Skip to content
OpenAdvisories
Medium · 6.5 CVE-2025-61727 BIT-golang-2025-61727EUVD-2025-201106GHSA-5mh9-3jwc-rp59GO-2025-4175

Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509

Published Dec 3, 2025 · Updated Dec 3, 2025 · Assigned by Go

Vendor: Go standard library Product: crypto/x509 Package: cert-manager-webhook-pdns Package: chisel Package: chisel-compat Package: docker Package: falco-no-driver Package: frp Package: gitea Package: gitea-compat Package: github-mcp-server Package: gitness Package: gitsign Package: gitsign-config Package: gitsign-credential-cache Package: go Package: go-1.20 Package: go-1.22 Package: go-1.23 Package: go-discover Package: gogatekeeper Package: gogatekeeper-compat Package: golang Package: golang-1.19 Package: golang-1.24 Package: golang-1.24 Package: golang-1.25 Package: gonew Package: gpu-feature-discovery Package: grafana-12.3 Package: grafana-12.3-oci-compat Package: grafana-image-renderer Package: grpc-health-probe Package: grpc-health-probe-compat Package: harbor-scanner-trivy Package: headlamp Package: helm-operator Package: helm-operator-compat Package: helm-push Package: infinispan-operator Package: infinispan-operator-compat Package: ipfs-cluster Package: ipfs-cluster-compat Package: ipfs-cluster-oci-entrypoint Package: k3d Package: k3d-proxy Package: k3d-tools Package: k8s-device-plugin Package: k8sgpt Package: k8ssandra-client Package: k8ssandra-client-compat Package: k9s Package: kargo Package: kargo-oci-compat Package: karma Package: katib-controller Package: katib-controller-compat Package: katib-db-manager Package: katib-db-manager-compat Package: katib-earlystopping Package: katib-file-metricscollector Package: katib-file-metricscollector-compat Package: katib-suggestion-goptuna Package: katib-suggestion-goptuna-compat Package: katib-suggestion-hyperband Package: katib-suggestion-hyperopt Package: katib-suggestion-nas-darts Package: katib-suggestion-nas-enas Package: katib-suggestion-optuna-enas Package: katib-suggestion-pbt-enas Package: katib-suggestion-skopt-enas Package: katib-tfevent-metricscollector Package: kiali Package: kind Package: ko Package: kpt Package: kserve-rest-proxy Package: kube-bench Package: kube-bench-configs Package: kube-fluentd-operator Package: kube-fluentd-operator-compat Package: kube-fluentd-operator-default-config Package: kube-fluentd-operator-oci-entrypoint Package: kube-metrics-adapter Package: kube-rbac-proxy Package: kubeflow-access-management Package: kubeflow-admission-webhook Package: kubeflow-katib Package: kubeflow-notebook-controller Package: kubeflow-pipelines Package: kubeflow-pipelines-apiserver Package: kubeflow-pipelines-cache_server Package: kubeflow-pipelines-cache-deployer Package: kubeflow-pipelines-cache-deployer-compat Package: kubeflow-pipelines-frontend Package: kubeflow-pipelines-metadata-envoy-config Package: kubeflow-pipelines-metadata-writer Package: kubeflow-pipelines-metadata-writer-compat Package: kubeflow-pipelines-persistence_agent Package: kubeflow-pipelines-scheduledworkflow Package: kubeflow-pipelines-viewer-crd-controller Package: kubeflow-profile-controller Package: kubeflow-pvcviewer-controller Package: kubeflow-tensorboard-controller Package: kubelet-csr-approver Package: kubelet-csr-approver-compat Package: kubernetes-csi-external-resizer Package: kubernetes-csi-livenessprobe Package: kubernetes-dashboard-auth Package: kubernetes-dashboard-auth-compat Package: kubernetes-dashboard-web Package: kubernetes-dashboard-web-compat Package: kubernetes-event-exporter Package: kubernetes-event-exporter-iamguarded-compat Package: kubernetes-replicator Package: mesosphere-vsphere-csi Package: mesosphere-vsphere-csi-driver Package: mesosphere-vsphere-csi-syncer Package: metrics-agent Package: metrics-server Package: metrics-server-compat Package: metrics-server-iamguarded-compat Package: mkcert Package: mockery Package: mongo-tools Package: mongodb-kubernetes-operator Package: mongodb-kubernetes-operator-compat Package: mongodb-kubernetes-operator-readinessprobe Package: mongodb-kubernetes-operator-readinessprobe-compat Package: mongodb-kubernetes-operator-version-upgrade-post-start-hook Package: mongodb-kubernetes-operator-version-upgrade-post-start-hook-compat Package: mps-control-daemon Package: msft-golang Package: nats-server Package: nats-server-compat Package: newrelic-infrastructure-agent Package: newrelic-nri-kube-events Package: nfpm Package: nova Package: nova-compat Package: nri-apache Package: nri-apache-compat Package: nri-consul Package: nri-consul-compat Package: nri-couchbase Package: nri-couchbase-compat Package: nri-f5 Package: nri-f5-compat Package: nri-haproxy Package: nri-haproxy-compat Package: nri-jmx Package: nri-jmx-compat Package: nri-jmx-jdk11 Package: nri-kafka Package: nri-kafka-compat Package: nri-kafka-jdk11 Package: nri-mssql Package: nri-mssql-compat Package: nri-rabbitmq Package: nri-rabbitmq-compat Package: nvidia-container-toolkit Package: nvidia-container-toolkit-nvidia-cdi-hook Package: nvidia-container-toolkit-nvidia-container-runtime Package: nvidia-container-toolkit-nvidia-container-runtime-cdi Package: nvidia-container-toolkit-nvidia-container-runtime-hook Package: nvidia-container-toolkit-nvidia-container-runtime-legacy Package: nvidia-container-toolkit-nvidia-ctk Package: nvidia-container-toolkit-nvidia-ctk-installer Package: nvidia-container-toolkit-nvidia-toolkit Package: nvidia-device-plugin Package: oauth2-proxy Package: oauth2-proxy-iamguarded-compat Package: octo-sts Package: octo-sts-webhook Package: opa Package: opa-envoy Package: opencost Package: opencost-compat Package: opensearch-k8s-operator Package: opensearch-k8s-operator-compat Package: opentelemetry-collector Package: opentelemetry-collector-compat Package: opentelemetry-collector-contrib Package: opentelemetry-collector-contrib-compat Package: opentelemetry-collector-ocb Package: osv-scanner Package: paranoia Package: pg_timetable Package: php-fpm_exporter Package: pluto Package: pluto-compat Package: polaris Package: policy-controller Package: policy-controller-tester Package: portieris Package: portieris-compat Package: postgres-operator Package: postgres-operator-compat Package: prometheus-adapter Package: prometheus-admission-webhook Package: prometheus-config-reloader Package: prometheus-operator Package: prometheus-operator-iamguarded-compat Package: promxy Package: protoc-gen-go Package: pulumi-kubernetes-operator Package: rabbitmq-messaging-topology-operator Package: rabbitmq-messaging-topology-operator-compat Package: rabbitmq-messaging-topology-operator-iamguarded-compat Package: rancher-helm-3 Package: rancher-loglevel Package: rancher-system-agent Package: rancher-telemetry Package: regclient Package: regclient-regbot Package: regclient-regbot-compat Package: regclient-regctl Package: regclient-regctl-compat Package: regclient-regsync Package: regclient-regsync-compat Package: rke2-cloud-provider Package: rke2-cloud-provider-compat Package: rootlesskit Package: rootlesskit-config-nonroot Package: runc Package: runc-doc Package: s5cmd Package: seaweedfs Package: seaweedfs-iamguarded-compat Package: seaweedfs-oci-entrypoint Package: secrets-store-csi-driver Package: secrets-store-csi-driver-crds Package: secrets-store-csi-driver-provider-azure Package: sftpgo-plugin-eventsearch Package: sftpgo-plugin-eventstore Package: sftpgo-plugin-kms Package: sftpgo-plugin-pubsub Package: skaffold Package: slsa-verifier Package: snyk-cli Package: sonobuoy Package: sonobuoy-compat Package: sops Package: spicedb-operator Package: spicedb-operator-compat Package: spire-controller-manager Package: spire-controller-manager-compat Package: splunk-otel-collector Package: splunk-otel-collector-compat Package: splunk-otel-collector-doc Package: spqr Package: src Package: stakater-reloader Package: stakater-reloader-compat Package: stdlib Package: steampipe Package: supercronic Package: task Package: tdbg Package: temporal Package: temporal-cassandra-tool Package: temporal-compat Package: temporal-server Package: temporal-server-schema Package: temporal-sql-tool Package: terraform Package: terraform-compat Package: terraform-docs Package: terraform-local-provider-config Package: terraform-mcp-server Package: terraform-provider-azuread Package: terraform-provider-google Package: terraform-provider-sendgrid Package: terraform-provider-time Package: thanos-operator Package: thanos-operator-compat Package: timescaledb-tune Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.

Affected products

VendorProductAffectedFixed
Go standard library crypto/x509 < 1.24.11, 1.25.0 – < 1.25.5 1.24.11

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 13 golang-1.24 No fix yet —
Debian 12 golang-1.19 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS golang-1.24 +1 No fix yet —
Ubuntu 25.10 golang-1.24 +1 No fix yet —
Ubuntu 24.04 LTS golang-1.24 +1 No fix yet —
Ubuntu 22.04 LTS golang-1.24 +1 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 golang-fips1.25 +6 1.25.8-0.1.hum1 RHSA-2026:7070
Red Hat Hardened Images 1 golang1.25 +6 1.25.9-1.hum1 RHSA-2026:7385
Red Hat Hardened Images 1 golang1.26 +6 1.26.2-1.hum1 RHSA-2026:7291

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 go1.24 1.24.11-150000.1.50.1 SUSE-SU-2025:4337-1
SLES 15 SP7 go1.24-openssl 1.24.12-150600.13.15.1 SUSE-SU-2026:0308-1
SLES 15 SP7 go1.25 1.25.5-150000.1.23.1 SUSE-SU-2025:4336-1
SLES 15 SP7 go1.25-openssl 1.25.6-150600.13.9.1 SUSE-SU-2026:0298-1
SLES 15 SP6 go1.24 1.24.11-150000.1.50.1 SUSE-SU-2025:4337-1
SLES 15 SP6 go1.24-openssl 1.24.12-150600.13.15.1 SUSE-SU-2026:0308-1
SLES 15 SP6 go1.25 1.25.5-150000.1.23.1 SUSE-SU-2025:4336-1
SLES 15 SP6 go1.25-openssl 1.25.6-150600.13.9.1 SUSE-SU-2026:0298-1
SLES 15 SP6 govulncheck-vulndb 0.0.20251209T172047-150000.1.127.1 SUSE-SU-2025:4395-1
SLES 15 SP5 go1.24 1.24.11-150000.1.50.1 SUSE-SU-2025:4337-1
SLES 15 SP5 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLES 15 SP5 go1.25 1.25.5-150000.1.23.1 SUSE-SU-2025:4336-1
SLES 15 SP5 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLES 15 SP4 go1.24 1.24.11-150000.1.50.1 SUSE-SU-2025:4337-1
SLES 15 SP4 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLES 15 SP4 go1.25 1.25.5-150000.1.23.1 SUSE-SU-2025:4336-1
SLES 15 SP4 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLES 15 SP3 go1.24 1.24.11-150000.1.50.1 SUSE-SU-2025:4337-1
SLES 15 SP3 go1.25 1.25.5-150000.1.23.1 SUSE-SU-2025:4336-1
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 go1.24 1.24.11-160000.1.1 SUSE-SU-2025:21193-1
SLES for SAP 16.0 go1.24-openssl 1.24.13-160000.1.1 SUSE-SU-2026:20629-1
SLES for SAP 16.0 go1.25 1.25.5-160000.1.1 SUSE-SU-2025:21192-1
SLES for SAP 16.0 go1.25-openssl 1.25.7-160000.1.1 SUSE-SU-2026:20623-1
SLES for SAP 15 SP6 go1.24-openssl 1.24.12-150600.13.15.1 SUSE-SU-2026:0308-1
SLES for SAP 15 SP6 go1.25-openssl 1.25.6-150600.13.9.1 SUSE-SU-2026:0298-1
SLES for SAP 15 SP5 go1.24 1.24.11-150000.1.50.1 SUSE-SU-2025:4337-1
SLES for SAP 15 SP5 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLES for SAP 15 SP5 go1.25 1.25.5-150000.1.23.1 SUSE-SU-2025:4336-1
SLES for SAP 15 SP5 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLES for SAP 15 SP4 go1.24 1.24.11-150000.1.50.1 SUSE-SU-2025:4337-1
SLES for SAP 15 SP4 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLES for SAP 15 SP4 go1.25 1.25.5-150000.1.23.1 SUSE-SU-2025:4336-1
SLES for SAP 15 SP4 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLES for SAP 15 SP3 go1.24 1.24.11-150000.1.50.1 SUSE-SU-2025:4337-1
SLES for SAP 15 SP3 go1.25 1.25.5-150000.1.23.1 SUSE-SU-2025:4336-1
SLES 16.0 go1.24 1.24.11-160000.1.1 SUSE-SU-2025:21193-1
SLES 16.0 go1.24-openssl 1.24.13-160000.1.1 SUSE-SU-2026:20629-1
SLES 16.0 go1.25 1.25.5-160000.1.1 SUSE-SU-2025:21192-1
SLES 16.0 go1.25-openssl 1.25.7-160000.1.1 SUSE-SU-2026:20623-1
SLE HPC 15 SP5 go1.24 1.24.11-150000.1.50.1 SUSE-SU-2025:4337-1
SLE HPC 15 SP5 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLE HPC 15 SP5 go1.25 1.25.5-150000.1.23.1 SUSE-SU-2025:4336-1
SLE HPC 15 SP5 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLE HPC 15 SP4 go1.24 1.24.11-150000.1.50.1 SUSE-SU-2025:4337-1
SLE HPC 15 SP4 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLE HPC 15 SP4 go1.25 1.25.5-150000.1.23.1 SUSE-SU-2025:4336-1
SLE HPC 15 SP4 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLE HPC 15 SP3 go1.24 1.24.11-150000.1.50.1 SUSE-SU-2025:4337-1
SLE HPC 15 SP3 go1.25 1.25.5-150000.1.23.1 SUSE-SU-2025:4336-1
SUSE Enterprise Storage 7.1 go1.24 1.24.11-150000.1.50.1 SUSE-SU-2025:4337-1
SUSE Enterprise Storage 7.1 go1.25 1.25.5-150000.1.23.1 SUSE-SU-2025:4336-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed buildpacks-cli 0.39.1-1.1 openSUSE-SU-2025:15817-1
openSUSE Tumbleweed go1.24 1.24.11-1.1 openSUSE-SU-2025:15796-1
openSUSE Tumbleweed go1.25 1.25.5-1.1 openSUSE-SU-2025:15795-1
openSUSE Tumbleweed kubelogin 0.2.14-1.1 openSUSE-SU-2026:10031-1
openSUSE Tumbleweed regclient 0.11.1-1.1 openSUSE-SU-2025:15807-1
openSUSE Leap 16.0 go1.24 1.24.11-160000.1.1 openSUSE-SU-2025:20158-1
openSUSE Leap 16.0 go1.24-openssl 1.24.13-160000.1.1 openSUSE-SU-2026:20308-1
openSUSE Leap 16.0 go1.25 1.25.5-160000.1.1 openSUSE-SU-2025:20157-1
openSUSE Leap 16.0 go1.25-openssl 1.25.7-160000.1.1 openSUSE-SU-2026:20301-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 15.6 go1.24 1.24.11-150000.1.50.1 SUSE-SU-2025:4337-1
openSUSE Leap 15.6 go1.24-openssl 1.24.12-150600.13.15.1 SUSE-SU-2026:0308-1
openSUSE Leap 15.6 go1.25 1.25.5-150000.1.23.1 SUSE-SU-2025:4336-1
