Action not permitted
Modal body text goes here.
Modal Title
Modal Body
GHSA-J5W8-Q4QC-RX2X
Vulnerability from github – Published: 2025-11-19 23:01 – Updated: 2025-11-19 23:01
VLAI
Summary
golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption
Details
SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.
Severity
5.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "golang.org/x/crypto"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.45.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-58181"
],
"database_specific": {
"cwe_ids": [
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-19T23:01:20Z",
"nvd_published_at": "2025-11-19T21:15:50Z",
"severity": "MODERATE"
},
"details": "SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.",
"id": "GHSA-j5w8-q4qc-rx2x",
"modified": "2025-11-19T23:01:20Z",
"published": "2025-11-19T23:01:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58181"
},
{
"type": "WEB",
"url": "https://go.dev/cl/721961"
},
{
"type": "WEB",
"url": "https://go.dev/issue/76363"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2025-4134"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption"
}
CLEANSTART-2026-HP74468 (GHSA-J5W8-Q4QC-RX2X)
Vulnerability from cleanstart – Published: 2026-09-18 10:32 – Updated: 2025-11-28 11:03 – Source website
VLAI
Summary
Security fix for ghsa-j5w8-q4qc-rx2x applied in: argo-cd 3.1.9-r4, argo-cd-fips 2.14.20-r1, argo-cd-fips 3.0.20-r2, argo-cd-fips 3.1.9-r4, argo-workflows-fips 3.4.18-r0, atlantis 0.37.1-r1, atlantis-fips 0.37.1-r0, boring-registry 0.16.6-r0, calico-fips 3.28.5-r2, cert-manager-fips 1.18.2-r0, certificate-transparency-trillian-ctserver 1.3.2-r0, certificate-transparency-trillian-ctserver-fips 1.3.2-r0, cfssl 1.5.0-r1, cloud-provider-aws-1.34 1.34.1-r1, cloudprober-fips 0.14.1-r0, consul-fips 1.21.5-r0, cortex-fips 1.20.1-r1, cosign 2.4.3-r0, cosign 2.5.3-r0, crossplane-provider-sql 0.13.0-r0, crossplane-provider-sql-fips 0.13.0-r0, dcgm-exporter 4.5.1-r0, descheduler 0.34.0-r0, dex-fips 2.41.1-r3, dex-fips 2.42.1-r3, dex-fips 2.43.1-r3, distribution 3.0.0-r0, dynamic-localpv-provisioner 4.4.0-r0, eck-operator 3.2.0-r0, eck-operator-fips 3.2.0-r0, eks-distro-kube-apiserver 1.34.2-r0, eks-distro-kube-apiserver-fips 1.34.2-r0, eks-distro-kube-controller-manager-fips 1.34.2-r0, elastic-beats-fips 9.0.8-r1, elastic-beats-fips 9.2.0-r2, external-dns 0.18.0-r0, external-dns-fips 0.20.0-r2, external-secrets-fips 0.17.0-r0, external-secrets-fips 0.20.4-r1, falcoctl 0.11.0-r0, flux-notification-controller-fips 1.5.0-r0, forecastle 1.0.159-r2, fulcio 1.8.2-r0, fulcio-fips 1.8.2-r0, git-lfs-fips 3.7.0-r2, gitlab-shell 14.45.5-r0, gitlab-shell-fips 14.45.5-r0, gitness 3.3.0-r1, go-fips-1.25 1.25.6-r0, go1.24 1.24.11-r0, go1.26 1.25.5-r0, gomplate-fips 4.3.3-r3, gotenberg 8.31.0-r0, gotenberg 8.32.0-r0, gptscript 0.9.7-r1, gpu-operator 25.10.0-r1, gpu-operator-fips 25.10.0-r1, harbor 2.13.4-r0, harbor 2.14.2-r0, harbor-fips 2.14.2-r0, harbor-registry 3.0.0.1-r2, helm-fips 3.19.0-r1, helm-fips 3.19.0-r2, jitsucom-bulker 2.11.913-r0, k8ssandra-client-fips 0.7.0-r2, k8ssandra-client-fips 0.7.0-r4, k8ssandra-client-fips 0.8.4-r0, kapp-controller 0.59.0-r0, kapp-controller-fips 0.59.0-r0, kube-fluentd-operator 1.18.2-r0, kube-rbac-proxy-fips 0.19.1-r1, kube-state-metrics-fips 2.17.0-r1, kubernetes 1.33.11-r0, kubernetes 1.34.7-r0, kubernetes-csi-external-snapshotter 8.4.0-r0, kubernetes-csi-external-snapshotter-fips 8.4.0-r0, kubernetes-dashboard-api 1.14.0-r0, kubernetes-dashboard-api-fips 1.14.0-r0, kubernetes-dashboard-auth 1.4.0-r0, kubernetes-dashboard-auth-fips 1.4.0-r0, kubernetes-dashboard-web 1.7.0-r0, kubernetes-dashboard-web-fips 1.7.0-r0, litestream 0.5.2-r1, local-static-provisioner 2.8.0-r0, minio-operator 7.1.1-r3, minio-operator-fips 5.0.18-r7, minio-operator-fips 6.0.4-r7, minio-operator-fips 7.0.1-r7, minio-operator-fips 7.1.1-r7, modelmesh-runtime-adapter 0.12.0-r0, modelmesh-runtime-adapter 0.12.0-r1, node-problem-detector 0.8.22-r0, openbao 2.4.3-r0, percona-server-mongodb-operator 1.22.0-r1, percona-xtradb-cluster-operator 1.18.0-r0, percona-xtradb-cluster-operator-fips 1.18.0-r0, postgres-operator 1.12.2-r2, prom-mysqld-exporter-fips 0.18.0-r0, prometheus-blackbox-exporter 0.27.0-r0, prometheus-mongodb-exporter 0.47.2-r0, prometheus-mongodb-exporter-fips 0.47.2-r0, prometheus-mysqld-exporter 0.18.0-r0, prometheus-mysqld-exporter-fips 0.18.0-r0, prometheus-node-exporter 1.8.0-r3, prometheus-node-exporter-fips 1.10.2-r1, prometheus-node-exporter-fips 1.10.2-r3, prometheus-node-exporter-fips 1.7.0-r2, prometheus-node-exporter-fips 1.8.2-r2, prometheus-node-exporter-fips 1.9.1-r1, prometheus-operator-fips 0.85.0-r2, prometheus-operator-fips 0.86.2-r1, prometheus-operator-fips 0.87.0-r1, prometheus-statsd-exporter 0.28.0-r0, prometheus-statsd-exporter-fips 0.28.0-r0, promxy 0.0.93-r0, rabbitmq-messaging-topology-operator 1.15.0-r1, rekor-backfill-index 1.4.3-r0, rekor-fips 1.4.3-r0, secrets-store-csi-driver-fips 1.5.4-r0, skaffold 2.16.1-r1, step-issuer-fips 0.9.9-r1, tekton-chains 0.26.0-r0, tekton-chains-fips 0.26.0-r0, tekton-pipelines 1.5.0-r0, tekton-pipelines-fips 1.5.0-r0, tempo 2.9.0-r0, tempo-fips 2.7.2-r0, tempo-fips 2.8.3-r0, tempo-fips 2.9.1-r0, trivy-fips 0.67.2-r0, velero-fips 1.14.1-r1, velero-fips 1.16.2, velero-fips 1.16.2-r2, wavefront-collector-for-kubernetes 1.13.0-r0, weaviate 1.35.2-r0
Details
ghsa-j5w8-q4qc-rx2x affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
References
