Kubeflow Pipelines API server contains an authorization bypass vulnerability in the run-log endpoint, allowing unauthorized users who can access the backend and know a run ID to read logs of that run or unrelated pods in the same namespace. This can expose sensitive workload data or credentials. The issue affects versions through 2.17.3 and is fixed in version 2.18.0.
A vulnerability in Fiber v2.52.1 and v2.52.2 CORS middleware allowed wildcard origins to be matched incorrectly without enforcing a dot boundary or scheme check. This caused origins with hosts ending in the base domain, but not actual subdomains (e.g., https://evil-example.com for https://*.example.com), to be reflected in Access-Control-Allow-Origin with credentials allowed. The issue was fixed in v2.52.3 by improving the origin matching logic.
An integer overflow vulnerability exists in the ICO loader of imgproxy before version 4.0.16. The flaw occurs when a 32-bit attacker-controlled data size is added to a constant header length, causing an allocation size wraparound and resulting in a heap overflow. This can lead to denial of service or potentially remote code execution when processing a crafted ICO image.
A heap out-of-bounds write vulnerability exists in imgproxy's ICO loader affecting versions from 3.3.0 up to but not including 4.0.17. The flaw occurs during BMP header reconstruction when processing ICO images with a crafted small data buffer, causing heap corruption and a deterministic worker crash. This results in denial of service by terminating the worker handling the request.
A vulnerability in imgproxy's ICO image loader allows unauthenticated attackers to trigger unbounded memory allocation by crafting a specially formed ICO file. The flaw exists because the ICO loader reads a data size field from the file without validation and uses it directly to allocate memory, potentially causing a ~4GB allocation from a small 23-byte file. This can lead to denial of service via memory exhaustion on affected imgproxy versions prior to 4.0.16.
The anacrolix/torrent library's bencode decoder lacks any limit on the nesting depth of dictionaries and lists, leading to two denial-of-service vulnerabilities. First, deeply nested lists in a .torrent file can cause a stack overflow crash due to unbounded recursion, terminating the process. Second, the BitTorrent v2 file tree parser re-parses subtrees recursively in a quadratic time complexity manner, causing CPU exhaustion and process hang. These issues affect all applications embedding this library that process untrusted torrent metadata, including CLI tools and clients accepting magnet-link/v2 metadata. A fix is available in version 1.61.1-0.20260911233437-76452a2c8a2f.
A race condition in charmbracelet/soft-serve's SetPrivate function causes a private repository to remain readable by unauthenticated users until the server restarts. The issue arises because the repository visibility cache is cleared before the database commit, allowing a stale public record to be cached and used for access checks after the repository is made private. This stale cache persists until eviction or server restart, enabling continued unauthorized read access over HTTP, SSH, and git protocols. The flaw affects versions 0.6.0 through 0.12.2 and is fixed in version 0.12.3.
Soft Serve, a Go-based Git server, improperly discloses the existence, exact names, and clone URLs of private repositories via HTTP responses. This occurs because the server responds to certain requests without verifying if the requester has read access, allowing enumeration of private repository names. Repository contents and metadata remain protected, and no write access is exposed. The issue affects versions from 0.5.0 up to but not including 0.12.3 and is fixed in version 0.12.3.
cert-manager versions prior to 1.19.6 and 1.20.3 allow namespace users with permission to create ACME Challenge resources to bypass Issuer and ClusterIssuer DNS01 solver policies. This occurs because the controller accepts attacker-controlled DNS provider configurations from Challenge.spec.solver without validating ownership or solver restrictions. This can lead to unauthorized use of DNS credentials or credential disclosure, particularly with acme-dns providers.
Daptin versions up to 0.12.15 contain a vulnerability in their global LanguageMiddleware that parses the Accept-Language HTTP header without proper size or character filtering. The underlying Go language parser has quadratic-time complexity on malformed language tags using underscore separators, allowing an unauthenticated attacker to cause significant CPU resource exhaustion with a single crafted request. This can lead to denial of service by consuming excessive server CPU for extended periods.
