Skip to content
OpenAdvisories
High · 7.5 CVE-2025-61723 BIT-golang-2025-61723EUVD-2025-36736GHSA-hjx7-fpxx-mj48GO-2025-4009

Quadratic complexity when parsing some invalid inputs in encoding/pem

Published Oct 29, 2025 · Updated Nov 4, 2025 · Assigned by Go

Vendor: Go standard library Product: encoding/pem Package: age Package: amass Package: apisix-ingress-controller Package: apisix-ingress-controller-compat Package: apisix-ingress-controller-iamguarded-compat Package: argo-rollouts Package: atlantis Package: aws-node-termination-handler Package: aws-node-termination-handler-compat Package: aws-s3-controller Package: aws-signer-notation-plugin Package: aws-sigv4-proxy Package: aws-sigv4-proxy-compat Package: azure-ipam Package: azure-ipam-dropgz Package: azure-workload-identity-webhook Package: azure-workload-identity-webhook-compat Package: bazelisk Package: bazelisk-default Package: bom Package: boring-registry Package: cadvisor Package: cadvisor-compat Package: capslock Package: cargobump Package: cert-exporter Package: cert-manager-cmctl Package: cert-manager-webhook-pdns Package: certificate-transparency Package: certificate-transparency-trillian-ctserver Package: cfssl Package: cfssl-bundle Package: cfssl-certinfo Package: cfssl-json Package: cfssl-mkbundle Package: cfssl-multirootca Package: cfssl-newkey Package: cfssl-scan Package: chartmuseum Package: checksec Package: chisel Package: chisel-compat Package: cloud-provider-gcp-cloud-controller-manager Package: cloud-provider-gcp-cloud-controller-manager-compat Package: cloud-provider-vsphere Package: cloud-sql-proxy-2.16 Package: cloud-sql-proxy-2.16-compat Package: cluster-api-gcp-controller Package: cluster-api-gcp-controller-compat Package: cluster-api-helm-controller Package: cluster-api-helm-controller-compat Package: cluster-api-provider-vsphere Package: cluster-api-provider-vsphere-compat Package: cluster-proportional-autoscaler Package: cluster-proportional-autoscaler-compat Package: configmap-reload Package: conftest Package: conjur-cli Package: container-object-storage-interface Package: container-object-storage-interface-controller Package: container-object-storage-interface-controller-compat Package: container-object-storage-interface-sidecar Package: container-object-storage-interface-sidecar-compat Package: controller-gen Package: crane Package: crane-cov Package: cri-tools Package: crictl Package: critest Package: crossplane-crank Package: ctop Package: custom-pod-autoscaler Package: custom-pod-autoscaler-compat Package: custom-pod-autoscaler-operator Package: custom-pod-autoscaler-operator-compat Package: dagdotdev Package: dask-gateway Package: dask-gateway-server Package: dbmate Package: delve Package: dfc Package: direnv Package: distribution Package: dive Package: docker-cli-buildx Package: docker-credential-acr-env Package: docker-credential-ecr-login Package: docker-credential-gcr Package: docker-machine-driver-harvester Package: docker-machine-driver-linode Package: dockerize Package: doppler-kubernetes-operator Package: dynamic-localpv-provisioner Package: elvish Package: envconsul Package: etcd-3.6 Package: etcd-3.6-iamguarded-compat Package: extism Package: falco-exporter Package: falco-no-driver Package: falcoctl Package: falcosidekick Package: ferretdb Package: fixuid Package: flyte Package: fq Package: fscrypt Package: fulcio Package: gcsfuse Package: ghaudit Package: git-credential-oauth Package: gke-gcloud-auth-plugin Package: glow Package: go Package: go-1.20 Package: go-1.22 Package: go-1.23 Package: go-bindata Package: go-licenses Package: go-md2man Package: go-md2man-doc Package: gobuster Package: golang Package: golang-1.10 Package: golang-1.13 Package: golang-1.14 Package: golang-1.16 Package: golang-1.17 Package: golang-1.18 Package: golang-1.19 Package: golang-1.20 Package: golang-1.21 Package: golang-1.22 Package: golang-1.23 Package: golang-1.24 Package: golang-1.24 Package: golang-1.25 Package: golang-1.6 Package: golang-1.8 Package: golang-1.9 Package: gops Package: gostatsd Package: gosu Package: gotestsum Package: govulncheck Package: grpcurl Package: guac Package: guaccsub Package: guacgql Package: guacingest Package: guacone Package: harbor-2.14 Package: harbor-2.14-exporter Package: harbor-2.14-jobservice Package: harbor-2.14-portal Package: harbor-2.14-portal-nginx-config Package: harbor-2.14-redis-compat Package: harbor-2.14-registryctl Package: harbor-registry Package: hello-world-golang Package: helm-docs Package: helm-mapkubeapis Package: helm-push Package: helm-set-status Package: hey Package: hivemind Package: http-echo Package: hydra Package: incert