Skip to content
OpenAdvisories
Medium · 5.3 CVE-2025-61730 BIT-golang-2025-61730EUVD-2025-206448GHSA-gr56-3gp6-6gmjGO-2026-4340

Handshake messages may be processed at the incorrect encryption level in crypto/tls

Published Jan 28, 2026 · Updated Feb 2, 2026 · Assigned by Go

Vendor: Go standard library Product: crypto/tls Package: aactl Package: actions-runner-controller Package: amass Package: amazon-cloudwatch-agent-operator Package: apache-exporter Package: authservice Package: aws-eks-pod-identity-agent Package: aws-flb-cloudwatch Package: aws-flb-kinesis Package: aws-privateca-issuer Package: aws-signer-notation-plugin Package: aws-sigv4-proxy Package: azcopy Package: azure-ipam Package: azure-service-operator Package: azure-workload-identity-webhook Package: bank-vaults-template Package: bento Package: blobfuse2 Package: bom Package: boring-registry Package: calico-app-policy-3.31 Package: calico-felix-3.31 Package: calicoctl-3.31 Package: cass-operator Package: cert-manager-cmctl Package: cert-manager-istio-csr Package: cfssl Package: cfssl-bundle Package: chart-testing Package: chisel Package: cilium-cli Package: clickhouse-operator-metrics-exporter Package: cloud-provider-aws-1.31-cloud-controller-manager Package: cloud-provider-vsphere Package: cluster-api-gcp-controller Package: cluster-api-ipam-provider-in-cluster Package: conftest Package: conjur-cli Package: container-object-storage-interface-controller Package: container-object-storage-interface-sidecar Package: cortex Package: cosign Package: critest Package: croc Package: crossplane-provider-aws-cloudformation Package: crossplane-provider-aws-cloudfront Package: crossplane-provider-aws-cloudwatchlogs Package: crossplane-provider-aws-dynamodb Package: crossplane-provider-aws-ec2 Package: crossplane-provider-aws-elasticache Package: crossplane-provider-aws-firehose Package: crossplane-provider-aws-iam Package: crossplane-provider-aws-kinesis Package: crossplane-provider-aws-lambda Package: crossplane-provider-aws-rds Package: crossplane-provider-aws-s3 Package: crossplane-provider-aws-sns Package: crossplane-provider-azure-sql Package: crossplane-provider-family-aws Package: crossplane-provider-sql Package: ctop Package: custom-pod-autoscaler Package: dask-gateway-server Package: db-operator Package: dbmate Package: descheduler Package: dex Package: dkron Package: dkron-executor-grpc Package: dkron-executor-nats Package: dkron-executor-rabbitmq Package: dkron-processor-fluent Package: dkron-processor-log Package: dkron-processor-syslog Package: docker-credential-ecr-login Package: docker-credential-gcr Package: docker-machine-driver-linode Package: dockerize Package: doppler-kubernetes-operator Package: dynamic-localpv-provisioner Package: eksctl Package: esbuild Package: extism Package: falco-no-driver Package: falcosidekick Package: ferretdb Package: flannel Package: flux-image-automation-controller Package: flux-kustomize-controller Package: flux-notification-controller Package: fluxcd-kustomize-mutating-webhook Package: frp Package: fuse-overlayfs-snapshotter Package: gatus Package: ghaudit Package: git-credential-oauth Package: git-lfs Package: git-sync Package: gitlab-docker-machine-18.7 Package: gitlab-runner-helper-18.7 Package: gitleaks Package: gitness Package: gke-gcloud-auth-plugin Package: go Package: go-1.20 Package: go-1.22 Package: go-1.23 Package: go-licenses Package: gobuster Package: gogatekeeper Package: golang Package: golang-1.10 Package: golang-1.13 Package: golang-1.14 Package: golang-1.16 Package: golang-1.17 Package: golang-1.18 Package: golang-1.19 Package: golang-1.20 Package: golang-1.21 Package: golang-1.22 Package: golang-1.23 Package: golang-1.24 Package: golang-1.24 Package: golang-1.25 Package: golang-1.6 Package: golang-1.8 Package: golang-1.9 Package: golangci-lint Package: goreleaser Package: gostatsd Package: govulncheck Package: gptscript Package: grafana-operator Package: grafana-rollout-operator Package: grpcurl Package: guac Package: guaccsub Package: guacgql Package: guacingest Package: guacone Package: harbor-registry Package: headlamp Package: helm-3 Package: helm-operator Package: helm-set-status Package: hey Package: http-echo Package: hubble Package: hubble-ui-backend Package: hydra Package: influx Package: ingress-nginx-controller-1.12 Package: ip-masq-agent Package: ipfs-cluster Package: jaeger-2-es-index-cleaner Package: jaeger-2-es-rollover Package: jaeger-2-jaeger Package: jaeger-2-remote-storage Package: jaeger-2-tracegen Package: juicefs-1.3 Package: k3d Package: k3d-proxy Package: k3d-tools Package: k3s Package: k3s-multicall Package: k3s-static Package: k8s_gateway Package: kapp Package: kapp-controller Package: katib-earlystopping Package: katib-suggestion-goptuna-compat Package: katib-suggestion-hyperband Package: katib-suggestion-hyperopt Package: katib-suggestion-nas-darts Package: katib-suggestion-nas-enas Package: katib-suggestion-optuna-enas Package: katib-suggestion-pbt-enas Package: katib-suggestion-skopt-enas Package: