ghcr.io/dexidp/dex:v2.45.1

golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

Authentication Bypass in dex

Critical security issues in XML encoding in github.com/dexidp/dex

gRPC-Go has an authorization bypass via missing leading slash in :path

Dex vulnerable to Man-in-the-Middle allowing ID token capture via intercepted authorization code

golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses

golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys

golang.org/x/crypto vulnerable to infinite loop on large channel writes

golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed

golang.org/x/crypto doesn't enforce invoking key constraints

OpenTelemetry-Go: multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

Go JOSE Panics in JWE decryption

golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic

golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS

go-billy has path traversal vulnerabilities

go-ntlmssp NTLM challenges can panic on malformed payloads

go-git: Worktree operations may follow symlinks

validateSignature Loop Variable Capture Signature Bypass in goxmldsig

go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

go-git: Malicious reference names may modify files outside the reference storage

opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking

CIRCL has an incorrect calculation in secp384r1 CombinedMult

golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions

Go Net HTML parser is vulnerable to denial of service

golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS

golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

golang.org/x/crypto: Invoking pathological inputs can lead to client panic

go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git

OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking

Crash when handling long CNAME response in net

Quadratic string concatenation in consumePhrase in net/mail

Quadratic string concatentation in consumeComment in net/mail

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Unexpected session resumption in crypto/tls

go-git: Crafted repositories may modify main and submodule .git directories

Incorrect parsing of IPv6 host literals in net/url

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna