prometheus28.16.0

golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

gRPC-Go has an authorization bypass via missing leading slash in :path

Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker

golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses

golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys

golang.org/x/crypto vulnerable to infinite loop on large channel writes

Prometheus: Remote read endpoint allows denial of service via crafted snappy payload

golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed

github.com/buger/jsonparser has a denial of service vulnerability

golang.org/x/crypto doesn't enforce invoking key constraints

OpenTelemetry-Go: multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic

golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS

Prometheus Azure AD remote write OAuth client secret exposed via config API

Memory exhaustion in query parameter parsing in net/url

Moby has an Off-by-one error in its plugin privilege validation

opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking

golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions

Go Net HTML parser is vulnerable to denial of service

golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption

golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS

golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read

golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

golang.org/x/crypto: Invoking pathological inputs can lead to client panic

mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling

Docker: `PUT /containers/{id}/archive` executes container binary on the host

Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer

OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking

Crash when handling long CNAME response in net

Quadratic string concatenation in consumePhrase in net/mail

Quadratic string concatentation in consumeComment in net/mail

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Unexpected session resumption in crypto/tls

Incorrect parsing of IPv6 host literals in net/url

Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Excessive CPU consumption when building archive index in archive/zip

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

Unexpected work during chain building in crypto/x509

Docker: Race condition in docker cp allows bind mount redirection to host path

Inefficient candidate hostname parsing in crypto/x509

Panic in Dial and LookupPort when handling NUL byte on Windows in net

Enforce maximum recursion depth in encoding/asn1

Add recursion depth guard during decode in encoding/xml

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

Limit handshake messages we are willing to accept post-handshake in crypto/tls

Quadratic complexity in WordDecoder.DecodeHeader in mime

Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Avoid quadratic complexity in resolvePath in net/url

Infinite loop on invalid input in golang.org/x/text

Excessive resource consumption when printing error string for host certificate validation in crypto/x509

opentelemetry-go: OTLP HTTP exporters read unbounded HTTP response bodies

cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag

ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil

Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap

Invoking Encrypted Client Hello privacy leak in crypto/tls

Escaper bypass leads to XSS in html/template

Arbitrary inputs are included in errors without any escaping in net/textproto

Inefficient policy validation in crypto/x509

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

URLs in meta content attribute actions are not escaped in html/template

Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

Bypass of meta content URL escaping causes XSS in html/template

Fix Javascript regexp context tracking in html/template

Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

JsBraceDepth Context Tracking Bugs (XSS) in html/template

Unbounded allocation for old GNU sparse in archive/tar

Handshake messages may be processed at the incorrect encryption level in crypto/tls

Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509

Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html

Root escape via symlink plus trailing slash in os

Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

FileInfo can escape from a Root in os

Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows

Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

OOB read in github.com/klauspost/compress/s2

The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues

Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc

JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go