katib-tfevent-metricscollector Package: kbld Package: kine Package: kor Package: kratos Package: kserve-modelmesh-serving Package: ksops Package: kube-bench Package: kube-logging-operator Package: kube-logging-operator-config-reloader Package: kube-logging-operator-custom-runner Package: kube-vip-cloud-provider Package: kubectl-1.30 Package: kubeflow-access-management Package: kubeflow-pipelines-apiserver Package: kubeflow-pipelines-cache_server Package: kubeflow-pipelines-persistence_agent Package: kubeflow-pipelines-scheduledworkflow Package: kubeflow-pipelines-viewer-crd-controller Package: kubeflow-profile-controller Package: kubelet-csr-approver Package: kuberay-operator Package: kuberlr Package: kubernetes-csi-driver-nfs Package: kubernetes-csi-external-attacher Package: kubernetes-csi-external-provisioner Package: kubernetes-csi-external-resizer Package: kubernetes-csi-livenessprobe Package: kubernetes-dashboard Package: kubernetes-dashboard-api Package: kubernetes-dashboard-metrics-scraper Package: kubernetes-dns-node-cache Package: kubernetes-event-exporter Package: kubernetes-replicator Package: kubescape-operator Package: kubo Package: kuma-cni-2.12 Package: kuma-cni-2.13 Package: kuma-cp-2.12 Package: kuma-dp-2.12 Package: kuma-dp-2.13 Package: kuma-install-cni-2.12 Package: kuma-install-cni-2.13 Package: kustomize Package: kyverno-policy-reporter-kyverno-plugin Package: kyverno-policy-reporter-ui Package: langfuse-3 Package: langfuse-3-worker Package: lazygit Package: litefs Package: litestream Package: local-path-provisioner Package: local-static-provisioner Package: lvm-driver Package: manifest-tool Package: maru Package: mattermost-11.1 Package: mc Package: mesosphere-vsphere-csi-driver Package: mesosphere-vsphere-csi-syncer Package: metacontroller Package: metallb-controller Package: metallb-frr-compat Package: minio Package: minio-object-browser Package: minio-operator Package: minio-operator-sidecar Package: mods Package: mongodb-kubernetes-operator-version-upgrade-post-start-hook Package: msft-golang Package: nats-top Package: nerdctl Package: neuvector-sigstore-interface Package: newrelic-fluent-bit-output Package: newrelic-infra-operator Package: newrelic-nri-statsd Package: nfs-subdir-external-provisioner Package: nginx-prometheus-exporter Package: nri-couchbase Package: nri-f5 Package: nri-haproxy Package: nri-mongodb Package: nri-nginx Package: nri-postgresql Package: nri-rabbitmq Package: nri-redis Package: octo-sts Package: octo-sts-webhook Package: openbao-k8s Package: opencost Package: opensearch-k8s-operator Package: opentofu-1.9 Package: osv-scanner Package: paranoia Package: percona-server-mongodb-operator Package: percona-server-mongodb-operator-mongodb-healthcheck Package: pg_timetable Package: pg_user Package: pgpool2_exporter Package: podcli Package: policy-controller Package: policy-controller-tester Package: postgres-operator Package: pvc-autoresizer Package: rabbitmq-cluster-operator Package: rabbitmq-default-user-credential-updater Package: rabbitmq-messaging-topology-operator Package: rancher-helm-3 Package: rancher-loglevel Package: rancher-machine Package: rancher-system-agent Package: rancher-system-upgrade-controller Package: rancher-telemetry Package: ratify Package: ratify-licensechecker Package: ratify-sbom Package: ratify-schemavalidator Package: ratify-vulnerabilityreport Package: redis-operator Package: redka Package: restic Package: runc Package: s5cmd Package: sbomqs Package: scorecard Package: sealed-secrets Package: sealed-secrets-kubeseal Package: secrets-store-csi-driver Package: secrets-store-csi-driver-provider-aws Package: sftpgo-plugin-auth Package: sftpgo-plugin-geoipfilter Package: sftpgo-plugin-kms Package: sftpgo-plugin-pubsub Package: slsa-verifier Package: sonobuoy Package: sops Package: spark-operator Package: spegel Package: spire-agent Package: spire-controller-manager Package: spire-oidc-discovery-provider Package: spire-server Package: spqr Package: src Package: src-fingerprint Package: sriov-network-device-plugin Package: stakater-reloader Package: stdlib Package: steampipe Package: step Package: step-kms-plugin Package: swagger Package: temporal-ui-server Package: terraform Package: terraform-docs Package: terraform-mcp-server Package: terraform-provider-pagerduty Package: terraform-provider-time Package: tetra Package: tetragon-operator Package: tfsec Package: thanos-operator Package: timescaledb-parallel-copy Package: timoni Package: tofu-controller Package: tofu-controller-runner Package: traefik-3.6 Package: undock Package: vale Package: vault-benchmark Package: vault-k8s Package: vault-secrets-webhook Package: verticadb-operator Package: vertical-pod-autoscaler Package: vertical-pod-autoscaler-recommender Package: vertical-pod-autoscaler-updater Package: volume-modifier-for-k8s Package: wave Package: wgcf Package: whereabouts Package: wuzz Package: x509-certificate-exporter Package: xeol Package: yace Package: ytt Package: yunikorn-k8shim Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.

Affected products

VendorProductAffectedFixed
Go standard library crypto/tls < 1.24.12, 1.25.0 – < 1.25.6 1.24.12

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 13 golang-1.24 No fix yet —
Debian 12 golang-1.19 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS golang-1.23 +2 No fix yet —
Ubuntu 25.10 golang-1.23 +2 No fix yet —
Ubuntu 24.04 LTS golang-1.21 +4 No fix yet —
Ubuntu 22.04 LTS golang-1.17 +7 No fix yet —
Ubuntu 20.04 LTS golang-1.13 +5 No fix yet —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS golang-1.8 +2 No fix yet —
Ubuntu 16.04 LTS golang-1.6 +1 No fix yet —
Ubuntu 14.04 LTS golang-1.10 No fix yet —
Ubuntu Pro 22.04 LTS golang-1.13 No fix yet —
Ubuntu Pro 20.04 LTS golang-1.16 No fix yet —
Ubuntu Pro 18.04 LTS golang-1.13 +2 No fix yet —
Ubuntu Pro 16.04 LTS golang-1.13 +1 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 golang1.25 +6 1.25.9-1.hum1 RHSA-2026:7385
Red Hat Hardened Images 1 golang1.26 +6 1.26.2-1.hum1 RHSA-2026:7291

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0219-1
SLES 15 SP7 go1.24-openssl 1.24.12-150600.13.15.1 SUSE-SU-2026:0308-1
SLES 15 SP7 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLES 15 SP7 go1.25-openssl 1.25.6-150600.13.9.1 SUSE-SU-2026:0298-1
SLES 15 SP6 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0219-1
SLES 15 SP6 go1.24-openssl 1.24.12-150600.13.15.1 SUSE-SU-2026:0308-1
SLES 15 SP6 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLES 15 SP6 go1.25-openssl 1.25.6-150600.13.9.1 SUSE-SU-2026:0298-1
SLES 15 SP5 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0219-1
SLES 15 SP5 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLES 15 SP5 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLES 15 SP5 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLES 15 SP4 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0219-1
SLES 15 SP4 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLES 15 SP4 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLES 15 SP4 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 go1.24 1.24.12-160000.1.1 SUSE-SU-2026:20122-1
SLES for SAP 16.0 go1.24-openssl 1.24.13-160000.1.1 SUSE-SU-2026:20629-1
SLES for SAP 16.0 go1.25 1.25.6-160000.1.1 SUSE-SU-2026:20132-1
SLES for SAP 16.0 go1.25-openssl 1.25.7-160000.1.1 SUSE-SU-2026:20623-1
SLES for SAP 15 SP6 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0219-1
SLES for SAP 15 SP6 go1.24-openssl 1.24.12-150600.13.15.1 SUSE-SU-2026:0308-1
SLES for SAP 15 SP6 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLES for SAP 15 SP6 go1.25-openssl 1.25.6-150600.13.9.1 SUSE-SU-2026:0298-1
SLES for SAP 15 SP5 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0219-1
SLES for SAP 15 SP5 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLES for SAP 15 SP5 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLES for SAP 15 SP5 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLES for SAP 15 SP4 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0219-1
