Threats affecting pkg:generic/kimageformats

The security issue identified as GO-2026-5932 affects multiple packages including loki and yunikorn-k8shim. The vulnerability has been addressed in specific later releases of these packages. No detailed impact or exploitation information is provided.

CVE-2026-78661 is a high-severity vulnerability in the Loki software affecting multiple versions prior to their respective fixed releases. The flaw involves the handling of adjacent text nodes during operations like addText and fosterParent, where appending to an existing TextNode's Data via string concatenation can lead to a security issue. The vulnerability has been addressed in versions 3.5.12-r9, 1.8.0-r3, 1.9.0-r1, 1.11.1-r6, and 1.9.1-r7.

CVE-2026-97045 is a medium severity vulnerability affecting multiple versions of the Loki software. The issue occurs in the childTextNodesAreLiteral function, where tree traversal previously stopped incorrectly at the nearest foreign ancestor upon encountering an HTML integration point. This flaw has been addressed in fixed versions 3.5.12-r9, 1.8.0-r3, 1.9.0-r1, 1.11.1-r6, and 1.9.1-r7.

A high-severity security vulnerability (CVE-2026-32952) affects the yunikorn-k8shim package versions prior to 1.8.0-r4. The issue involves the go-ntlmssp Go package, which provides NTLM/Negotiate authentication over HTTP. The vulnerability has no impact on confidentiality or integrity but causes a denial of service (availability impact). A fix is available in version 1.8.0-r4.

A high-severity security vulnerability affects the yunikorn-k8shim package prior to version 1.8.0-r4. The issue has been resolved in version 1.8.0-r4. The vulnerability has a CVSS 4.0 base score of 8.8, indicating a network attack vector with no required privileges or user interaction, and high impact on integrity and availability.

A critical security vulnerability (CVE-2026-33186) affects the yunikorn-k8shim package, specifically related to the gRPC-Go implementation. Versions prior to 1.8.0-r4 are vulnerable. The flaw has a high impact on confidentiality and integrity but does not affect availability. A patch is available in version 1.8.0-r4.

A security vulnerability affecting the yunikorn-k8shim package has been identified and resolved in version 1.8.0-r5. The vulnerability has a CVSS 4.0 base score of 6.3, indicating a medium severity issue. The flaw allows network-based exploitation without user interaction but requires partial attack complexity and privileges. No known exploits are reported in the wild.

A security vulnerability identified as CVE-2026-84303 affects the yunikorn-k8shim package, specifically related to the gRPC-Go implementation. The issue impacts versions prior to 1.8.0-r4. The vulnerability has a medium severity rating with a CVSS score of 6.3. A fix is available in version 1.8.0-r4.

A high-severity security vulnerability (CVE-2026-84445) affects the yunikorn-k8shim package, specifically versions prior to 1.8.0-r4. The issue relates to the gRPC-Go implementation used within this package. A fix is available in version 1.8.0-r4.

A high-severity security vulnerability (CVE-2026-84304) affects the yunikorn-k8shim package, specifically versions prior to 1.8.0-r4. The issue involves the gRPC-Go implementation, which is the Go language version of gRPC. A fix is available in version 1.8.0-r4.

A security vulnerability in the yunikorn-k8shim package allows the Nickname profile to panic due to an out-of-bounds slice error when processing crafted input into a short destination buffer. This can cause a denial of service by crashing the affected component. The issue affects versions prior to 1.9.0-r1 and has been assigned CVE-2026-56851 with a high severity rating.

A concurrency issue in the yunikorn-k8shim package's HTTP/2 server implementation can cause crashes by inadvertently modifying the HPACK encoder concurrently. This vulnerability affects versions prior to 1.9.0-r1 and has been fixed in version 1.9.0-r1.

A security vulnerability in the yunikorn-k8shim package affects HTTP/1 servers where exceeding MaxBytesReader's limit causes the "Connection: close" header to be set automatically without synchronization. This can race with another header set explicitly in the server handler, potentially leading to inconsistent header states.

A critical security vulnerability in the yunikorn-k8shim package's HTTP/2 server allows connection-level flow control to be refunded twice for the same data. This occurs once when a client resets a stream and again when the request handler reads buffered data. This flaw affects versions prior to 1.9.0-r1 and has been fixed in version 1.9.0-r1.

A vulnerability in the yunikorn-k8shim package allows a malicious HTTP/2 peer to cause excessive CPU consumption on the client or server. This occurs when the attacker opens many streams and sends numerous small SETTINGS frames with SETTINGS_INITIAL_WINDOW_SIZE values. The issue affects versions prior to 1.9.0-r1 and has a high severity rating.

A security vulnerability in the yunikorn-k8shim package prior to version 1.9.0-r1 involves lax handling of malformed framing-related headers in its HTTP/2 implementation. Although these malformed headers cannot disrupt HTTP/2 framing, they can lead to a high-impact integrity issue. The vulnerability is rated with a CVSS score of 7.5 (high severity).

A security vulnerability in the yunikorn-k8shim package involves the use of system root certificates by Go on most platforms. This issue affects versions prior to 1.8.0-r3 and has been addressed in version 1.8.0-r3.

A security vulnerability in the yunikorn-k8shim package exists where the HTTP server uses client-sent "Trailer" headers to populate the request internally. This flaw affects versions prior to 1.9.0-r1 and can cause denial of service. A fix is available in version 1.9.0-r1.

A high-severity security vulnerability (CVE-2026-116587) affects the loki package, specifically versions prior to 3.5.12-r9. The vulnerability involves the Go JOSE implementation of Javascript Object Signing and Encryption standards, including JSON Web Encryption, Signature, and Token standards. The flaw does not impact confidentiality or integrity but results in a high impact on availability. A patch is available in version 3.5.12-r9.

A security vulnerability exists in the loki package's Go JOSE implementation, which handles Javascript Object Signing and Encryption standards including JWE, JWS, and JWT. Versions prior to 3.5.12-r9 are affected. The vulnerability has a medium severity with a CVSS score of 6.9. A fix is available in version 3.5.12-r9.