Package: infinispan-operator Package: infinispan-operator-compat Package: ini-file Package: ip-masq-agent Package: ipfs-cluster Package: ipfs-cluster-compat Package: ipfs-cluster-oci-entrypoint Package: iptables-wrappers Package: istio-pilot-agent-1.25 Package: istio-pilot-agent-1.25-compat Package: jitsucom-bulker Package: jitsucom-bulker-bulker Package: jitsucom-bulker-bulker-compat Package: jitsucom-bulker-ingest Package: jitsucom-bulker-ingest-compat Package: jitsucom-bulker-ingmgr Package: jitsucom-bulker-ingmgr-compat Package: jitsucom-bulker-sidecar Package: jitsucom-bulker-sidecar-compat Package: jitsucom-bulker-syncctl Package: jitsucom-bulker-syncctl-compat Package: juicefs-1.3 Package: juicefs-1.3-compat Package: k3d Package: k3d-proxy Package: k3d-tools Package: k6 Package: kaf Package: kafka_exporter Package: kafka-proxy Package: kafka-proxy-compat Package: kapp Package: katib-earlystopping Package: katib-suggestion-goptuna-compat Package: katib-suggestion-hyperband Package: katib-suggestion-hyperopt Package: katib-suggestion-nas-darts Package: katib-suggestion-nas-enas Package: katib-suggestion-optuna-enas Package: katib-suggestion-pbt-enas Package: katib-suggestion-skopt-enas Package: katib-tfevent-metricscollector Package: kbld Package: kind Package: ko Package: kpt Package: kratos Package: kratos-protoc-gen Package: kube-bench Package: kube-bench-configs Package: kube-logging-operator-custom-runner Package: kube-logging-operator-custom-runner-compat Package: kube-metrics-adapter Package: kube-rbac-proxy Package: kube-state-metrics Package: kube-state-metrics-iamguarded-compat Package: kube-vip-cloud-provider Package: kube-vip-cloud-provider-compat Package: kubebuilder Package: kubecolor Package: kubectl-argo-rollouts Package: kubeflow Package: kubeflow-access-management Package: kubeflow-access-management-compat Package: kubeflow-admission-webhook Package: kubeflow-admission-webhook-compat Package: kubeflow-notebook-controller Package: kubeflow-notebook-controller-compat Package: kubeflow-profile-controller Package: kubeflow-profile-controller-compat Package: kubeflow-pvcviewer-controller Package: kubeflow-pvcviewer-controller-compat Package: kubeflow-tensorboard-controller Package: kubeflow-tensorboard-controller-compat Package: kubelet-csr-approver Package: kubelet-csr-approver-compat Package: kuberlr Package: kubernetes-csi-driver-hostpath Package: kubernetes-csi-external-attacher Package: kubernetes-csi-external-attacher-compat Package: kubernetes-csi-external-health-monitor Package: kubernetes-csi-external-health-monitor-compat Package: kubernetes-csi-livenessprobe Package: kubernetes-dashboard-metrics-scraper Package: kubernetes-dashboard-metrics-scraper-compat Package: kubernetes-dashboard-web Package: kubernetes-dashboard-web-compat Package: kubernetes-event-exporter Package: kubernetes-event-exporter-iamguarded-compat Package: kubernetes-replicator Package: kubescape-operator Package: kubevela Package: kubevela-vela-cli Package: kubevela-vela-core Package: kubevela-vela-core-compat Package: kustomize Package: kwok Package: kwokctl Package: lazydocker Package: licenseclassifier Package: litefs Package: local-path-provisioner Package: logstash-exporter Package: mage Package: manifest-tool Package: maru Package: mc Package: mc-iamguarded-2025-compat Package: mesosphere-vsphere-csi Package: mesosphere-vsphere-csi-driver Package: mesosphere-vsphere-csi-syncer Package: metacontroller Package: metrics-server Package: metrics-server-compat Package: metrics-server-iamguarded-compat Package: minio-object-browser Package: minio-object-browser-iamguarded-compat Package: mkcert Package: mockery Package: mockgen Package: mods Package: mongo-tools Package: mongodb-kubernetes-operator Package: mongodb-kubernetes-operator-compat Package: mongodb-kubernetes-operator-readinessprobe Package: mongodb-kubernetes-operator-readinessprobe-compat Package: mongodb-kubernetes-operator-version-upgrade-post-start-hook Package: mongodb-kubernetes-operator-version-upgrade-post-start-hook-compat Package: nats Package: nerdctl Package: neuvector-db-updater Package: neuvector-dbgen Package: neuvector-sigstore-interface Package: newrelic-nri-statsd Package: nfs-subdir-external-provisioner Package: nodetaint Package: nova Package: nova-compat Package: nri-prometheus Package: nsc Package: oauth2-proxy Package: oauth2-proxy-iamguarded-compat Package: octo-sts Package: octo-sts-webhook Package: openbao-k8s Package: openbao-k8s-compat Package: opensearch-k8s-operator Package: opensearch-k8s-operator-compat Package: opentofu-1.9 Package: oras Package: otel-cli Package: petname