.24.8 · >= 1.25.0, < 1.25.2 1.24.8, 1.25.2 GO-2025-4008

Advisories 45

References