SLES for SAP 15 SP4 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLES for SAP 15 SP4 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLES for SAP 15 SP4 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLES 16.0 go1.24 1.24.12-160000.1.1 SUSE-SU-2026:20122-1
SLES 16.0 go1.24-openssl 1.24.13-160000.1.1 SUSE-SU-2026:20629-1
SLES 16.0 go1.25 1.25.6-160000.1.1 SUSE-SU-2026:20132-1
SLES 16.0 go1.25-openssl 1.25.7-160000.1.1 SUSE-SU-2026:20623-1
SLE HPC 15 SP5 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0219-1
SLE HPC 15 SP5 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLE HPC 15 SP5 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLE HPC 15 SP5 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLE HPC 15 SP4 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0219-1
SLE HPC 15 SP4 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0296-1
SLE HPC 15 SP4 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLE HPC 15 SP4 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed go1.24 1.24.12-1.1 openSUSE-SU-2026:10063-1
openSUSE Tumbleweed go1.25 1.25.6-1.1 openSUSE-SU-2026:10064-1
openSUSE Leap 16.0 go1.24 1.24.12-160000.1.1 openSUSE-SU-2026:20077-1
openSUSE Leap 16.0 go1.24-openssl 1.24.13-160000.1.1 openSUSE-SU-2026:20308-1
openSUSE Leap 16.0 go1.25 1.25.6-160000.1.1 openSUSE-SU-2026:20085-1
openSUSE Leap 16.0 go1.25-openssl 1.25.7-160000.1.1 openSUSE-SU-2026:20301-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 15.6 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0219-1
openSUSE Leap 15.6 go1.24-openssl 1.24.12-150600.13.15.1 SUSE-SU-2026:0308-1
openSUSE Leap 15.6 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
openSUSE Leap 15.6 go1.25-openssl 1.25.6-150600.13.9.1 SUSE-SU-2026:0298-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20260128T190828-150000.1.143.1 SUSE-SU-2026:0354-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 go 1.25.6-r0 —
Alpine v3.23 go 1.25.6-r0 —
Alpine v3.22 go 1.24.12-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 amazon-cloudwatch-agent 1.300064.1-1.amzn2023 ALAS2023-2026-1473
Amazon Linux 2023 amazon-ecr-credential-helper 0.11.0-3.amzn2023 ALAS2023-2026-1370
Amazon Linux 2023 cni-plugins 1.7.1-1.amzn2023.0.5 ALAS2023-2026-1373
Amazon Linux 2023 containerd +1 2.1.5-1.amzn2023.0.5 ALAS2023-2026-1374
Amazon Linux 2023 credentials-fetcher 2.0.1-1.amzn2023.0.5 ALAS2023-2026-1744
Amazon Linux 2023 docker 25.0.14-1.amzn2023.0.2 ALAS2023-2026-1376
Amazon Linux 2023 ecs-init 1.101.3-1.amzn2023 ALAS2023-2026-1443
Amazon Linux 2023 golang +6 1.24.12-1.amzn2023.0.1 ALAS2023-2026-1381
Amazon Linux 2023 golang-github-burntsushi-toml +1 1.5.0-1.amzn2023.0.1 ALAS2023-2026-1751
Amazon Linux 2023 golang-github-burntsushi-toml-test +1 0.2.0-8.amzn2023.0.3 ALAS2023-2026-1750
Amazon Linux 2023 golang-github-cpuguy83-md2man +2 2.0.2-24.amzn2023.0.7 ALAS2023-2026-1749
Amazon Linux 2023 golist 0.10.1-11.amzn2023.0.6 ALAS2023-2026-1382
Amazon Linux 2023 libcap +3 2.73-1.amzn2023.0.6 ALAS2023-2026-1389
Amazon Linux 2023 nerdctl 2.2.1-1.amzn2023.0.2 ALAS2023-2026-1401
Amazon Linux 2023 oci-add-hooks 0-0.1.20200504git268e3bb.amzn2023.0.8 ALAS2023-2026-1405
