Action not permitted
Modal body text goes here.
Modal Title
Modal Body
(CVE-2025-29923)
Vulnerability from cleanstart – Published: 2026-07-21 07:30 – Updated: 2026-09-18 11:59 – Source website
Withdrawn 2026-09-18
VLAI
Summary
Security fixes for CVE-2025-29923, CVE-2026-34040, CVE-2026-39822, CVE-2026-49834, CVE-2026-49835, CVE-2026-50151 applied in versions: 0.36.0-r0, 0.36.0-r1
Details
Multiple security vulnerabilities affect the harbor-trivy-adapter-fips package. These issues are resolved in later releases. See references for individual vulnerability details.
References
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "harbor-trivy-adapter-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.36.0-r1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [],
"database_specific": {},
"details": "Multiple security vulnerabilities affect the harbor-trivy-adapter-fips package. These issues are resolved in later releases. See references for individual vulnerability details.",
"id": "CLEANSTART-2026-LZ81863",
"modified": "2026-09-18T11:59:01.768079Z",
"published": "2026-07-21T07:30:34.359511Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-LZ81863.json"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-29923"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-34040"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39822"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-49834"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-49835"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-50151"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29923"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34040"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39822"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49834"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49835"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50151"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes for CVE-2025-29923, CVE-2026-34040, CVE-2026-39822, CVE-2026-49834, CVE-2026-49835, CVE-2026-50151 applied in versions: 0.36.0-r0, 0.36.0-r1",
"upstream": [
"CVE-2025-29923",
"CVE-2026-34040",
"CVE-2026-39822",
"CVE-2026-49834",
"CVE-2026-49835",
"CVE-2026-50151"
],
"withdrawn": "2026-09-18T11:59:01.768079Z"
}
CVE-2025-29923 (GCVE-0-2025-29923)
Vulnerability from cvelistv5 – Published: 2025-03-20 18:03 – Updated: 2026-09-02 21:19
VLAI
EPSS
VEX
Title
go-redis allows potential out of order responses when `CLIENT SETINFO` times out during connection establishment
Summary
go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.2, go-redis potentially responds out of order when `CLIENT SETINFO` times out during connection establishment. This can happen when the client is configured to transmit its identity, there are network connectivity issues, or the client was configured with aggressive timeouts. The problem occurs for multiple use cases. For sticky connections, you receive persistent out-of-order responses for the lifetime of the connection. All commands in the pipeline receive incorrect responses. When used with the default ConnPool once a connection is returned after use with ConnPool#Put the read buffer will be checked and the connection will be marked as bad due to the unread data. This means that at most one out-of-order response before the connection is discarded. This issue is fixed in 9.5.5, 9.6.3, and 9.7.2; however, 9.7.2 has been yanked and 9.7.3 is the lowest available patched version on the 9.7.x branch. As a workaround, set the flag `DisableIndentity` to `true` when constructing the client instance.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-20 19:43 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/redis/go-redis/security/adviso… | x_refsource_CONFIRM |
| https://github.com/redis/go-redis/pull/3295 | x_refsource_MISC |
| https://github.com/redis/go-redis/commit/d236865b… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-29923",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-20T19:43:05.478582Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-20T19:43:13.663Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "go-redis",
"vendor": "redis",
"versions": [
{
"status": "affected",
"version": "\u003e= 9.7.0-beta.1, \u003c 9.7.2"
},
{
"status": "affected",
"version": "\u003e= 9.6.0b1, \u003c 9.6.3"
},
{
"status": "affected",
"version": "\u003e= 9.5.1, \u003c 9.5.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.2, go-redis potentially responds out of order when `CLIENT SETINFO` times out during connection establishment. This can happen when the client is configured to transmit its identity, there are network connectivity issues, or the client was configured with aggressive timeouts. The problem occurs for multiple use cases. For sticky connections, you receive persistent out-of-order responses for the lifetime of the connection. All commands in the pipeline receive incorrect responses. When used with the default ConnPool once a connection is returned after use with ConnPool#Put the read buffer will be checked and the connection will be marked as bad due to the unread data. This means that at most one out-of-order response before the connection is discarded. This issue is fixed in 9.5.5, 9.6.3, and 9.7.2; however, 9.7.2 has been yanked and 9.7.3 is the lowest available patched version on the 9.7.x branch. As a workaround, set the flag `DisableIndentity` to `true` when constructing the client instance."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T21:19:29.467Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/redis/go-redis/security/advisories/GHSA-92cp-5422-2mw7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/redis/go-redis/security/advisories/GHSA-92cp-5422-2mw7"
},
{
"name": "https://github.com/redis/go-redis/pull/3295",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/redis/go-redis/pull/3295"
