Skip to content
OpenAdvisories
Medium · 6.1 CVE-2026-32289 BIT-golang-2026-32289EUVD-2026-20018GHSA-7mr4-xjxg-34g6GO-2026-4865

JsBraceDepth Context Tracking Bugs (XSS) in html/template

Published Apr 8, 2026 · Updated Apr 13, 2026 · Assigned by Go

Vendor: Go standard library Product: html/template Package: aactl Package: amazon-cloudwatch-agent Package: amazon-cloudwatch-agent-operator Package: amazon-k8s-cni Package: amazon-k8s-cni-compat Package: amazon-k8s-cni-init Package: amazon-k8s-cni-init-compat Package: apache-exporter Package: apisix-ingress-controller Package: apko Package: argo-cd-3.3 Package: argo-cd-3.3-compat Package: argo-events Package: argo-rollouts Package: argo-workflow-executor-3.7 Package: argo-workflows-3.7 Package: argocd-image-updater Package: atlantis Package: authservice Package: aws-efs-csi-driver Package: aws-flb-cloudwatch Package: aws-flb-firehose Package: aws-flb-kinesis Package: aws-node-termination-handler Package: azure-service-operator Package: bank-vaults Package: bank-vaults-template Package: bento Package: blobfuse2 Package: bom Package: boring-registry Package: buildah Package: caddy Package: cadvisor Package: calico-apiserver-3.31 Package: calico-app-policy-3.31 Package: calico-cni-3.31 Package: calico-felix-3.31 Package: calico-goldmane-3.31 Package: calico-kube-controllers-3.31 Package: calico-node-3.31 Package: calico-pod2daemon-3.31 Package: calico-typhad-3.31 Package: calico-whisker-backend-3.31 Package: calicoctl-3.31 Package: cerbos Package: cerbosctl Package: cert-manager-1.20 Package: cert-manager-acmesolver-1.20 Package: cert-manager-cainjector-1.20 Package: cert-manager-cmctl Package: cert-manager-controller-1.20 Package: cert-manager-csi-driver Package: cert-manager-startupapicheck-1.20 Package: cert-manager-webhook-1.20 Package: certificate-transparency-trillian-ctserver Package: chartmuseum Package: cilium-1.19 Package: cilium-1.19-clustermesh-apiserver Package: cilium-1.19-hubble-relay Package: cilium-1.19-operator-aws Package: cilium-1.19-operator-generic Package: cilium-cli Package: cis-operator-1.4 Package: cloud-provider-aws-1.31-cloud-controller-manager Package: cloud-provider-aws-1.31-ecr-credential-provider Package: cloud-provider-azure-cloud-controller-manager-1.35 Package: cloud-provider-azure-cloud-node-manager-1.35 Package: cloud-provider-vsphere Package: cloud-sql-proxy-2.16 Package: cloud-sql-proxy-2.21 Package: cloudnative-pg Package: cloudnative-pg-plugins Package: cluster-api-provider-vsphere Package: cluster-autoscaler-1.35 Package: cni-plugins-dhcp Package: cni-plugins-ipam Package: consul-k8s-1.9-cli Package: container-object-storage-interface-sidecar Package: coredns-1.13 Package: coredns-1.14 Package: cortex Package: cosign Package: cri-tools Package: crictl Package: critest Package: crossplane-2.2 Package: crossplane-2.2-crank Package: crossplane-provider-azure-authorization Package: crossplane-provider-azure-managedidentity Package: crossplane-provider-azure-sql Package: crossplane-provider-azure-storage Package: crossplane-provider-family-azure Package: crossplane-provider-keycloak Package: crossplane-provider-sql Package: cue Package: dapr-daprd-1.17 Package: dapr-injector-1.17 Package: dapr-operator-1.17 Package: dapr-placement-1.17 Package: dapr-scheduler-1.17 Package: dapr-sentry-1.17 Package: dask-gateway-server Package: datadog-agent-7.72 Package: datadog-agent-7.73 Package: datadog-cluster-agent-7.72 Package: datadog-cluster-agent-7.73 Package: dataplaneapi Package: db-operator Package: dbmate Package: delve Package: descheduler Package: dex Package: dgraph Package: dkron Package: dkron-executor-gcppubsub Package: dkron-executor-grpc Package: dkron-executor-kafka Package: dkron-executor-nats Package: dkron-executor-rabbitmq Package: dkron-processor-files Package: dkron-processor-fluent Package: dkron-processor-log Package: dkron-processor-syslog Package: docker-cli Package: docker-cli-buildx Package: docker-credential-gcr Package: docker-machine-driver-harvester Package: docker-machine-driver-linode Package: dogstatsd-7.72 Package: dogstatsd-7.73 Package: eksctl Package: emissary Package: emissary-apiext Package: envconsul Package: envoy-gateway Package: envoy-gateway-egctl Package: envoy-ratelimit Package: etcd-3.6 Package: external-secrets-operator-1.1 Package: falco-exporter Package: falco-no-driver Package: falcoctl Package: filebrowser Package: flannel Package: flux-2.8 Package: flux-helm-controller Package: flux-image-automation-controller Package: flux-image-reflector-controller Package: flux-notification-controller Package: flux-source-controller Package: fscrypt Package: fuse-overlayfs-snapshotter Package: gatus Package: gcsfuse Package: gh Package: gitaly-18.10 Package: gitaly-18.6 Package: gitaly-18.7 Package: gitaly-18.8 Package: gitaly-18.9 Package: gitaly-backup-18.10 Package: gitaly-backup-18.6 Package: gitaly-backup-18.7 Package: gitaly-backup-18.8 Package: gitaly-backup-18.9 Package: gitaly-init-cgroups-18.6 Package: gitaly-init-cgroups-18.7 Package: gitea Package: gitlab-agent-18.10 Package: gitlab-agent-18.6 Package: gitlab-agent-18.7 Package: gitlab-agent-18.8 Package: gitlab-agent-18.9 Package: gitlab-kas-18.10 Package: gitlab-kas-18.6 Package: gitlab-kas-18.7 Package: gitlab-kas-18.8 Package: gitlab-kas-18.9 Package: gitlab-pages-18.10 Package: gitlab-pages-18.6 Package: gitlab-pages-18.7 Package: gitlab-pages-18.8 Package: gitlab-pages-18.9 Package: gitness Package: gitsign Package: gitsign-credential-cache Package: go Package: go-1.24 Package: go-1.24-asm Package: go-1.24-covdata Package: go-1.24-cover Package: go-1.24-nm Package: go-1.24-objdump Package: go-1.24-test2json Package: go-1.26 Package: go-discover Package: golang Package: golang-1.10 Package: golang-1.13 Package: golang-1.14 Package: golang-1.16 Package: golang-1.17 Package: golang-1.18 Package: golang-1.19 Package: golang-1.20 Package: golang-1.21 Package: golang-1.22 Package: golang-1.23 Package: golang-1.24 Package: golang-1.24 Package: golang-1.25 Package: golang-1.26 Package: golang-1.6 Package: golang-1.8 Package: golang-1.9 Package: golangci-lint Package: goreleaser Package: gpu-feature-discovery Package: grafana-12.4 Package: grafana-agent-operator Package: grafana-mimir-3.0 Package: grafana-mimir-3.0-metaconvert-3.0 Package: grafana-mimir-3.0-mimirtool-3.0 Package: grafana-mimir-3.0-query-tee-3.0 Package: grafana-rollout-operator Package: grpc-health-probe Package: grpcurl Package: harbor-2.14 Package: harbor-2.14-exporter Package: harbor-2.14-jobservice Package: harbor-2.14-registryctl Package: helm-3 Package: helm-4 Package: helm-mapkubeapis Package: helm-set-status Package: hubble Package: hubble-ui-backend Package: ingress-nginx-controller-1.12 Package: jitsucom-bulker-bulker Package: jitsucom-bulker-ingest Package: jitsucom-bulker-ingmgr Package: jitsucom-bulker-sidecar Package: jitsucom-bulker-syncctl Package: juicefs-csi-driver Package: k3d Package: k3d-proxy Package: k8sgpt-operator Package: k8ssandra-client Package: k8ssandra-operator Package: kaf Package: kafka-proxy Package: kargo Package: katib-controller Package: katib-suggestion-goptuna Package: keda-2.19 Package: keda-2.19-admission-webhooks Package: keda-2.19-metrics-apiserver Package: kine Package: knative-client Package: knative-eventing-1.21-channel-controller Package: knative-eventing-1.21-channel-dispatcher Package: knative-eventing-1.21-controller Package: knative-eventing-1.21-filter Package: knative-eventing-1.21-ingress Package: knative-eventing-1.21-jobsink Package: knative-eventing-1.21-mtchannel-broker Package: knative-eventing-1.21-webhook Package: knative-operator-1.21 Package: knative-operator-1.21-webhook Package: knative-serving-1.21-activator Package: knative-serving-1.21-autoscaler Package: knative-serving-1.21-autoscaler-hpa Package: knative-serving-1.21-controller Package: knative-serving-1.21-queue Package: knative-serving-1.21-webhook Package: ko Package: kots Package: kpt Package: kratos Package: kserve-modelmesh-serving Package: kserve-rest-proxy Package: kube-apiserver-1.34 Package: kube-apiserver-1.35 Package: kube-arangodb-1.4 Package: kube-controller-manager-1.34 Package: kube-controller-manager-1.35 Package: kube-fluentd-operator Package: kube-proxy-1.34 Package: kube-proxy-1.35 Package: kube-scheduler-1.34 Package: kube-scheduler-1.35 Package: kube-state-metrics Package: kube-vip Package: kubeadm-1.34 Package: kubeadm-1.35 Package: kubectl-1.31 Package: kubectl-1.32 Package: kubectl-1.34 Package: kubectl-1.35 Package: kubectl-argo-rollouts Package: kubeflow-profile-controller Package: kubelet-1.34 Package: kubelet-1.35 Package: kubernetes-1.34 Package: kubernetes-1.35 Package: kubernetes-csi-driver-hostpath Package: kubernetes-csi-driver-nfs Package: kubernetes-csi-external-attacher Package: kubernetes-csi-external-health-monitor Package: kubernetes-csi-external-resizer Package: kubernetes-csi-livenessprobe Package: kubernetes-csi-node-driver-registrar-2.16 Package: kubernetes-dashboard Package: kubernetes-dashboard-api Package: kubernetes-dashboard-auth Package: kubernetes-dashboard-web Package: kubernetes-event-exporter Package: kubescape Package: kubescape-operator Package: kuma-coredns-1.13 Package: kuma-coredns-1.14 Package: kwok Package: kwokctl Package: kyverno-1.17 Package: kyverno-background-controller-1.17 Package: kyverno-cleanup-controller-1.17 Package: kyverno-cli-1.17 Package: kyverno-init-container-1.17 Package: kyverno-notation-aws Package: kyverno-policy-reporter-kyverno-plugin Package: kyverno-policy-reporter-ui Package: kyverno-readiness-checker-1.17 Package: kyverno-reports-controller-1.17 Package: lazydocker Package: libnvidia-container Package: linkerd2-cli Package: linkerd2-controller Package: linkerd2-metrics-api Package: linkerd2-tap Package: linkerd2-web Package: litestream Package: lvm-driver Package: mattermost-11.1 Package: mattermost-11.5 Package: mc Package: mcp-grafana Package: memcached-exporter Package: mesosphere-vsphere-csi-driver Package: mesosphere-vsphere-csi-syncer Package: metallb-speaker Package: migrate Package: minio-object-browser Package: minio-operator Package: mps-control-daemon Package: nerdctl Package: net-kourier-1.21 Package: neuvector-scanner Package: neuvector-scanner-task Package: newrelic-fluent-bit-output Package: newrelic-infrastructure-agent Package: nginx-prometheus-exporter Package: no-docs-check Package: node-problem-detector-1.35 Package: nuclei Package: nvidia-container-toolkit-nvidia-ctk-installer Package: nvidia-device-plugin Package: oauth2-proxy Package: opa-envoy Package: openbao Package: opencost Package: opentelemetry-collector Package: opentelemetry-operator Package: opentelemetry-operator-otel-allocator Package: opentofu-1.9 Package: osv-scanner Package: otel-cli Package: percona-server-mongodb-operator Package: polaris Package: policy-controller Package: policy-controller-tester Package: prometheus-3.10 Package: prometheus-3.8 Package: prometheus-3.9 Package: prometheus-adapter Package: prometheus-admission-webhook Package: prometheus-config-reloader Package: prometheus-operator Package: prometheus-pushgateway Package: promxy Package: pulumi Package: pulumi-language-java Package: pulumi-language-yaml Package: rabbitmq-messaging-topology-operator Package: rancher-2.13 Package: rancher-agent-2.13 Package: rancher-fleet-agent Package: rancher-fleet-cli Package: rancher-fleet-controller Package: rancher-helm-3 Package: rancher-machine Package: rclone Package: rclone Package: redka Package: rook Package: rpk-26.1.2 Package: runc Package: scorecard Package: seaweedfs Package: secrets-store-csi-driver Package: secrets-store-csi-driver-provider-aws Package: secrets-store-csi-driver-provider-azure Package: sftpgo Package: sftpgo-plugin-auth Package: sftpgo-plugin-eventsearch Package: sftpgo-plugin-eventstore Package: sftpgo-plugin-geoipfilter Package: sftpgo-plugin-pubsub Package: sigstore-scaffolding-trillian-createtree Package: sigstore-scaffolding-trillian-updatetree Package: sigstore-scaffolding-tsa-createcertchain Package: slsa-verifier Package: smarter-device-manager Package: snyk-cli Package: spegel Package: spicedb-operator Package: spiffe-helper Package: spire-agent Package: spire-controller-manager Package: spire-oidc-discovery-provider Package: spire-server Package: splunk-otel-collector Package: spqr Package: sriov-network-device-plugin Package: stdlib Package: step Package: step-ca Package: step-issuer Package: step-kms-plugin Package: swagger Package: syft Package: symlink-check Package: tailscale Package: task Package: temporal Package: temporal-ui-server Package: terraform Package: terraform-docs Package: terraform-provider-aws Package: terraform-provider-azapi Package: terraform-provider-azuread Package: terraform-provider-kubernetes Package: terraform-provider-pagerduty Package: terraform-provider-random Package: terraform-provider-sendgrid Package: terraform-provider-time Package: terraform-provider-tls Package: tetra Package: tetragon Package: tetragon-operator Package: timestamp-authority-server Package: timoni Package: tkn Package: tofu-controller Package: tofu-controller-runner Package: trillian-logserver Package: trillian-logsigner Package: trivy Package: trivy-operator Package: tw Package: twt Package: vault-benchmark Package: vault-env Package: vault-secrets-webhook Package: velero-plugin-for-aws-compat Package: velero-plugin-for-csi-compat Package: verticadb-operator Package: vexctl Package: volume-modifier-for-k8s Package: wal-g-pg Package: wave Package: weaviate Package: witness Package: x509-certificate-exporter Package: xeol Package: yunikorn-k8shim Package: zot Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.

Affected products

VendorProductAffectedFixed
Go standard library html/template < 1.25.9, 1.26.0-0 – < 1.26.2 1.25.9

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 golang-1.26 1.26.2-1 —
Debian 13 golang-1.24 No fix yet —
Debian 12 golang-1.19 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS golang-1.23 +1 No fix yet —
Ubuntu 25.10 golang-1.23 +2 No fix yet —
Ubuntu 24.04 LTS golang-1.21 +4 No fix yet —
Ubuntu 22.04 LTS golang-1.17 +7 No fix yet —
Ubuntu 20.04 LTS golang-1.13 +5 No fix yet —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS golang-1.8 +2 No fix yet —
Ubuntu 16.04 LTS golang-1.6 +1 No fix yet —
Ubuntu 14.04 LTS golang-1.10 No fix yet —
Ubuntu Pro 22.04 LTS golang-1.13 No fix yet —
Ubuntu Pro 20.04 LTS golang-1.16 No fix yet —
Ubuntu Pro 18.04 LTS golang-1.13 +2 No fix yet —
Ubuntu Pro 16.04 LTS golang-1.13 +1 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 golang +7 1.25.9-3.el10_1 RHSA-2026:10217
RHEL 9 golang +7 1.25.9-1.el9_7 RHSA-2026:10219
RHEL 8 delve 1.25.2-1.module+el8.10.0+23746+9db33b5e RHSA-2026:22112
RHEL 8 golang +7 1.25.10-1.module+el8.10.0+24308+5c4a16b7 RHSA-2026:22112
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 golang1.25 +6 1.25.9-1.hum1 RHSA-2026:7385
Red Hat Hardened Images 1 golang1.26 +6 1.26.2-1.hum1 RHSA-2026:7291

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 8 delve 1.25.2-1.module_el8.10.0+4074+24330916 ALSA-2026:22112
AlmaLinux 8 golang +7 1.25.10-1.module_el8.10.0+4187+c45165c4 ALSA-2026:22112

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 go1.25 1.25.9-150000.1.35.1 SUSE-SU-2026:1321-1
SLES 15 SP7 go1.26 1.26.2-150000.1.9.1 SUSE-SU-2026:1320-1
SLES 15 SP6 go1.25 1.25.9-150000.1.35.1 SUSE-SU-2026:1321-1
SLES 15 SP6 go1.26 1.26.2-150000.1.9.1 SUSE-SU-2026:1320-1
SLES 15 SP5 go1.25 1.25.9-150000.1.35.1 SUSE-SU-2026:1321-1
SLES 15 SP5 go1.25-openssl 1.25.9-150000.1.21.1 SUSE-SU-2026:1581-1
SLES 15 SP5 go1.26 1.26.2-150000.1.9.1 SUSE-SU-2026:1320-1
SLES 15 SP5 go1.26-openssl 1.26.2-150000.1.6.1 SUSE-SU-2026:1580-1
SLES 15 SP4 go1.25 1.25.9-150000.1.35.1 SUSE-SU-2026:1321-1
SLES 15 SP4 go1.25-openssl 1.25.9-150000.1.21.1 SUSE-SU-2026:1581-1
SLES 15 SP4 go1.26 1.26.2-150000.1.9.1 SUSE-SU-2026:1320-1
SLES 15 SP4 go1.26-openssl 1.26.2-150000.1.6.1 SUSE-SU-2026:1580-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 go1.25-openssl 1.25.12-160000.1.1 SUSE-SU-2026:22638-1
SLES for SAP 16.0 go1.26-openssl 1.26.4-160000.1.1 SUSE-SU-2026:22572-1
SLES for SAP 15 SP6 go1.25 1.25.9-150000.1.35.1 SUSE-SU-2026:1321-1
SLES for SAP 15 SP6 go1.26 1.26.2-150000.1.9.1 SUSE-SU-2026:1320-1
SLES for SAP 15 SP5 go1.25 1.25.9-150000.1.35.1 SUSE-SU-2026:1321-1
SLES for SAP 15 SP5 go1.25-openssl 1.25.9-150000.1.21.1 SUSE-SU-2026:1581-1
SLES for SAP 15 SP5 go1.26 1.26.2-150000.1.9.1 SUSE-SU-2026:1320-1
SLES for SAP 15 SP5 go1.26-openssl 1.26.2-150000.1.6.1 SUSE-SU-2026:1580-1
SLES for SAP 15 SP4 go1.25 1.25.9-150000.1.35.1 SUSE-SU-2026:1321-1