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "argo-cd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.9-r4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "argo-cd-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.14.20-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "argo-cd-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.20-r2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "argo-cd-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.9-r4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "argo-workflows-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.18-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "atlantis"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.37.1-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "atlantis-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.37.1-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "boring-registry"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.16.6-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "calico-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.28.5-r2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "cert-manager-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.18.2-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "certificate-transparency-trillian-ctserver"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.2-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "certificate-transparency-trillian-ctserver-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.2-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "cfssl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.0-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "cloud-provider-aws-1.34"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.34.1-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "cloudprober-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.14.1-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "consul-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.21.5-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "cortex-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.20.1-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "cosign"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.3-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "cosign"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.3-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "crossplane-provider-sql"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.13.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "crossplane-provider-sql-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.13.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "dcgm-exporter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.5.1-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "descheduler"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.34.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "dex-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.41.1-r3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "dex-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.42.1-r3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "dex-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.43.1-r3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "distribution"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "dynamic-localpv-provisioner"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.4.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "eck-operator"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "eck-operator-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "eks-distro-kube-apiserver"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.34.2-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "eks-distro-kube-apiserver-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.34.2-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "eks-distro-kube-controller-manager-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.34.2-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "elastic-beats-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.0.8-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "elastic-beats-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.2.0-r2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "external-dns"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.18.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "external-dns-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.20.0-r2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "external-secrets-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.17.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "external-secrets-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.20.4-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "falcoctl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.11.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "flux-notification-controller-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "forecastle"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.159-r2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "fulcio"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.8.2-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "fulcio-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.8.2-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "git-lfs-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.0-r2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "gitlab-shell"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.45.5-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "gitlab-shell-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.45.5-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "gitness"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.0-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "go-fips-1.25"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.25.6-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "go1.24"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.24.11-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "go1.26"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.25.5-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "gomplate-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.3-r3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "gotenberg"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.31.