},
{
"name": "https://github.com/redis/go-redis/commit/d236865b0cfa1b752ea4b7da666b1fdcd0acebb6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/redis/go-redis/commit/d236865b0cfa1b752ea4b7da666b1fdcd0acebb6"
}
],
"source": {
"advisory": "GHSA-92cp-5422-2mw7",
"discovery": "UNKNOWN"
},
"title": "go-redis allows potential out of order responses when `CLIENT SETINFO` times out during connection establishment"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-29923",
"datePublished": "2025-03-20T18:03:14.933Z",
"dateReserved": "2025-03-12T13:42:22.136Z",
"dateUpdated": "2026-09-02T21:19:29.467Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34040 (GCVE-0-2026-34040)
Vulnerability from cvelistv5 – Published: 2026-03-31 01:36 – Updated: 2026-04-02 03:55
VLAI
EPSS
VEX
Title
Moby: AuthZ plugin bypass with oversized request body
Summary
Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-01 00:00 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/moby/moby/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/moby/moby/releases/tag/docker-… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-34040",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-01T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T03:55:56.676Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "moby",
"vendor": "moby",
"versions": [
{
"status": "affected",
"version": "\u003c 29.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-31T01:36:48.205Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2"
},
{
"name": "https://github.com/moby/moby/releases/tag/docker-v29.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/moby/moby/releases/tag/docker-v29.3.1"
}
],
"source": {
"advisory": "GHSA-x744-4wpc-v9h2",
"discovery": "UNKNOWN"
},
"title": "Moby: AuthZ plugin bypass with oversized request body"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34040",
"datePublished": "2026-03-31T01:36:48.205Z",
"dateReserved": "2026-03-25T15:29:04.744Z",
"dateUpdated": "2026-04-02T03:55:56.676Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-39822 (GCVE-0-2026-39822)
Vulnerability from cvelistv5 – Published: 2026-07-08 15:46 – Updated: 2026-07-08 19:39
VLAI
EPSS
VEX
Title
Root escape via symlink plus trailing slash in os
Summary
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-08 18:06 UTC
CWE
- CWE-61 - UNIX Symbolic Link (Symlink) Following
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Go standard library | os |
Affected:
0 , < 1.25.12
(semver)
Affected: 1.26.0-0 , < 1.26.5 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.2 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-39822",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-08T18:06:16.360721Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-61",
"description": "CWE-61 UNIX Symbolic Link (Symlink) Following",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T19:39:17.341Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "os",
"product": "os",
"programRoutines": [
{
"name": "rootOpenFileNolog"
},
{
"name": "openRootInRoot"
},
{
"name": "OpenInRoot"
},
{
"name": "Root.Create"
},
{
"name": "Root.Open"
},
{
"name": "Root.OpenFile"
},
{
"name": "Root.OpenRoot"
},
{
"name": "Root.ReadFile"
},
{
"name": "Root.WriteFile"
},
{
"name": "rootFS.Open"
},
{
"name": "rootFS.ReadDir"
},
{
"name": "rootFS.ReadFile"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.25.12",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.26.5",
"status": "affected",
"version": "1.26.0-0",
"versionType": "semver"
},
{
"lessThan": "1.27.0-rc.2",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mundur (https://github.com/M0nd0R)"
}
],
"descriptions": [
{
"lang": "en",
"value": "On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, \u0027root.Open(\"symlink/\")\u0027 will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T15:46:27.199Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/issue/79005"
},
{
"url": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc"
},
{
"url": "https://go.dev/cl/797880"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-4970"
}
],
"title": "Root escape via symlink plus trailing slash in os"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-39822",
"datePublished": "2026-07-08T15:46:27.199Z",
"dateReserved": "2026-04-07T18:13:03.527Z",
"dateUpdated": "2026-07-08T19:39:17.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49834 (GCVE-0-2026-49834)
Vulnerability from cvelistv5 – Published: 2026-07-17 19:20 – Updated: 2026-07-17 19:42
VLAI
EPSS
VEX
Title
sigstore-go: Multi-log threshold bypass via single compromised log
Summary
sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) counts verified witnesses per entry or per validation path rather than per log authority, allowing a single compromised transparency log or CT log to satisfy multi-log threshold requirements and defeat the multi-log policy. This issue is fixed in version 1.2.0.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-17 19:42 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/sigstore/sigstore-go/security/… | x_refsource_CONFIRM |
| https://github.com/sigstore/sigstore-go/pull/633 | x_refsource_MISC |
| https://github.com/sigstore/sigstore-go/commit/db… | x_refsource_MISC |
| https://github.com/sigstore/sigstore-go/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sigstore | sigstore-go |
Affected:
< 1.2.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49834",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T19:42:04.325650Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T19:42:17.005Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sigstore-go",
"vendor": "sigstore",
"versions": [
{
"status": "affected",
"version": "\u003c 1.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransparencyLog(N\u003e1) or WithSignedCertificateTimestamps(N\u003e1) counts verified witnesses per entry or per validation path rather than per log authority, allowing a single compromised transparency log or CT log to satisfy multi-log threshold requirements and defeat the multi-log policy. This issue is fixed in version 1.2.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T19:20:06.140Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-9vcr-p3rj-q5q6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-9vcr-p3rj-q5q6"
},
{
"name": "https://github.com/sigstore/sigstore-go/pull/633",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sigstore/sigstore-go/pull/633"
},
{
"name": "https://github.com/sigstore/sigstore-go/commit/dbb07e62623edd5b175fb9dd5a41dcb85a159207",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sigstore/sigstore-go/commit/dbb07e62623edd5b175fb9dd5a41dcb85a159207"
},
{
"name": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.0"
}
],
"source": {
"advisory": "GHSA-9vcr-p3rj-q5q6",
"discovery": "UNKNOWN"
},
"title": "sigstore-go: Multi-log threshold bypass via single compromised log"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49834",
"datePublished": "2026-07-17T19:20:06.140Z",
"dateReserved": "2026-06-01T18:50:36.056Z",
"dateUpdated": "2026-07-17T19:42:17.005Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49835 (GCVE-0-2026-49835)
Vulnerability from cvelistv5 – Published: 2026-07-17 18:16 – Updated: 2026-07-17 19:45
VLAI
EPSS
VEX
Title
Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality
Summary
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an unauthenticated remote attacker to issue requests with random paths such as /api/v1/timestamp/<uuid> or random HTTP methods and create unbounded permanent time-series entries that exhaust memory. This issue is fixed in version 2.1.0.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-17 19:45 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/sigstore/timestamp-authority/s… | x_refsource_CONFIRM |
| https://github.com/sigstore/timestamp-authority/c… | x_refsource_MISC |
| https://github.com/sigstore/timestamp-authority/r… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sigstore | timestamp-authority |
Affected:
< 2.1.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49835",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T19:45:33.792018Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T19:45:44.026Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "timestamp-authority",
"vendor": "sigstore",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an unauthenticated remote attacker to issue requests with random paths such as /api/v1/timestamp/\u003cuuid\u003e or random HTTP methods and create unbounded permanent time-series entries that exhaust memory. This issue is fixed in version 2.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T18:16:41.764Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-9c54-x2g4-v92j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-9c54-x2g4-v92j"
},
{
"name": "https://github.com/sigstore/timestamp-authority/commit/506ec57b6ac2ea1e4739322e47453469425b69b5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sigstore/timestamp-authority/commit/506ec57b6ac2ea1e4739322e47453469425b69b5"
},
{
"name": "https://github.com/sigstore/timestamp-authority/releases/tag/v2.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sigstore/timestamp-authority/releases/tag/v2.1.0"
}
],
"source": {
"advisory": "GHSA-9c54-x2g4-v92j",
"discovery": "UNKNOWN"
},
"title": "Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49835",
"datePublished": "2026-07-17T18:16:41.764Z",
"dateReserved": "2026-06-01T18:50:36.056Z",
"dateUpdated": "2026-07-17T19:45:44.026Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50151 (GCVE-0-2026-50151)
Vulnerability from cvelistv5 – Published: 2026-07-17 19:41 – Updated: 2026-07-20 13:52
VLAI
EPSS
VEX
Title
oras-go: credential forwarding via unvalidated Location header in blob upload
Summary
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 13:52 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/oras-project/oras-go/security/… | x_refsource_CONFIRM |
| https://github.com/oras-project/oras-go/pull/1152 | x_refsource_MISC |
| https://github.com/oras-project/oras-go/commit/46… | x_refsource_MISC |
| https://github.com/oras-project/oras-go/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| oras-project | oras-go |
Affected:
< 2.6.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50151",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T13:52:00.588088Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T13:52:07.476Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "oras-go",
"vendor": "oras-project",
"versions": [
{
"status": "affected",
"version": "\u003c 2.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller\u0027s credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T19:41:11.648Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7"
},
{
"name": "https://github.com/oras-project/oras-go/pull/1152",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/oras-project/oras-go/pull/1152"
},
{
"name": "https://github.com/oras-project/oras-go/commit/4683c46ef078091544f5f55fd25102f002806991",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/oras-project/oras-go/commit/4683c46ef078091544f5f55fd25102f002806991"
},
{
"name": "https://github.com/oras-project/oras-go/releases/tag/v2.6.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/oras-project/oras-go/releases/tag/v2.6.1"
}
],
"source": {
"advisory": "GHSA-jxpm-75mh-9fp7",
"discovery": "UNKNOWN"
},
"title": "oras-go: credential forwarding via unvalidated Location header in blob upload"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50151",
"datePublished": "2026-07-17T19:41:11.648Z",
"dateReserved": "2026-06-03T20:54:20.431Z",
"dateUpdated": "2026-07-20T13:52:07.476Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…