A security vulnerability in the argo-workflows package exists where the function NewNTUnicodeString does not properly check for string length overflow. This flaw could lead to an integrity impact but does not affect confidentiality or availability. The issue is fixed in version 4.1.6-r1.
A vulnerability in argo-workflows prior to version 4.1.6-r1 allows a TLS connection to deadlock if one side sends multiple key update messages post-handshake in a single record. This deadlock causes uncontrolled resource consumption, potentially leading to denial of service.
A security vulnerability in argo-workflows prior to version 4.1.6-r1 causes improper limitation of work during chain building when many intermediate certificates are passed in VerifyOptions. This can lead to a denial of service due to excessive resource consumption.
CVE-2026-39821 is a critical vulnerability in Kubernetes affecting the ToASCII and ToUnicode functions. These functions incorrectly accept Punycode-encoded labels that decode to ASCII-only labels, potentially leading to security issues. The flaw affects Kubernetes versions prior to 1.34.13-r2 and 4.1.6-r1. A fix is available in these versions. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality and integrity without requiring user interaction.
A security vulnerability in argo-workflows affects versions prior to 4.1.6-r1. The issue involves inefficient validation of certificate chains that use policies when the certificates contain a very large number of policy mappings. This inefficiency can lead to a denial of service condition. The vulnerability has a high severity rating with a CVSS score of 7.5 and is addressed in version 4.1.6-r1.
A security vulnerability in the argo-workflows package causes the Dial and LookupPort functions to panic on Windows when given input containing a NUL (0) character. This issue affects versions prior to 4.1.6-r1 and can lead to denial of service due to application crashes.
A security vulnerability in the argo-workflows package involves functions in the net/textproto package that include their input as part of error messages. This behavior can lead to unintended information disclosure. The issue affects versions prior to 4.1.6-r1 and has a medium severity rating with a CVSS score of 5.3. A patch is available in version 4.1.6-r1.
A security vulnerability in argo-workflows prior to version 4.1.6-r1 allows a denial of service (DoS) condition. The issue arises from pathological inputs causing excessive resource consumption in the consumePhrase function when parsing email addresses according to RFC 5322. This vulnerability has a high severity rating with a CVSS score of 7.5.
A vulnerability in argo-workflows allows excessive CPU consumption when decoding a maliciously-crafted MIME header containing many invalid encoded-words. This can lead to denial of service conditions due to resource exhaustion. The issue affects versions prior to 4.1.6-r1 and has been assigned CVE-2026-42504 with a high severity rating.
A security vulnerability in the argo-workflows package allows well-crafted inputs to the functions ParseAddress, ParseAddressList, and ParseDate to cause excessive CPU exhaustion and memory allocations, leading to denial of service. This issue affects versions prior to 4.1.6-r1 and has been assigned CVE-2026-39820 with a high severity rating.
A security vulnerability identified as CVE-2026-27145 affects the argo-workflows package, specifically versions prior to 4.1.6-r1. The vulnerability involves the (*x509 component. It has a CVSS 3.1 score of 6.5, indicating a medium severity level. The flaw does not impact confidentiality but can cause integrity loss and high availability impact. A fix is available in version 4.1.6-r1.
A security vulnerability was identified in the keda package affecting versions prior to 2.19.0-r4. The issue has been resolved in version 2.19.0-r4. No specific details about the nature or impact of the vulnerability are provided.
A high-severity security vulnerability (CVE-2026-73500) affects the keda package, specifically versions prior to 2.19.0-r4. The vulnerability involves etcd, a distributed key-value store used in distributed systems. A fix is available in version 2.19.0-r4.
A high-severity security vulnerability (CVE-2026-63209) affects the keda package's compress module, which provides various compression algorithms. The vulnerability impacts versions prior to 2.19.0-r4 and can cause a denial of service (availability impact) without affecting confidentiality or integrity. A patch is available in version 2.19.0-r4.
A high-severity security vulnerability (CVE-2026-79921) affects the keda package, specifically the amqp091-go component, which is a Go implementation of AMQP 0. The vulnerability impacts versions prior to 2.19.0-r4. A fix is available in version 2.19.0-r4.
CVE-2026-107386 is a medium severity vulnerability affecting the amqp091-go package used by Minio. It impacts versions prior to 0.20250907.161309-r9 and 2.19.0-r4. The vulnerability relates to the Go AMQP 0 protocol implementation. A fix is available in versions 0.20250907.161309-r9 and 2.19.0-r4.
CVE-2026-77412 is a high-severity security vulnerability affecting the keda package, specifically involving the RabbitMQ amqp091-go Go AMQP 0 client. The vulnerability impacts versions of keda prior to 2.19.0-r4. A fix is available in version 2.19.0-r4.
A high-severity security vulnerability (CVE-2026-77410) affects the keda package, specifically involving the RabbitMQ amqp091-go Go AMQP 0 client. Versions prior to 2.19.0-r4 are impacted. The vulnerability has a CVSS 4.0 score of 8.9, indicating a significant risk. A fix is available in version 2.19.0-r4.
A high-severity security vulnerability (CVE-2026-77403) affects the keda package, specifically related to the RabbitMQ amqp091-go Go AMQP 0 client. Versions prior to 2.19.0-r4 are affected. The vulnerability has a CVSS 4.0 base score of 8.9, indicating a significant risk. A patch is available in version 2.19.0-r4 to remediate this issue.
A high-severity security vulnerability (CVE-2026-77404) affects the keda package, specifically related to the RabbitMQ amqp091-go Go AMQP 0 client. Versions prior to 2.19.0-r4 are vulnerable. The vulnerability has a CVSS 4.0 base score of 8.7, indicating significant impact. A fix is available in version 2.19.0-r4.