SLES for SAP 15 SP4 go1.25-openssl 1.25.9-150000.1.21.1 SUSE-SU-2026:1581-1
SLES for SAP 15 SP4 go1.26 1.26.2-150000.1.9.1 SUSE-SU-2026:1320-1
SLES for SAP 15 SP4 go1.26-openssl 1.26.2-150000.1.6.1 SUSE-SU-2026:1580-1
SLES 16.0 go1.25-openssl 1.25.12-160000.1.1 SUSE-SU-2026:22638-1
SLES 16.0 go1.26-openssl 1.26.4-160000.1.1 SUSE-SU-2026:22572-1
SLE HPC 15 SP5 go1.25 1.25.9-150000.1.35.1 SUSE-SU-2026:1321-1
SLE HPC 15 SP5 go1.25-openssl 1.25.9-150000.1.21.1 SUSE-SU-2026:1581-1
SLE HPC 15 SP5 go1.26 1.26.2-150000.1.9.1 SUSE-SU-2026:1320-1
SLE HPC 15 SP5 go1.26-openssl 1.26.2-150000.1.6.1 SUSE-SU-2026:1580-1
SLE HPC 15 SP4 go1.25 1.25.9-150000.1.35.1 SUSE-SU-2026:1321-1
SLE HPC 15 SP4 go1.25-openssl 1.25.9-150000.1.21.1 SUSE-SU-2026:1581-1
SLE HPC 15 SP4 go1.26 1.26.2-150000.1.9.1 SUSE-SU-2026:1320-1
SLE HPC 15 SP4 go1.26-openssl 1.26.2-150000.1.6.1 SUSE-SU-2026:1580-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed go1.25 1.25.9-1.1 openSUSE-SU-2026:10514-1
openSUSE Tumbleweed go1.26 1.26.2-1.1 openSUSE-SU-2026:10525-1
openSUSE Leap 16.0 go1.25 1.25.9-160000.1.1 openSUSE-SU-2026:20570-1
openSUSE Leap 16.0 go1.25-openssl 1.25.12-160000.1.1 openSUSE-SU-2026:21319-1
openSUSE Leap 16.0 go1.26 1.26.2-160000.1.1 openSUSE-SU-2026:20571-1
openSUSE Leap 16.0 go1.26-openssl 1.26.4-160000.1.1 openSUSE-SU-2026:21254-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 go 1.26.2-r0 —
Alpine v3.24 rclone 1.73.5-r0 —
Alpine v3.23 go 1.25.9-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 amazon-cloudwatch-agent 1.300066.2-2.amzn2023 ALAS2023-2026-1747
Amazon Linux 2023 amazon-ecr-credential-helper 0.12.0-2.amzn2023 ALAS2023-2026-1645
Amazon Linux 2023 containerd +1 2.2.3-1.amzn2023.0.1 ALAS2023-2026-1606
Amazon Linux 2023 credentials-fetcher 2.0.1-1.amzn2023.0.3 ALAS2023-2026-1598
Amazon Linux 2023 docker 25.0.14-1.amzn2023.0.4 ALAS2023-2026-1615
Amazon Linux 2023 ecs-init 1.103.0-1.amzn2023 ALAS2023-2026-1637
Amazon Linux 2023 golang +6 1.25.9-1.amzn2023.0.1 ALAS2023-2026-1593
Amazon Linux 2023 golang-github-burntsushi-toml +1 1.5.0-1.amzn2023.0.1 ALAS2023-2026-1751
Amazon Linux 2023 golang-github-burntsushi-toml-test +1 0.2.0-8.amzn2023.0.3 ALAS2023-2026-1750
Amazon Linux 2023 golang-github-cpuguy83-md2man +2 2.0.2-24.amzn2023.0.7 ALAS2023-2026-1749
Amazon Linux 2023 golist 0.10.4-12.amzn2023.0.8 ALAS2023-2026-1599
Amazon Linux 2023 nerdctl 2.2.2-1.amzn2023.0.1 ALAS2023-2026-1605
Amazon Linux 2023 oci-add-hooks 0-0.1.20200504git268e3bb.amzn2023.0.10 ALAS2023-2026-1660
Amazon Linux 2023 rclone 1.73.4-74.amzn2023 ALAS2023-2026-1607
Amazon Linux 2023 runc 1.3.4-4.amzn2023.0.2 ALAS2023-2026-1661
Amazon Linux 2023 runfinch-finch 1.17.0-1.amzn2023.0.1 ALAS2023-2026-1671
Amazon Linux 2023 soci-snapshotter 0.13.0-1.amzn2023.0.2 ALAS2023-2026-1700
Amazon Linux 2 amazon-cloudwatch-agent 1.300066.2-2.amzn2 ALAS2-2026-3323
Amazon Linux 2 golang +6 1.25.9-1.amzn2.0.1 ALAS2-2026-3259
Amazon Linux 2 golist 0.10.1-10.amzn2.0.12 ALAS2-2026-3260
Amazon Linux 2 nerdctl 2.2.2-1.amzn2.0.1 ALAS2-2026-3265

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 golang No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling aactl 0.4.12-r53 —
Wolfi rolling amazon-cloudwatch-agent 1.300066.1-r2 —
Wolfi rolling amazon-cloudwatch-agent-operator 3.4.2-r3 —
Wolfi rolling amazon-k8s-cni +3 1.21.1-r5 —
Wolfi rolling apache-exporter 1.0.12-r6 —
Wolfi rolling apisix-ingress-controller 2.0.1-r10 —
Wolfi rolling apko 1.2.15-r0 —
Wolfi rolling argo-cd-3.3 3.3.6-r4 —
Wolfi rolling argo-cd-3.3-compat 3.3.7-r0 —
Wolfi rolling argo-events 1.9.10-r24 —
Wolfi rolling argo-rollouts +1 1.9.0-r7 —
Wolfi rolling argo-workflows-3.7 +1 3.7.13-r1 —
Wolfi rolling argocd-image-updater 1.1.1-r8 —
Wolfi rolling atlantis 0.42.0-r0 —
Wolfi rolling authservice 1.1.5-r7 —
Wolfi rolling aws-efs-csi-driver 3.2.0-r1 —
Wolfi rolling aws-flb-cloudwatch 1.9.5-r2 —
Wolfi rolling aws-flb-firehose 1.7.2-r26 —
Wolfi rolling aws-flb-kinesis 1.10.4-r2 —
Wolfi rolling aws-node-termination-handler 1.25.6-r9 —
Wolfi rolling azure-service-operator 2.18.0-r6 —
Wolfi rolling bank-vaults +1 1.32.1-r19 —
Wolfi rolling bento 1.17.0-r1 —
Wolfi rolling blobfuse2 2.4.2-r13 —
Wolfi rolling bom 0.7.1-r21 —
Wolfi rolling boring-registry 0.17.0-r4 —
Wolfi rolling buildah 1.44.0-r0 —
Wolfi rolling caddy 2.11.2-r11 —
Wolfi rolling cadvisor 0.56.2-r15 —
Wolfi rolling calicoctl-3.31 +10 3.31.5-r2 —
Wolfi rolling cerbos +1 0.53.0-r6 —
Wolfi rolling cert-manager-1.20 +5 1.20.2-r0 —
Wolfi rolling cert-manager-cmctl 2.4.1-r5 —
Wolfi rolling cert-manager-csi-driver +1 0.15.0-r1 —
Wolfi rolling certificate-transparency-trillian-ctserver 1.3.3-r10 —
Wolfi rolling chartmuseum 0.16.5-r10 —
Wolfi rolling cilium-1.19 +1 1.19.4-r4 —
Wolfi rolling cilium-1.19-hubble-relay +2 1.19.3-r0 —
Wolfi rolling cilium-cli 0.19.4-r0 —
Wolfi rolling cis-operator-1.4 1.4.8-r7 —
Wolfi rolling cloud-provider-aws-1.31-ecr-credential-provider +1 1.31.9-r12 —
Wolfi rolling cloud-provider-azure-cloud-node-manager-1.35 +1 1.35.5-r2 —
Wolfi rolling cloud-provider-vsphere 1.35.1-r2 —
Wolfi rolling cloud-sql-proxy-2.16 2.16.0-r23 —
Wolfi rolling cloud-sql-proxy-2.21 2.21.3-r5 —
Wolfi rolling cloudnative-pg +1 1.29.1-r3 —
Wolfi rolling cluster-api-provider-vsphere 1.15.2-r10 —
Wolfi rolling cluster-autoscaler-1.35 1.35.0-r4 —
Wolfi rolling cni-plugins-dhcp +1 1.9.1-r3 —
Wolfi rolling consul-k8s-1.9-cli 1.9.8-r2 —
Wolfi rolling container-object-storage-interface-sidecar 0.2.2-r13 —
Wolfi rolling coredns-1.13 +1 1.13.2-r4 —
Wolfi rolling coredns-1.14 +1 1.14.2-r6 —
Wolfi rolling cortex 1.21.0-r3 —
Wolfi rolling cosign 3.0.5-r9 —
Wolfi rolling crictl +2 1.35.0-r8 —
Wolfi rolling crossplane-2.2 +1 2.2.0-r8 —
Wolfi rolling crossplane-provider-azure-managedidentity 2.5.0-r12 —
Wolfi rolling crossplane-provider-azure-sql +1 2.5.0-r11 —
Wolfi rolling crossplane-provider-family-azure +1 2.5.0-r10 —
Wolfi rolling crossplane-provider-keycloak 2.19.0-r7 —
Wolfi rolling cue 0.16.1-r4 —
Wolfi rolling dapr-daprd-1.17 +5 1.17.5-r0 —
Wolfi rolling dask-gateway-server 2026.3.0-r1 —
Wolfi rolling dataplaneapi 3.3.2-r2 —
Wolfi rolling db-operator 2.16.0-r13 —
Wolfi rolling dbmate 2.33.0-r2 —
Wolfi rolling delve +1 1.26.2-r0 —
Wolfi rolling descheduler 0.36.0-r2 —
Wolfi rolling dex 2.45.1-r6 —
Wolfi rolling dgraph 25.3.2-r0 —
Wolfi rolling dkron +9 4.1.0-r2 —
Wolfi rolling docker-cli 29.4.1-r0 —
Wolfi rolling docker-cli-buildx 0.34.1-r3 —
Wolfi rolling docker-credential-gcr 2.1.32-r4 —
Wolfi rolling docker-machine-driver-harvester 1.0.6-r11 —
Wolfi rolling docker-machine-driver-linode 0.1.16-r1 —
Wolfi rolling dogstatsd-7.72 +2 7.72.4-r17 —
Wolfi rolling dogstatsd-7.73 +2 7.73.3-r9 —
Wolfi rolling eksctl 0.225.0-r4 —
Wolfi rolling emissary +1 4.1.0-r1 —
Wolfi rolling envconsul 0.13.4-r14 —
Wolfi rolling envoy-gateway 1.7.1-r4 —
Wolfi rolling envoy-gateway-egctl 1.7.2-r0 —
Wolfi rolling envoy-ratelimit 0.0.0_git20260322-r3 —
Wolfi rolling etcd-3.6 3.6.10-r3 —
Wolfi rolling external-secrets-operator-1.1 1.1.1-r6 —
Wolfi rolling falco-exporter 0.8.7-r18 —
Wolfi rolling falco-no-driver 0.43.0-r7 —
Wolfi rolling falcoctl 0.12.2-r10 —
Wolfi rolling filebrowser 2.63.5-r2 —
Wolfi rolling flannel 0.28.4-r4 —
Wolfi rolling flux-2.8 2.8.8-r2 —
Wolfi rolling flux-helm-controller 1.5.5-r2 —
Wolfi rolling flux-image-automation-controller 1.1.1-r11 —
Wolfi rolling flux-image-reflector-controller 1.1.2-r2 —
Wolfi rolling flux-notification-controller 1.8.3-r3 —
Wolfi rolling flux-source-controller 1.8.2-r4 —
Wolfi rolling fscrypt 0.3.6-r9 —
Wolfi rolling fuse-overlayfs-snapshotter 2.1.7-r11 —
Wolfi rolling gatus 5.35.0-r8 —
Wolfi rolling gcsfuse 2.12.2-r22 —
Wolfi rolling gh 2.90.0-r0 —
Wolfi rolling gitaly-18.10 +2 18.10.3-r1 —
Wolfi rolling gitaly-18.6 +2 18.6.6-r9 —
Wolfi rolling gitaly-18.7 +5 18.7.6-r1 —
Wolfi rolling gitaly-18.8 18.8.9-r2 —
Wolfi rolling gitaly-18.9 +3 18.9.8-r1 —
Wolfi rolling gitea 1.26.2-r3 —
Wolfi rolling gitlab-agent-18.10 18.10.7-r0 —
Wolfi rolling gitlab-agent-18.9 18.9.5-r1 —
Wolfi rolling gitlab-kas-18.6 +1 18.6.6-r7 —
Wolfi rolling gitlab-kas-18.8 +3 18.8.10-r1 —
Wolfi rolling gitlab-pages-18.10 18.10.7-r1 —
Wolfi rolling gitlab-pages-18.6 18.6.6-r4 —
Wolfi rolling gitness 3.3.0-r20 —
Wolfi rolling gitsign +1 0.16.0-r6 —
Wolfi rolling go-1.24 +7 No fix yet —
Wolfi rolling go-discover 0_git20260413-r0 —
Wolfi rolling golangci-lint 2.11.4-r3 —