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "gotenberg"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.32.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "gptscript"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.7-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "gpu-operator"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "25.10.0-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "gpu-operator-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "25.10.0-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "harbor"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.13.4-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "harbor"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.14.2-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "harbor-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.14.2-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "harbor-registry"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.0.1-r2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "helm-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.19.0-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "helm-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.19.0-r2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "jitsucom-bulker"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.11.913-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "k8ssandra-client-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.7.0-r2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "k8ssandra-client-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.7.0-r4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "k8ssandra-client-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.4-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "kapp-controller"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.59.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "kapp-controller-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.59.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "kube-fluentd-operator"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.18.2-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "kube-rbac-proxy-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.19.1-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "kube-state-metrics-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.17.0-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "kubernetes"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.33.11-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "kubernetes"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.34.7-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "kubernetes-csi-external-snapshotter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.4.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "kubernetes-csi-external-snapshotter-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.4.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "kubernetes-dashboard-api"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "kubernetes-dashboard-api-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "kubernetes-dashboard-auth"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "kubernetes-dashboard-auth-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "kubernetes-dashboard-web"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "kubernetes-dashboard-web-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "litestream"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.2-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "local-static-provisioner"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.8.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "minio-operator"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.1.1-r3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "minio-operator-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.18-r7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "minio-operator-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.4-r7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "minio-operator-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.0.1-r7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "minio-operator-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.1.1-r7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "modelmesh-runtime-adapter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.12.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "modelmesh-runtime-adapter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.12.0-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "node-problem-detector"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.22-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "openbao"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.3-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "percona-server-mongodb-operator"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.22.0-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "percona-xtradb-cluster-operator"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.18.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "percona-xtradb-cluster-operator-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.18.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "postgres-operator"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.12.2-r2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "prom-mysqld-exporter-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.18.