Amazon Linux 2023 rclone 1.73.4-74.amzn2023 ALAS2023-2026-1607
Amazon Linux 2023 runc 1.3.4-1.amzn2023.0.2 ALAS2023-2026-1419
Amazon Linux 2023 runfinch-finch 1.14.1-1.amzn2023.0.1 ALAS2023-2026-1420
Amazon Linux 2023 soci-snapshotter 0.12.0-1.amzn2023.0.3 ALAS2023-2026-1421
Amazon Linux 2023 yq 4.47.1-12.amzn2023 ALAS2023-2026-1582
Amazon Linux 2 amazon-cloudwatch-agent 1.300064.1-1.amzn2 ALAS2-2026-3191
Amazon Linux 2 cni-plugins 1.7.1-1.amzn2.0.5 ALAS2-2026-3134
Amazon Linux 2 cri-tools 1.32.0-1.amzn2.0.4 ALAS2-2026-3135
Amazon Linux 2 golang +6 1.24.12-1.amzn2.0.1 ALAS2-2026-3136
Amazon Linux 2 golang-github-cpuguy83-go-md2man 1.0.4-4.amzn2.0.4 ALAS2-2026-3137
Amazon Linux 2 golist 0.10.1-10.amzn2.0.10 ALAS2-2026-3138
Amazon Linux 2 nerdctl 2.2.1-1.amzn2.0.2 ALAS2-2026-3146

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 golang 1.24.12-1 —
Azure Linux 2 (CBL-Mariner) msft-golang 1.24.12-1 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling aactl 0.4.12-r40 —
Wolfi rolling actions-runner-controller 0.13.1-r1 —
Wolfi rolling amass 5.0.1-r4 —
Wolfi rolling amazon-cloudwatch-agent-operator 3.3.1-r1 —
Wolfi rolling apache-exporter 1.0.12-r1 —
Wolfi rolling authservice +1 1.1.5-r1 —
Wolfi rolling aws-eks-pod-identity-agent 0.1.36-r2 —
Wolfi rolling aws-flb-cloudwatch 1.9.4-r23 —
Wolfi rolling aws-flb-kinesis 1.10.3-r4 —
Wolfi rolling aws-privateca-issuer 1.8.0-r1 —
Wolfi rolling aws-signer-notation-plugin 1.0.2292-r5 —
Wolfi rolling aws-sigv4-proxy 1.11-r1 —
Wolfi rolling azcopy 10.31.1-r1 —
Wolfi rolling azure-ipam 0.4.0-r8 —
Wolfi rolling azure-service-operator 2.17.0-r1 —
Wolfi rolling azure-workload-identity-webhook 1.5.1-r6 —
Wolfi rolling bank-vaults-template 1.32.1-r1 —
Wolfi rolling bento +3 1.14.1-r1 —
Wolfi rolling blobfuse2 2.4.2-r8 —
Wolfi rolling bom 0.7.1-r4 —
Wolfi rolling boring-registry 0.16.6-r5 —
Wolfi rolling calicoctl-3.31 +2 3.31.3-r2 —
Wolfi rolling cass-operator 1.28.0-r3 —
Wolfi rolling cert-manager-cmctl 2.4.0-r2 —
Wolfi rolling cert-manager-istio-csr 0.15.0-r1 —
Wolfi rolling cfssl +1 1.6.5-r26 —
Wolfi rolling chart-testing 3.14.0-r3 —
Wolfi rolling chisel 1.11.3-r4 —
Wolfi rolling cilium-cli 0.19.0-r1 —
Wolfi rolling clickhouse-operator-metrics-exporter 0.25.6-r1 —
Wolfi rolling cloud-provider-aws-1.31-cloud-controller-manager 1.31.9-r2 —
Wolfi rolling cluster-api-gcp-controller 1.10.0-r7 —
Wolfi rolling cluster-api-ipam-provider-in-cluster 1.0.3-r4 —
Wolfi rolling conjur-cli 9.1.1-r1 —
Wolfi rolling container-object-storage-interface-sidecar +1 0.2.2-r1 —
Wolfi rolling cortex 1.20.1-r1 —
Wolfi rolling cosign 3.0.4-r2 —
Wolfi rolling critest +1 1.35.0-r1 —
Wolfi rolling croc 10.3.1-r2 —
Wolfi rolling crossplane-provider-aws-s3 +13 2.3.0-r3 —
Wolfi rolling crossplane-provider-azure-sql 2.3.0-r2 —
Wolfi rolling crossplane-provider-sql 0.13.0-r3 —
Wolfi rolling ctop 0.7.7-r30 —
Wolfi rolling custom-pod-autoscaler 2.12.2-r5 —
Wolfi rolling dask-gateway-server 2025.4.0-r7 —
Wolfi rolling db-operator 2.16.0-r4 —
Wolfi rolling dbmate 2.29.3-r1 —
