quay.io/prometheus-operator/prometheus-config-reloader:v0.90.1

golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses

golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys

golang.org/x/crypto vulnerable to infinite loop on large channel writes

Prometheus: Remote read endpoint allows denial of service via crafted snappy payload

golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed

golang.org/x/crypto doesn't enforce invoking key constraints

golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic

golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS

Prometheus Azure AD remote write OAuth client secret exposed via config API

golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions

Go Net HTML parser is vulnerable to denial of service

golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS

golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow

golang.org/x/crypto: Invoking pathological inputs can lead to client panic

Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer

Crash when handling long CNAME response in net

Quadratic string concatenation in consumePhrase in net/mail

Quadratic string concatentation in consumeComment in net/mail

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

Unexpected work during chain building in crypto/x509

Inefficient candidate hostname parsing in crypto/x509

Panic in Dial and LookupPort when handling NUL byte on Windows in net

Enforce maximum recursion depth in encoding/asn1

Add recursion depth guard during decode in encoding/xml

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

Limit handshake messages we are willing to accept post-handshake in crypto/tls

Quadratic complexity in WordDecoder.DecodeHeader in mime

Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Avoid quadratic complexity in resolvePath in net/url

Infinite loop on invalid input in golang.org/x/text

ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil

Invoking Encrypted Client Hello privacy leak in crypto/tls

Escaper bypass leads to XSS in html/template

Arbitrary inputs are included in errors without any escaping in net/textproto

Inefficient policy validation in crypto/x509

Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

Bypass of meta content URL escaping causes XSS in html/template

Fix Javascript regexp context tracking in html/template

TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

JsBraceDepth Context Tracking Bugs (XSS) in html/template

Unbounded allocation for old GNU sparse in archive/tar

Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html

Root escape via symlink plus trailing slash in os

Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows

The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues