Skip to content
OpenAdvisories
Medium · 6.1 CVE-2026-27142 BIT-golang-2026-27142EUVD-2026-10088GHSA-j4j7-vw47-rhfqGO-2026-4603

URLs in meta content attribute actions are not escaped in html/template

Published Mar 6, 2026 · Updated Mar 16, 2026 · Assigned by Go

Vendor: Go standard library Product: html/template Package: amazon-cloudwatch-agent Package: amazon-cloudwatch-agent-operator Package: amazon-k8s-cni Package: amazon-k8s-cni-compat Package: amazon-k8s-cni-init Package: amazon-k8s-cni-init-compat Package: apache-exporter Package: apisix-ingress-controller Package: argo-cd-3.2 Package: argo-cd-3.2-compat Package: argo-events Package: argo-rollouts Package: argocd-image-updater Package: atlantis Package: authservice Package: aws-flb-kinesis Package: aws-load-balancer-controller Package: aws-otel-collector Package: azcopy Package: azure-service-operator Package: azuredisk-csi-1.34 Package: azurefile-csi-1.35 Package: bank-vaults Package: bank-vaults-template Package: blob-csi-1.27 Package: blobfuse2 Package: bom Package: boring-registry Package: buildah Package: cadvisor Package: cass-operator Package: cerbos Package: cert-manager-cmctl Package: chartmuseum Package: cilium-1.19 Package: cilium-1.19-clustermesh-apiserver Package: cilium-1.19-hubble-relay Package: cilium-1.19-operator-aws Package: cilium-1.19-operator-generic Package: cloud-provider-aws-1.31-cloud-controller-manager Package: cloud-provider-aws-1.35-cloud-controller-manager Package: cloudflared Package: cloudprober Package: cluster-api-1.12-capd-manager Package: cluster-api-1.12-controller Package: cluster-api-1.12-kubeadm-bootstrap-controller Package: cluster-api-1.12-kubeadm-control-plane-controller Package: cluster-api-aws-controller Package: cluster-api-azure-controller Package: cluster-api-gcp-controller Package: cluster-api-provider-vsphere Package: cluster-autoscaler-1.35 Package: cni-plugins-dhcp Package: cni-plugins-ipam Package: conftest Package: consul-k8s-1.9-cli Package: container-object-storage-interface-sidecar Package: containerd-1 Package: containerd-2 Package: containerd-shim-runc-v2-1 Package: containerd-shim-runc-v2-2 Package: containerd-stress-2 Package: coredns-1.13 Package: cortex Package: cri-tools Package: crictl Package: crossplane-provider-aws-cloudformation Package: crossplane-provider-aws-cloudfront Package: crossplane-provider-aws-cloudwatchlogs Package: crossplane-provider-aws-dynamodb Package: crossplane-provider-aws-ec2 Package: crossplane-provider-aws-eks Package: crossplane-provider-aws-elasticache Package: crossplane-provider-aws-firehose Package: crossplane-provider-aws-iam Package: crossplane-provider-aws-kinesis Package: crossplane-provider-aws-kms Package: crossplane-provider-aws-lambda Package: crossplane-provider-aws-memorydb Package: crossplane-provider-aws-rds Package: crossplane-provider-aws-route53 Package: crossplane-provider-aws-s3 Package: crossplane-provider-aws-sns Package: crossplane-provider-aws-sqs Package: crossplane-provider-family-aws Package: ctr-1 Package: ctr-2 Package: dask-gateway-server Package: dataplaneapi Package: dex Package: dkron Package: dkron-executor-gcppubsub Package: dkron-executor-grpc Package: dkron-executor-kafka Package: dkron-executor-nats Package: dkron-executor-rabbitmq Package: dkron-processor-files Package: dkron-processor-fluent Package: dkron-processor-log Package: dkron-processor-syslog Package: docker-cli Package: docker-compose Package: falco-no-driver Package: falcoctl Package: flux-helm-controller Package: flux-image-automation-controller Package: flux-image-reflector-controller Package: flux-notification-controller Package: flux-source-controller Package: fscrypt Package: fuse-overlayfs-snapshotter Package: gcc Package: gitaly-18.6 Package: gitaly-18.7 Package: gitaly-18.8 Package: gitaly-18.9 Package: gitaly-backup-18.6 Package: gitaly-backup-18.7 Package: gitaly-backup-18.8 Package: gitaly-backup-18.9 Package: gitaly-init-cgroups-18.6 Package: gitea