quay.io/argoproj/argocd:v3.5.2

golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses

golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys

golang.org/x/crypto vulnerable to infinite loop on large channel writes

golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed

golang.org/x/crypto doesn't enforce invoking key constraints

golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic

golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS

`oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution

go-git: Worktree operations may follow symlinks

Memory exhaustion in query parameter parsing in net/url

go-git: Malicious reference names may modify files outside the reference storage

golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions

Go Net HTML parser is vulnerable to denial of service

golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption

golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS

golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read

golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

golang.org/x/crypto: Invoking pathological inputs can lead to client panic

slack-go `SecretsVerifier` accepts empty signing secret without precondition

Crash when handling long CNAME response in net

Quadratic string concatenation in consumePhrase in net/mail

Quadratic string concatentation in consumeComment in net/mail

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Request smuggling due to acceptance of invalid chunked data in net/http

Unexpected session resumption in crypto/tls

Incorrect parsing of IPv6 host literals in net/url

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Excessive CPU consumption when building archive index in archive/zip

Potential denial of service in golang.org/x/crypto/ssh/agent

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

Quadratic complexity when parsing some invalid inputs in encoding/pem

Unexpected work during chain building in crypto/x509

Sensitive headers not cleared on cross-origin redirect in net/http

Excessive CPU consumption in ParseAddress in net/mail

Inefficient candidate hostname parsing in crypto/x509

Panic in Dial and LookupPort when handling NUL byte on Windows in net

Enforce maximum recursion depth in encoding/asn1

Add recursion depth guard during decode in encoding/xml

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

Limit handshake messages we are willing to accept post-handshake in crypto/tls

Quadratic complexity in WordDecoder.DecodeHeader in mime

Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes

Lack of limit when parsing cookies can cause memory exhaustion in net/http

Unexpected paths returned from LookPath in os/exec

Parsing DER payload can cause memory exhaustion in encoding/asn1

Excessive CPU consumption in Reader.ReadResponse in net/textproto

Avoid quadratic complexity in resolvePath in net/url

Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key

Quadratic parsing complexity in golang.org/x/net/html

Infinite parsing loop in golang.org/x/net

Infinite loop on invalid input in golang.org/x/text

Excessive resource consumption when printing error string for host certificate validation in crypto/x509

ALPN negotiation error contains attacker controlled information in crypto/tls

Insufficient validation of bracketed IPv6 hostnames in net/url

Unbounded allocation when parsing GNU sparse map in archive/tar

HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil

Invoking Encrypted Client Hello privacy leak in crypto/tls

Quadratic complexity when checking name constraints in crypto/x509

Escaper bypass leads to XSS in html/template

Arbitrary inputs are included in errors without any escaping in net/textproto

Panic when validating certificates with DSA public keys in crypto/x509

Incorrect results returned from Rows.Scan in database/sql

Inefficient policy validation in crypto/x509

Usage of ExtKeyUsageAny disables policy validation in crypto/x509

Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion in helm.sh/helm

Helm May Panic Due To Incorrect YAML Content in helm.sh/helm

URLs in meta content attribute actions are not escaped in html/template

Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes

Bypass of meta content URL escaping causes XSS in html/template

Fix Javascript regexp context tracking in html/template

TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

JsBraceDepth Context Tracking Bugs (XSS) in html/template

Unbounded allocation for old GNU sparse in archive/tar

Handshake messages may be processed at the incorrect encryption level in crypto/tls

Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509

Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall

Improper access to parent directory of root in os

Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html

Root escape via symlink plus trailing slash in os

Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

FileInfo can escape from a Root in os

Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows

SecretsVerifier accepts empty signing secret without precondition in github.com/slack-go/slack

OOB read in github.com/klauspost/compress/s2

The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues

Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc

Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key in github.com/gorilla/websocket

pam vulnerability