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "prometheus-blackbox-exporter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.27.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "prometheus-mongodb-exporter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.47.2-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "prometheus-mongodb-exporter-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.47.2-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "prometheus-mysqld-exporter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.18.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "prometheus-mysqld-exporter-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.18.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "prometheus-node-exporter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.8.0-r3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "prometheus-node-exporter-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.10.2-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "prometheus-node-exporter-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.10.2-r3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "prometheus-node-exporter-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.0-r2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "prometheus-node-exporter-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.8.2-r2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "prometheus-node-exporter-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.9.1-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "prometheus-operator-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.85.0-r2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "prometheus-operator-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.86.2-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "prometheus-operator-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.87.0-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "prometheus-statsd-exporter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.28.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "prometheus-statsd-exporter-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.28.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "promxy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.93-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "rabbitmq-messaging-topology-operator"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.15.0-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "rekor-backfill-index"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.3-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "rekor-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.3-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "secrets-store-csi-driver-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "skaffold"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.16.1-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "step-issuer-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.9-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "tekton-chains"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.26.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "tekton-chains-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.26.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "tekton-pipelines"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "tekton-pipelines-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "tempo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.9.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "tempo-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.2-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "tempo-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.8.3-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "tempo-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.9.1-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "trivy-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.67.2-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "velero-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.1-r1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "velero-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.16.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "velero-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.16.2-r2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "wavefront-collector-for-kubernetes"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.13.0-r0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "CleanStart",
"name": "weaviate"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.35.2-r0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [],
"database_specific": {},
"details": "ghsa-j5w8-q4qc-rx2x affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.",
"id": "CLEANSTART-2026-HP74468",
"modified": "2025-11-28T11:03:27Z",
"published": "2026-09-18T10:32:27.652055Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-HP74468.json"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-j5w8-q4qc-rx2x"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fix for ghsa-j5w8-q4qc-rx2x applied in: argo-cd 3.1.9-r4, argo-cd-fips 2.14.20-r1, argo-cd-fips 3.0.20-r2, argo-cd-fips 3.1.9-r4, argo-workflows-fips 3.4.18-r0, atlantis 0.37.1-r1, atlantis-fips 0.37.1-r0, boring-registry 0.16.6-r0, calico-fips 3.28.5-r2, cert-manager-fips 1.18.2-r0, certificate-transparency-trillian-ctserver 1.3.2-r0, certificate-transparency-trillian-ctserver-fips 1.3.2-r0, cfssl 1.5.0-r1, cloud-provider-aws-1.34 1.34.1-r1, cloudprober-fips 0.14.1-r0, consul-fips 1.21.5-r0, cortex-fips 1.20.1-r1, cosign 2.4.3-r0, cosign 2.5.3-r0, crossplane-provider-sql 0.13.0-r0, crossplane-provider-sql-fips 0.13.0-r0, dcgm-exporter 4.5.1-r0, descheduler 0.34.0-r0, dex-fips 2.41.1-r3, dex-fips 2.42.1-r3, dex-fips 2.43.1-r3, distribution 3.0.0-r0, dynamic-localpv-provisioner 4.4.0-r0, eck-operator 3.2.0-r0, eck-operator-fips 3.2.0-r0, eks-distro-kube-apiserver 1.34.2-r0, eks-distro-kube-apiserver-fips 1.34.2-r0, eks-distro-kube-controller-manager-fips 1.34.2-r0, elastic-beats-fips 9.0.8-r1, elastic-beats-fips 9.2.0-r2, external-dns 0.18.0-r0, external-dns-fips 0.20.0-r2, external-secrets-fips 0.17.0-r0, external-secrets-fips 0.20.4-r1, falcoctl 0.11.0-r0, flux-notification-controller-fips 1.5.0-r0, forecastle 1.0.159-r2, fulcio 1.8.2-r0, fulcio-fips 1.8.2-r0, git-lfs-fips 3.7.0-r2, gitlab-shell 14.45.5-r0, gitlab-shell-fips 14.45.5-r0, gitness 3.3.0-r1, go-fips-1.25 1.25.6-r0, go1.24 1.24.11-r0, go1.26 1.25.5-r0, gomplate-fips 4.3.3-r3, gotenberg 8.31.0-r0, gotenberg 8.32.0-r0, gptscript 0.9.7-r1, gpu-operator 25.10.0-r1, gpu-operator-fips 25.10.0-r1, harbor 2.13.4-r0, harbor 2.14.2-r0, harbor-fips 2.14.2-r0, harbor-registry 3.0.0.1-r2, helm-fips 3.19.0-r1, helm-fips 3.19.0-r2, jitsucom-bulker 2.11.913-r0, k8ssandra-client-fips 0.7.0-r2, k8ssandra-client-fips 0.7.0-r4, k8ssandra-client-fips 0.8.4-r0, kapp-controller 0.59.0-r0, kapp-controller-fips 0.59.0-r0, kube-fluentd-operator 1.18.2-r0, kube-rbac-proxy-fips 0.19.1-r1, kube-state-metrics-fips 2.17.0-r1, kubernetes 1.33.11-r0, kubernetes 1.34.7-r0, kubernetes-csi-external-snapshotter 8.4.0-r0, kubernetes-csi-external-snapshotter-fips 8.4.0-r0, kubernetes-dashboard-api 1.14.0-r0, kubernetes-dashboard-api-fips 1.14.0-r0, kubernetes-dashboard-auth 1.4.0-r0, kubernetes-dashboard-auth-fips 1.4.0-r0, kubernetes-dashboard-web 1.7.0-r0, kubernetes-dashboard-web-fips 1.7.0-r0, litestream 0.5.2-r1, local-static-provisioner 2.8.0-r0, minio-operator 7.1.1-r3, minio-operator-fips 5.0.18-r7, minio-operator-fips 6.0.4-r7, minio-operator-fips 7.0.1-r7, minio-operator-fips 7.1.1-r7, modelmesh-runtime-adapter 0.12.0-r0, modelmesh-runtime-adapter 0.12.0-r1, node-problem-detector 0.8.22-r0, openbao 2.4.3-r0, percona-server-mongodb-operator 1.22.0-r1, percona-xtradb-cluster-operator 1.18.0-r0, percona-xtradb-cluster-operator-fips 1.18.0-r0, postgres-operator 1.12.2-r2, prom-mysqld-exporter-fips 0.18.0-r0, prometheus-blackbox-exporter 0.27.0-r0, prometheus-mongodb-exporter 0.47.2-r0, prometheus-mongodb-exporter-fips 0.47.2-r0, prometheus-mysqld-exporter 0.18.0-r0, prometheus-mysqld-exporter-fips 0.18.0-r0, prometheus-node-exporter 1.8.0-r3, prometheus-node-exporter-fips 1.10.2-r1, prometheus-node-exporter-fips 1.10.2-r3, prometheus-node-exporter-fips 1.7.0-r2, prometheus-node-exporter-fips 1.8.2-r2, prometheus-node-exporter-fips 1.9.1-r1, prometheus-operator-fips 0.85.0-r2, prometheus-operator-fips 0.86.2-r1, prometheus-operator-fips 0.87.0-r1, prometheus-statsd-exporter 0.28.0-r0, prometheus-statsd-exporter-fips 0.28.0-r0, promxy 0.0.93-r0, rabbitmq-messaging-topology-operator 1.15.0-r1, rekor-backfill-index 1.4.3-r0, rekor-fips 1.4.3-r0, secrets-store-csi-driver-fips 1.5.4-r0, skaffold 2.16.1-r1, step-issuer-fips 0.9.9-r1, tekton-chains 0.26.0-r0, tekton-chains-fips 0.26.0-r0, tekton-pipelines 1.5.0-r0, tekton-pipelines-fips 1.5.0-r0, tempo 2.9.0-r0, tempo-fips 2.7.2-r0, tempo-fips 2.8.3-r0, tempo-fips 2.9.1-r0, trivy-fips 0.67.2-r0, velero-fips 1.14.1-r1, velero-fips 1.16.2, velero-fips 1.16.2-r2, wavefront-collector-for-kubernetes 1.13.0-r0, weaviate 1.35.2-r0",
"upstream": [
"ghsa-j5w8-q4qc-rx2x"
]
}
CLEANSTART-2026-HU33730 (CVE-2025-61726)
Vulnerability from cleanstart – Published: 2026-05-18 13:43 – Updated: 2026-09-18 11:59 – Source website
Withdrawn 2026-09-18
VLAI
Summary
Security fixes for CVE-2025-61726, CVE-2025-61727, CVE-2025-61728, CVE-2025-61729, CVE-2025-61730, CVE-2025-61732, CVE-2025-68119, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, CVE-2026-34986, CVE-2026-39882, ghsa-78h2-9frx-2jm8, ghsa-9h8m-3fm2-qjrq, ghsa-f6x5-jh6r-wrfv, ghsa-fcv2-xgw5-pqxf, ghsa-j5w8-q4qc-rx2x, ghsa-p436-gjf2-799p, ghsa-p77j-4mvh-x3m3, ghsa-w8rr-5gcm-pp58 applied in versions: 1.10.2-r0, 1.5.0-r0, 1.5.0-r1, 1.5.0-r2, 1.5.0-r3, 1.5.0-r4
Details
Multiple security vulnerabilities affect the tekton-pipelines package. These issues are resolved in later releases. See references for individual vulnerability details.
References
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "tekton-pipelines"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.0-r4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [],
"database_specific": {},
"details": "Multiple security vulnerabilities affect the tekton-pipelines package. These issues are resolved in later releases. See references for individual vulnerability details.",
"id": "CLEANSTART-2026-HU33730",
"modified": "2026-09-18T11:59:01.768079Z",
"published": "2026-05-18T13:43:42.777786Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-HU33730.json"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-61726"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-61727"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-61728"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-61729"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-61730"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-61732"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-68119"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-68121"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-25679"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-27139"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-27142"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-33186"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