Package: gitlab-agent-18.6 Package: gitlab-agent-18.7 Package: gitlab-agent-18.9 Package: gitlab-docker-machine-18.6 Package: gitlab-docker-machine-18.7 Package: gitlab-docker-machine-18.8 Package: gitlab-docker-machine-18.9 Package: gitlab-kas-18.6 Package: gitlab-kas-18.7 Package: gitlab-kas-18.8 Package: gitlab-kas-18.9 Package: gitlab-pages-18.6 Package: gitlab-pages-18.7 Package: gitlab-pages-18.8 Package: gitlab-pages-18.9 Package: gitlab-runner-18.6 Package: gitlab-runner-18.7 Package: gitlab-runner-18.8 Package: gitlab-runner-18.9 Package: gitlab-runner-helper-18.6 Package: gitlab-runner-helper-18.7 Package: gitlab-runner-helper-18.8 Package: gitlab-runner-helper-18.9 Package: gitness Package: go Package: go-1.24 Package: go-1.24-asm Package: go-1.24-covdata Package: go-1.24-cover Package: go-1.24-nm Package: go-1.24-objdump Package: go-1.24-test2json Package: go-1.26 Package: gogatekeeper Package: golang Package: golang-1.19 Package: golang-1.24 Package: golang-1.24 Package: golang-1.25 Package: golang-1.26 Package: golang-1.26 Package: gpu-feature-discovery Package: grafana-rollout-operator Package: helm-3 Package: helm-4 Package: ingress-nginx-controller-1.12 Package: istio-pilot-agent-1.25 Package: k8sgpt Package: k8ssandra-operator Package: kaf Package: kafka-proxy Package: kaniko Package: kapp-controller Package: karma Package: katib-earlystopping Package: katib-suggestion-goptuna-compat Package: katib-suggestion-hyperband Package: katib-suggestion-hyperopt Package: katib-suggestion-nas-darts Package: katib-suggestion-nas-enas Package: katib-suggestion-optuna-enas Package: katib-suggestion-pbt-enas Package: katib-suggestion-skopt-enas Package: katib-tfevent-metricscollector Package: keda-2.19 Package: keda-2.19-metrics-apiserver Package: knative-client Package: knative-eventing-1.21-channel-controller Package: knative-eventing-1.21-channel-dispatcher Package: knative-eventing-1.21-controller Package: knative-eventing-1.21-filter Package: knative-eventing-1.21-ingress Package: knative-eventing-1.21-jobsink Package: knative-eventing-1.21-mtchannel-broker Package: knative-eventing-1.21-webhook Package: knative-operator-1.21 Package: knative-operator-1.21-webhook Package: kots Package: kpt Package: kratos Package: kserve-agent Package: kserve-manager Package: kserve-modelmesh-serving Package: kserve-qpext Package: kserve-rest-proxy Package: kserve-router Package: ksops Package: kube-apiserver-1.34 Package: kube-apiserver-1.35 Package: kube-arangodb-1.4 Package: kube-controller-manager-1.34 Package: kube-controller-manager-1.35 Package: kube-fluentd-operator Package: kube-logging-operator Package: kube-metrics-adapter Package: kube-proxy-1.34 Package: kube-proxy-1.35 Package: kube-rbac-proxy Package: kube-scheduler-1.34 Package: kube-scheduler-1.35 Package: kube-state-metrics Package: kube-vip-cloud-provider Package: kubeadm-1.34 Package: kubeadm-1.35 Package: kubectl-1.31 Package: kubectl-1.32 Package: kubectl-1.33 Package: kubectl-1.34 Package: kubectl-1.35 Package: kubectl-argo-rollouts Package: kubeflow-pipelines-apiserver Package: kubeflow-pipelines-cache_server Package: kubeflow-pipelines-persistence_agent Package: kubeflow-pipelines-scheduledworkflow Package: kubeflow-profile-controller Package: kubelet-1.34 Package: kubelet-1.35 Package: kubernetes-1.34 Package: kubernetes-1.35 Package: kubernetes-csi-driver-hostpath Package: kubernetes-csi-driver-nfs Package: kubernetes-csi-external-attacher Package: kubernetes-csi-external-health-monitor Package: kubernetes-csi-external-provisioner Package: kubernetes-csi-external-resizer Package: kubernetes-csi-external-snapshot-controller-8.5 Package: kubernetes-csi-external-snapshotter-8.5 Package: kubernetes-csi-livenessprobe Package: kubernetes-csi-node-driver-registrar-2.16 Package: kubernetes-dashboard Package: kubernetes-dashboard-api Package: kubernetes-dashboard-auth Package: kubernetes-dashboard-web Package: kubernetes-dns-node-cache Package: kubernetes-event-exporter Package: kubescape Package: kubevela-vela-cli Package: kubevela-vela-core Package: kubo Package: kuma-cni-2.12 Package: kuma-cni-2.13 Package: kuma-coredns-1.13 Package: kuma-cp-2.12 Package: kuma-cp-2.13 Package: kuma-dp-2.12 Package: kuma-dp-2.13 Package: kuma-install-cni-2.12 Package: kuma-install-cni-2.13 Package: kumactl-2.12 Package: kumactl-2.13 Package: kyverno-1.17 Package: kyverno-background-controller-1.17 Package: kyverno-cleanup-controller-1.17 Package: kyverno-cli-1.17 Package: kyverno-init-container-1.17 Package: kyverno-policy-reporter Package: kyverno-policy-reporter-kyverno-plugin Package: kyverno-policy-reporter-ui Package: kyverno-readiness-checker-1.17 Package: kyverno-reports-controller-1.17 Package: langfuse-3-worker Package: libnvidia-container Package: litestream Package: lvm-driver Package: mariadb-operator Package: mattermost-11.1 Package: mc Package: mcp-grafana Package: memcached-exporter Package: mesosphere-vsphere-csi-driver Package: mesosphere-vsphere-csi-syncer Package: metrics-server Package: migrate Package: minio Package: minio-object-browser Package: mps-control-daemon Package: msft-golang Package: net-kourier-1.21 Package: neuvector-sigstore-interface Package: newrelic-fluent-bit-output Package: newrelic-infrastructure-agent Package: nginx-prometheus-exporter Package: no-docs-check Package: node-problem-detector-1.35 Package: nvidia-container-toolkit-nvidia-cdi-hook Package: nvidia-container-toolkit-nvidia-container-runtime Package: nvidia-container-toolkit-nvidia-container-runtime-cdi Package: nvidia-container-toolkit-nvidia-container-runtime-hook Package: nvidia-container-toolkit-nvidia-container-runtime-legacy Package: nvidia-container-toolkit-nvidia-ctk Package: nvidia-container-toolkit-nvidia-ctk-installer Package: nvidia-device-plugin Package: oauth2-proxy Package: octo-sts Package: octo-sts-webhook Package: opencost Package: openfga Package: opentelemetry-collector Package: opentelemetry-collector-contrib Package: opentofu-1.11 Package: opentofu-1.9 Package: otel-cli Package: percona-server-mongodb-operator Package: podcli Package: podinfo Package: polaris Package: prometheus-3.10 Package: prometheus-3.8 Package: prometheus-3.9 Package: prometheus-adapter Package: prometheus-admission-webhook Package: prometheus-alertmanager Package: prometheus-config-reloader Package: prometheus-operator Package: prometheus-pushgateway Package: promxy Package: pulumi Package: pulumi-kubernetes-operator Package: pulumi-language-dotnet Package: pulumi-language-go Package: pulumi-language-java Package: pulumi-language-nodejs Package: pulumi-language-python Package: pulumi-language-yaml Package: python-tensorboard Package: rancher-2.13 Package: rancher-agent-2.13 Package: rancher-helm-3 Package: rancher-machine Package: ratify Package: rclone Package: redka Package: restic Package: rook Package: rook-oci-compat Package: runc Package: secrets-store-csi-driver Package: secrets-store-csi-driver-provider-aws Package: secrets-store-csi-driver-provider-azure Package: secrets-store-csi-driver-provider-gcp Package: sftpgo Package: sftpgo-plugin-auth Package: sftpgo-plugin-eventsearch Package: sftpgo-plugin-eventstore Package: sftpgo-plugin-geoipfilter Package: sftpgo-plugin-kms Package: sftpgo-plugin-pubsub Package: sigstore-scaffolding-tsa-createcertchain Package: skopeo Package: smarter-device-manager Package: snyk-cli Package: sops Package: spegel Package: spicedb Package: spiffe-helper Package: spire-controller-manager Package: spqr Package: sql_exporter Package: src Package: sriov-network-device-plugin Package: stdlib Package: steampipe Package: step Package: step-ca Package: step-issuer Package: step-kms-plugin Package: swagger Package: syft Package: symlink-check Package: tdbg Package: tempo-2.10 Package: tempo-2.10-cli Package: tempo-2.10-query Package: tempo-2.10-vulture Package: temporal-cassandra-tool Package: temporal-server Package: temporal-sql-tool Package: tensorflow Package: terraform-provider-azapi Package: terraform-provider-azuread Package: terraform-provider-google Package: terraform-provider-grafana Package: terraform-provider-kubernetes Package: terraform-provider-pagerduty Package: terraform-provider-random Package: terraform-provider-sendgrid Package: terraform-provider-time Package: terraform-provider-tls Package: terragrunt Package: tetra Package: tetragon Package: tetragon-operator Package: tflint Package: tfsec Package: thanos Package: timestamp-authority-server Package: timoni Package: tkn Package: tofu-controller Package: tofu-controller-runner Package: trillian-logserver Package: trillian-logsigner Package: trino Package: tw Package: twt Package: undock Package: vault-benchmark Package: vault-env Package: velero-plugin-for-csi-compat Package: verticadb-operator Package: victoriametrics-operator Package: volume-modifier-for-k8s Package: wal-g-pg Package: x509-certificate-exporter Package: yunikorn-k8shim Package: zarf Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.

Affected products

VendorProductAffectedFixed
Go standard library html/template < 1.25.8, 1.26.0-0 – < 1.26.1 1.25.8

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 golang-1.26 1.26.1-1 —
Debian 13 golang-1.24 No fix yet —
Debian 12 golang-1.19 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 golang-1.26 No fix yet —
Ubuntu 26.04 LTS golang-1.24 +2 No fix yet —
Ubuntu 25.10 golang-1.24 +1 No fix yet —
Ubuntu 24.04 LTS golang-1.24 +2 No fix yet —
Ubuntu 22.04 LTS golang-1.24 +2 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 golang1.25 +6 1.25.8-1.1.hum1 RHSA-2026:5192
Red Hat Hardened Images 1 golang1.26 +6 1.26.2-1.hum1 RHSA-2026:7291

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 go1.25 1.25.8-150000.1.32.1 SUSE-SU-2026:2817-1, SUSE-SU-2026:0875-1
SLES 15 SP7 go1.25-openssl 1.25.8-150600.13.15.1 SUSE-SU-2026:3151-1, SUSE-SU-2026:0977-1
SLES 15 SP7 go1.26 1.26.1-150000.1.6.1 SUSE-SU-2026:0876-1
SLES 15 SP7 go1.26-openssl 1.26.1-150600.13.3.1 SUSE-SU-2026:0976-1
SLES 15 SP6 go1.25 1.25.8-150000.1.32.1 SUSE-SU-2026:2817-1, SUSE-SU-2026:0875-1
SLES 15 SP6 go1.25-openssl 1.25.8-150600.13.15.1 SUSE-SU-2026:3151-1, SUSE-SU-2026:0977-1
SLES 15 SP6 go1.26 1.26.1-150000.1.6.1 SUSE-SU-2026:0876-1
SLES 15 SP6 go1.26-openssl 1.26.1-150600.13.3.1 SUSE-SU-2026:0976-1
SLES 15 SP5 go1.25 1.25.8-150000.1.32.1 SUSE-SU-2026:2817-1, SUSE-SU-2026:0875-1
SLES 15 SP5 go1.25-openssl 1.25.8-150000.1.18.1 SUSE-SU-2026:3046-1, SUSE-SU-2026:0947-1
SLES 15 SP5 go1.26 1.26.1-150000.1.6.1 SUSE-SU-2026:0876-1
SLES 15 SP5 go1.26-openssl 1.26.1-150000.1.3.1 SUSE-SU-2026:0993-1
SLES 15 SP4 go1.25 1.25.8-150000.1.32.1 SUSE-SU-2026:2817-1, SUSE-SU-2026:0875-1
SLES 15 SP4 go1.25-openssl 1.25.8-150000.1.18.1 SUSE-SU-2026:3046-1, SUSE-SU-2026:0947-1
SLES 15 SP4 go1.26 1.26.1-150000.1.6.1 SUSE-SU-2026:0876-1
SLES 15 SP4 go1.26-openssl 1.26.1-150000.1.3.1 SUSE-SU-2026:0993-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 go1.25 1.25.8-160000.1.1 SUSE-SU-2026:22643-1, SUSE-SU-2026:21200-1
SLES for SAP 16.0 go1.25-openssl 1.25.12-160000.1.1 SUSE-SU-2026:22638-1
SLES for SAP 16.0 go1.26-openssl 1.26.1-160000.1.1 SUSE-SU-2026:21195-1
SLES for SAP 15 SP6 go1.25 1.25.8-150000.1.32.1 SUSE-SU-2026:2817-1, SUSE-SU-2026:0875-1
SLES for SAP 15 SP6 go1.25-openssl 1.25.8-150600.13.15.1 SUSE-SU-2026:3151-1, SUSE-SU-2026:0977-1
SLES for SAP 15 SP6 go1.26 1.26.1-150000.1.6.1 SUSE-SU-2026:0876-1
SLES for SAP 15 SP6 go1.26-openssl 1.26.1-150600.13.3.1 SUSE-SU-2026:0976-1
SLES for SAP 15 SP5 go1.25 1.25.8-150000.1.32.1 SUSE-SU-2026:2817-1, SUSE-SU-2026:0875-1
SLES for SAP 15 SP5 go1.25-openssl 1.25.8-150000.1.18.1 SUSE-SU-2026:3046-1, SUSE-SU-2026:0947-1
SLES for SAP 15 SP5 go1.26 1.26.1-150000.1.6.1 SUSE-SU-2026:0876-1
SLES for SAP 15 SP5 go1.26-openssl 1.26.1-150000.1.3.1 SUSE-SU-2026:0993-1
SLES for SAP 15 SP4 go1.25 1.25.8-150000.1.32.1 SUSE-SU-2026:2817-1, SUSE-SU-2026:0875-1