The knative.dev/pkg admission webhook handler lacks an upper bound on the HTTP request body size, leading to unbounded memory consumption. This causes the controller pod to exhaust memory and be OOM-killed when processing large POST requests. The vulnerability affects all projects using this webhook scaffolding, including Knative serving/eventing, Tekton Pipelines/Triggers, KEDA, Sigstore policy-controller, and Kpack. The peak memory usage can be approximately 4.5 times the request body size due to internal buffering and copying. This issue is confirmed in the main branch and all releases shipping the vulnerable handler code. A fix is available in version 0.0.0-20260531000007-52dbd5ece63f.
A denial of service vulnerability exists in github.com/go-jose/go-jose/v4 where parsing deeply nested JSON structures can cause the Go runtime to hit its stack limit and crash the application. This affects versions prior to 4.1.5 and up to 3.0.5. The issue is fixed in version 4.1.5. Applications parsing untrusted JSON with affected versions are exposed to crashes.
A denial of service vulnerability exists in github.com/go-jose/go-jose/v4 when decrypting ciphertexts using the CBC-HMAC content encryption algorithms A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512. Insufficient validation of parameters can cause a panic due to indexing into an empty buffer on untrusted input. This affects versions prior to 4.1.5 and up to 3.0.5. A fix is available in version 4.1.5.
The Echo web framework versions prior to 5.4.0 and 4.16.0 unconditionally trust certain client-controlled HTTP headers to determine the request scheme. This allows unauthenticated remote attackers to bypass HTTPS redirect enforcement and suppress HSTS headers by sending crafted headers such as X-Forwarded-Proto: https. The vulnerability arises because the framework lacks a mechanism to restrict trust to known proxies, making the default behavior unsafe. This can lead to man-in-the-middle attacks when the application is directly exposed or improperly protected behind a proxy.
Echo v5.2.0 and current master contain a vulnerability allowing bypass of route-level middleware protections for static files via encoded dot-dot traversal sequences. An attacker can access files intended to be protected by middleware by using encoded path segments such as %2E%2E, which are unescaped and normalized to access restricted directories. This bypass works with the default router configuration and a non-default configuration using UseEscapedPathForMatching=true. No patched version is currently known, but fixes are planned in versions 5.4.0 and 4.16.0.
A path traversal vulnerability was found in the Echo web framework's static file middleware due to double-unescaping of URL paths. This flaw allowed attackers to use double-encoded sequences to access files outside the intended directory. The issue was fixed by disabling the redundant unescaping in versions 5.2.0 and 4.15.3 and later.
Echo versions prior to 5.4.0 and 4.16.0 contain an open redirect vulnerability due to improper sanitization of redirect URIs. The sanitizeURI function only inspects the first two bytes of the URI for separator characters, allowing a control character such as a tab to prefix the URI and bypass the check. Browsers strip such control characters and normalize backslashes to forward slashes, causing the Location header to redirect to an attacker-controlled domain. This vulnerability has been confirmed with a proof of concept and affects the RemoveTrailingSlash middleware when configured to redirect.
The Echo web framework versions prior to 5.1.1 and 4.15.2 contain a vulnerability in the Scheme() method that trusts certain HTTP headers (X-Forwarded-Proto, X-Forwarded-Protocol, X-Url-Scheme) without validating their values. This allows attackers to inject arbitrary URI schemes into redirect URLs generated by the WWWRedirect and NonWWWRedirect middlewares, potentially leading to open redirect issues and cache poisoning. The vulnerability is fixed in Echo v5.1.1 and v4.15.2 by whitelisting accepted schemes.
A vulnerability in github.com/labstack/echo/v5 middleware.Static allows bypassing route/group middleware guards by using a %2F-encoded path. When middleware.Static is mounted globally, the router matches routes on the raw encoded path, skipping guards for %2F-encoded requests, while the static handler decodes the path and serves the file inside the static root. This leads to unauthorized access to files within the static root that were intended to be protected by route-level middleware. The issue is not path traversal and does not expose files outside the static root. A fix is available in versions 5.4.0 and 4.16.0.
The Echo web framework versions up to v5.1.0 and v4 prior to 4.16.0 contain a reflected Cross-Site Scripting (XSS) vulnerability in the Context.JSONP and Context.JSONPBlob functions. These functions directly concatenate the user-supplied callback parameter into a JavaScript response without validation or escaping, allowing arbitrary JavaScript execution. This vulnerability can lead to session hijacking, cookie theft, and other malicious impacts. It is fixed in Echo v5.4.0 and v4.16.0 by enforcing strict validation of the callback parameter and adding security headers.