Wolfi rolling descheduler 0.34.0-r3 —
Wolfi rolling dex 2.44.0-r8 —
Wolfi rolling dkron +6 4.0.9-r1 —
Wolfi rolling docker-credential-ecr-login 0.11.0-r2 —
Wolfi rolling docker-credential-gcr 2.1.31-r1 —
Wolfi rolling docker-machine-driver-linode 0.1.15-r9 —
Wolfi rolling dockerize 0.9.9-r1 —
Wolfi rolling doppler-kubernetes-operator 1.7.1-r3 —
Wolfi rolling dynamic-localpv-provisioner 4.4.0-r3 —
Wolfi rolling eksctl 0.221.0-r1 —
Wolfi rolling esbuild 0.27.2-r1 —
Wolfi rolling extism 1.6.3-r5 —
Wolfi rolling falco-no-driver 0.43.0-r1 —
Wolfi rolling falcosidekick 2.32.0-r4 —
Wolfi rolling ferretdb 2.7.0-r3 —
Wolfi rolling flannel 0.28.0-r2 —
Wolfi rolling flux-image-automation-controller 1.0.4-r4 —
Wolfi rolling flux-kustomize-controller 1.7.3-r4 —
Wolfi rolling flux-notification-controller 1.7.5-r4 —
Wolfi rolling fluxcd-kustomize-mutating-webhook 0.7.0-r2 —
Wolfi rolling frp +1 0.66.0-r1 —
Wolfi rolling fuse-overlayfs-snapshotter 2.1.7-r2 —
Wolfi rolling gatus 5.34.0-r1 —
Wolfi rolling ghaudit 0.4.0-r17 —
Wolfi rolling git-credential-oauth 0.17.2-r1 —
Wolfi rolling git-lfs 3.7.1-r3 —
Wolfi rolling git-sync 4.5.1-r1 —
Wolfi rolling gitlab-runner-helper-18.7 +1 18.7.2-r1 —
Wolfi rolling gitleaks 8.30.0-r2 —
Wolfi rolling gitness 3.3.0-r5 —
Wolfi rolling gke-gcloud-auth-plugin 0.1.0-r12 —
Wolfi rolling go-1.20 +3 No fix yet —
Wolfi rolling go-licenses 2.0.1-r3 —
Wolfi rolling gobuster 3.8.2-r5 —
Wolfi rolling gogatekeeper 4.4.0-r1 —
Wolfi rolling golangci-lint 2.8.0-r1 —
Wolfi rolling goreleaser 2.13.3-r2 —
Wolfi rolling gostatsd 28.3.0-r22 —
Wolfi rolling govulncheck 1.1.4-r6 —
Wolfi rolling gptscript 0.9.8-r1 —
Wolfi rolling grafana-operator 5.21.4-r1 —
Wolfi rolling grafana-rollout-operator 0.33.0-r1 —
Wolfi rolling grpcurl 1.9.3-r10 —
Wolfi rolling guac +4 1.0.1-r4 —
Wolfi rolling harbor-registry 3.0.0-r14 —
Wolfi rolling headlamp 0.39.0-r1 —
Wolfi rolling helm-3 3.22.0-r0 —
Wolfi rolling helm-operator 1.42.0-r4 —
Wolfi rolling helm-set-status 0.3.0-r9 —
Wolfi rolling hey 0.1.5-r1 —
Wolfi rolling http-echo 1.0.0-r20 —
Wolfi rolling hubble 1.18.5-r1 —
Wolfi rolling hubble-ui-backend 0.13.3-r4 —
Wolfi rolling hydra 25.4.0-r3 —
Wolfi rolling influx 2.7.5-r13 —
Wolfi rolling ingress-nginx-controller-1.12 1.12.8-r3 —
Wolfi rolling ip-masq-agent 2.12.0-r17 —
Wolfi rolling jaeger-2-jaeger +4 2.13.0-r3 —
Wolfi rolling juicefs-1.3 1.3.1-r3 —
Wolfi rolling k3d +2 5.8.3-r21 —
Wolfi rolling k3s +2 1.35.0.1-r2 —
Wolfi rolling k8s_gateway 1.6.2-r1 —
Wolfi rolling kapp 0.65.0-r3 —
Wolfi rolling kapp-controller 0.59.1-r2 —
Wolfi rolling katib-earlystopping +8 0.19.0-r31 —
Wolfi rolling katib-suggestion-goptuna-compat 0.19.0-r40 —
Wolfi rolling kbld 0.47.0-r2 —
Wolfi rolling kine 0.14.11-r0 —
Wolfi rolling kor 0.6.7-r1 —
Wolfi rolling kratos +1 2.9.2-r1 —
Wolfi rolling kserve-modelmesh-serving 0.12.0-r19 —
Wolfi rolling ksops 4.4.0-r4 —
Wolfi rolling kube-bench 0.14.1-r1 —
Wolfi rolling kube-logging-operator +1 6.3.2-r1 —
Wolfi rolling kube-vip-cloud-provider 0.0.12-r8 —
Wolfi rolling kubeflow-access-management +1 1.10.0-r11 —