SLES for SAP 15 SP4 go1.25-openssl 1.25.8-150000.1.18.1 SUSE-SU-2026:3046-1, SUSE-SU-2026:0947-1
SLES for SAP 15 SP4 go1.26 1.26.1-150000.1.6.1 SUSE-SU-2026:0876-1
SLES for SAP 15 SP4 go1.26-openssl 1.26.1-150000.1.3.1 SUSE-SU-2026:0993-1
SLES 16.0 go1.25 1.25.8-160000.1.1 SUSE-SU-2026:22643-1, SUSE-SU-2026:21200-1
SLES 16.0 go1.25-openssl 1.25.12-160000.1.1 SUSE-SU-2026:22638-1
SLES 16.0 go1.26-openssl 1.26.1-160000.1.1 SUSE-SU-2026:21195-1
SLE HPC 15 SP5 go1.25 1.25.8-150000.1.32.1 SUSE-SU-2026:2817-1, SUSE-SU-2026:0875-1
SLE HPC 15 SP5 go1.25-openssl 1.25.8-150000.1.18.1 SUSE-SU-2026:3046-1, SUSE-SU-2026:0947-1
SLE HPC 15 SP5 go1.26 1.26.1-150000.1.6.1 SUSE-SU-2026:0876-1
SLE HPC 15 SP5 go1.26-openssl 1.26.1-150000.1.3.1 SUSE-SU-2026:0993-1
SLE HPC 15 SP4 go1.25 1.25.8-150000.1.32.1 SUSE-SU-2026:2817-1, SUSE-SU-2026:0875-1
SLE HPC 15 SP4 go1.25-openssl 1.25.8-150000.1.18.1 SUSE-SU-2026:3046-1, SUSE-SU-2026:0947-1
SLE HPC 15 SP4 go1.26 1.26.1-150000.1.6.1 SUSE-SU-2026:0876-1
SLE HPC 15 SP4 go1.26-openssl 1.26.1-150000.1.3.1 SUSE-SU-2026:0993-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed go1.25 1.25.8-1.1 openSUSE-SU-2026:10310-1
openSUSE Tumbleweed go1.26 1.26.1-1.1 openSUSE-SU-2026:10299-1
openSUSE Leap 16.0 go1.25 1.25.8-160000.1.1 openSUSE-SU-2026:21324-1, openSUSE-SU-2026:20496-1
openSUSE Leap 16.0 go1.25-openssl 1.25.12-160000.1.1 openSUSE-SU-2026:21319-1
openSUSE Leap 16.0 go1.26 +1 1.26.1-160000.1.1 openSUSE-SU-2026:20537-1, openSUSE-SU-2026:20342-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 15.6 go1.25 1.25.8-150000.1.32.1 SUSE-SU-2026:0875-1
openSUSE Leap 15.6 go1.25-openssl 1.25.8-150600.13.15.1 SUSE-SU-2026:0977-1
openSUSE Leap 15.6 go1.26 1.26.1-150000.1.6.1 SUSE-SU-2026:0876-1
openSUSE Leap 15.6 go1.26-openssl 1.26.1-150600.13.3.1 SUSE-SU-2026:0976-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20260317T205859-150000.1.152.1 SUSE-SU-2026:1042-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 go 1.25.8-r0 —
Alpine v3.24 rclone 1.73.5-r0 —
Alpine v3.23 go 1.25.8-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 amazon-cloudwatch-agent 1.300064.2-1.amzn2023 ALAS2023-2026-1572
Amazon Linux 2023 amazon-ecr-credential-helper 0.12.0-1.amzn2023 ALAS2023-2026-1574
Amazon Linux 2023 cni-plugins 1.7.1-1.amzn2023.0.6 ALAS2023-2026-1723
Amazon Linux 2023 containerd +1 2.2.1-1.amzn2023.0.2 ALAS2023-2026-1534
Amazon Linux 2023 credentials-fetcher 2.0.1-1.amzn2023.0.1 ALAS2023-2026-1501
Amazon Linux 2023 docker 25.0.14-1.amzn2023.0.3 ALAS2023-2026-1571
Amazon Linux 2023 ecs-init 1.102.2-1.amzn2023 ALAS2023-2026-1552
Amazon Linux 2023 git-lfs 3.7.1-80.amzn2023 ALAS2023-2026-1722
Amazon Linux 2023 golang +6 1.25.8-1.amzn2023.0.1 ALAS2023-2026-1482
Amazon Linux 2023 golang-github-burntsushi-toml +1 1.5.0-1.amzn2023.0.1 ALAS2023-2026-1751
Amazon Linux 2023 golang-github-burntsushi-toml-test +1 0.2.0-8.amzn2023.0.3 ALAS2023-2026-1750
Amazon Linux 2023 golang-github-cpuguy83-md2man +2 2.0.2-24.amzn2023.0.7 ALAS2023-2026-1749
Amazon Linux 2023 golist 0.10.4-12.amzn2023.0.7 ALAS2023-2026-1513
Amazon Linux 2023 libcap +3 2.73-1.amzn2023.0.7 ALAS2023-2026-1721
Amazon Linux 2023 nerdctl 2.2.1-1.amzn2023.0.3 ALAS2023-2026-1535
Amazon Linux 2023 oci-add-hooks 0-0.1.20200504git268e3bb.amzn2023.0.9 ALAS2023-2026-1575
Amazon Linux 2023 rclone 1.73.4-74.amzn2023 ALAS2023-2026-1607
Amazon Linux 2023 runc 1.3.4-3.amzn2023.0.2 ALAS2023-2026-1541
Amazon Linux 2023 runfinch-finch 1.15.1-1.amzn2023.0.1 ALAS2023-2026-1507
Amazon Linux 2023 soci-snapshotter 0.13.0-1.amzn2023.0.1 ALAS2023-2026-1573
Amazon Linux 2023 yq 4.47.1-12.amzn2023 ALAS2023-2026-1582
Amazon Linux 2 amazon-cloudwatch-agent 1.300064.2-1.amzn2 ALAS2-2026-3248
Amazon Linux 2 cni-plugins 1.7.1-1.amzn2.0.6 ALAS2-2026-3311
Amazon Linux 2 cri-tools 1.32.0-1.amzn2.0.6 ALAS2-2026-3310
Amazon Linux 2 golang +6 1.25.8-1.amzn2.0.1 ALAS2-2026-3203
Amazon Linux 2 golist 0.10.1-10.amzn2.0.11 ALAS2-2026-3202
Amazon Linux 2 nerdctl 2.2.1-1.amzn2.0.3 ALAS2-2026-3229
Amazon Linux 2 rclone 1.55.1-1.amzn2.0.6 ALAS2-2026-3309

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 gcc +3 No fix yet —
Azure Linux 2 (CBL-Mariner) gcc +4 No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling amazon-cloudwatch-agent 1.300064.1-r1 —
Wolfi rolling amazon-cloudwatch-agent-operator 3.3.2-r0 —
Wolfi rolling amazon-k8s-cni +3 1.21.1-r5 —
Wolfi rolling apache-exporter 1.0.12-r4 —
Wolfi rolling apisix-ingress-controller 2.0.1-r5 —
Wolfi rolling argo-cd-3.2 +1 3.2.7-r2 —
Wolfi rolling argo-events 1.9.10-r5 —
Wolfi rolling argo-rollouts +1 1.8.4-r4 —
Wolfi rolling argocd-image-updater +1 1.1.1-r3 —
Wolfi rolling atlantis 0.40.0-r3 —
Wolfi rolling authservice 1.1.5-r4 —
Wolfi rolling aws-flb-kinesis 1.10.3-r7 —
Wolfi rolling aws-load-balancer-controller 3.1.0-r2 —
Wolfi rolling aws-otel-collector 0.47.0-r7 —
Wolfi rolling azcopy 10.32.1-r7 —
Wolfi rolling azuredisk-csi-1.34 1.34.2-r3 —
Wolfi rolling azurefile-csi-1.35 1.35.1-r5 —
Wolfi rolling bank-vaults +1 1.32.1-r6 —
Wolfi rolling blob-csi-1.27 1.27.3-r2 —
Wolfi rolling blobfuse2 2.4.2-r12 —
Wolfi rolling bom 0.7.1-r10 —
Wolfi rolling boring-registry 0.16.6-r13 —
Wolfi rolling buildah 1.43.0-r1 —
Wolfi rolling cadvisor 0.56.2-r5 —
Wolfi rolling cass-operator 1.29.0-r3 —
Wolfi rolling cerbos 0.51.0-r7 —
Wolfi rolling cert-manager-cmctl 2.4.1-r3 —
Wolfi rolling chartmuseum 0.16.4-r3 —
Wolfi rolling cilium-1.19 +4 1.19.1-r2 —
Wolfi rolling cloud-provider-aws-1.31-cloud-controller-manager 1.31.9-r6 —
Wolfi rolling cloud-provider-aws-1.35-cloud-controller-manager 1.35.0-r3 —
Wolfi rolling cloudflared 2026.3.0-r0 —
Wolfi rolling cloudprober 0.14.2-r0 —
Wolfi rolling cluster-api-1.12-controller +3 1.12.3-r3 —
Wolfi rolling cluster-api-aws-controller 2.10.2-r1 —
Wolfi rolling cluster-api-azure-controller 1.22.0-r3 —
Wolfi rolling cluster-api-gcp-controller 1.11.0-r2 —
Wolfi rolling cluster-api-provider-vsphere 1.15.2-r4 —
Wolfi rolling cluster-autoscaler-1.35 1.35.0-r1 —
Wolfi rolling cni-plugins-dhcp +1 1.9.0-r4 —
Wolfi rolling conftest 0.66.0-r3 —
Wolfi rolling consul-k8s-1.9-cli 1.9.5-r1 —
Wolfi rolling container-object-storage-interface-sidecar 0.2.2-r4 —
Wolfi rolling coredns-1.13 +1 1.13.2-r4 —
Wolfi rolling cortex 1.20.1-r4 —
Wolfi rolling crictl +1 1.35.0-r4 —
Wolfi rolling crossplane-provider-aws-s3 +18 2.5.0-r0 —
Wolfi rolling ctr-1 +2 1.7.30-r4 —
Wolfi rolling ctr-2 +3 2.2.2-r0 —
Wolfi rolling dask-gateway-server 2025.4.0-r9 —
Wolfi rolling dataplaneapi 3.3.1-r0 —
Wolfi rolling dex 2.45.1-r2 —
Wolfi rolling dkron +9 4.1.0-r2 —
Wolfi rolling docker-cli 29.3.0-r1 —
Wolfi rolling docker-compose 5.1.0-r3 —
Wolfi rolling falco-no-driver 0.43.0-r7 —
Wolfi rolling falcoctl 0.12.2-r3 —
Wolfi rolling flux-helm-controller 1.5.3-r1 —
Wolfi rolling flux-image-reflector-controller 1.1.1-r1 —
Wolfi rolling flux-notification-controller 1.8.2-r1 —
Wolfi rolling flux-source-controller 1.8.1-r1 —
Wolfi rolling fscrypt 0.3.6-r5 —
Wolfi rolling fuse-overlayfs-snapshotter 2.1.7-r3 —
Wolfi rolling gitaly-18.6 +5 18.6.6-r6 —
Wolfi rolling gitaly-18.7 +1 18.7.5-r6 —
Wolfi rolling gitaly-18.8 +1 18.8.6-r0 —
Wolfi rolling gitaly-18.9 +2 18.9.2-r0 —
Wolfi rolling gitea 1.25.4-r9 —
Wolfi rolling gitlab-agent-18.7 18.7.5-r2 —
Wolfi rolling gitlab-kas-18.6 +1 18.6.6-r5 —
Wolfi rolling gitlab-kas-18.7 +1 18.7.5-r3 —
Wolfi rolling gitlab-kas-18.8 18.8.5-r5 —
Wolfi rolling gitlab-kas-18.9 +1 18.9.1-r5 —
Wolfi rolling gitlab-pages-18.6 18.6.6-r4 —
Wolfi rolling gitlab-pages-18.8 18.8.5-r3 —
Wolfi rolling gitlab-runner-18.7 +2 18.7.2-r8 —
Wolfi rolling gitlab-runner-18.8 +2 18.8.0-r4 —
Wolfi rolling gitlab-runner-18.9 +2 18.9.0-r3 —
Wolfi rolling gitness 3.3.0-r10 —
Wolfi rolling go-1.24 +7 No fix yet —
Wolfi rolling go-1.26 1.26.1-r0 —
Wolfi rolling gogatekeeper 4.7.0-r0 —
Wolfi rolling grafana-rollout-operator 0.35.0-r2 —
Wolfi rolling helm-3 3.20.1-r0 —
Wolfi rolling helm-4 4.1.1-r2 —
Wolfi rolling ingress-nginx-controller-1.12 1.12.8-r6 —
Wolfi rolling k8sgpt 0.4.30-r2 —