Package: pg_user Package: pgpool2_exporter Package: php-fpm_exporter Package: podcli Package: podinfo Package: podinfo-compat Package: policy-controller Package: policy-controller-tester Package: portieris Package: portieris-compat Package: prometheus-adapter Package: prometheus-alertmanager Package: prometheus-alertmanager-iamguarded-compat Package: prometheus-pushgateway Package: prometheus-pushgateway-iamguarded-compat Package: promxy Package: protoc-gen-go Package: protoc-gen-go-grpc Package: pulumi-kubernetes-operator Package: pvc-autoresizer Package: pvc-autoresizer-compat Package: rancher-helm-3 Package: rancher-loglevel Package: rancher-machine Package: rancher-system-agent Package: rancher-telemetry Package: redka Package: regclient Package: regclient-regbot Package: regclient-regbot-compat Package: regclient-regctl Package: regclient-regctl-compat Package: regclient-regsync Package: regclient-regsync-compat Package: rekor Package: rekor-backfill-index Package: rekor-cli Package: rekor-server Package: render-template Package: renovate Package: restic Package: restic-compat Package: rootlesskit Package: rootlesskit-config-nonroot Package: runc Package: runc-doc Package: s5cmd Package: sbom-convert Package: sbom-scorecard Package: scorecard Package: sealed-secrets Package: sealed-secrets-compat Package: sealed-secrets-kubeseal Package: sealed-secrets-kubeseal-compat Package: secrets-store-csi-driver Package: secrets-store-csi-driver-crds Package: secrets-store-csi-driver-provider-aws Package: secrets-store-csi-driver-provider-gcp Package: shfmt Package: sigstore-scaffolding Package: sigstore-scaffolding-cloudsqlproxy Package: sigstore-scaffolding-ctlog-createctconfig Package: sigstore-scaffolding-ctlog-managectroots Package: sigstore-scaffolding-ctlog-verifyfulcio Package: sigstore-scaffolding-fulcio-createcerts Package: sigstore-scaffolding-getoidctoken Package: sigstore-scaffolding-rekor-createsecret Package: sigstore-scaffolding-trillian-createdb Package: sigstore-scaffolding-trillian-createtree Package: sigstore-scaffolding-trillian-updatetree Package: sigstore-scaffolding-tsa-createcertchain Package: sigstore-scaffolding-tuf-createsecret Package: sigstore-scaffolding-tuf-server Package: skaffold Package: skopeo Package: slsa-verifier Package: smarter-device-manager Package: sonobuoy Package: sonobuoy-compat Package: sops Package: spark-operator Package: spark-operator-oci-entrypoint Package: speedtest-go Package: spicedb-operator Package: spicedb-operator-compat Package: spiffe-helper Package: spiffe-helper-compat Package: spire-controller-manager Package: spire-controller-manager-compat Package: spqr Package: src-fingerprint Package: sriov-network-device-plugin Package: sriov-network-device-plugin-entrypoint Package: stakater-reloader Package: stakater-reloader-compat Package: stdlib Package: step-kms-plugin Package: stern Package: task Package: terraform Package: terraform-compat Package: terraform-docs Package: terraform-local-provider-config Package: terraform-provider-azapi Package: terraform-provider-azuread Package: terraform-provider-kubernetes Package: terraform-provider-random Package: terraform-provider-sendgrid Package: terraform-provider-time Package: terraform-provider-tls Package: tfsec Package: thanos-operator Package: timescaledb-parallel-copy Package: timescaledb-tune Package: timestamp-authority Package: timestamp-authority-cli Package: timestamp-authority-server Package: timoni Package: tofu-controller Package: tofu-controller-compat Package: tofu-controller-runner Package: tofu-controller-runner-compat Package: trillian Package: trillian-logserver Package: trillian-logsigner Package: trivy-operator Package: vault-env Package: vault-env-compat Package: vault-k8s Package: vault-secrets-webhook Package: vault-secrets-webhook-compat Package: velero Package: velero-compat Package: velero-plugin-for-aws Package: velero-plugin-for-aws-compat Package: velero-plugin-for-csi Package: velero-plugin-for-csi-compat Package: velero-plugin-for-microsoft-azure Package: velero-plugin-for-microsoft-azure-compat Package: velero-restore-helper Package: vendir Package: vertical-pod-autoscaler Package: vertical-pod-autoscaler-recommender Package: vertical-pod-autoscaler-updater Package: vexctl Package: vt-cli Package: wait-for-port Package: wave Package: wazero Package: wgcf Package: whereabouts Package: whereabouts-compat Package: wire-go Package: wireguard-go Package: xcaddy Package: xcover Package: yunikorn-k8shim Package: yunikorn-k8shim-compat Package: yunikorn-web Package: yunikorn-web-compat Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs.