Wolfi rolling kubeflow-pipelines-apiserver +4 2.15.0-r7 —
Wolfi rolling kubelet-csr-approver 1.2.12-r2 —
Wolfi rolling kuberay-operator 1.5.1-r2 —
Wolfi rolling kuberlr 0.6.1-r6 —
Wolfi rolling kubernetes-csi-driver-nfs 4.12.1-r4 —
Wolfi rolling kubernetes-csi-external-attacher 4.10.0-r4 —
Wolfi rolling kubernetes-csi-external-provisioner 6.1.0-r3 —
Wolfi rolling kubernetes-csi-external-resizer 2.0.0-r3 —
Wolfi rolling kubernetes-csi-livenessprobe 2.17.0-r3 —
Wolfi rolling kubernetes-dashboard 7.14.0-r3 —
Wolfi rolling kubernetes-dashboard-api 1.14.0-r2 —
Wolfi rolling kubernetes-dashboard-metrics-scraper 1.2.2-r15 —
Wolfi rolling kubernetes-dns-node-cache 1.26.7-r6 —
Wolfi rolling kubernetes-event-exporter 1.7-r50 —
Wolfi rolling kubernetes-replicator 2.12.2-r2 —
Wolfi rolling kubescape-operator 0.2.121-r1 —
Wolfi rolling kubo 0.39.0-r2 —
Wolfi rolling kuma-cp-2.12 +3 2.12.3-r4 —
Wolfi rolling kuma-dp-2.13 +2 2.13.0-r1 —
Wolfi rolling kustomize 5.8.0-r2 —
Wolfi rolling kyverno-policy-reporter-kyverno-plugin 1.6.4-r15 —
Wolfi rolling kyverno-policy-reporter-ui 2.5.1-r1 —
Wolfi rolling langfuse-3 +1 3.149.0-r1 —
Wolfi rolling lazygit 0.58.1-r1 —
Wolfi rolling litefs 0.5.14-r6 —
Wolfi rolling litestream 0.5.6-r1 —
Wolfi rolling local-path-provisioner 0.0.34-r1 —
Wolfi rolling local-static-provisioner 2.8.0-r7 —
Wolfi rolling lvm-driver 1.8.0-r2 —
Wolfi rolling manifest-tool 2.2.1-r4 —
Wolfi rolling maru 0.6.0-r7 —
Wolfi rolling mattermost-11.1 11.1.3-r1 —
Wolfi rolling mc 0.20250813.083541-r4 —
Wolfi rolling mesosphere-vsphere-csi-driver +1 3.5.0-r7 —
Wolfi rolling metacontroller 4.12.5-r3 —
Wolfi rolling metallb-controller +1 0.15.3-r1 —
Wolfi rolling minio 0.20251015.172955-r3 —
Wolfi rolling minio-object-browser 2.0.4-r4 —
Wolfi rolling minio-operator +1 7.1.1-r8 —
Wolfi rolling mods 1.8.1-r6 —
Wolfi rolling mongodb-kubernetes-operator-version-upgrade-post-start-hook 0.13.0-r6 —
Wolfi rolling nats-top 0.6.3-r12 —
Wolfi rolling nerdctl 2.2.1-r2 —
Wolfi rolling neuvector-sigstore-interface 0_git20251212-r2 —
Wolfi rolling newrelic-fluent-bit-output 3.3.0-r1 —
Wolfi rolling newrelic-infra-operator 0.26.4-r1 —
Wolfi rolling newrelic-nri-statsd 2.12.0-r3 —
Wolfi rolling nfs-subdir-external-provisioner 4.0.18-r28 —
Wolfi rolling nri-couchbase 2.8.4-r1 —
Wolfi rolling nri-haproxy 3.2.4-r1 —
Wolfi rolling nri-mongodb 2.10.2-r1 —
Wolfi rolling nri-nginx 3.6.4-r1 —
Wolfi rolling nri-postgresql 2.23.0-r1 —
Wolfi rolling nri-rabbitmq 2.15.4-r1 —
Wolfi rolling nri-redis 1.12.7-r1 —
Wolfi rolling octo-sts +1 0.5.4-r1 —
Wolfi rolling openbao-k8s 1.4.0-r43 —
Wolfi rolling opencost 1.119.1-r1 —
Wolfi rolling opensearch-k8s-operator 2.8.0-r6 —
Wolfi rolling opentofu-1.9 1.9.4-r5 —
Wolfi rolling osv-scanner 2.3.2-r1 —
Wolfi rolling paranoia 0.5.0-r2 —
Wolfi rolling percona-server-mongodb-operator +1 1.21.2-r1 —
Wolfi rolling pg_timetable 6.2.0-r4 —
Wolfi rolling pg_user 1.1.1-r4 —
Wolfi rolling pgpool2_exporter 1.2.2-r10 —
Wolfi rolling podcli 6.9.4-r1 —
Wolfi rolling policy-controller +2 0.14.0-r1 —