Wolfi rolling goreleaser 2.15.3-r1 —
Wolfi rolling grafana-12.4 12.4.2-r5 —
Wolfi rolling grafana-agent-operator 0.44.8-r3 —
Wolfi rolling grafana-mimir-3.0 +3 3.0.5-r5 —
Wolfi rolling grafana-rollout-operator 0.37.0-r1 —
Wolfi rolling grpc-health-probe 0.4.48-r1 —
Wolfi rolling grpcurl 1.9.3-r22 —
Wolfi rolling harbor-2.14 +3 2.14.3-r5 —
Wolfi rolling helm-3 3.22.0-r0 —
Wolfi rolling helm-4 4.1.4-r1 —
Wolfi rolling helm-mapkubeapis 0.6.1-r19 —
Wolfi rolling helm-set-status 0.3.0-r14 —
Wolfi rolling hubble 1.18.6-r6 —
Wolfi rolling hubble-ui-backend 0.13.5-r4 —
Wolfi rolling ingress-nginx-controller-1.12 1.12.8-r8 —
Wolfi rolling jitsucom-bulker-bulker +4 2.11.913-r29 —
Wolfi rolling juicefs-csi-driver 0.31.4-r2 —
Wolfi rolling k3d +1 5.8.3-r31 —
Wolfi rolling k8sgpt-operator 0.2.27-r5 —
Wolfi rolling k8ssandra-client 0.8.11-r5 —
Wolfi rolling k8ssandra-operator 1.32.1-r1 —
Wolfi rolling kaf 0.2.14-r5 —
Wolfi rolling kafka-proxy 0.4.3-r16 —
Wolfi rolling kargo 1.10.5-r0 —
Wolfi rolling katib-controller +1 0.19.0-r17 —
Wolfi rolling keda-2.19 +2 2.19.0-r11 —
Wolfi rolling kine 0.14.16-r1 —
Wolfi rolling knative-client 1.22.0-r3 —
Wolfi rolling knative-eventing-1.21-filter +7 1.21.2-r1 —
Wolfi rolling knative-operator-1.21 +7 1.21.2-r3 —
Wolfi rolling ko 0.18.1-r17 —
Wolfi rolling kots 1.130.0-r4 —
Wolfi rolling kpt 1.0.0_beta55-r24 —
Wolfi rolling kratos 2.9.2-r5 —
Wolfi rolling kserve-modelmesh-serving 0.12.0-r31 —
Wolfi rolling kserve-rest-proxy 0.12.0-r22 —
Wolfi rolling kube-arangodb-1.4 1.4.1-r14 —
Wolfi rolling kube-fluentd-operator 1.18.2-r65 —
Wolfi rolling kube-state-metrics 2.19.0-r2 —
Wolfi rolling kube-vip 1.2.0-r0 —
Wolfi rolling kubeadm-1.34 +7 1.34.7-r0 —
Wolfi rolling kubeadm-1.35 +7 1.35.4-r0 —
Wolfi rolling kubectl-1.32 1.32.13-r1 —
Wolfi rolling kubeflow-profile-controller 1.10.0-r24 —
Wolfi rolling kubernetes-csi-driver-nfs 4.13.2-r6 —
Wolfi rolling kubernetes-csi-external-attacher 4.11.0-r9 —
Wolfi rolling kubernetes-csi-external-health-monitor 0.18.0-r0 —
Wolfi rolling kubernetes-csi-external-resizer 2.1.0-r8 —
Wolfi rolling kubernetes-csi-livenessprobe 2.18.0-r5 —
Wolfi rolling kubernetes-csi-node-driver-registrar-2.16 2.16.0-r11 —
Wolfi rolling kubernetes-dashboard 7.14.0-r5 —
Wolfi rolling kubernetes-dashboard-api 1.14.0-r6 —
Wolfi rolling kubernetes-dashboard-auth 1.4.0-r12 —
Wolfi rolling kubernetes-dashboard-web 1.7.0-r23 —
Wolfi rolling kubernetes-event-exporter 1.7-r56 —
Wolfi rolling kubescape 4.0.3-r3 —
Wolfi rolling kubescape-operator 0.2.139-r0 —
Wolfi rolling kwok +1 0.7.0-r24 —
Wolfi rolling kyverno-1.17 +7 1.17.1-r15 —
Wolfi rolling kyverno-notation-aws 1.1-r56 —
Wolfi rolling kyverno-policy-reporter-kyverno-plugin 1.6.4-r28 —
Wolfi rolling kyverno-policy-reporter-ui 2.5.1-r9 —
Wolfi rolling lazydocker 0.25.2-r3 —
Wolfi rolling libnvidia-container 1.19.0-r0 —
Wolfi rolling linkerd2-cli +4 26.4.3-r0 —
Wolfi rolling litestream 0.5.11-r6 —
Wolfi rolling lvm-driver 1.8.1-r9 —
Wolfi rolling mattermost-11.1 11.1.3-r3 —
Wolfi rolling mattermost-11.5 11.5.1-r6 —
Wolfi rolling mc 0.20250813.083541-r14 —
Wolfi rolling mcp-grafana 0.11.6-r0 —
Wolfi rolling memcached-exporter 0.16.0-r1 —
Wolfi rolling mesosphere-vsphere-csi-driver +1 3.5.0-r15 —
Wolfi rolling metallb-speaker 0.15.3-r10 —
Wolfi rolling migrate 4.19.1-r16 —
Wolfi rolling minio-object-browser 2.0.4-r11 —
Wolfi rolling minio-operator 7.1.1-r22 —
Wolfi rolling mps-control-daemon +1 0.19.0-r3 —
Wolfi rolling nerdctl 2.3.1-r3 —
Wolfi rolling net-kourier-1.21 1.21.0-r6 —
Wolfi rolling neuvector-scanner +1 4.179-r0 —
Wolfi rolling newrelic-fluent-bit-output 3.4.1-r3 —
Wolfi rolling newrelic-infrastructure-agent 1.76.1-r0 —
Wolfi rolling nginx-prometheus-exporter 1.5.1-r8 —
Wolfi rolling node-problem-detector-1.35 1.35.2-r10 —
Wolfi rolling nuclei 3.8.0-r9 —
Wolfi rolling nvidia-container-toolkit-nvidia-ctk-installer 1.19.0-r3 —
Wolfi rolling nvidia-device-plugin 0.19.2-r0 —
Wolfi rolling oauth2-proxy 7.15.2-r0 —
Wolfi rolling opa-envoy 1.15.2-r2 —
Wolfi rolling openbao 2.5.2-r3 —
Wolfi rolling opencost 1.120.0-r0 —
Wolfi rolling opentelemetry-operator +1 0.148.0-r3 —
Wolfi rolling opentofu-1.9 1.9.4-r13 —
Wolfi rolling osv-scanner 2.3.5-r1 —