Affected products

VendorProductAffectedFixed
Go standard library encoding/pem < 1.24.8, 1.25.0 – < 1.25.2 1.24.8

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 13 golang-1.24 No fix yet —
Debian 12 golang-1.19 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS golang-1.23 +1 No fix yet —
Ubuntu 25.10 golang-1.23 +2 No fix yet —
Ubuntu 24.04 LTS golang-1.21 +3 No fix yet —
Ubuntu 22.04 LTS golang-1.17 +7 No fix yet —
Ubuntu 20.04 LTS golang-1.13 +5 No fix yet —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS golang-1.8 +2 No fix yet —
Ubuntu 16.04 LTS golang-1.6 +1 No fix yet —
Ubuntu 14.04 LTS golang-1.10 No fix yet —
Ubuntu Pro 22.04 LTS golang-1.13 No fix yet —
Ubuntu Pro 20.04 LTS golang-1.16 No fix yet —
Ubuntu Pro 18.04 LTS golang-1.13 +2 No fix yet —
Ubuntu Pro 16.04 LTS golang-1.13 +1 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 golang1.25 +6 1.25.9-1.hum1 RHSA-2026:7385
Red Hat Hardened Images 1 golang1.26 +6 1.26.2-1.hum1 RHSA-2026:7291

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
SLES 15 SP7 go1.24-openssl 1.24.12-150600.13.15.1 SUSE-SU-2026:0308-1
SLES 15 SP7 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1
SLES 15 SP7 go1.25-openssl 1.25.6-150600.13.9.1 SUSE-SU-2026:0298-1
SLES 15 SP6 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
SLES 15 SP6 go1.24-openssl 1.24.12-150600.13.15.1 SUSE-SU-2026:0308-1
SLES 15 SP6 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1
SLES 15 SP6 go1.25-openssl 1.25.6-150600.13.9.1 SUSE-SU-2026:0298-1
SLES 15 SP5 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
SLES 15 SP5 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLES 15 SP5 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1
SLES 15 SP5 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLES 15 SP4 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
SLES 15 SP4 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLES 15 SP4 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1
SLES 15 SP4 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLES 15 SP3 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
SLES 15 SP3 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 go1.24 1.24.11-160000.1.1 SUSE-SU-2025:21193-1
SLES for SAP 16.0 go1.24-openssl 1.24.13-160000.1.1 SUSE-SU-2026:20629-1
SLES for SAP 16.0 go1.25 1.25.5-160000.1.1 SUSE-SU-2025:21192-1
SLES for SAP 16.0 go1.25-openssl 1.25.7-160000.1.1 SUSE-SU-2026:20623-1
SLES for SAP 15 SP6 go1.24-openssl 1.24.12-150600.13.15.1 SUSE-SU-2026:0308-1
SLES for SAP 15 SP6 go1.25-openssl 1.25.6-150600.13.9.1 SUSE-SU-2026:0298-1
SLES for SAP 15 SP5 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
SLES for SAP 15 SP5 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLES for SAP 15 SP5 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1
SLES for SAP 15 SP5 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLES for SAP 15 SP4 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
SLES for SAP 15 SP4 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLES for SAP 15 SP4 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1
SLES for SAP 15 SP4 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLES for SAP 15 SP3 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
SLES for SAP 15 SP3 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1
SLES 16.0 go1.24 1.24.11-160000.1.1 SUSE-SU-2025:21193-1
SLES 16.0 go1.24-openssl 1.24.13-160000.1.1 SUSE-SU-2026:20629-1
SLES 16.0 go1.25 1.25.5-160000.1.1 SUSE-SU-2025:21192-1
SLES 16.0 go1.25-openssl 1.25.7-160000.1.1 SUSE-SU-2026:20623-1
SLE HPC 15 SP5 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
SLE HPC 15 SP5 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLE HPC 15 SP5 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1
SLE HPC 15 SP5 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLE HPC 15 SP4 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
SLE HPC 15 SP4 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLE HPC 15 SP4 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1
SLE HPC 15 SP4 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLE HPC 15 SP3 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
SLE HPC 15 SP3 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1
SUSE Enterprise Storage 7.1 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
SUSE Enterprise Storage 7.1 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed go1.24 1.24.8-1.1 openSUSE-SU-2025:15608-1
openSUSE Tumbleweed go1.25 1.25.2-1.1 openSUSE-SU-2025:15609-1
openSUSE Tumbleweed govulncheck-vulndb 0.0.20251029T215107-1.1 openSUSE-SU-2025:15695-1
openSUSE Tumbleweed regclient 0.10.0-1.1 openSUSE-SU-2025:15723-1
openSUSE Leap 16.0 go1.24 1.24.11-160000.1.1 openSUSE-SU-2025:20158-1
openSUSE Leap 16.0 go1.24-openssl 1.24.13-160000.1.1 openSUSE-SU-2026:20308-1
openSUSE Leap 16.0 go1.25 1.25.5-160000.1.1 openSUSE-SU-2025:20157-1
openSUSE Leap 16.0 go1.25-openssl 1.25.7-160000.1.1 openSUSE-SU-2026:20301-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 15.6 go1.24 1.24.9-150000.1.42.1 SUSE-SU-2025:3682-1
openSUSE Leap 15.6 go1.24-openssl 1.24.12-150600.13.15.1 SUSE-SU-2026:0308-1
openSUSE Leap 15.6 go1.25 1.25.2-150000.1.14.1 SUSE-SU-2025:03547-1
openSUSE Leap 15.6 go1.25-openssl 1.25.6-150600.13.9.1 SUSE-SU-2026:0298-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 go 1.25.2-r0 —
Alpine v3.23 go 1.25.2-r0 —
Alpine v3.22 go 1.24.8-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 amazon-cloudwatch-agent 1.300060.1-1.amzn2023 ALAS2023-2025-1275
Amazon Linux 2023 amazon-ecr-credential-helper 0.10.1-3.amzn2023 ALAS2023-2025-1271
Amazon Linux 2023 amazon-ssm-agent 3.3.3572.0-1.amzn2023 ALAS2023-2025-1359
Amazon Linux 2023 cni-plugins 1.7.1-1.amzn2023.0.3 ALAS2023-2025-1287
Amazon Linux 2023 containerd +1 2.1.4-1.amzn2023.0.2 ALAS2023-2025-1272
Amazon Linux 2023 docker 25.0.13-1.amzn2023.0.2 ALAS2023-2025-1274
Amazon Linux 2023 golang +6 1.24.8-1.amzn2023.0.1 ALAS2023-2025-1239
Amazon Linux 2023 golist 0.10.1-11.amzn2023.0.5 ALAS2023-2025-1276
Amazon Linux 2023 libcap +3 2.73-1.amzn2023.0.4 ALAS2023-2025-1279
Amazon Linux 2023 nerdctl 2.1.5-1.amzn2023.0.2 ALAS2023-2025-1278
Amazon Linux 2023 oci-add-hooks 0-0.1.20200504git268e3bb.amzn2023.0.6 ALAS2023-2025-1273
Amazon Linux 2023 runc 1.3.3-2.amzn2023.0.1 ALAS2023-2025-1286
Amazon Linux 2023 runfinch-finch 1.10.0-1.amzn2023.0.5 ALAS2023-2025-1270
Amazon Linux 2023 soci-snapshotter 0.11.1-1.amzn2023.0.3 ALAS2023-2025-1277
Amazon Linux 2 amazon-cloudwatch-agent 1.300060.1-1.amzn2 ALAS2-2025-3068
Amazon Linux 2 amazon-ssm-agent 3.3.3572.0-1.amzn2 ALAS2-2025-3121
Amazon Linux 2 cni-plugins 1.7.1-1.amzn2.0.3 ALAS2-2025-3078
Amazon Linux 2 cri-tools 1.32.0-1.amzn2.0.2 ALAS2-2025-3079
Amazon Linux 2 golang +6 1.24.8-1.amzn2.0.1 ALAS2-2025-3042
Amazon Linux 2 golist 0.10.1-10.amzn2.0.8 ALAS2-2025-3069
Amazon Linux 2 nerdctl 2.1.5-1.amzn2.0.2 ALAS2-2025-3070
Amazon Linux 2 rclone 1.55.1-1.amzn2.0.3 ALAS2-2025-3071

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 golang No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling age 1.2.1-r8 —
Wolfi rolling amass 5.0.1-r1 —
Wolfi rolling apisix-ingress-controller +2 1.8.4-r4 —
Wolfi rolling argo-rollouts +1 1.8.3-r4 —
Wolfi rolling atlantis 0.36.0-r2 —
Wolfi rolling aws-s3-controller 1.1.1-r1 —
Wolfi rolling aws-signer-notation-plugin 1.0.2292-r3 —
Wolfi rolling aws-sigv4-proxy +1 1.10-r3 —
Wolfi rolling azure-ipam +1 0.4.0-r4 —
Wolfi rolling azure-workload-identity-webhook +1 1.5.1-r3 —
Wolfi rolling bazelisk +1 1.27.0-r1 —
Wolfi rolling bom 0.7.1-r1 —
Wolfi rolling boring-registry 0.16.6-r2 —
Wolfi rolling cadvisor +1 0.53.0-r6 —
Wolfi rolling capslock 0.2.8-r1 —
Wolfi rolling cargobump 0.1.0-r7 —
Wolfi rolling cert-exporter 2.16.0-r2 —
Wolfi rolling cert-manager-cmctl 2.3.0-r5 —
Wolfi rolling cert-manager-webhook-pdns 2.5.3-r1 —
Wolfi rolling certificate-transparency +1 1.3.2-r4 —
Wolfi rolling cfssl +7 1.6.5-r23 —
Wolfi rolling chartmuseum 0.16.3-r8 —
Wolfi rolling checksec 3.0.2-r6 —
Wolfi rolling chisel +1 1.11.3-r1 —
Wolfi rolling cloud-provider-gcp-cloud-controller-manager +1 34.0.0-r1 —
Wolfi rolling cloud-sql-proxy-2.16 +1 2.16.0-r10 —
Wolfi rolling cluster-api-gcp-controller +1 1.10.0-r4 —
Wolfi rolling cluster-api-provider-vsphere +1 1.14.0-r2 —
Wolfi rolling cluster-proportional-autoscaler +1 1.10.2-r7 —
Wolfi rolling configmap-reload 0.15.0-r4 —
Wolfi rolling conftest 0.63.0-r1 —
Wolfi rolling conjur-cli 8.1.3-r1 —
Wolfi rolling container-object-storage-interface +4 0.2.1-r2 —
Wolfi rolling controller-gen 0.19.0-r2 —
Wolfi rolling crane +1 0.20.6-r3 —
Wolfi rolling crictl +3 1.34.0-r2 —
Wolfi rolling crossplane-crank 2.0.2-r4 —
Wolfi rolling ctop 0.7.7-r28 —
Wolfi rolling custom-pod-autoscaler +1 2.12.2-r3 —
Wolfi rolling custom-pod-autoscaler-operator +1 1.4.2-r3 —
Wolfi rolling dagdotdev 0.0.17-r3 —
Wolfi rolling dask-gateway +1 2025.4.0-r5 —
Wolfi rolling dbmate 2.28.0-r2 —
Wolfi rolling delve +2 1.25.2-r2 —
Wolfi rolling dfc 0.9.5-r1 —
Wolfi rolling direnv 2.37.1-r2 —
Wolfi rolling distribution 3.0.0-r42 —
Wolfi rolling dive 0.13.1-r9 —
Wolfi rolling docker-cli-buildx 0.29.1-r1 —
Wolfi rolling docker-credential-acr-env 0.7.0-r24 —
Wolfi rolling docker-credential-ecr-login 0.10.1-r3 —
Wolfi rolling docker-credential-gcr 2.1.30-r5 —
Wolfi rolling docker-machine-driver-harvester 1.0.4-r1 —
Wolfi rolling docker-machine-driver-linode 0.1.15-r6 —
Wolfi rolling dockerize 0.9.6-r1 —
Wolfi rolling doppler-kubernetes-operator 1.7.1-r1 —
Wolfi rolling dynamic-localpv-provisioner 4.3.0-r4 —
Wolfi rolling elvish 0.21.0-r7 —
Wolfi rolling envconsul 0.13.4-r2 —
Wolfi rolling etcd-3.6 +1 3.6.5-r1 —
Wolfi rolling extism 1.6.3-r2 —
Wolfi rolling falco-exporter 0.8.7-r10 —
Wolfi rolling falco-no-driver 0.43.0-r3 —
Wolfi rolling falcoctl 0.11.4-r1 —
Wolfi rolling falcosidekick 2.32.0-r1 —
Wolfi rolling ferretdb 2.5.0-r2 —
Wolfi rolling flyte 1.16.1-r1 —
Wolfi rolling fq 0.15.1-r3 —
Wolfi rolling fscrypt 0.3.5-r11 —
Wolfi rolling fulcio 1.7.1-r8 —
Wolfi rolling gcsfuse 2.12.2-r6 —
Wolfi rolling ghaudit 0.4.0-r15 —
Wolfi rolling git-credential-oauth +2 0.16.0-r1 —
Wolfi rolling gke-gcloud-auth-plugin 0.1.0-r10 —
Wolfi rolling glow 2.1.1-r7 —
Wolfi rolling go-1.20 +2 No fix yet —
Wolfi rolling go-bindata 3.1.3-r31 —
Wolfi rolling go-licenses 2.0.1-r1 —
Wolfi rolling go-md2man +1 2.0.7-r4 —
Wolfi rolling gobuster 3.8.2-r2 —
Wolfi rolling gops 0.3.28-r21 —
Wolfi rolling gostatsd 28.3.0-r19 —
Wolfi rolling gosu 1.19-r1 —
Wolfi rolling gotestsum +4 1.13.0-r1 —
Wolfi rolling govulncheck 1.1.4-r4 —
Wolfi rolling grpcurl 1.9.3-r8 —
Wolfi rolling guac +4 1.0.1-r1 —
Wolfi rolling harbor-2.14 +6 2.14.0-r2 —
Wolfi rolling harbor-registry 3.0.0-r11 —
Wolfi rolling hello-world-golang 1.3-r14 —
Wolfi rolling helm-docs 1.14.2-r15 —
Wolfi rolling helm-push 0.10.4-r35 —
Wolfi rolling helm-set-status 0.3.0-r5 —
Wolfi rolling hey 0.1.4-r27 —
Wolfi rolling hivemind 1.1.0-r11 —
