ghcr.io/dexidp/dex:v2.45.1

golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

Authentication Bypass in dex

Critical security issues in XML encoding in github.com/dexidp/dex

gRPC-Go has an authorization bypass via missing leading slash in :path

Dex vulnerable to Man-in-the-Middle allowing ID token capture via intercepted authorization code

golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses

golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys

golang.org/x/crypto vulnerable to infinite loop on large channel writes

golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed

golang.org/x/crypto doesn't enforce invoking key constraints

OpenTelemetry-Go: multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

Go JOSE Panics in JWE decryption

golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic

golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS

go-billy has path traversal vulnerabilities

go-ntlmssp NTLM challenges can panic on malformed payloads

go-git: Worktree operations may follow symlinks

validateSignature Loop Variable Capture Signature Bypass in goxmldsig

go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

go-git: Malicious reference names may modify files outside the reference storage

opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking

CIRCL has an incorrect calculation in secp384r1 CombinedMult

golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions

Go Net HTML parser is vulnerable to denial of service

golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS

golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

golang.org/x/crypto: Invoking pathological inputs can lead to client panic

go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git

OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking

Crash when handling long CNAME response in net

Quadratic string concatenation in consumePhrase in net/mail

Quadratic string concatentation in consumeComment in net/mail

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Unexpected session resumption in crypto/tls

go-git: Crafted repositories may modify main and submodule .git directories

Incorrect parsing of IPv6 host literals in net/url

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

Unexpected work during chain building in crypto/x509

Incorrect enforcement of email constraints in crypto/x509

Inefficient candidate hostname parsing in crypto/x509

Panic in Dial and LookupPort when handling NUL byte on Windows in net

Enforce maximum recursion depth in encoding/asn1

Add recursion depth guard during decode in encoding/xml

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

Limit handshake messages we are willing to accept post-handshake in crypto/tls

Quadratic complexity in WordDecoder.DecodeHeader in mime

Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Avoid quadratic complexity in resolvePath in net/url

Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net

Infinite loop on invalid input in golang.org/x/text

Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers in github.com/dexidp/dex

go-git: Malformed Git object data may cause panics or resource exhaustion

go-git: Credential leak via cross-host redirect in smart HTTP transport

Unbounded TLS handshake goroutines in go.etcd.io/etcd/client/pkg/v3

ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil

Invoking Encrypted Client Hello privacy leak in crypto/tls

Escaper bypass leads to XSS in html/template

Arbitrary inputs are included in errors without any escaping in net/textproto

Inefficient policy validation in crypto/x509

Panic in name constraint checking for malformed certificates in crypto/x509

CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

URLs in meta content attribute actions are not escaped in html/template

Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder

Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder

Bypass of meta content URL escaping causes XSS in html/template

Fix Javascript regexp context tracking in html/template

Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

JsBraceDepth Context Tracking Bugs (XSS) in html/template

Unbounded allocation for old GNU sparse in archive/tar

go-git: Maliciously crafted idx file can cause asymmetric memory consumption

Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html

Root escape via symlink plus trailing slash in os

In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go

Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

FileInfo can escape from a Root in os

go-git improperly verifies data integrity values for .idx and .pack files

Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows

Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

Go-git: Malformed Git object data may cause panics or resource exhaustion in github.com/go-git/go-git

DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream

DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream

The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues

Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc

go-git: Improper single-quote escaping in go-git SSH transport

go-git missing validation decoding Index v4 files leads to panic