Wolfi rolling otel-cli 0.4.5-r23 —
Wolfi rolling percona-server-mongodb-operator 1.22.0-r13 —
Wolfi rolling polaris 10.1.7-r2 —
Wolfi rolling policy-controller +1 0.15.1-r4 —
Wolfi rolling prometheus-3.10 3.10.0-r5 —
Wolfi rolling prometheus-3.8 3.8.1-r4 —
Wolfi rolling prometheus-3.9 3.9.1-r6 —
Wolfi rolling prometheus-adapter 0.12.0-r25 —
Wolfi rolling prometheus-operator +2 0.90.1-r3 —
Wolfi rolling prometheus-pushgateway 1.11.3-r0 —
Wolfi rolling promxy 0.0.93-r18 —
Wolfi rolling pulumi 3.229.0-r4 —
Wolfi rolling pulumi-language-java 1.22.0-r4 —
Wolfi rolling pulumi-language-yaml 1.35.0-r2 —
Wolfi rolling rabbitmq-messaging-topology-operator 1.19.2-r3 —
Wolfi rolling rancher-2.13 2.13.4-r4 —
Wolfi rolling rancher-agent-2.13 2.13.4-r3 —
Wolfi rolling rancher-fleet-cli +2 0.15.2-r1 —
Wolfi rolling rancher-helm-3 3.20.0-r13 —
Wolfi rolling rancher-machine 0.15.0.142-r3 —
Wolfi rolling rclone 1.74.2-r1 —
Wolfi rolling redka 1.0.1-r1 —
Wolfi rolling rook 1.19.4-r0 —
Wolfi rolling rpk-26.1.2 26.1.2-r1 —
Wolfi rolling runc 1.4.2-r4 —
Wolfi rolling scorecard 5.4.0-r16 —
Wolfi rolling seaweedfs 4.20-r0 —
Wolfi rolling secrets-store-csi-driver 1.6.0-r2 —
Wolfi rolling secrets-store-csi-driver-provider-aws 3.1.0-r2 —
Wolfi rolling secrets-store-csi-driver-provider-azure 1.7.2-r13 —
Wolfi rolling sftpgo 2.7.1-r7 —
Wolfi rolling sftpgo-plugin-auth 1.0.15-r0 —
Wolfi rolling sftpgo-plugin-eventsearch 1.0.22-r6 —
Wolfi rolling sftpgo-plugin-eventstore 1.0.23-r3 —
Wolfi rolling sftpgo-plugin-geoipfilter 1.0.13-r0 —
Wolfi rolling sftpgo-plugin-pubsub 1.0.17-r0 —
Wolfi rolling sigstore-scaffolding-trillian-createtree +2 0.7.31-r11 —
Wolfi rolling slsa-verifier 2.7.1-r17 —
Wolfi rolling smarter-device-manager 1.20.11-r32 —
Wolfi rolling snyk-cli 1.1304.0-r0 —
Wolfi rolling spegel 0.7.1-r2 —
Wolfi rolling spicedb-operator 1.23.0-r4 —
Wolfi rolling spiffe-helper 0.11.0-r19 —
Wolfi rolling spire-agent +2 1.14.5-r0 —
Wolfi rolling spire-controller-manager 0.6.4-r6 —
Wolfi rolling splunk-otel-collector +1 0.149.0-r1 —
Wolfi rolling spqr 2.9.9-r1 —
Wolfi rolling sriov-network-device-plugin 3.11.0-r12 —
Wolfi rolling step 0.30.2-r10 —
Wolfi rolling step-ca 0.30.2-r9 —
Wolfi rolling step-issuer 0.10.2-r15 —
Wolfi rolling step-kms-plugin 0.17.0-r1 —
Wolfi rolling swagger 0.34.0-r0 —
Wolfi rolling syft 1.42.4-r2 —
Wolfi rolling tailscale 1.96.4-r1 —
Wolfi rolling task 3.50.0-r0 —
Wolfi rolling temporal 1.6.2-r3 —
Wolfi rolling temporal-ui-server 2.50.0-r1 —
Wolfi rolling terraform 1.5.7-r46 —
Wolfi rolling terraform-docs 0.24.0-r2 —
Wolfi rolling terraform-provider-aws 6.47.0-r0 —
Wolfi rolling terraform-provider-azapi 2.10.0-r2 —
Wolfi rolling terraform-provider-azuread 3.8.0-r10 —
Wolfi rolling terraform-provider-kubernetes 3.1.0-r0 —
Wolfi rolling terraform-provider-pagerduty 3.32.4-r2 —
Wolfi rolling terraform-provider-random 3.9.0-r1 —
Wolfi rolling terraform-provider-sendgrid 1.0.1-r19 —
Wolfi rolling terraform-provider-time 0.14.0-r1 —
Wolfi rolling terraform-provider-tls 4.3.0-r2 —
Wolfi rolling tetra +2 1.6.0-r7 —
Wolfi rolling timestamp-authority-server 2.1.0-r1 —
Wolfi rolling timoni 0.26.0-r12 —
Wolfi rolling tkn 0.44.1-r2 —
Wolfi rolling tofu-controller +1 0.16.2-r0 —
Wolfi rolling trillian-logserver +1 1.7.3-r7 —
Wolfi rolling trivy 0.70.0-r3 —
Wolfi rolling trivy-operator 0.30.1-r5 —
Wolfi rolling tw +3 0.0.49-r0 —
Wolfi rolling vault-benchmark 0.4.0-r18 —
Wolfi rolling vault-env 1.22.1-r9 —
Wolfi rolling vault-secrets-webhook 1.22.2-r14 —
Wolfi rolling velero-plugin-for-aws-compat 1.14.0-r4 —
Wolfi rolling velero-plugin-for-csi-compat 0.7.1-r50 —
Wolfi rolling verticadb-operator 25.4.0.0-r12 —
Wolfi rolling vexctl 0.4.1-r22 —
Wolfi rolling volume-modifier-for-k8s 0.9.5-r0 —
Wolfi rolling wal-g-pg 3.0.8-r16 —
Wolfi rolling wave 0.11.0-r11 —
Wolfi rolling weaviate 1.37.7-r0 —
Wolfi rolling witness 0.11.0-r6 —
Wolfi rolling x509-certificate-exporter 3.20.1-r2 —
Wolfi rolling xeol 0.10.8-r43 —
Wolfi rolling yunikorn-k8shim 1.8.0-r17 —
Wolfi rolling zot 2.1.15-r12 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go stdlib < 1.25.9 · >= 1.26.0-0, < 1.26.2 1.25.9, 1.26.2 GO-2026-4865

Advisories 41

References