Wolfi rolling k8ssandra-operator 1.30.2-r2 —
Wolfi rolling kaf 0.2.14-r1 —
Wolfi rolling kafka-proxy 0.4.3-r10 —
Wolfi rolling kaniko 1.25.11-r1 —
Wolfi rolling kapp-controller 0.59.3-r1 —
Wolfi rolling karma 0.126-r1 —
Wolfi rolling katib-earlystopping +8 0.19.0-r31 —
Wolfi rolling katib-suggestion-goptuna-compat 0.19.0-r40 —
Wolfi rolling keda-2.19 +1 2.19.0-r2 —
Wolfi rolling knative-client +1 1.21.0-r2 —
Wolfi rolling knative-eventing-1.21-filter +7 1.21.1-r0 —
Wolfi rolling knative-operator-1.21 +1 1.21.1-r2 —
Wolfi rolling kots 1.129.4-r3 —
Wolfi rolling kpt 1.0.0_beta55-r18 —
Wolfi rolling kratos 2.9.2-r3 —
Wolfi rolling kserve-agent +3 0.16.0-r15 —
Wolfi rolling kserve-rest-proxy 0.12.0-r15 —
Wolfi rolling ksops 4.4.0-r9 —
Wolfi rolling kube-arangodb-1.4 1.4.1-r3 —
Wolfi rolling kube-fluentd-operator 1.18.2-r58 —
Wolfi rolling kube-logging-operator 6.4.0-r1 —
Wolfi rolling kube-metrics-adapter 0.2.8-r2 —
Wolfi rolling kube-rbac-proxy 0.21.0-r2 —
Wolfi rolling kube-state-metrics +1 2.18.0-r4 —
Wolfi rolling kube-vip-cloud-provider 0.0.12-r11 —
Wolfi rolling kubeadm-1.34 +7 1.34.5-r1 —
Wolfi rolling kubeadm-1.35 +7 1.35.2-r2 —
Wolfi rolling kubectl-1.31 1.31.14-r8 —
Wolfi rolling kubectl-1.32 1.32.13-r1 —
Wolfi rolling kubectl-1.33 1.33.9-r2 —
Wolfi rolling kubeflow-pipelines-apiserver +3 2.16.0-r3 —
Wolfi rolling kubeflow-profile-controller 1.10.0-r14 —
Wolfi rolling kubernetes-csi-driver-hostpath 1.17.1-r1 —
Wolfi rolling kubernetes-csi-driver-nfs 4.13.1-r1 —
Wolfi rolling kubernetes-csi-external-attacher 4.11.0-r2 —
Wolfi rolling kubernetes-csi-external-health-monitor 0.17.0-r2 —
Wolfi rolling kubernetes-csi-external-provisioner 6.2.0-r1 —
Wolfi rolling kubernetes-csi-external-resizer 2.1.0-r2 —
Wolfi rolling kubernetes-csi-external-snapshotter-8.5 +1 8.5.0-r1 —
Wolfi rolling kubernetes-csi-livenessprobe 2.18.0-r1 —
Wolfi rolling kubernetes-csi-node-driver-registrar-2.16 2.16.0-r1 —
Wolfi rolling kubernetes-dashboard 7.14.0-r4 —
Wolfi rolling kubernetes-dashboard-api 1.14.0-r4 —
Wolfi rolling kubernetes-dashboard-auth 1.4.0-r3 —
Wolfi rolling kubernetes-dashboard-web 1.7.0-r11 —
Wolfi rolling kubernetes-dns-node-cache 1.26.7-r8 —
Wolfi rolling kubernetes-event-exporter 1.7-r52 —
Wolfi rolling kubescape 4.0.2-r3 —
Wolfi rolling kubevela-vela-cli +1 1.10.7-r3 —
Wolfi rolling kubo 0.40.1-r2 —
Wolfi rolling kuma-cp-2.12 +4 2.12.3-r7 —
Wolfi rolling kuma-cp-2.13 +4 2.13.2-r1 —
Wolfi rolling kyverno-1.17 +6 1.17.1-r4 —
Wolfi rolling kyverno-policy-reporter 3.7.3-r2 —
Wolfi rolling kyverno-policy-reporter-kyverno-plugin 1.6.4-r16 —
Wolfi rolling kyverno-policy-reporter-ui 2.5.1-r4 —
Wolfi rolling langfuse-3-worker 3.163.0-r0 —
Wolfi rolling libnvidia-container 1.18.2-r3 —
Wolfi rolling litestream 0.5.9-r1 —
Wolfi rolling lvm-driver 1.8.1-r2 —
Wolfi rolling mariadb-operator 25.10.4-r6 —
Wolfi rolling mattermost-11.1 11.1.3-r3 —
Wolfi rolling mc 0.20250813.083541-r6 —
Wolfi rolling mcp-grafana 0.11.2-r1 —
Wolfi rolling memcached-exporter 0.15.5-r3 —
Wolfi rolling mesosphere-vsphere-csi-driver +1 3.5.0-r9 —
Wolfi rolling metrics-server 0.8.1-r3 —
Wolfi rolling migrate 4.19.1-r5 —
Wolfi rolling minio 0.20251015.172955-r7 —
Wolfi rolling minio-object-browser 2.0.4-r7 —
Wolfi rolling mps-control-daemon +2 0.18.2-r5 —
Wolfi rolling neuvector-sigstore-interface 0_git20251212-r7 —
Wolfi rolling newrelic-fluent-bit-output 3.4.1-r2 —
Wolfi rolling newrelic-infrastructure-agent 1.72.7-r2 —
Wolfi rolling nginx-prometheus-exporter 1.5.1-r7 —
Wolfi rolling node-problem-detector-1.35 1.35.2-r1 —
Wolfi rolling nvidia-container-toolkit-nvidia-ctk +6 1.18.2-r2 —
Wolfi rolling oauth2-proxy 7.14.3-r1 —
Wolfi rolling octo-sts +1 0.5.4-r5 —
Wolfi rolling opencost 1.119.2-r4 —
Wolfi rolling openfga 1.11.6-r1 —
Wolfi rolling opentelemetry-collector 0.147.0-r5 —
Wolfi rolling opentelemetry-collector-contrib 0.147.0-r0 —
Wolfi rolling opentofu-1.11 1.11.5-r6 —
Wolfi rolling opentofu-1.9 1.9.4-r10 —
Wolfi rolling otel-cli 0.4.5-r16 —
Wolfi rolling percona-server-mongodb-operator 1.22.0-r7 —
Wolfi rolling podcli +1 6.11.1-r1 —
Wolfi rolling polaris 10.1.6-r1 —
Wolfi rolling prometheus-3.10 3.10.0-r1 —
Wolfi rolling prometheus-3.8 3.8.1-r4 —
Wolfi rolling prometheus-3.9 3.9.1-r6 —
Wolfi rolling prometheus-adapter +1 0.12.0-r22 —
Wolfi rolling prometheus-alertmanager 0.31.1-r2 —
Wolfi rolling prometheus-operator +2 0.89.0-r1 —
Wolfi rolling prometheus-pushgateway 1.11.2-r7 —
Wolfi rolling promxy 0.0.93-r11 —
Wolfi rolling pulumi +3 3.224.0-r2 —
Wolfi rolling pulumi-kubernetes-operator 2.5.1-r2 —
Wolfi rolling pulumi-language-dotnet 3.101.2-r4 —
Wolfi rolling pulumi-language-java 1.21.2-r4 —
Wolfi rolling pulumi-language-yaml 1.30.0-r2 —
Wolfi rolling rancher-2.13 +1 2.13.3-r2 —
Wolfi rolling rancher-helm-3 3.20.0-r2 —
Wolfi rolling rancher-machine 0.15.0.141-r0 —
Wolfi rolling ratify 1.4.0-r17 —
Wolfi rolling redka 1.0.1-r1 —
Wolfi rolling restic 0.18.1-r12 —
Wolfi rolling rook +1 1.19.2-r1 —
Wolfi rolling runc 1.4.0-r4 —
Wolfi rolling secrets-store-csi-driver 1.5.6-r1 —
Wolfi rolling secrets-store-csi-driver-provider-aws 2.1.1-r5 —
Wolfi rolling secrets-store-csi-driver-provider-azure 1.7.2-r5 —
Wolfi rolling secrets-store-csi-driver-provider-gcp 1.11.0-r4 —
Wolfi rolling sftpgo 2.7.0-r7 —
Wolfi rolling sftpgo-plugin-auth 1.0.13-r6 —
Wolfi rolling sftpgo-plugin-eventsearch 1.0.22-r0 —
Wolfi rolling sftpgo-plugin-eventstore 1.0.22-r6 —
Wolfi rolling sftpgo-plugin-geoipfilter 1.0.11-r5 —
Wolfi rolling sftpgo-plugin-kms 1.0.16-r7 —
Wolfi rolling sftpgo-plugin-pubsub 1.0.15-r6 —
Wolfi rolling sigstore-scaffolding-tsa-createcertchain 0.7.31-r6 —
Wolfi rolling skopeo 1.22.0-r1 —
Wolfi rolling smarter-device-manager 1.20.11-r24 —
Wolfi rolling snyk-cli 1.1303.1-r2 —
Wolfi rolling sops 3.12.1-r4 —
Wolfi rolling spegel 0.6.0-r9 —
Wolfi rolling spicedb 1.49.2-r6 —
Wolfi rolling spiffe-helper 0.11.0-r9 —
Wolfi rolling spire-controller-manager 0.6.3-r12 —
Wolfi rolling spqr 2.9.0-r3 —
Wolfi rolling sql_exporter 0.19.1-r4 —
Wolfi rolling src 7.0.0-r4 —
Wolfi rolling sriov-network-device-plugin 3.11.0-r4 —
Wolfi rolling steampipe 2.4.0-r2 —
Wolfi rolling step +1 0.29.0-r7 —
Wolfi rolling step-issuer 0.9.11-r7 —
Wolfi rolling step-kms-plugin 0.16.0-r11 —
Wolfi rolling swagger 0.33.1-r7 —
Wolfi rolling syft 1.42.1-r5 —
Wolfi rolling tdbg +3 1.30.1-r1 —
Wolfi rolling tempo-2.10 +3 2.10.2-r0 —
Wolfi rolling terraform-provider-azapi 2.8.0-r4 —
Wolfi rolling terraform-provider-azuread 3.8.0-r3 —
Wolfi rolling terraform-provider-google 7.22.0-r2 —
Wolfi rolling terraform-provider-grafana 4.27.1-r0 —
Wolfi rolling terraform-provider-kubernetes 3.0.1-r4 —
Wolfi rolling terraform-provider-pagerduty 3.31.3-r4 —
Wolfi rolling terraform-provider-random 3.8.1-r5 —
Wolfi rolling terraform-provider-sendgrid 1.0.1-r13 —
Wolfi rolling terraform-provider-time 0.13.1-r10 —
Wolfi rolling terraform-provider-tls 4.2.1-r4 —
Wolfi rolling terragrunt 0.99.4-r2 —
Wolfi rolling tetra +2 1.6.0-r6 —
Wolfi rolling tflint 0.61.0-r3 —
Wolfi rolling tfsec 1.28.14-r20 —
Wolfi rolling thanos 0.41.0-r6 —
Wolfi rolling timestamp-authority-server 2.0.5-r3 —
Wolfi rolling timoni 0.26.0-r6 —
Wolfi rolling tkn 0.44.0-r2 —
Wolfi rolling tofu-controller +1 0.16.1-r5 —
Wolfi rolling trillian-logserver +1 1.7.2-r14 —
Wolfi rolling trino 479-r6 —
Wolfi rolling tw +3 0.0.44-r1 —
Wolfi rolling undock 0.11.0-r4 —
Wolfi rolling vault-benchmark 0.4.0-r7 —
Wolfi rolling vault-env 1.22.1-r5 —
Wolfi rolling velero-plugin-for-csi-compat 0.7.1-r44 —
Wolfi rolling verticadb-operator 25.4.0.0-r12 —
Wolfi rolling victoriametrics-operator 0.68.2-r5 —
Wolfi rolling volume-modifier-for-k8s 0.9.3-r2 —
Wolfi rolling wal-g-pg 3.0.8-r7 —
Wolfi rolling x509-certificate-exporter 3.19.1-r16 —
Wolfi rolling yunikorn-k8shim 1.8.0-r7 —
Wolfi rolling zarf 0.73.1-r3 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go stdlib < 1.25.8 · >= 1.26.0-0, < 1.26.1 1.25.8, 1.26.1 GO-2026-4603

Advisories 50

References