A high-severity vulnerability in the argo-workflows package involves the brace-expansion library, which generates arbitrary strings containing a common prefix and suffix. This flaw affects versions prior to 4.0.15-r2 and 4.1.6-r1. The vulnerability does not impact confidentiality or integrity but causes a denial of service (availability impact). A fix is available in versions 4.0.15-r2 and 4.1.6-r1.
A security vulnerability in the argo-workflows package involves the brace-expansion library, which generates arbitrary strings containing a common prefix and suffix. This flaw can cause an availability impact but does not affect confidentiality or integrity. The issue is fixed in versions 4.0.15-r2 and 4.1.6-r1.
A security vulnerability in the argo-workflows package involves the brace-expansion library, which generates arbitrary strings containing a common prefix and suffix. This flaw can cause a denial of service by impacting availability. Versions prior to 4.0.15-r2 and 4.1.6-r1 are affected. A fix is available in these versions.
A medium severity security vulnerability (CVE-2026-86472) affects the argo-workflows package through its fast-uri component, a dependency-free RFC 3986 URI parser for Node.js. Versions prior to 4.1.6-r1 are affected. The vulnerability has a CVSS score of 4.8, indicating limited impact on confidentiality and integrity with no availability impact. A fix is available in version 4.1.6-r1.
A security vulnerability in the argo-workflows package involves the fast-uri component serializing the port part of a URI without proper validation. This flaw could allow an attacker to manipulate the port serialization, potentially leading to integrity issues. The vulnerability affects versions prior to 4.1.6-r1 and has been assigned CVE-2026-84292. A fix is available in version 4.1.6-r1. The issue has a high severity rating with a CVSS score of 7.5.
A high-severity security vulnerability (CVE-2026-76172) affects the argo-workflows package due to an issue in the fast-uri Node.js URI parser. This vulnerability impacts versions prior to 4.1.6-r1. A fix is available in version 4.1.6-r1.
A high-severity security vulnerability (CVE-2026-75975) affects the argo-workflows package due to an issue in the fast-uri Node.js URI parser. The vulnerability impacts versions prior to 4.1.6-r1 and allows for integrity violations without confidentiality or availability impact. A patch is available in version 4.1.6-r1.
CVE-2026-56862 is a high-severity vulnerability in Kubernetes where handshake messages like KeyUpdate are always treated as state-advancing, even if the handshake has not completed. This behavior affects multiple Kubernetes package versions prior to 1.34.13-r2 and 4.1.6-r1. The flaw can cause denial of service by disrupting the expected handshake state management.
CVE-2026-56860 is a vulnerability in Kubernetes involving the resolution of relative paths containing parent directory references. It affects multiple packages and can cause availability impact. The issue has been fixed in versions 1.34.13-r2 and 4.1.6-r1.
CVE-2026-56859 is a high-severity vulnerability in Kubernetes where the DecodeElement function previously reset the depth counter incorrectly, preventing it from firing as intended. This flaw could lead to stack exhaustion, potentially causing denial of service. Fixed versions 1.34.13-r2 and 4.1.6-r1 address this issue.
CVE-2026-56858 is a vulnerability in Kubernetes where certain pathological inputs could prematurely close an unescaped '/' character. This flaw allows an attacker to inject arbitrary content, potentially leading to cross-site scripting (XSS). The issue affects multiple Kubernetes packages and has been addressed in versions 1.34.13-r2 and 4.1.6-r1.
CVE-2026-56853 is a high-severity vulnerability affecting Kubernetes servers configured to support unencrypted HTTP/2. The issue involves the server reading a few bytes from each new connection to detect the HTTP/2 client preface, which can lead to an availability impact. Fixed versions 1.34.13-r2 and 4.1.6-r1 address this vulnerability.
CVE-2026-33818 is a high-severity vulnerability in Kubernetes involving the Unmarshal function. It allows an attacker to cause stack exhaustion by parsing deeply nested, recursive data structures without a recursion limit. This can lead to denial of service due to resource exhaustion. Fixed versions 1.34.13-r2 and 4.1.6-r1 address this issue by enforcing a recursion limit during unmarshalling.
A high-severity security vulnerability (CVE-2026-18446) affects the argo-workflows package due to an issue in the fast-uri component before version 4.1.6-r1. The flaw allows unauthorized modification of data integrity without impacting confidentiality or availability. A fix is available in version 4.1.6-r1.
A high-severity security vulnerability (CVE-2026-16221) affects the argo-workflows package, specifically impacting fast-uri versions from 2. Versions prior to 4.1.6-r1 are vulnerable. The vulnerability allows unauthorized integrity modification without confidentiality or availability impact. A patch is available in version 4.1.6-r1.
A high-severity security vulnerability (CVE-2026-13676) affects the argo-workflows package specifically in fast-uri versions 2. The vulnerability impacts versions of argo-workflows prior to 4.1.6-r1. It has a CVSS 3.1 base score of 7.5, indicating a network exploitable flaw with low attack complexity, no privileges required, no user interaction, and an impact on integrity but not confidentiality or availability. A fix is available in version 4.1.6-r1.
A security vulnerability in the argo-workflows package affects versions prior to 4.1.6-r1. The issue involves the fast-uri normalize() function decoding percent-encoded authority delimiters inside the host component and then re-emitting them as raw delimiters during serialization. This behavior can lead to security concerns related to improper URI handling. A fix is available in version 4.1.6-r1.
A security vulnerability in the argo-workflows package involves the fast-uri library decoding percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. This flaw affects versions prior to 4.1.6-r1 and can lead to improper URI normalization.
A security vulnerability exists in the argo-workflows package due to the use of ajv (Another JSON Schema Validator) versions before 8. This vulnerability affects argo-workflows versions prior to 4.0.15-r2 and 4.1.6-r1. The vulnerability has a low severity score and impacts availability with no confidentiality or integrity impact. Fixed versions are available.
A medium severity security vulnerability (CVE-2025-64718) affects the argo-workflows package due to an issue in the js-yaml JavaScript YAML parser and dumper. The vulnerability impacts versions prior to 4.0.15-r2 and 4.1.6-r1. It allows an attacker to cause integrity loss without confidentiality or availability impact. A patch is available in versions 4.0.15-r2 and 4.1.6-r1.