Threats affecting pkg:generic/boost

A high-severity security vulnerability (CVE-2026-77406) affects the keda package, specifically related to the RabbitMQ amqp091-go Go AMQP 0 client. The vulnerability impacts versions prior to 2.19.0-r4. A fix is available in version 2.19.0-r4.

A high-severity security vulnerability (CVE-2026-77407) affects the keda package, specifically related to the RabbitMQ amqp091-go Go AMQP 0 client. Versions prior to 2.19.0-r4 are vulnerable. The vulnerability has been addressed in version 2.19.0-r4.

CVE-2026-77411 is a critical security vulnerability in the keda package affecting versions prior to 2.19.0-r4. It involves the RabbitMQ amqp091-go Go AMQP 0 client library. The vulnerability has a very high CVSS 4.0 score of 9.5, indicating severe impact if exploited. A fix is available in version 2.19.0-r4.

A critical security vulnerability (CVE-2026-77405) affects the keda package due to an issue in RabbitMQ amqp091-go, a Go implementation of AMQP 0. The vulnerability impacts versions of keda prior to 2.19.0-r4. It has a high CVSS 4.0 score of 9.4, indicating severe potential impact. A fix is available in version 2.19.0-r4.

A critical security vulnerability (CVE-2026-77408) affects the keda package, specifically related to the RabbitMQ amqp091-go Go AMQP 0 client. Versions of keda prior to 2.19.0-r4 are vulnerable. The vulnerability has a high CVSS 4.0 score of 9.1, indicating a severe impact. A fix is available in version 2.19.0-r4.

A security vulnerability (CVE-2026-40179) affects the keda package, which integrates with Prometheus, an open-source monitoring system and time series database. The vulnerability impacts versions prior to 2.19.0-r4 and 2.19.0-r5. It has a medium severity with a CVSS score of 6.1. A patch is available in versions 2.19.0-r4 and 2.19.0-r5.

A security vulnerability identified as CVE-2026-44903 affects the keda package, which relates to Prometheus, an open-source monitoring system and time series database. The vulnerability has a CVSS 3.1 base score of 6.1, indicating a medium severity level. It allows network-based attacks with low attack complexity and no privileges required but requires user interaction. The impact includes limited confidentiality and integrity loss but no availability impact. Fixed versions 2.19.0-r4 and 2.19.0-r5 are available.

A high-severity security vulnerability (CVE-2026-42154) affects the keda package, which relates to Prometheus, an open-source monitoring system and time series database. The vulnerability impacts versions prior to 2.19.0-r4 and 2.19.0-r5. It does not affect confidentiality or integrity but causes a significant availability impact. A patch is available in versions 2.19.0-r4 and 2.19.0-r5.

CVE-2026-42151 is a high-severity security vulnerability affecting the keda package, which integrates with Prometheus, an open-source monitoring system and time series database. The vulnerability impacts versions prior to 2.19.0-r4 and 2.19.0-r5. It has a CVSS 3.1 base score of 7.5, indicating network attack vector, low complexity, no privileges or user interaction required, and high confidentiality impact without affecting integrity or availability. A patch is available in versions 2.19.0-r4 and 2.19.0-r5.

A security vulnerability was identified in the keda package and has been addressed in versions 2.19.0-r5 and 2.19.0-r6. The flaw has a CVSS 4.0 score of 6.3, indicating a medium severity level. The vulnerability allows network-based exploitation without requiring privileges or user interaction, but with partial impact on confidentiality and no impact on integrity or availability. No known exploits are reported in the wild.

A security vulnerability (CVE-2026-54462) affects the keda package, which provides common packages shared across Knative repositories. The vulnerability impacts versions prior to 2.19.0-r6 and has a CVSS 3.1 base score of 6.5, indicating a medium severity. The flaw does not affect confidentiality or integrity but impacts availability. A patch is available in version 2.19.0-r6.

A security vulnerability identified as CVE-2025-58183 affects the argo-workflows package, specifically versions prior to 4.1.6-r1. The vulnerability has a medium severity score of 4.3 and impacts availability without compromising confidentiality or integrity. A patch is available in version 4.1.6-r1 to address this issue.

A security vulnerability in argo-workflows affects versions prior to 4.1.6-r1. The flaw arises from the design of the name constraint checking algorithm, where processing time for certain inputs increases non-linearly with certificate size, leading to a potential denial of service. This vulnerability has a high severity rating with a CVSS score of 7.5 and impacts availability without affecting confidentiality or integrity.

A vulnerability in argo-workflows allows parsing of a maliciously crafted DER payload that can cause excessive memory allocation, leading to memory exhaustion. This issue affects versions prior to 4.1.6-r1 and has a medium severity rating. A fix is available in version 4.1.6-r1.

CVE-2025-58189 is a medium severity security vulnerability in the argo-workflows package affecting versions prior to 4.1.6-r1. The vulnerability has a CVSS score of 5.3 and involves a network attack vector with low complexity and no privileges or user interaction required. Confidentiality impact is limited, with no impact on integrity or availability. A fix is available in version 4.1.6-r1.

A security vulnerability in argo-workflows versions prior to 4.1.6-r1 causes programs to panic when validating certificate chains containing DSA public keys. This occurs due to an interface cast that incorrectly assumes the presence of an Equal method on the keys. The issue has been fixed in version 4.1.6-r1.

CVE-2025-61724 is a medium severity security vulnerability in the argo-workflows package affecting versions prior to 4.1.6-r1. It does not impact confidentiality or integrity but can cause an availability impact. A patch is available in version 4.1.6-r1.

A vulnerability in argo-workflows allows parsing an unlimited number of cookies despite HTTP headers having a default 1MB size limit. This flaw affects versions prior to 4.1.6-r1 and can lead to denial of service by exhausting resources. The issue has been fixed in version 4.1.6-r1.

A high-severity vulnerability exists in the argo-workflows package affecting versions prior to 4.1.6-r1. The issue involves the ParseAddress function, which constructs domain-literal address components through repeated string concatenation. This flaw can lead to a denial of service (DoS) condition. A fix is available in version 4.1.6-r1.

A vulnerability in argo-workflows causes the processing time for parsing certain invalid inputs to scale non-linearly with input size, potentially leading to denial of service. This issue affects versions prior to 4.1.6-r1 and has been assigned CVE-2025-61723. The vulnerability has a high severity rating with a CVSS score of 7.5 and is addressed in version 4.1.6-r1.