Wolfi rolling postgres-operator 1.15.1-r1 —
Wolfi rolling pvc-autoresizer 0.18.0-r3 —
Wolfi rolling rabbitmq-cluster-operator 2.19.0-r1 —
Wolfi rolling rabbitmq-default-user-credential-updater 1.0.10-r1 —
Wolfi rolling rabbitmq-messaging-topology-operator 1.18.2-r1 —
Wolfi rolling rancher-helm-3 3.19.0-r5 —
Wolfi rolling rancher-loglevel 0.1.6-r10 —
Wolfi rolling rancher-machine 0.15.0.138-r1 —
Wolfi rolling rancher-system-agent 0.3.14-r4 —
Wolfi rolling rancher-system-upgrade-controller 0.18.0-r2 —
Wolfi rolling rancher-telemetry 0.6.2-r8 —
Wolfi rolling ratify +4 1.4.0-r10 —
Wolfi rolling redis-operator 0.23.0-r1 —
Wolfi rolling redka 1.0.1-r0 —
Wolfi rolling restic 0.18.1-r4 —
Wolfi rolling runc 1.4.0-r2 —
Wolfi rolling s5cmd 2.3.0-r9 —
Wolfi rolling sbomqs 2.0.3-r2 —
Wolfi rolling scorecard 5.4.0-r3 —
Wolfi rolling sealed-secrets +1 0.34.0-r1 —
Wolfi rolling secrets-store-csi-driver 1.5.5-r1 —
Wolfi rolling secrets-store-csi-driver-provider-aws 2.1.1-r3 —
Wolfi rolling sftpgo-plugin-auth 1.0.13-r3 —
Wolfi rolling sftpgo-plugin-geoipfilter 1.0.11-r2 —
Wolfi rolling sftpgo-plugin-kms 1.0.16-r3 —
Wolfi rolling sftpgo-plugin-pubsub 1.0.15-r3 —
Wolfi rolling slsa-verifier 2.7.1-r7 —
Wolfi rolling sonobuoy 0.57.3-r13 —
Wolfi rolling sops 3.11.0-r4 —
Wolfi rolling spark-operator 2.4.0-r3 —
Wolfi rolling spegel 0.6.0-r2 —
Wolfi rolling spire-controller-manager 0.6.3-r4 —
Wolfi rolling spqr 2.9.0-r1 —
Wolfi rolling src 6.12.0-r2 —
Wolfi rolling src-fingerprint 0.19.0-r37 —
Wolfi rolling sriov-network-device-plugin 3.11.0-r1 —
Wolfi rolling stakater-reloader 1.4.12-r1 —
Wolfi rolling steampipe 2.3.4-r1 —
Wolfi rolling step 0.29.0-r1 —
Wolfi rolling step-kms-plugin 0.16.0-r1 —
Wolfi rolling swagger 0.33.1-r4 —
Wolfi rolling temporal-ui-server 2.44.1-r1 —
Wolfi rolling terraform 1.5.7-r37 —
Wolfi rolling terraform-docs 0.21.0-r1 —
Wolfi rolling terraform-mcp-server 0.3.3-r2 —
Wolfi rolling terraform-provider-pagerduty 3.30.9-r1 —
Wolfi rolling terraform-provider-time 0.13.1-r6 —
Wolfi rolling tetra +1 1.6.0-r2 —
Wolfi rolling tfsec 1.28.14-r10 —
Wolfi rolling thanos-operator 0.3.7-r37 —
Wolfi rolling timescaledb-parallel-copy 0.12.0-r1 —
Wolfi rolling timoni 0.25.2-r4 —
Wolfi rolling tofu-controller +1 0.16.0_rc5-r9 —
Wolfi rolling traefik-3.6 3.6.7-r1 —
Wolfi rolling undock 0.11.0-r3 —
Wolfi rolling vale 3.13.0-r4 —
Wolfi rolling vault-benchmark 0.4.0-r3 —
Wolfi rolling vault-k8s 1.7.2-r1 —
Wolfi rolling vault-secrets-webhook 1.22.2-r1 —
Wolfi rolling verticadb-operator 25.4.0.0-r3 —
Wolfi rolling vertical-pod-autoscaler +3 1.5.1-r3 —
Wolfi rolling volume-modifier-for-k8s 0.9.1-r1 —
Wolfi rolling wave 0.10.0-r14 —
Wolfi rolling wgcf 2.2.30-r1 —
Wolfi rolling whereabouts 0.9.2-r4 —
Wolfi rolling wuzz 0.5.0-r15 —
Wolfi rolling x509-certificate-exporter 3.19.1-r8 —
Wolfi rolling xeol 0.10.8-r21 —
Wolfi rolling yace 0.63.0-r4 —
Wolfi rolling ytt 0.52.2-r1 —
Wolfi rolling yunikorn-k8shim 1.7.0-r8 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go stdlib < 1.24.12 · >= 1.25.0, < 1.25.6 1.24.12, 1.25.6 GO-2026-4340

Advisories 50

References