openSUSE Leap 15.6 go1.25-openssl 1.25.6-150600.13.9.1 SUSE-SU-2026:0298-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20251209T172047-150000.1.127.1 SUSE-SU-2025:4395-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 docker 29.1.2-r0 —
Alpine v3.24 go 1.25.5-r0 —
Alpine v3.23 docker 29.1.2-r0 —
Alpine v3.23 go 1.25.5-r0 —
Alpine v3.22 go 1.24.11-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 amazon-cloudwatch-agent 1.300062.1-1.amzn2023 ALAS2023-2025-1358
Amazon Linux 2023 amazon-ecr-credential-helper 0.11.0-2.amzn2023 ALAS2023-2025-1327
Amazon Linux 2023 amazon-ssm-agent 3.3.3572.0-1.amzn2023 ALAS2023-2025-1359
Amazon Linux 2023 cni-plugins 1.7.1-1.amzn2023.0.4 ALAS2023-2025-1321
Amazon Linux 2023 docker 25.0.13-1.amzn2023.0.3 ALAS2023-2025-1329
Amazon Linux 2023 ecs-init 1.101.1-1.amzn2023 ALAS2023-2025-1341
Amazon Linux 2023 golang +6 1.24.11-1.amzn2023.0.1 ALAS2023-2025-1323
Amazon Linux 2023 libcap +3 2.73-1.amzn2023.0.5 ALAS2023-2025-1322
Amazon Linux 2023 nerdctl +2 2.1.5-1.amzn2023.0.3 ALAS2023-2025-1333, ALAS2023-2025-1326
Amazon Linux 2023 oci-add-hooks 0-0.1.20200504git268e3bb.amzn2023.0.7 ALAS2023-2025-1335
Amazon Linux 2023 runc 1.3.4-1.amzn2023.0.1 ALAS2023-2025-1328
Amazon Linux 2023 runfinch-finch 1.10.0-1.amzn2023.0.6 ALAS2023-2025-1336
Amazon Linux 2023 soci-snapshotter 0.12.0-1.amzn2023.0.2 ALAS2023-2025-1334
Amazon Linux 2 amazon-cloudwatch-agent 1.300062.1-1.amzn2 ALAS2-2025-3120
Amazon Linux 2 cni-plugins 1.7.1-1.amzn2.0.4 ALAS2-2025-3098
Amazon Linux 2 cri-tools 1.32.0-1.amzn2.0.3 ALAS2-2025-3097
Amazon Linux 2 golang +6 1.24.11-1.amzn2.0.1 ALAS2-2025-3105
Amazon Linux 2 golang-github-cpuguy83-go-md2man 1.0.4-4.amzn2.0.3 ALAS2-2025-3118
Amazon Linux 2 golist 0.10.1-10.amzn2.0.9 ALAS2-2025-3119
Amazon Linux 2 nerdctl 2.1.5-1.amzn2.0.3 ALAS2-2025-3100

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 golang No fix yet —
Azure Linux 2 (CBL-Mariner) msft-golang No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling cert-manager-webhook-pdns 2.5.3-r3 —
Wolfi rolling chisel +1 1.11.3-r3 —
Wolfi rolling falco-no-driver 0.43.0-r1 —
Wolfi rolling frp 0.65.0-r4 —
Wolfi rolling gitea +1 1.25.2-r1 —
Wolfi rolling github-mcp-server 0.24.1-r0 —
Wolfi rolling gitness 3.3.0-r4 —
Wolfi rolling gitsign +2 0.13.0-r7 —
Wolfi rolling go-1.20 +2 No fix yet —
Wolfi rolling go-discover 0_git20251208-r0 —
Wolfi rolling gogatekeeper +1 4.3.0-r3 —
Wolfi rolling gonew 0.39.0-r1 —
Wolfi rolling grafana-12.3 +1 12.3.0-r2 —
Wolfi rolling grafana-image-renderer 5.0.11-r1 —