Wolfi rolling http-echo 1.0.0-r18 —
Wolfi rolling hydra 2.3.0-r13 —
Wolfi rolling incert 0.5.0-r6 —
Wolfi rolling infinispan-operator +1 2.4.18-r1 —
Wolfi rolling ini-file 1.4.9-r2 —
Wolfi rolling ip-masq-agent 2.12.0-r14 —
Wolfi rolling ipfs-cluster +2 1.1.4-r8 —
Wolfi rolling iptables-wrappers 2-r3 —
Wolfi rolling istio-pilot-agent-1.25 +1 1.25.5-r2 —
Wolfi rolling jitsucom-bulker +10 2.11.913-r0 —
Wolfi rolling juicefs-1.3 +1 1.3.0-r7 —
Wolfi rolling k3d +2 5.8.3-r18 —
Wolfi rolling k6 +1 1.3.0-r1 —
Wolfi rolling kaf 0.2.13-r5 —
Wolfi rolling kafka-proxy +1 0.4.3-r5 —
Wolfi rolling kafka_exporter 1.9.0-r39 —
Wolfi rolling kapp 0.64.2-r5 —
Wolfi rolling katib-earlystopping +8 0.19.0-r31 —
Wolfi rolling katib-suggestion-goptuna-compat 0.19.0-r40 —
Wolfi rolling kbld 0.46.0-r4 —
Wolfi rolling kind 0.30.0-r2 —
Wolfi rolling ko 0.18.0-r7 —
Wolfi rolling kpt 1.0.0_beta55-r13 —
Wolfi rolling kratos +1 2.9.1-r1 —
Wolfi rolling kube-bench +1 0.13.0-r1 —
Wolfi rolling kube-logging-operator-custom-runner +1 0.13.0-r2 —
Wolfi rolling kube-metrics-adapter 0.2.6-r1 —
Wolfi rolling kube-rbac-proxy 0.20.0-r1 —
Wolfi rolling kube-state-metrics +2 2.17.0-r1 —
Wolfi rolling kube-vip-cloud-provider +1 0.0.12-r5 —
Wolfi rolling kubebuilder 4.9.0-r1 —
Wolfi rolling kubecolor 0.5.2-r1 —
Wolfi rolling kubeflow +12 1.10.0-r7 —
Wolfi rolling kubelet-csr-approver +1 1.2.11-r1 —
Wolfi rolling kuberlr +1 0.6.1-r4 —
Wolfi rolling kubernetes-csi-driver-hostpath 1.17.0-r6 —
Wolfi rolling kubernetes-csi-external-attacher +1 4.10.0-r1 —
Wolfi rolling kubernetes-dashboard-metrics-scraper +1 1.2.2-r13 —
Wolfi rolling kubernetes-dashboard-web +1 1.7.0-r7 —
Wolfi rolling kubernetes-event-exporter +1 1.7-r47 —
Wolfi rolling kubernetes-replicator 2.12.0-r3 —
Wolfi rolling kubescape-operator 0.2.109-r1 —
Wolfi rolling kubevela +3 1.10.4-r2 —
Wolfi rolling kustomize 5.7.1-r2 —
Wolfi rolling kwok +1 0.7.0-r4 —
Wolfi rolling lazydocker 0.24.1-r8 —
Wolfi rolling licenseclassifier 2.0.0-r5 —
Wolfi rolling litefs 0.5.14-r4 —
Wolfi rolling local-path-provisioner 0.0.32-r2 —
Wolfi rolling logstash-exporter 1.9.1-r2 —
Wolfi rolling mage 1.15.0-r17 —
Wolfi rolling manifest-tool 2.2.1-r1 —
Wolfi rolling maru 0.6.0-r5 —
Wolfi rolling mc +1 0.20250813.083541-r1 —
Wolfi rolling mesosphere-vsphere-csi +2 3.5.0-r3 —
Wolfi rolling metacontroller 4.12.5-r1 —
Wolfi rolling metrics-server +2 0.8.0-r4 —
Wolfi rolling minio-object-browser +1 2.0.4-r1 —
Wolfi rolling mkcert 1.4.4-r17 —
Wolfi rolling mockery 3.5.5-r1 —
Wolfi rolling mockgen 0.6.0-r2 —
Wolfi rolling mods 1.8.1-r3 —
Wolfi rolling mongo-tools 100.13.0-r3 —
Wolfi rolling mongodb-kubernetes-operator +5 0.13.0-r4 —
Wolfi rolling nats 0.3.0-r1 —
Wolfi rolling nerdctl 2.1.6-r1 —
Wolfi rolling neuvector-dbgen +1 0_git20240423-r8 —
Wolfi rolling neuvector-sigstore-interface 0_git20250629-r4 —
Wolfi rolling newrelic-nri-statsd 2.11.0-r9 —
Wolfi rolling nfs-subdir-external-provisioner 4.0.18-r25 —
Wolfi rolling nodetaint 0.0.4-r38 —
Wolfi rolling nova +1 3.11.8-r3 —
Wolfi rolling nri-prometheus 2.27.2-r1 —
Wolfi rolling nsc 2.12.0-r1 —
Wolfi rolling oauth2-proxy +1 7.12.0-r2 —
Wolfi rolling octo-sts +1 0.5.3-r3 —
Wolfi rolling openbao-k8s +1 1.4.0-r40 —
Wolfi rolling opensearch-k8s-operator +1 2.8.0-r3 —
Wolfi rolling opentofu-1.9 1.9.4-r2 —
Wolfi rolling otel-cli 0.4.5-r7 —
Wolfi rolling petname 2.11-r17 —
Wolfi rolling pg_user 1.1.1-r2 —
Wolfi rolling pgpool2_exporter 1.2.2-r6 —
Wolfi rolling php-fpm_exporter 2.2.0-r17 —
Wolfi rolling podcli +2 6.9.2-r1 —
Wolfi rolling policy-controller +1 0.13.1-r1 —
Wolfi rolling portieris +1 0.13.31-r1 —
Wolfi rolling prometheus-adapter 0.12.0-r16 —
Wolfi rolling prometheus-alertmanager +1 0.28.1-r10 —
Wolfi rolling prometheus-pushgateway +1 1.11.2-r0 —
Wolfi rolling promxy 0.0.93-r4 —
Wolfi rolling protoc-gen-go 1.36.10-r1 —
Wolfi rolling protoc-gen-go-grpc 1.5.1-r8 —
Wolfi rolling pulumi-kubernetes-operator 1.16.0-r20 —
Wolfi rolling pvc-autoresizer +1 0.18.0-r1 —
Wolfi rolling rancher-helm-3 3.19.0-r1 —
Wolfi rolling rancher-loglevel 0.1.6-r8 —
Wolfi rolling rancher-machine 0.15.0.135-r1 —
Wolfi rolling rancher-system-agent 0.3.13-r4 —
Wolfi rolling rancher-telemetry 0.6.2-r5 —
Wolfi rolling redka +1 0.6.0-r4 —
Wolfi rolling regclient +8 0.9.2-r2 —
Wolfi rolling rekor +3 1.4.2-r1 —
Wolfi rolling render-template 1.0.9-r2 —
Wolfi rolling renovate 42.12.1-r0 —
Wolfi rolling restic +1 0.18.1-r1 —
Wolfi rolling rootlesskit +1 2.3.5-r7 —
Wolfi rolling runc +1 1.3.2-r1 —
Wolfi rolling s5cmd 2.3.0-r7 —
Wolfi rolling sbom-convert 0.0.7-r5 —
Wolfi rolling sbom-scorecard 0.0.7-r24 —
Wolfi rolling scorecard 5.3.0-r1 —
Wolfi rolling sealed-secrets +3 0.32.2-r2 —
Wolfi rolling secrets-store-csi-driver +1 1.5.4-r1 —
Wolfi rolling secrets-store-csi-driver-provider-aws 2.1.1-r1 —
Wolfi rolling secrets-store-csi-driver-provider-gcp 1.9.0-r3 —
Wolfi rolling shfmt 3.12.0-r3 —
Wolfi rolling sigstore-scaffolding +13 0.7.25-r1 —
Wolfi rolling skaffold 2.16.1-r3 —
Wolfi rolling skopeo 1.20.0-r4 —
Wolfi rolling slsa-verifier 2.7.1-r3 —
Wolfi rolling smarter-device-manager 1.20.11-r21 —
Wolfi rolling sonobuoy +1 0.57.3-r9 —
Wolfi rolling sops 3.11.0-r1 —
Wolfi rolling spark-operator +1 2.3.0-r4 —
Wolfi rolling speedtest-go 1.7.10-r7 —
Wolfi rolling spicedb-operator +1 1.21.0-r1 —
Wolfi rolling spiffe-helper +1 0.10.1-r2 —
Wolfi rolling spire-controller-manager +1 0.6.3-r2 —
Wolfi rolling spqr +1 2.7.0-r1 —
Wolfi rolling src-fingerprint 0.19.0-r33 —
Wolfi rolling sriov-network-device-plugin +1 3.10.0-r1 —
Wolfi rolling stakater-reloader +1 1.4.8-r2 —
Wolfi rolling step-kms-plugin 0.15.1-r2 —
Wolfi rolling stern 1.33.0-r1 —
Wolfi rolling task 3.45.4-r1 —
Wolfi rolling terraform +2 1.5.7-r34 —
Wolfi rolling terraform-docs 0.20.0-r5 —
Wolfi rolling terraform-provider-azuread 3.6.0-r1 —
Wolfi rolling terraform-provider-kubernetes 2.38.0-r3 —
Wolfi rolling terraform-provider-random 3.7.2-r4 —
Wolfi rolling terraform-provider-sendgrid 1.0.1-r7 —
Wolfi rolling terraform-provider-time 0.13.1-r4 —
Wolfi rolling terraform-provider-tls 4.1.0-r4 —
Wolfi rolling tfsec 1.28.14-r7 —
Wolfi rolling thanos-operator 0.3.7-r35 —
Wolfi rolling timescaledb-parallel-copy 0.11.0-r0 —
Wolfi rolling timescaledb-tune 0.18.1-r2 —
Wolfi rolling timestamp-authority +2 1.2.9-r1 —
Wolfi rolling timoni 0.25.2-r2 —
Wolfi rolling tofu-controller +3 0.16.0_rc5-r5 —
Wolfi rolling trillian +2 1.7.2-r5 —
Wolfi rolling trivy-operator 0.29.0-r1 —
Wolfi rolling vault-env +1 1.22.0-r3 —
Wolfi rolling vault-k8s 1.7.0-r4 —
Wolfi rolling vault-secrets-webhook +1 1.22.1-r1 —
Wolfi rolling velero +2 1.17.0-r1 —
Wolfi rolling velero-plugin-for-csi +1 0.7.1-r38 —
Wolfi rolling vendir 0.44.0-r4 —
Wolfi rolling vertical-pod-autoscaler +2 1.5.1-r1 —
Wolfi rolling vexctl +2 0.4.1-r1 —
Wolfi rolling vt-cli 1.2.0-r1 —
Wolfi rolling wait-for-port 1.0.10-r2 —
Wolfi rolling wave 0.10.0-r12 —
Wolfi rolling wazero 1.9.0-r6 —
Wolfi rolling wgcf 2.2.29-r2 —
Wolfi rolling wire-go 0.7.0-r2 —
Wolfi rolling wireguard-go 0.0.20250522-r5 —
Wolfi rolling xcaddy 0.4.5-r2 —
Wolfi rolling xcover 0.2.0-r4 —
Wolfi rolling yunikorn-k8shim +1 1.7.0-r5 —
Wolfi rolling yunikorn-web +1 1.7.0-r2 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go stdlib < 1.24.8 · >= 1.25.0, < 1.25.2 1.24.8, 1.25.2 GO-2025-4009

Advisories 47

References