Threats Tagged 'cve-2026-37236'

A medium severity heap out-of-bounds read vulnerability (CVE-2026-2303) was found in the GSSAPI error handling of the go.mongodb.org mongo-driver dependency used by Apptainer. The vulnerability is addressed by removing this dependency in a security update for the alloy component. The update also adds support for building the SUID starter on SLES 15. A patch is available for affected versions.

grpc-gateway version 2.28.0 contains an incorrect access control vulnerability involving the processing of the X-HTTP-Method-Override header in ServeMux.ServeHTTP. The application does not properly restrict allowed HTTP methods, which can lead to unintended method overrides when handling POST requests with Content-Type application/x-www-form-urlencoded. This vulnerability is assigned CVE-2026-37236 and is rated medium severity. No patch or CVSS score is currently available, and no known exploits have been reported in the wild.

This security update for Helm addresses multiple vulnerabilities across several dependencies, including grpc-gateway, OpenTelemetry baggage parsing, oras-go registry authentication, and grpc-go components. The issues range from HTTP method override bypasses, denial of service via oversized inputs or crashes, credential exfiltration risks, to authorization bypasses and memory exhaustion. The update consolidates fixes into Helm version 3.21.1.

grpc-gateway version 2.28.0 has an incorrect access control vulnerability where the X-HTTP-Method-Override header is processed without restricting allowed HTTP methods. This allows an attacker to rewrite the HTTP method of a POST request with content type application/x-www-form-urlencoded to an arbitrary method before routing, potentially bypassing method-based access controls enforced by upstream proxies or WAFs.

This security update for the Trivy tool addresses multiple vulnerabilities across several dependencies, including improper certificate validation, HTTP method override bypass, denial of service via oversized inputs, information disclosure through crafted tarball hardlinks, authentication bypass and deadlocks in SSH libraries, authorization bypass due to header case mismatches, heap memory exhaustion, and denial of service from missing headers in gRPC servers. These issues collectively pose risks ranging from low to potentially higher impact depending on context. The update fixes these issues to improve overall security.

Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate should be considered expired. When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's "not before" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestamp authority, or using the current time. The root and all issuing certificates are assumed to be valid during the leaf certificate's validity. There is no impact to users of the public Sigstore infrastructure. This may affect private deployments with customized PKIs. This issue has been fixed in version 3.0.5.

MediumVulnerabilityUnited StatesGermanyJapan+7#cve#cve-2026-24122#cwe-295