Wolfi rolling grpc-health-probe +1 0.4.42-r1 —
Wolfi rolling harbor-scanner-trivy 0.34.1-r1 —
Wolfi rolling headlamp 0.38.0-r2 —
Wolfi rolling helm-operator +1 1.42.0-r3 —
Wolfi rolling helm-push 0.10.4-r38 —
Wolfi rolling infinispan-operator +1 2.5.0-r2 —
Wolfi rolling ipfs-cluster +2 1.1.4-r10 —
Wolfi rolling k3d +2 5.8.3-r20 —
Wolfi rolling k8s-device-plugin +3 0.18.0-r2 —
Wolfi rolling k8sgpt 0.4.26-r3 —
Wolfi rolling k8ssandra-client +1 0.8.4-r2 —
Wolfi rolling k9s 0.50.16-r5 —
Wolfi rolling kargo +1 1.8.4-r1 —
Wolfi rolling karma 0.122-r1 —
Wolfi rolling kiali 2.19.0-r1 —
Wolfi rolling kind 0.30.0-r3 —
Wolfi rolling ko 0.18.0-r9 —
Wolfi rolling kpt 1.0.0_beta55-r14 —
Wolfi rolling kserve-rest-proxy 0.12.0-r12 —
Wolfi rolling kube-bench +1 0.14.0-r2 —
Wolfi rolling kube-fluentd-operator +3 1.18.2-r52 —
Wolfi rolling kube-metrics-adapter 0.2.6-r3 —
Wolfi rolling kube-rbac-proxy 0.20.1-r1 —
Wolfi rolling kubeflow-access-management +5 1.10.0-r9 —
Wolfi rolling kubeflow-katib +17 0.19.0-r2 —
Wolfi rolling kubeflow-pipelines +11 2.15.0-r2 —
Wolfi rolling kubelet-csr-approver +1 1.2.12-r1 —
Wolfi rolling kubernetes-csi-external-resizer 2.0.0-r2 —
Wolfi rolling kubernetes-dashboard-web +1 1.7.0-r8 —
Wolfi rolling kubernetes-event-exporter +1 1.7-r49 —
Wolfi rolling kubernetes-replicator 2.12.2-r1 —
Wolfi rolling mesosphere-vsphere-csi +2 3.5.0-r5 —
Wolfi rolling metrics-agent 2.14.7-r1 —
Wolfi rolling metrics-server +2 0.8.0-r6 —
Wolfi rolling mkcert 1.4.4-r19 —
Wolfi rolling mockery 3.6.1-r1 —
Wolfi rolling mongo-tools 100.13.0-r5 —
Wolfi rolling mongodb-kubernetes-operator +5 0.13.0-r5 —
Wolfi rolling nats-server +1 2.12.2-r2 —
Wolfi rolling newrelic-infrastructure-agent 1.71.2-r0 —
Wolfi rolling newrelic-nri-kube-events 2.16.2-r1 —
Wolfi rolling nfpm 2.44.0-r1 —
Wolfi rolling nova +1 3.11.9-r1 —
Wolfi rolling nri-apache +1 1.15.3-r1 —
Wolfi rolling nri-consul +1 2.9.4-r1 —
Wolfi rolling nri-couchbase +1 2.8.3-r1 —
Wolfi rolling nri-f5 +1 2.9.1-r1 —
Wolfi rolling nri-haproxy +1 3.2.3-r1 —
Wolfi rolling nri-jmx +2 3.11.1-r1 —
Wolfi rolling nri-kafka +2 3.15.0-r2 —
Wolfi rolling nri-mssql +1 2.25.1-r1 —
Wolfi rolling nri-rabbitmq +1 2.15.3-r1 —
Wolfi rolling nvidia-container-toolkit +8 1.18.1-r1 —
Wolfi rolling oauth2-proxy +1 7.13.0-r2 —
Wolfi rolling octo-sts +1 0.5.3-r4 —
Wolfi rolling opa +1 1.11.0-r1 —
Wolfi rolling opencost +1 1.118.0-r2 —
Wolfi rolling opensearch-k8s-operator +1 2.8.0-r4 —
Wolfi rolling opentelemetry-collector +4 0.141.0-r1 —
Wolfi rolling osv-scanner 2.3.0-r1 —
Wolfi rolling paranoia 0.5.0-r1 —
Wolfi rolling pg_timetable 6.2.0-r2 —
Wolfi rolling php-fpm_exporter 2.2.0-r18 —
Wolfi rolling pluto +1 5.22.6-r1 —
Wolfi rolling polaris 10.1.2-r1 —
Wolfi rolling policy-controller +1 0.13.1-r4 —
Wolfi rolling portieris +1 0.13.33-r2 —
Wolfi rolling postgres-operator +1 1.15.0-r3 —
Wolfi rolling prometheus-adapter 0.12.0-r18 —
Wolfi rolling prometheus-operator +3 0.87.0-r2 —
Wolfi rolling promxy 0.0.93-r6 —
Wolfi rolling protoc-gen-go 1.36.10-r2 —
Wolfi rolling pulumi-kubernetes-operator 1.16.0-r23 —
Wolfi rolling rabbitmq-messaging-topology-operator +2 1.18.1-r2 —
Wolfi rolling rancher-helm-3 3.19.0-r4 —
Wolfi rolling rancher-loglevel 0.1.6-r9 —
Wolfi rolling rancher-system-agent 0.3.14-r2 —
Wolfi rolling rancher-telemetry 0.6.2-r7 —
Wolfi rolling regclient +6 0.11.1-r0 —
Wolfi rolling rke2-cloud-provider +1 1.34.2-r2 —
Wolfi rolling rootlesskit +1 2.3.5-r8 —
Wolfi rolling runc +3 1.4.0-r1 —
Wolfi rolling s5cmd 2.3.0-r8 —
Wolfi rolling seaweedfs +2 4.02-r0 —
Wolfi rolling secrets-store-csi-driver +1 1.5.4-r3 —
Wolfi rolling secrets-store-csi-driver-provider-azure 1.7.2-r2 —
Wolfi rolling sftpgo-plugin-eventsearch 1.0.21-r2 —
Wolfi rolling sftpgo-plugin-eventstore 1.0.22-r2 —
Wolfi rolling sftpgo-plugin-kms 1.0.16-r2 —
Wolfi rolling sftpgo-plugin-pubsub 1.0.15-r2 —
Wolfi rolling skaffold +1 2.17.0-r2 —
Wolfi rolling slsa-verifier 2.7.1-r5 —
Wolfi rolling snyk-cli 1.1301.0-r2 —
Wolfi rolling sonobuoy +1 0.57.3-r12 —
Wolfi rolling sops 3.11.0-r3 —
Wolfi rolling spicedb-operator +1 1.21.0-r3 —
Wolfi rolling spire-controller-manager +1 0.6.3-r3 —
Wolfi rolling splunk-otel-collector 0.141.0-r0 —
Wolfi rolling splunk-otel-collector-doc +1 0.140.0-r1 —
Wolfi rolling spqr 2.8.0-r2 —
Wolfi rolling src 6.10.0-r2 —
Wolfi rolling stakater-reloader +1 1.4.10-r1 —
Wolfi rolling steampipe 2.3.2-r3 —
Wolfi rolling supercronic 0.2.39-r1 —
Wolfi rolling task 3.45.5-r2 —
Wolfi rolling tdbg +4 1.29.1-r2 —
Wolfi rolling temporal +1 1.5.1-r2 —
Wolfi rolling terraform +2 1.5.7-r36 —
Wolfi rolling terraform-docs 0.20.0-r7 —
Wolfi rolling terraform-mcp-server 0.3.3-r1 —
Wolfi rolling terraform-provider-azuread 3.7.0-r2 —
Wolfi rolling terraform-provider-google 7.12.0-r2 —
Wolfi rolling terraform-provider-sendgrid 1.0.1-r9 —
Wolfi rolling terraform-provider-time 0.13.1-r5 —
Wolfi rolling thanos-operator +1 0.3.7-r36 —
Wolfi rolling timescaledb-tune 0.18.1-r3 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go stdlib < 1.24.11 · >= 1.25.0, < 1.25.5 1.24.11, 1.25.5 GO-2025-4175

Advisories 49

References