Live threat intelligence radar

A security vulnerability exists in the loki package's Go JOSE implementation, which supports Javascript Object Signing and Encryption standards including JWE, JWS, and JWT. Versions prior to 3.5.12-r9 are affected. The vulnerability has a medium severity with a CVSS score of 6.9. A fix is available in version 3.5.12-r9.

A security vulnerability exists in the loki package's Go JOSE implementation, which handles Javascript Object Signing and Encryption standards including JWE, JWS, and JWT. Versions prior to 3.5.12-r9 are affected. The vulnerability has a medium severity with a CVSS score of 6.9. A fix is available in version 3.5.12-r9.

A high-severity security vulnerability (CVE-2026-116587) affects the loki package, specifically versions prior to 3.5.12-r9. The vulnerability involves the Go JOSE implementation of Javascript Object Signing and Encryption standards, including JSON Web Encryption, Signature, and Token standards. The flaw does not impact confidentiality or integrity but results in a high impact on availability. A patch is available in version 3.5.12-r9.

A security vulnerability in the yunikorn-k8shim package allows the Nickname profile to panic due to an out-of-bounds slice error when processing crafted input into a short destination buffer. This can cause a denial of service by crashing the affected component. The issue affects versions prior to 1.9.0-r1 and has been assigned CVE-2026-56851 with a high severity rating.

A security vulnerability in the yunikorn-k8shim package affects HTTP/1 servers where exceeding MaxBytesReader's limit causes the "Connection: close" header to be set automatically without synchronization. This can race with another header set explicitly in the server handler, potentially leading to inconsistent header states.

A high-severity security vulnerability (CVE-2026-32952) affects the yunikorn-k8shim package versions prior to 1.8.0-r4. The issue involves the go-ntlmssp Go package, which provides NTLM/Negotiate authentication over HTTP. The vulnerability has no impact on confidentiality or integrity but causes a denial of service (availability impact). A fix is available in version 1.8.0-r4.

A security vulnerability affecting the yunikorn-k8shim package has been identified and resolved in version 1.8.0-r5. The vulnerability has a CVSS 4.0 base score of 6.3, indicating a medium severity issue. The flaw allows network-based exploitation without user interaction but requires partial attack complexity and privileges. No known exploits are reported in the wild.

A critical security vulnerability (CVE-2026-33186) affects the yunikorn-k8shim package, specifically related to the gRPC-Go implementation. Versions prior to 1.8.0-r4 are vulnerable. The flaw has a high impact on confidentiality and integrity but does not affect availability. A patch is available in version 1.8.0-r4.

The security issue identified as GO-2026-5932 affects multiple packages including loki and yunikorn-k8shim. The vulnerability has been addressed in specific later releases of these packages. No detailed impact or exploitation information is provided.

CVE-2026-97045 is a medium severity vulnerability affecting multiple versions of the Loki software. The issue occurs in the childTextNodesAreLiteral function, where tree traversal previously stopped incorrectly at the nearest foreign ancestor upon encountering an HTML integration point. This flaw has been addressed in fixed versions 3.5.12-r9, 1.8.0-r3, 1.9.0-r1, 1.11.1-r6, and 1.9.1-r7.