-34986"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39882"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-78h2-9frx-2jm8"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-9h8m-3fm2-qjrq"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-f6x5-jh6r-wrfv"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-fcv2-xgw5-pqxf"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-j5w8-q4qc-rx2x"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-p436-gjf2-799p"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-p77j-4mvh-x3m3"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-w8rr-5gcm-pp58"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61727"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61729"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61730"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61732"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68119"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27139"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27142"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39882"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes for CVE-2025-61726, CVE-2025-61727, CVE-2025-61728, CVE-2025-61729, CVE-2025-61730, CVE-2025-61732, CVE-2025-68119, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, CVE-2026-34986, CVE-2026-39882, ghsa-78h2-9frx-2jm8, ghsa-9h8m-3fm2-qjrq, ghsa-f6x5-jh6r-wrfv, ghsa-fcv2-xgw5-pqxf, ghsa-j5w8-q4qc-rx2x, ghsa-p436-gjf2-799p, ghsa-p77j-4mvh-x3m3, ghsa-w8rr-5gcm-pp58 applied in versions: 1.10.2-r0, 1.5.0-r0, 1.5.0-r1, 1.5.0-r2, 1.5.0-r3, 1.5.0-r4",
"upstream": [
"CVE-2025-61726",
"CVE-2025-61727",
"CVE-2025-61728",
"CVE-2025-61729",
"CVE-2025-61730",
"CVE-2025-61732",
"CVE-2025-68119",
"CVE-2025-68121",
"CVE-2026-25679",
"CVE-2026-27139",
"CVE-2026-27142",
"CVE-2026-33186",
"CVE-2026-34986",
"CVE-2026-39882",
"ghsa-78h2-9frx-2jm8",
"ghsa-9h8m-3fm2-qjrq",
"ghsa-f6x5-jh6r-wrfv",
"ghsa-fcv2-xgw5-pqxf",
"ghsa-j5w8-q4qc-rx2x",
"ghsa-p436-gjf2-799p",
"ghsa-p77j-4mvh-x3m3",
"ghsa-w8rr-5gcm-pp58"
],
"withdrawn": "2026-09-18T11:59:01.768079Z"
}
CLEANSTART-2026-HY30847 (GHSA-F6X5-JH6R-WRFV)
Vulnerability from cleanstart – Published: 2026-07-30 07:10 – Updated: 2026-09-09 10:55 – Source website
Withdrawn 2026-09-09
VLAI
Summary
Security fixes in atlantis-fips 0.37.1-r0
Details
Package atlantis-fips version 0.37.1-r0 fixes 3 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x, ghsa-wjrx-6529-hcj3
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "atlantis-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.37.1-r0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.37.1-r0"
]
}
],
"credits": [],
"database_specific": {},
"details": "Package atlantis-fips version 0.37.1-r0 fixes 3 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x, ghsa-wjrx-6529-hcj3",
"id": "CLEANSTART-2026-HY30847",
"modified": "2026-09-09T10:55:12Z",
"published": "2026-07-30T07:10:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/runatlantis/atlantis"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes in atlantis-fips 0.37.1-r0",
"upstream": [
"ghsa-f6x5-jh6r-wrfv",
"ghsa-j5w8-q4qc-rx2x",
"ghsa-wjrx-6529-hcj3"
],
"withdrawn": "2026-09-09T10:55:12Z"
}
CLEANSTART-2026-HZ73294 (CVE-2023-45288)
Vulnerability from cleanstart – Published: 2026-04-09 00:45 – Updated: 2026-09-18 11:59 – Source website
Withdrawn 2026-09-18
VLAI
Summary
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service
Details
Multiple security vulnerabilities affect the kube-fluentd-operator package. Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. See references for individual vulnerability details.
Severity
9.8 (Critical)
References
| URL | Type | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "kube-fluentd-operator"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.18.2-r1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [],
"database_specific": {},
"details": "Multiple security vulnerabilities affect the kube-fluentd-operator package. Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. See references for individual vulnerability details.",
"id": "CLEANSTART-2026-HZ73294",
"modified": "2026-09-18T11:59:01.768079Z",
"published": "2026-04-09T00:45:08.400884Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-HZ73294.json"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2023-45288"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2024-24786"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2024-45338"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-22868"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-22869"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-22872"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-47911"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-47913"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-47914"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-58181"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-58190"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-65637"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-32281"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-32282"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-4f99-4q7p-p3gh"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-4v7x-pqxf-cx7m"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-6v2p-p543-phr9"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-8r3f-844c-mc37"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-f6x5-jh6r-wrfv"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-hcg3-q754-cr77"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-j5w8-q4qc-rx2x"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-qxp5-gwg8-xv66"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-v778-237x-gjrc"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-vvgc-356p-c3xw"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45288"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24786"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45338"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22868"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22869"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22872"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47911"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47913"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47914"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58181"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58190"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65637"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
}
],
"related": [],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service",
"upstream": [
"CVE-2023-45288",
"CVE-2024-24786",
"CVE-2024-45338",
"CVE-2025-22868",
"CVE-2025-22869",
"CVE-2025-22872",
"CVE-2025-47911",
"CVE-2025-47913",
"CVE-2025-47914",
"CVE-2025-58181",
"CVE-2025-58190",
"CVE-2025-65637",
"CVE-2026-32281",
"CVE-2026-32282",
"ghsa-4f99-4q7p-p3gh",
"ghsa-4v7x-pqxf-cx7m",
"ghsa-6v2p-p543-phr9",
"ghsa-8r3f-844c-mc37",
"ghsa-f6x5-jh6r-wrfv",
"ghsa-hcg3-q754-cr77",
"ghsa-j5w8-q4qc-rx2x",
"ghsa-qxp5-gwg8-xv66",
"ghsa-v778-237x-gjrc",
"ghsa-vvgc-356p-c3xw"
],
"withdrawn": "2026-09-18T11:59:01.768079Z"
}
CLEANSTART-2026-IA15090 (GHSA-72C7-4G63-HPW5)
Vulnerability from cleanstart – Published: 2026-07-30 07:10 – Updated: 2026-09-18 11:59 – Source website
Withdrawn 2026-09-18
VLAI
Summary
Security fixes in tekton-chains 0.26.0-r0
Details
Package tekton-chains version 0.26.0-r0 fixes 3 vulnerabilities: ghsa-72c7-4g63-hpw5, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "tekton-chains"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.26.0-r0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.26.0-r0"
]
}
],
"credits": [],
"database_specific": {},
"details": "Package tekton-chains version 0.26.0-r0 fixes 3 vulnerabilities: ghsa-72c7-4g63-hpw5, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x",
"id": "CLEANSTART-2026-IA15090",
"modified": "2026-09-18T11:59:01.768079Z",
"published": "2026-07-30T07:10:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/tektoncd/chains"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes in tekton-chains 0.26.0-r0",
"upstream": [
"ghsa-72c7-4g63-hpw5",
"ghsa-f6x5-jh6r-wrfv",
"ghsa-j5w8-q4qc-rx2x"
],
"withdrawn": "2026-09-18T11:59:01.768079Z"
}
CLEANSTART-2026-IA26094 (CVE-2025-61727)
Vulnerability from cleanstart – Published: 2026-01-30 14:51 – Updated: 2026-09-18 11:59 – Source website
Withdrawn 2026-09-18
VLAI
Summary
excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate
Details
Multiple security vulnerabilities affect the prometheus-operator-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details.
Severity
9.8 (Critical)
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "prometheus-operator-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.86.2-r1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [],
"database_specific": {},
"details": "Multiple security vulnerabilities affect the prometheus-operator-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details.",
"id": "CLEANSTART-2026-IA26094",
"modified": "2026-09-18T11:59:01.768079Z",
"published": "2026-01-30T14:51:22.634752Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-IA26094"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-61727"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-61729"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/GHSA-F6X5-JH6R-WRFV"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/GHSA-J5W8-Q4QC-RX2X"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61727"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61729"
}
],
"related": [],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate",
"upstream": [
"CVE-2025-61727",
"CVE-2025-61729",
"GHSA-F6X5-JH6R-WRFV",
"GHSA-J5W8-Q4QC-RX2X"
],
"withdrawn": "2026-09-18T11:59:01.768079Z"
}
CLEANSTART-2026-IB31523 (GHSA-F6X5-JH6R-WRFV)
Vulnerability from cleanstart – Published: 2026-09-01 11:17 – Updated: 2026-09-18 11:59 – Source website
Withdrawn 2026-09-18
VLAI
Summary
Security fixes in go-fips-1.25 1.25.6-r0
Details
Package go-fips-1.25 version 1.25.6-r0 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x
References
| URL | Type | ||||
|---|---|---|---|---|---|
|
|||||
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "go-fips-1.25"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.25.6-r0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.25.6-r0"
]
}
],
"credits": [],
"database_specific": {},
"details": "Package go-fips-1.25 version 1.25.6-r0 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x",
"id": "CLEANSTART-2026-IB31523",
"modified": "2026-09-18T11:59:01.768079Z",
"published": "2026-09-01T11:17:16Z",
"references": [
{
"type": "WEB",
"url": "https://go.dev/"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes in go-fips-1.25 1.25.6-r0",
"upstream": [
"ghsa-f6x5-jh6r-wrfv",
"ghsa-j5w8-q4qc-rx2x"
],
"withdrawn": "2026-09-18T11:59:01.768079Z"
}
CLEANSTART-2026-IE99306 (GHSA-J5W8-Q4QC-RX2X)
Vulnerability from cleanstart – Published: 2026-07-30 07:10 – Updated: 2026-09-18 11:59 – Source website
Withdrawn 2026-09-18
VLAI
Summary
Security fixes in elastic-beats-fips 9.0.8-r1
Details
Package elastic-beats-fips version 9.0.8-r1 fixes 3 vulnerabilities: ghsa-j5w8-q4qc-rx2x, ghsa-f6x5-jh6r-wrfv, CVE-2025-47913
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "elastic-beats-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.0.8-r1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"9.0.8-r1"
]
}
],
"credits": [],
"database_specific": {},
"details": "Package elastic-beats-fips version 9.0.8-r1 fixes 3 vulnerabilities: ghsa-j5w8-q4qc-rx2x, ghsa-f6x5-jh6r-wrfv, CVE-2025-47913",
"id": "CLEANSTART-2026-IE99306",
"modified": "2026-09-18T11:59:01.768079Z",
"published": "2026-07-30T07:10:53Z",
"references": [
{
"type": "WEB",
"url": "https://www.elastic.co/products/beats"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes in elastic-beats-fips 9.0.8-r1",
"upstream": [
"ghsa-j5w8-q4qc-rx2x",
"ghsa-f6x5-jh6r-wrfv",
"CVE-2025-47913"
],
"withdrawn": "2026-09-18T11:59:01.768079Z"
}
CLEANSTART-2026-IL48193 (GHSA-F6X5-JH6R-WRFV)
Vulnerability from cleanstart – Published: 2026-07-30 07:10 – Updated: 2026-09-18 11:59 – Source website
Withdrawn 2026-09-18
VLAI
Summary
Security fixes in cloudprober-fips 0.14.1-r0
Details
Package cloudprober-fips version 0.14.1-r0 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "cloudprober-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.14.1-r0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.14.1-r0"
]
}
],
"credits": [],
"database_specific": {},
"details": "Package cloudprober-fips version 0.14.1-r0 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x",
"id": "CLEANSTART-2026-IL48193",
"modified": "2026-09-18T11:59:01.768079Z",
"published": "2026-07-30T07:10:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cloudprober/cloudprober"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes in cloudprober-fips 0.14.1-r0",
"upstream": [
"ghsa-f6x5-jh6r-wrfv",
"ghsa-j5w8-q4qc-rx2x"
],
"withdrawn": "2026-09-18T11:59:01.768079Z"
}
CLEANSTART-2026-IO04548 (CVE-2025-55190)
Vulnerability from cleanstart – Published: 2026-02-24 00:44 – Updated: 2026-09-18 11:59 – Source website
Withdrawn 2026-09-18
VLAI
Summary
Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate
Details
Multiple security vulnerabilities affect the argo-cd package. Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. See references for individual vulnerability details.
Severity
9.8 (Critical)
References
| URL | Type | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "argo-cd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.7-r0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [],
"database_specific": {},
"details": "Multiple security vulnerabilities affect the argo-cd package. Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. See references for individual vulnerability details.",
"id": "CLEANSTART-2026-IO04548",
"modified": "2026-09-18T11:59:01.768079Z",
"published": "2026-02-24T00:44:50.498217Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-IO04548"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-55190"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-55191"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-58183"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-58185"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-58187"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-58188"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-58189"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-59537"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-59538"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-61723"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-61724"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-61725"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/GHSA-2V5J-VHC3-9CWM"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/GHSA-2VGG-9H3W-QBR4"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/GHSA-2XSJ-VH29-9CWM"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/GHSA-37CX-329C-33X3"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/GHSA-3WGM-2MW2-VH5M"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/GHSA-4X4M-3C2P-QPPC"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/GHSA-6V2P-P543-PHR9"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/GHSA-92CP-5422-2M47"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/GHSA-93MQ-9FFX-83M2"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/GHSA-F6X5-JH6R-WRFV"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/GHSA-HJ2P-8WJ8-PFQ4"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/GHSA-J5W8-Q4QC-RX2X"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/GHSA-MH63-6H87-95CP"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/GHSA-MW99-9CHC-XW7R"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55190"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55191"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58183"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58185"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58187"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58188"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58189"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59537"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59538"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61723"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61724"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61725"
}
],
"related": [],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate",
"upstream": [
"CVE-2025-55190",
"CVE-2025-55191",
"CVE-2025-58183",
"CVE-2025-58185",
"CVE-2025-58187",
"CVE-2025-58188",
"CVE-2025-58189",
"CVE-2025-59537",
"CVE-2025-59538",
"CVE-2025-61723",
"CVE-2025-61724",
"CVE-2025-61725",
"GHSA-2V5J-VHC3-9CWM",
"GHSA-2VGG-9H3W-QBR4",
"GHSA-2XSJ-VH29-9CWM",
"GHSA-37CX-329C-33X3",
"GHSA-3WGM-2MW2-VH5M",
"GHSA-4X4M-3C2P-QPPC",
"GHSA-6V2P-P543-PHR9",
"GHSA-92CP-5422-2M47",
"GHSA-93MQ-9FFX-83M2",
"GHSA-F6X5-JH6R-WRFV",
"GHSA-HJ2P-8WJ8-PFQ4",
"GHSA-J5W8-Q4QC-RX2X",
"GHSA-MH63-6H87-95CP",
"GHSA-MW99-9CHC-XW7R"
],
"withdrawn": "2026-09-18T11:59:01.768079Z"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…
Loading…