Vulnerability-Lookup

(GHSA-W5PP-99CH-QJ29)

Vulnerability from cleanstart – Published: 2026-09-18 10:06 – Updated: 2026-10-15 12:00 – Source website

Summary

Security fix for GHSA-w5pp-99ch-qj29 applied in: apko 1.2.13-r0, argo-cd 3.1.16-r1, argo-cd 3.2.12-r0, argo-cd 3.3.11-r0, argo-events 1.9.10-r1, argo-workflows 4.0.5-r0, argo-workflows-fips 4.0.6-r1, external-secrets-operator 2.6.0-r6, grafana-alloy 1.16.1-r0, kyverno 1.16.4-r3, kyverno 1.18.1-r2, kyverno 1.18.2-r0, pulumi-kubernetes-operator 2.7.0-r0

Details

GHSA-w5pp-99ch-qj29 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

Severity

6.5 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/GHSA-w5pp-99ch-qj29	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "apko",
        "purl": "pkg:apk/cleanstart/apko"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.13-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "argo-cd",
        "purl": "pkg:apk/cleanstart/argo-cd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.16-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "argo-cd",
        "purl": "pkg:apk/cleanstart/argo-cd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2.12-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "argo-cd",
        "purl": "pkg:apk/cleanstart/argo-cd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.3.11-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "argo-events",
        "purl": "pkg:apk/cleanstart/argo-events"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9.10-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "argo-workflows",
        "purl": "pkg:apk/cleanstart/argo-workflows"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.5-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "argo-workflows-fips",
        "purl": "pkg:apk/cleanstart/argo-workflows-fips"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.6-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "external-secrets-operator",
        "purl": "pkg:apk/cleanstart/external-secrets-operator"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.6.0-r6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "grafana-alloy",
        "purl": "pkg:apk/cleanstart/grafana-alloy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.16.1-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "kyverno",
        "purl": "pkg:apk/cleanstart/kyverno"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.16.4-r3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "kyverno",
        "purl": "pkg:apk/cleanstart/kyverno"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.18.1-r2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "kyverno",
        "purl": "pkg:apk/cleanstart/kyverno"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.18.2-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "pulumi-kubernetes-operator",
        "purl": "pkg:apk/cleanstart/pulumi-kubernetes-operator"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.7.0-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "GHSA-w5pp-99ch-qj29 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.",
  "id": "CLEANSTART-2026-HG07568",
  "modified": "2026-10-15T12:00:00Z",
  "published": "2026-09-18T10:06:21.431066Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-HG07568.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/GHSA-w5pp-99ch-qj29"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Security fix for GHSA-w5pp-99ch-qj29 applied in: apko 1.2.13-r0, argo-cd 3.1.16-r1, argo-cd 3.2.12-r0, argo-cd 3.3.11-r0, argo-events 1.9.10-r1, argo-workflows 4.0.5-r0, argo-workflows-fips 4.0.6-r1, external-secrets-operator 2.6.0-r6, grafana-alloy 1.16.1-r0, kyverno 1.16.4-r3, kyverno 1.18.1-r2, kyverno 1.18.2-r0, pulumi-kubernetes-operator 2.7.0-r0",
  "upstream": [
    "GHSA-w5pp-99ch-qj29"
  ]
}

GHSA-W5PP-99CH-QJ29

Vulnerability from github – Published: 2026-05-29 19:43 – Updated: 2026-05-29 19:43

Summary

go-git: Malformed Git object data may cause panics or resource exhaustion

Details

Impact

Several denial-of-service issues were identified in go-git when parsing maliciously crafted Git repository data.

An attacker may craft a malicious .pack, .idx or loose objects that causes an application using an affected version of go-git to panic or consume excessive resources.

This can lead to denial of service in applications that use go-git to clone, fetch, open, or otherwise process untrusted repositories or Git object data.

Exploitation requires the ability to alter read-only files such as .pack or .idx from the local repository's .git/objects/pack/ directory. Alternatively, the user would need to be interacting with a malicious remote server, which is not recommended and exposes users to a broader class of security risks beyond this issue.

Patches

Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-git version.

Credits

go-git thanks @kodareef5, @AyushParkara and @N0zoM1z0 for reporting this in four separate reports. 🙇

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.19.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/go-git/go-git/v5"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.19.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.0.0-alpha.3"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/go-git/go-git/v6"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.0-alpha.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-29T19:43:27Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\nSeveral denial-of-service issues were identified in `go-git` when parsing maliciously crafted Git repository data.\n\nAn attacker may craft a malicious `.pack`, `.idx` or loose objects that causes an application using an affected version of `go-git` to panic or consume excessive resources.\n\nThis can lead to denial of service in applications that use `go-git` to clone, fetch, open, or otherwise process untrusted repositories or Git object data.\n\nExploitation requires the ability to alter read-only files such as `.pack` or `.idx` from the local repository\u0027s `.git/objects/pack/` directory. Alternatively, the user would need to be interacting with a malicious remote server, which is not recommended and exposes users to a broader class of security risks beyond this issue.\n\n### Patches\nUsers should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to `v5` are likely to be affected, users are recommended to upgrade to a supported `go-git` version.\n\n### Credits\ngo-git thanks @kodareef5, @AyushParkara and @N0zoM1z0 for reporting this in four separate reports. \ud83d\ude47",
  "id": "GHSA-w5pp-99ch-qj29",
  "modified": "2026-05-29T19:43:27Z",
  "published": "2026-05-29T19:43:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/go-git/go-git/security/advisories/GHSA-w5pp-99ch-qj29"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/go-git/go-git"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "go-git: Malformed Git object data may cause panics or resource exhaustion"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted