quay.io/argoproj/argocd:v3.4.4

golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

gRPC-Go has an authorization bypass via missing leading slash in :path

golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses

golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys

SpdyStream: DOS on CRI

golang.org/x/crypto vulnerable to infinite loop on large channel writes

Helm's Missing YAML Content Leads To Panic

golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed

golang.org/x/crypto doesn't enforce invoking key constraints

Helm Vulnerable to denial of service through string value parsing

Helm passes repository credentials to alternate domain

Helm vulnerable to Code Injection through malicious chart.yaml content

golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic

golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS

oras-go has file store write outside workingDir via symlink traversal

go-billy has path traversal vulnerabilities

oras-go blob upload vulnerable to credential forwarding via unvalidated Location header

`oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution

Helm dependency management path traversal

go-git: Worktree operations may follow symlinks

Memory exhaustion in query parameter parsing in net/url

Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow

Helm vulnerable to denial of service through through repository index file

Helm vulnerable to denial of service through schema file

Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination

Helm vulnerable to denial of service through string value parsing

containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull

go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

go-git: Malicious reference names may modify files outside the reference storage

golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions

Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion

Helm May Panic Due To Incorrect YAML Content

Go Net HTML parser is vulnerable to denial of service

containerd image-triggered runtime DoS via unbounded group parsing

golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption

containerd user ID handling bypass allows runAsNonRoot evasion

golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS

golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read

golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

golang.org/x/crypto: Invoking pathological inputs can lead to client panic

slack-go `SecretsVerifier` accepts empty signing secret without precondition

go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git

Crash when handling long CNAME response in net

Quadratic string concatenation in consumePhrase in net/mail

Quadratic string concatentation in consumeComment in net/mail

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Request smuggling due to acceptance of invalid chunked data in net/http

Information disclosure in helm.sh/helm/v3

Unexpected session resumption in crypto/tls

go-git: Crafted repositories may modify main and submodule .git directories

Incorrect parsing of IPv6 host literals in net/url

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Excessive CPU consumption when building archive index in archive/zip

Potential denial of service in golang.org/x/crypto/ssh/agent

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

Quadratic complexity when parsing some invalid inputs in encoding/pem

Unexpected work during chain building in crypto/x509

Incorrect enforcement of email constraints in crypto/x509

Sensitive headers not cleared on cross-origin redirect in net/http

Excessive CPU consumption in ParseAddress in net/mail

Inefficient candidate hostname parsing in crypto/x509

Panic in Dial and LookupPort when handling NUL byte on Windows in net

Enforce maximum recursion depth in encoding/asn1

Add recursion depth guard during decode in encoding/xml

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

Limit handshake messages we are willing to accept post-handshake in crypto/tls

Quadratic complexity in WordDecoder.DecodeHeader in mime

Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes

Lack of limit when parsing cookies can cause memory exhaustion in net/http

Unexpected paths returned from LookPath in os/exec

Parsing DER payload can cause memory exhaustion in encoding/asn1

Excessive CPU consumption in Reader.ReadResponse in net/textproto

Avoid quadratic complexity in resolvePath in net/url

ORAS Go forwards registry credentials across registry redirects

Quadratic parsing complexity in golang.org/x/net/html

Infinite parsing loop in golang.org/x/net

Infinite loop on invalid input in golang.org/x/text

Excessive resource consumption when printing error string for host certificate validation in crypto/x509

ALPN negotiation error contains attacker controlled information in crypto/tls

Insufficient validation of bracketed IPv6 hostnames in net/url

go-git: Malformed Git object data may cause panics or resource exhaustion

go-git: Credential leak via cross-host redirect in smart HTTP transport

Unbounded allocation when parsing GNU sparse map in archive/tar

HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil

Invoking Encrypted Client Hello privacy leak in crypto/tls

Quadratic complexity when checking name constraints in crypto/x509

Escaper bypass leads to XSS in html/template

Arbitrary inputs are included in errors without any escaping in net/textproto

Panic when validating certificates with DSA public keys in crypto/x509

Incorrect results returned from Rows.Scan in database/sql

Inefficient policy validation in crypto/x509

Panic in name constraint checking for malformed certificates in crypto/x509

containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd

Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

Usage of ExtKeyUsageAny disables policy validation in crypto/x509

Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

URLs in meta content attribute actions are not escaped in html/template

Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes

Bypass of meta content URL escaping causes XSS in html/template

Fix Javascript regexp context tracking in html/template

containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd

TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

JsBraceDepth Context Tracking Bugs (XSS) in html/template

Unbounded allocation for old GNU sparse in archive/tar

go-git: Maliciously crafted idx file can cause asymmetric memory consumption

Handshake messages may be processed at the incorrect encryption level in crypto/tls

Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509

Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall

Improper access to parent directory of root in os

Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html

Root escape via symlink plus trailing slash in os

Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

FileInfo can escape from a Root in os

Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd

go-git improperly verifies data integrity values for .idx and .pack files

Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows

SecretsVerifier accepts empty signing secret without precondition in github.com/slack-go/slack

Go-git: Malformed Git object data may cause panics or resource exhaustion in github.com/go-git/go-git

OOB read in github.com/klauspost/compress/s2

ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go

The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues

Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc

perl vulnerabilities

go-git: Improper single-quote escaping in go-git SSH transport

go-git missing validation decoding Index v4 files leads to panic

oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens